Network risk dynamic acl active protection method and system based on behavior analysis

Abstract

The application discloses a network risk dynamic ACL active protection method and system based on behavior analysis and belongs to the technical field of network security. The method comprises the following steps: S1, data collection; S2, behavior analysis and high-risk identification based on a behavior analysis model; S3, risk scoring based on a Bayesian network, the risk scoring being obtained by combining an instantaneous abnormal score and time sequence probability in S2, so that IP marking is performed; S4, dynamic white list isolation; S5, protection state monitoring and automatic release; and S6, closed-loop optimization. The application realizes active fusion of behavior analysis and time-limited white list by introducing a sunshine guardian mode, ensures accurate intervention and minimizes interference.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a network risk dynamic ACL active protection method and system based on behavior analysis. BACKGROUND

[0002] With the rapid development of the Internet and mobile communication, network fraud has become a global security risk, especially in the field of telecommunications and online services. Network criminals use social engineering attacks, phishing links or false investment inducements, and other means to focus on users who are vulnerable to influence, such as the elderly and those with insufficient network operation experience, to carry out invasions, resulting in serious consequences such as personal information leakage and financial loss. Such invasions often take the behavior patterns of high-risk groups (such as frequent clicking of unknown links or abnormal transaction attempts) as the starting point. Traditional network prevention measures mainly rely on firewalls, virus scanning or post-facto accountability, but these methods are difficult to deal with real-time dynamic disturbances.

[0003] In recent years, behavior analysis technology (such as user entity behavior analysis, UEBA) has begun to emerge, which identifies abnormalities by monitoring network traffic and interaction patterns, but overall still faces the challenges of not timely intervention and high misjudgment rate. The root of these problems lies in the fact that existing systems are mostly passive responses, and cannot actively isolate users from illegal sources when risks first appear, thereby amplifying losses.

[0004] The network security disturbance detection of user / user entity behavior analysis in the prior art is to use a UEBA system to detect security anomalies by analyzing user or entity behavior, regardless of whether the user holds a legal credential. There are also network security and illegality detection systems and methods in the prior art that can uniquely identify physical devices connected to the network and monitor potential network illegality. In addition, some telecommunications field solutions, such as an anomaly detection model using an Isolation Forest (Isolation Forest anomaly detection) algorithm, identify illegal behavior patterns by processing network traffic through machine learning. These systems usually combine IP identification, behavior profiling and threshold scoring to flag risky users, and trigger an alarm or basic access restriction when an anomaly is detected. However, these existing technologies still have significant deficiencies, specifically:

[0005] First, these systems mostly employ passive defense strategies and passive detection models, responding only after illegal activities occur and failing to proactively block communication links, leading to delayed loss mitigation. For example, while UEBA systems can identify anomalies, they lack an immediate isolation mechanism for high-risk users, who may still complete transactions under inducement. Post-event detection or rule-based filtering, for instance, results in delayed intervention, failing to prevent risks from occurring before illegal activities. Specifically, while existing intranet monitoring mechanisms can identify abnormal behavior, they lack the ability to proactively mark and isolate potential victims. Once a user is exposed to an illegal source, sensitive information has often already been leaked or unauthorized transactions have occurred, limiting the effectiveness of loss mitigation.

[0006] Secondly, the whitelist application is limited and static, usually only covering a few fixed services, rather than dynamically adapting to a scale of about 300,000 trusted addresses, and it does not integrate time window control (such as protection of no more than 30 minutes), which can easily lead to excessive intervention or user inconvenience.

[0007] Finally, the protection against false alarms is weak, and there is no mechanism for automatic unblocking during network switching, which increases the risk of false blocking and affects normal use. Summary of the Invention

[0008] To address the problems mentioned in the background section, this invention proposes a proactive protection method and system for dynamic ACLs based on behavioral analysis of network risks. By introducing a "Sunshine Guardian" mode, it achieves proactive integration of behavioral analysis and time-limited whitelists, ensuring accurate intervention and minimizing interference.

[0009] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0010] A proactive network risk protection method based on behavioral analysis dynamic ACL includes the following steps:

[0011] S1: Data collection, real-time analysis of network traffic through DPI probe, extraction of user application access logs, interaction sequences and IP traffic data;

[0012] S2: Based on behavioral analysis models, conduct behavioral analysis and high-risk identification;

[0013] S21: Extract features from the collected data to generate behavioral feature vectors;

[0014] S22: Input the extracted behavioral feature vector into the fusion model, use the isolated forest anomaly detection algorithm to detect instantaneous anomaly scores, and use LSTM to analyze the time series pattern and calculate the time series probability;

[0015] S3: Based on Bayesian networks, risk scores are obtained by combining the instantaneous anomaly scores and temporal probabilities from S2, thereby enabling IP tagging;

[0016] S4: Dynamic white list isolation, based on network filter application programming interface, real-time firewall rule delivery;

[0017] S5: Protection state monitoring and automatic release;

[0018] S6: Closed-loop optimization, collect protection logs and false seal events through visual dashboard, train LSTM model in reverse, adjust feature weight and risk threshold, and update white list library daily.

[0019] As preferred, in S21, the specific implementation content is:

[0020] The calculation formula of the behavior feature vector is:

[0021] ,

[0022] Among them, represents the behavior feature vector; represents the access rate; represents the abnormal keyword rate; represents the traffic fluctuation.

[0023] As preferred, in S22, the instantaneous anomaly score is calculated using the isolation forest anomaly detection algorithm, specifically:

[0024] The calculation formula of the instantaneous anomaly score s(x) is specifically:

[0025] ,

[0026] ,

[0027] Among them, x represents the data sample to be detected; represents the path length, represents the integrated average, represents the normalization term; m represents the sub-sample size; γ represents the Euler constant.

[0028] As preferred, in S22, the LSTM is used to analyze the time sequence pattern of user behavior, and the time sequence probability is predicted, with the specific content being:

[0029] The LSTM model receives a time sequence sequence composed of historical behavior feature vectors as input, extracts time sequence features through a gating mechanism, and outputs the final hidden state ;

[0030] The time sequence X is:

[0031] ,

[0032] The calculation formula of the time sequence probability is:

[0033] ,

[0034] wherein, denotes the behavior feature vector at time point t-T, denotes the behavior feature vector at time point t-1, t denotes the current time point; T denotes the size of the time window; σ denotes the Sigmoid function, and denotes the model parameter; denotes the final hidden state of the LSTM model at time point t-1.

[0035] As preferred, in S3, the specific implementation content is:

[0036] posterior probability is calculated based on Bayes' theorem, specifically:

[0037] ,

[0038] ,

[0039] ,

[0040] ,

[0041] wherein, denotes the feature vector; denotes the prior probability; denotes the likelihood; denotes the evidence probability; denotes the number of high-risk users in the historical data; denotes the total number of users in the historical data; denotes the i-th feature component in the feature vector ; n denotes the dimension of the feature vector; denotes the mean of the i-th feature component statistically obtained from the historical high-risk user data; denotes the variance of the i-th feature component statistically obtained from the historical high-risk user data; denotes the likelihood probability of observing the feature vector under the condition that the user behavior is normal; denotes the prior probability of the user behavior being normal.

[0042] As preferred, in S3, the risk score is calculated by fusing the instantaneous anomaly score and the time series probability, and its formula is:

[0043] ,

[0044] wherein, represents the final risk score; represents the instantaneous abnormal score; represents the timing probability; both a and β represent weight coefficients.

[0045] As preferred, in S4, the specific implementation process is as follows:

[0046] S41: Rule issuing, after the protection execution layer receives the high-risk IP, the network filter application programming interface is used to issue the firewall rule;

[0047] S42: White list matching, when the user initiates an access request, the request is first filtered by the Bloom filter, if a hit is found, the request is subjected to accurate query in the Trie tree; if the matching is successful, the request is released, and if the matching fails, fuzzy matching is performed;

[0048] S43: Fuzzy blocking, the edit distance between the request URL and the white list address is calculated, if the similarity is less than a set threshold, a customized interception page is returned, and a blocking log is recorded.

[0049] As preferred, in S5, the specific content of the protection state monitoring and automatic release is as follows:

[0050] S51: State initialization, after the high-risk IP is marked, the state machine is switched from normal to daemon, and a 30-minute timer and Netlink monitoring are started;

[0051] S52: Real-time monitoring, the false blocking rate is calculated every 5 seconds, if the false blocking rate is greater than 0.5, the early release logic is triggered, and the ACL rule is deleted;

[0052] S53: Automatic release, if the timer is timed out or the Netlink detects IP change, the state machine is switched to release, the user's normal network access is restored, and the release reason is recorded.

[0053] A network risk dynamic ACL active protection system based on behavior analysis, which implements the network risk dynamic ACL active protection method based on behavior analysis described in any of the above, comprises a data collection layer, an analysis and decision layer, a protection execution layer, and a monitoring and feedback layer;

[0054] Data collection layer: real-time collection of internal user behavior data, including application access logs, interaction sequences, and IP traffic data, supporting distributed log collection;

[0055] Analysis and decision layer: based on the user behavior data of the data collection layer, the machine learning model is integrated for behavior anomaly detection, the risk probability is calculated, and the IP marking is triggered;

[0056] Protection execution layer: based on the risk marking instruction of the analysis and decision layer, the application layer white list control and time window isolation mechanism are applied, and the traffic is filtered based on the DPI technology.

[0057] Monitoring feedback layer: based on the protection state data of the protection execution layer, log backtracking and adaptive optimization are performed to support false sealing protection and automatic release.

[0058] Advantages: compared with the prior art, the present application has the following advantages:

[0059] (1) Accurate identification of high-risk victims significantly reduces risk;

[0060] Multi-dimensional behavior analysis improves accuracy: by combining time series behavior analysis (such as abnormal login peak) and content semantic analysis, and combining Isolation Forest and LSTM hybrid model, high-risk user identification accuracy > 95% is achieved.

[0061] Active blocking of illegal communication links: application layer DPI technology deeply analyzes traffic, combined with more than 300,000 trusted white lists, and real-time blocking of illegal source links.

[0062] Technical support: Trie tree realizes millisecond-level white list matching (delay <1ms), and dynamic ACL rules force users to be isolated to a safe ecosystem.

[0063] Effect: sensitive information leakage risk is reduced by 90%, and unauthorized transaction success rate is reduced by 85%.

[0064] (2) Dynamic false sealing protection mechanism optimizes user experience;

[0065] Triple release protection minimizes false positives: behavior-driven release.

[0066] Network switching release: Netlink Socket listens to IP changes and automatically releases protection within 0.5 seconds.

[0067] Time hard limit: 30 minutes of forced release to eliminate infinite isolation.

[0068] Effect: false sealing rate is less than 0.5%, and user complaint volume is reduced by 95%.

[0069] Adaptive threshold optimization: gradient descent dynamically adjusts risk threshold.

[0070] Effect: high-risk user protection strength is improved by 40%, and low-risk user isolation time is shortened to 10 minutes.

[0071] (3) Efficient real-time protection supports telecom-level scale deployment;

[0072] Millisecond-level response performance: distributed stream processing architecture (Kafka+Flink) realizes behavior analysis delay not exceeding 100ms (P99), and protection rule delivery not exceeding 200ms.

[0073] Technology support: Netfilter kernel hook direct connection firewall, DPDK acceleration 10Gbps traffic processing.

[0074] Effect: Support for 100 million concurrent users, throughput increased by 50 times.

[0075] Resource optimization and elastic expansion: Trie tree + Bloom filter compresses whitelist storage space by 70%, containerized deployment (Docker + K8s) supports rapid expansion.

[0076] Effect: Hardware cost reduced by 60%, operation and maintenance efficiency improved by 80%.

[0077] (4) Closed-loop optimization system, continuously enhance protection capability;

[0078] AI feedback driven model evolution: Visual dashboard displays real-time mis-sealing event features, trains LSTM model in reverse, and optimizes feature weights.

[0079] Technology support: Reinforcement learning dynamically updates whitelist, ROC curve calibrates fuzzy matching threshold.

[0080] Effect: Model iteration cycle shortened to 24 hours, new mode response speed improved by 90%.

[0081] Full-link observability: BPMN standardized process monitoring, real-time generation of protection heat map and mis-sealing rate curve.

[0082] Effect: Operation and maintenance personnel disposal efficiency improved by 75%, system availability reached 99.99%. BRIEF DESCRIPTION OF DRAWINGS

[0083] Figure 1 is the system logic diagram of the present application;

[0084] Figure 2 is the system architecture diagram of the present application;

[0085] Figure 3 is the system hardware architecture diagram of the layered design of the present application;

[0086] Figure 4 is the front-end interaction timing diagram of the present application;

[0087] Figure 5 is the flowchart of the background workflow of the present application;

[0088] Figure 6 is the full-link data processing flowchart of the present application;

[0089] Figure 7 is the algorithm interaction diagram of the present application;

[0090] Figure 8 is a flow chart of the dynamic release state machine of the present application;

[0091] Figure 9 is a timing chart of the false seal protection mechanism of the present application. DETAILED DESCRIPTION

[0092] The application will be further illustrated below in combination with specific embodiments, which are implemented on the premise of the technical solutions of the present application, and it should be understood that these embodiments are only used for illustrating the present application and not for limiting the scope of the present application.

[0093] Embodiment 1

[0094] The embodiment provides a network risk dynamic ACL active protection method and system based on behavior analysis, and realizes active protection of network illegal behaviors based on behavior analysis by introducing the concept of “sunlight guardian mode”.

[0095] The terms involved in the embodiment are explained as follows:

[0096] Sunlight guardian mode: an active protection mechanism based on behavior analysis, which realizes real-time identification of high-risk users and forced isolation to a safe application ecosystem to block risks.

[0097] DPI probe: a deep packet inspection tool based on Suricata (network intrusion detection and defense system) / DPDK (data plane development kit), which realizes real-time analysis of application layer information (such as URL, keyword) in network traffic.

[0098] Dynamic ACL rule: a firewall access control list based on Netfilter API (network filter application programming interface) for real-time updating, which is used to execute a whitelist isolation strategy.

[0099] Trie tree: an efficient string retrieval data structure, which is used to millisecond-level matching of a whitelist library of more than 300,000 trusted addresses (delay <1 ms).

[0100] LSTM model: a long short-term memory neural network, which is used to analyze user behavior time sequence patterns (such as high-frequency login, abnormal transfer) and predict risk probability.

[0101] Isolation forest: an isolation forest anomaly detection algorithm, which is used to calculate an instantaneous abnormal score through path length and identify instantaneous high-risk behaviors.

[0102] Risk value: a risk quantification index of a 1km×1km grid, which is calculated by weighting user density change rate, moving speed deviation and special population proportion.

[0103] Levenshtein distance: string similarity algorithm for fuzzy matching suspicious URLs with whitelist (block if similarity < 0.1).

[0104] Netlink listener: Linux kernel communication mechanism for real-time detection of user IP change events (e.g., WiFi to 4G), triggering automatic protection removal.

[0105] Dual trigger removal mechanism: dual conditions for protection removal are 30-minute hard timeout + IP change event, ensuring that 99.9% of user isolation time does not exceed the actual risk window.

[0106] Bloom filter: probabilistic data structure used in conjunction with Trie tree to implement secondary index for whitelist, reducing storage space by 70%.

[0107] False positive rate: used to dynamically adjust the protection threshold.

[0108] Flink window calculation: 5-second time window analysis of stream processing engine, real-time aggregation of behavior feature vector.

[0109] State machine (FSM): protection state management model, defining three core state transitions: normal-guard (risk trigger)-release (timeout / IP change).

[0110] The embodiment provides a network risk dynamic ACL active protection method based on behavior analysis, which specifically includes the following steps:

[0111] S1: Data collection, real-time analysis of network traffic through DPI probe, extraction of user application access log, interaction sequence, and IP traffic data, transmission to analysis and decision module through Apache Kafka;

[0112] S2: Behavior analysis and high-risk identification based on behavior analysis model;

[0113] S21: Feature extraction of collected data to generate behavior feature vector;

[0114] The calculation formula of the behavior feature vector is:

[0115]

[0116] Where, represents the behavior feature vector. represents the access rate; represents the abnormal keyword rate; represents the traffic fluctuation.

[0117] S22: input the extracted behavior feature vector into the fusion model, perform isolation forest anomaly detection, detect transient anomaly, and LSTM analyze time series pattern, and calculate time series probability;

[0118] Anomaly detection, using the Isolation Forest anomaly detection algorithm to detect the behavior feature vector, calculating the transient anomaly score, isolating high-risk behavior paths, the calculation formula of the transient anomaly score s(x) is as follows:

[0119]

[0120]

[0121] Wherein, x represents the data sample to be detected; represents the path length, represents the integrated average, represents the normalization factor, which is used to adjust the expected value of the path length, so that it is independent of the sample size m; m represents the sub-sample size; γ represents the Euler constant, γ≈0.577.

[0122] Randomly partition the tree to isolate abnormal points, s(x)<0.5 triggers protection. If s(x)>0.6, the LSTM model is triggered for analysis.

[0123] Using LSTM to analyze the time series pattern of user behavior, predicting the time series probability, the specific content is as follows:

[0124] The LSTM model receives a time series sequence composed of historical behavior feature vectors as input, extracts time series features through the gating mechanism, and outputs the final hidden state .

[0125] The time series sequence X is:

[0126]

[0127] The calculation formula of the time series probability is as follows:

[0128]

[0129] Wherein, represents the behavior feature vector at time point t-T, t is the current time point, and T is the size of the time window (i.e. the length of the historical sequence); represents the behavior feature vector at time point t-1, i.e. the feature vector at the previous time point of the current time point t; t represents the current time point (or reference time point), which is used to identify the position of the latest data in the time series sequence; σ represents the Sigmoid function, and denotes the model parameters; denotes the final hidden state of the LSTM model at time point t-1.

[0130] The temporal probability represents the abnormal risk of the user behavior sequence, which is used for subsequent Bayesian network fusion decision.

[0131] S3: Based on the Bayesian network, combine the instantaneous anomaly score in S2 and the temporal probability to get the risk score, and then perform IP labeling;

[0132] Quantify the probability of user behavior conforming to illegal features, which is used for IP labeling.

[0133] Posterior probability The calculation is based on Bayes' theorem, specifically:

[0134]

[0135]

[0136]

[0137]

[0138] where, denotes the feature vector; denotes the prior probability; denotes the likelihood rate; denotes the evidence probability; denotes the number of high-risk users in the historical data; denotes the total number of users in the historical data; denotes the i-th feature component in the feature vector n denotes the dimension of the feature vector, i.e., the total number of feature components; denotes the mean of the i-th feature component obtained from the historical high-risk user data; denotes the variance of the i-th feature component obtained from the historical high-risk user data; denotes the likelihood probability of observing the feature vector under the condition that the user behavior is normal; denotes the prior probability of normal user behavior.

[0139] where, The calculation method is similar to , but uses parameters obtained from historical normal user data statistics.

[0140] Derivation and application: approximate Bayesian inference through evidence lower bound (ELBO), if the probability is greater than 0.8, mark IP and enter "sun guardian" mode, trigger protection, otherwise release.

[0141] Threshold optimization: use gradient descent to minimize cross-entropy loss , Specifically:

[0142]

[0143] Where y represents the ground truth label, and represents the true class of a sample (user). represents the predicted probability (Predicted Probability), which represents the probability that the model predicts that the sample (user) belongs to the "high-risk" category.

[0144] Complexity: O(n), n is the number of features.

[0145] The specific content of the risk score formula is as follows:

[0146] Risk score It is calculated by fusing the instantaneous anomaly score and the time series probability, and its formula is:

[0147]

[0148] Where, is the final risk score; is the instantaneous anomaly score, which is calculated by isolation forest anomaly detection; is the time series probability calculated by the LSTM model; α and β are weight coefficients (α+β=1), and their specific values are determined by historical data training and gradient descent algorithm optimization.

[0149] Get risk score After that, compare it with the risk threshold T (initial value is 0.8); if R≥T, mark the user IP as high-risk and trigger dynamic isolation protection; if R<T, determine that the user behavior is normal and do not intervene.

[0150] The risk threshold T is dynamically adjusted by minimizing the cross-entropy loss function L1 to minimize the system false positive rate.

[0151]

[0152] Where, , is the risk score predicted by the model; y is the true label (1 represents high-risk, 0 represents normal).

[0153] S4: Dynamic white list isolation, based on Netfilter API, real-time delivery of firewall rules;

[0154] S41: Rule delivery, after the protection execution layer receives the high-risk IP, it delivers the firewall rules through the network filter application programming interface;

[0155] S42: White list matching, when the user initiates an access request, it is first filtered by the Bloom filter, if it is hit, it is queried accurately in the Trie tree, if the matching is successful, it is released, if the matching fails, it is executed fuzzy matching;

[0156] S43: Fuzzy blocking, calculate the Levenshtein distance of the request URL and the white list address, if the similarity is less than 0.1, return the customized blocking page (show the remaining protection time), and record the blocking log.

[0157] In S43, fuzzy blocking, calculate the Levenshtein distance of the request URL and the white list address, and convert it into similarity for decision-making. The specific process is:

[0158] Calculate the Levenshtein distance d: let the request URL be string A and the white list address be string B, use the dynamic programming algorithm to calculate the minimum edit distance d.

[0159] The edit distance d(A, B) is calculated by the dynamic programming algorithm, A represents the URL string of the user's request; B represents a certain address string in the white list; d(A, B) represents the minimum edit distance of string A and B, that is, the final value of dp[len(A)][len(B)].

[0160] Its recursive formula is:

[0161]

[0162] Where, dp[i][j] represents the minimum edit distance between substring A[0:i] and substring B[0:j]; i is the index of string A (from 0 to len(A)); j is the index of string B (from 0 to len(B)); Indicates the character equality indication function; if , then δ=0 (the characters are the same, no editing operation is needed); if , then δ=1 (the characters are different, 1 times of replacement operation is needed).

[0163] Calculate the similarity : Normalize the edit distance to similarity according to the following formula, specifically:

[0164]

[0165] where d denotes the minimum edit distance; len(A) and len(B) are the lengths of strings A and B, respectively.

[0166] Blocking decision: determine whether the calculated similarity is less than the set threshold T similarity In this embodiment, T similarity = 0.1). If the condition Similarity < 0.1 is met, it is determined that the address is suspicious, a customized blocking page is returned, and a blocking log is recorded; otherwise, it is released.

[0167] S5: Protection state monitoring and automatic release;

[0168] S51: State initialization, after marking the high-risk IP, the state machine is converted from normal to guardian, and a 30-minute timer and Netlink listening are started;

[0169] S52: Real-time monitoring, calculate the false blocking rate every 5 seconds, if the false blocking rate is greater than 0.5, trigger the early release logic, and delete the ACL rule;

[0170] The specific calculation formula of the false blocking rate is as follows:

[0171]

[0172] wherein, is the false positive probability of each event.

[0173] Dynamic threshold adjustment, specifically:

[0174] 2

[0175] wherein, denotes the updated risk threshold; denotes the current risk threshold; denotes the learning rate (step parameter, controls the amplitude of each update); denotes the gradient of the loss function L2 to the threshold θ (i.e. the direction in which the loss function changes fastest).

[0176] The calculation formula of the loss function L2 is as follows:

[0177]

[0178] wherein, β1 is a balance factor, β1 = 0.7.

[0179] Time overrun: refers to the actual protection time executed by the system during the protection and isolation of the high-risk IP exceeding the effective protection time actually required by the user.

[0180] Network switching release: Netlink Socket listens to IP changes and automatically releases protection within 0.5 seconds.

[0181] Time hard limit: 30 minutes forced release, eliminating infinite isolation.

[0182] Effect: False seal rate less than 0.5%, user complaint volume reduced by 95%.

[0183] S53: Automatic release, if the timer expires or Netlink detects IP changes, the state machine transitions to release, restoring normal network access for users and recording the release reason.

[0184] S6: Closed-loop optimization, collect protection logs and false seal events through the visual dashboard, train the LSTM model in reverse, adjust feature weights and risk thresholds, and update the whitelist library daily.

[0185] This embodiment provides a network risk dynamic ACL active protection system based on behavior analysis, which is a "sunlight guardian mode" network illegal behavior active protection system architecture based on behavior analysis.

[0186] As Figure 1 shown, the architecture is divided into four layers: data collection layer, analysis and decision-making layer, protection execution layer, and monitoring feedback layer, ensuring closed-loop protection from behavior monitoring to risk isolation.

[0187] Data collection layer: Real-time collection of internal user behavior data, including application access logs, interaction sequences, IP traffic, etc., supporting distributed log collection (such as using Apache Kafka framework).

[0188] Analysis and decision-making layer: Based on user behavior data from the data collection layer, integrate machine learning models (such as IsolationForest and LSTM) for behavior anomaly detection, calculate risk probability and trigger IP labeling.

[0189] Protection execution layer: Based on risk labeling instructions from the analysis and decision-making layer, apply layer whitelist control and time window isolation mechanism, filter traffic based on DPI technology.

[0190] Monitoring feedback layer: Based on protection state data from the protection execution layer, perform log backtracking and adaptive optimization, supporting false seal protection and automatic release; the monitoring feedback layer adjusts threshold values input to the analysis and decision-making layer, optimizing parameters to the data collection layer.

[0191] Overall architecture process: From behavior data input - risk identification - protection triggering - state monitoring - feedback cycle.

[0192] This architecture solves the lag problem of existing passive defense, achieving real-time stop-loss through active labeling and isolation.

[0193] In this embodiment, the behavior analysis intelligent monitoring module (solves the problem of inaccurate behavior recognition): this module analyzes user behavior in real time through multi-dimensional feature extraction and identifies potential high-risk victims. The core algorithm uses a semi-supervised anomaly detection model combined with Isolation Forest and LSTM.

[0194] Data processing flow:

[0195] Input: internal network log stream (such as IP access sequence, timestamp).

[0196] Feature extraction: calculate behavior vector, including frequency (number of visits per hour), sequence deviation (abnormal interaction chain length).

[0197] Risk assessment: use Isolation Forest to calculate instantaneous anomaly score .

[0198] where x represents the data sample to be detected; is the path length, is the average path; E() represents integrated average; if > 0.6, LSTM predicts timing risk probability (LSTM output).

[0199] Output: if > 0.8, mark IP and trigger protection.

[0200] Deep time sequence fusion analysis improves recognition accuracy: to solve the problem of low recognition accuracy (usually less than 85%) caused by the shallow analysis of existing UEBA system behavior (such as relying on static rules), this invention introduces multi-dimensional time sequence fusion technology, integrates user behavior sequence (such as high-frequency login, abnormal transfer operation), content semantics (such as "safe account", "high return" keywords) and traffic fluctuation features, builds long-period behavior pattern through LSTM neural network modeling and combines Isolation Forest to detect instantaneous anomaly in real time, significantly improves risk recognition accuracy to more than 95% (real test compared with traditional system, improved by 23%), at the same time, the false positive rate is less than 5%, effectively avoiding the interference to normal users.

[0201] Dynamic IP marking and hierarchical real-time protection mechanism solves the lag: To solve the "intervention lag" problem (average delay more than 10 minutes) commonly existing in passive defense, the invention constructs an IP automatic marking-hierarchical triggering system: using network probes to analyze traffic in real time and match malicious behavior rule library (such as illegal domain name access, sensitive operation frequency), based on risk score formula for dynamic marking, and implementing hierarchical protection-low risk (0.4≤score<0.6) triggering pop-up warning, medium risk (0.6≤score<0.8) limiting unnecessary applications and strengthening monitoring, high risk (score≥0.8) then immediately forced isolation to whitelist safe ecological circle; At the same time, strictly set the protection window of 30 minutes (t start = t end = t start + 1800 seconds) from the moment of self-marking, automatically released after timeout to prevent excessive interception, this mechanism compresses illegal intervention delay to <3 seconds, and reduces the fund loss rate by 70% in actual measurement.

[0202] Active blocking execution and closed-loop effect verification:

[0203] In the protection execution layer, the system pushes the marked high-risk IP to the protection engine in real time and synchronously updates the firewall ACL rule, immediately redirects the user to the safe service domain that only allows access to the trusted application whitelist, and realizes active blocking; Its effectiveness is verified in real time by DPI deep traffic analysis, and is supplemented by post-transaction log analysis to confirm the loss reduction level in a closed loop, forming a complete protection chain from analysis, decision, execution to verification.

[0204] Application layer access control and whitelist mechanism module (solves the problem of insufficient whitelist coverage):

[0205] Force whitelist, only allow access to about 300,000 trusted addresses. Use DPI to filter traffic, and dynamically maintain ACL rules.

[0206] Workflow:

[0207] Input: User requests URL.

[0208] Matching: Trie tree queries whitelist, if not matched, use Levenshtein distance to calculate similarity less than 0.1 to block.

[0209] Update: Automated scanning + manual review, refreshed daily.

[0210] This mechanism solves the problem of static whitelist, adapts to the ecology through dynamic coverage, and the blocking rate reaches 98%.

[0211] False seal protection and automatic release mechanism module (solves the problem of false judgment interference):

[0212] The protection is not more than 30 minutes, and the network switching (IP change) is cancelled.

[0213] Misjudgment probability calculation, adaptive threshold adjustment.

[0214] Implementation: timer + Netlink monitoring IP change, state machine management (normal - daemon - cancel).

[0215] Solve over-protection, reduce user inconvenience through automatic mechanism, and misseal rate is less than 5%.

[0216] Integration and visualization module of practical logic (solve overall coordination problem):

[0217] Process: monitoring - identification - marking - isolation - monitoring - cancellation. Support dashboard display state, AI feedback optimization.

[0218] As shown in Figure 1 , there is a risk: since the current method is executed through the source IP of the suspected victim, there may be a problem that the IP correspondence is transformed, or one IP corresponds to one person or one organization.

[0219] Limitations of existing capabilities: 1) only for discovered website objects, website object time must be completed before judgment; 2) there may be a missed discovery in discovery capability.

[0220] The advantages of the method of the application: 1) taking the suspected victim's mobile phone IP as the object, initiating protection, avoiding missing control; 2) can specify objects and specify harm degree; Synchronization can face fixed network scenarios.

[0221] The application is mainly applied to the internal network products of telecom operators, such as integrated in mobile APP (such as official security guardian APP of operators), gateway equipment or enterprise-level security platform (such as telecom internal network protection system), and provides active network illegal protection service for high-risk user groups (such as the elderly, network beginners). Application scenarios include moments when potential illegal risks are encountered during daily online activities (such as browsing social media, searching for information or conducting online transactions), such as when the user clicks on a suspicious investment link or frequently interacts with false advertisements, the system background automatically intervenes in protection, avoiding financial loss or information leakage. The application is not limited to a single product, but can be extended to smart routers, mobile security software or cloud protection services, forming a hybrid mode of user end and background combination.

[0222] 1. Functional characteristics;

[0223] Real-time behavior monitoring and risk identification: the system background continuously monitors user network behavior (such as application access frequency, abnormal interaction), and once high-risk signs (such as matching illegal keywords or abnormal login peak) are detected, the user IP is automatically marked and the "sunlight guardian mode" is activated.

[0224] User-end unaware, but optional notification function is configurable.

[0225] Active isolation and whitelist control: In protection mode, users are forced to be isolated into a safe ecosystem, only allowed to access preset whitelist applications and services, and illegal communication is blocked. This ensures that users cannot access high-risk content within the risk window (such as 30 minutes after detection), while maintaining basic functions available.

[0226] False seal protection and automatic release: The protection time is strictly controlled within 30 minutes and automatically released after timeout; if the user switches the network (such as from WiFi to mobile data, IP changes), the system exits the mode immediately. The false seal feedback mechanism is integrated, and users can report false seals through the APP to optimize the system.

[0227] Visual state display and feedback: Provide user-end dashboard or notification bar display of protection state (such as "Sunlight Guardian mode activated, remaining time: 15 minutes"), and administrator-end supports panoramic monitoring of high-risk user distribution and protection logs.

[0228] Compatibility and expansion: Support for Android / iOS mobile end integration without additional hardware; can be seamlessly integrated with existing security APPs, providing one-key enable / disable options.

[0229] 2. Operation mode;

[0230] User operation is mainly passive (background protection is the main one), but contains a small amount of interaction to improve friendliness. The following describes the interaction process:

[0231] Initial setup: After the user installs the operator security APP, one-key authorizes the "Sunlight Guardian" function (UI interface: "Start active protection" button is displayed on the home page, click to pop up permission explanation, including behavior monitoring and whitelist access). The system runs in the background by default and does not require daily intervention.

[0232] Risk triggering and protection activation: When the system detects high-risk behavior (such as the user searching for "high-return investment" and clicking on unknown links), the IP is marked in the background and the mode is activated. User-end interaction: APP push notification popup (such as "Potential risk detected, entered Sunlight Guardian mode, only safe application access. Learn more?" ), click to view whitelist list.

[0233] Operation during protection: When the user tries to access non-whitelist content, the browser or APP displays a redirection page (such as "This link may have risks, blocked. Return to the safe zone?" ), guide back to the whitelist application. The remaining time countdown is displayed in the notification bar (UI: progress bar, such as "Protection remaining: 20 minutes").

[0234] Automatic deactivation and feedback: After timeout or network switch, a notification will be sent stating "Guardian mode has been deactivated and network has returned to normal." Users can report false blocking via the "Feedback" button in the app (UI: simple form "Was it a false alarm? Describe the behavior"), and the system will optimize the model accordingly.

[0235] Administrator interaction: Telecom operations and maintenance personnel can monitor through a web dashboard (UI: heat map showing the distribution of high-risk user IPs and bar chart of protection status), and manual intervention is supported (such as extending / removing protection for specific IPs).

[0236] Assuming a UI interaction diagram:

[0237] Homepage: The top displays "Sunshine Guardian: Real-time Protection", and the bottom buttons are "View Whitelist" and "Protection History".

[0238] Protection pop-up: Modal dialog box "Activation reason: Abnormal behavior detection", "Allowed applications: List", "Countdown: 29:59".

[0239] Feedback page: text box + submit button, integrated log preview.

[0240] These features and operations enable seamless protection on the product side, enhancing user security while minimizing disruption.

[0241] Hardware and software environment architecture: This system adopts a layered edge computing architecture, deploying traffic acquisition devices as edge nodes at core network nodes to form distributed processing capabilities. The hardware layer consists of dedicated DPI devices supporting 10Gbps throughput for deep traffic analysis. The software layer is based on Apache Kafka to build a real-time log pipeline, combined with a PyTorch-based LSTM+Isolation Forest dual-model analysis engine. The protection execution layer uses iptables (a stateful firewall) for dynamic ACL rule management. The management platform stores all logs through ElasticSearch (a distributed full-text search engine), and Grafana (an open-source data visualization tool) provides real-time monitoring dashboards.

[0242] like Figure 3 As shown, it includes the edge side, the computing side, and the control side.

[0243] The edge side includes user terminals, access switches, DPI probes, and firewalls.

[0244] Edge layer: Deploy DPI probes based on Suricata / DPDK to parse application layer information in network traffic in real time; at the same time, equip a firewall that supports Netfilter to enforce dynamic security rules.

[0245] Kafka cluster, Flink compute nodes in the compute side.

[0246] Compute tier: composed of Kafka cluster (processing capacity over 100,000 messages / sec) for receiving and processing behavior logs; compute nodes equipped with 32-core CPU and 128GB memory, running Flink stream processing engine to perform risk model computation.

[0247] Control tier: composed of shield engine, database cluster, visualization server.

[0248] Control tier: shield engine deployed on x86 servers with dual Intel Xeon Gold 6330 processors; backend database uses Redis combined with MySQL cluster to support business and store over 300,000 white list data.

[0249] Each tier in the embodiment and the components and functions implemented.

[0250] Data collection: Suricata / DPDK: traffic mirroring and feature extraction.

[0251] Stream processing: Kafka 3.4 + Flink 1.17: real-time computation of behavior risk score.

[0252] AI model: TensorFlow 2.12 + Scikit-learn: LSTM / Isolation Forest model.

[0253] Control tier: Netfilter API + Golang Hook: dynamic firewall rule management.

[0254] Visualization: Grafana + ElasticSearch: real-time monitoring of protection status.

[0255] As shown in Figure 4 User side: when the user accesses illegal resources, the firewall redirects it to the interception service, returning a customized page (showing the remaining protection time, such as "Sunlight Guardian remaining 28:15").

[0256] Management side: administrators monitor in real time through the visualization dashboard:

[0257] Risk heat map: geographic distribution of high-risk IP density.

[0258] Dynamic countdown: remaining protection time for each IP.

[0259] False seal rate curve: false positive statistics based on historical data.

[0260] In this embodiment, the user is not aware of the redirection technology, and the response delay is less than 50ms.

[0261] As shown in Figure 5 , the background workflow is divided into four stages:

[0262] 1) Monitoring: DPI probe captures traffic and extracts behavior feature vectors.

[0263] 2) Decision: Behavior analysis model (Isolation Forest + LSTM) calculates risk probability and marks whether IP is high-risk.

[0264] 3) Execution: Protection engine calls Netfilter API to add rules.

[0265] 4) Release: Automatically delete rules when 30-minute countdown ends or IP changes (such as from WiFi to 4G).

[0266] In this embodiment, the rule dynamic injection technology is adopted, and the protection takes effect within 200ms.

[0267] As shown in Figure 6 , data processing is divided into four stages:

[0268] 1) Collection: DPI probe parses raw traffic and generates structured logs (process 10 Gb traffic per second).

[0269] 2) Analysis: Fink window calculates (window size 5 seconds) feature vectors, inputs fusion model: Isolation Forest detects transient anomalies. LSTM analyzes time series patterns (such as high-frequency access to "transfer" page).

[0270] 3) Execution: White list engine uses Trie tree to match 30W+ domain names (delay <1ms).

[0271] 4) Release: Timer service monitors protection status, and Netlink Socket listens to IP change events.

[0272] In this embodiment, the Trie tree + Bloom filter secondary matching has O(log n) query efficiency.

[0273] As shown in Figure 7 , features are extracted based on raw traffic, and the extracted features are input into the fusion model, then Isolation Forest is performed to calculate transient anomaly score; at the same time, time series probability is obtained based on LSTM, and weighted calculation is performed based on transient anomaly score and time series probability to determine whether S is greater than 0.8, if yes, trigger protection, otherwise release.

[0274] AsFigure 8 The state machine defines three core states:

[0275] Normal: User behavior has not triggered the risk threshold.

[0276] Guardian: Enable whitelist isolation, while starting two release triggers: countdown trigger (hard cap 30 minutes); IP change listener (evaluate immediately upon detecting a new IP).

[0277] Released: Clean up firewall rules and release user connections.

[0278] In this embodiment, the double-trigger mechanism ensures that 99.9% of user isolation time does not exceed the actual risk window.

[0279] The system transitions between these three states through event-driven methods, achieving dynamic isolation and intelligent release of high-risk users. The specific execution process is as follows:

[0280] 1. Normal state;

[0281] 1) Condition: User behavior has not triggered the risk threshold (i.e., risk score R < 0.8).

[0282] 2) Behavior: The system continuously monitors user behavior, but does not impose any access restrictions.

[0283] 3) Event listener: No timer or Netlink listener is started.

[0284] 2. Guardian state;

[0285] 1) Trigger condition: When the user's behavior risk score R ≥ 0.8, the system marks it as a high-risk IP, and the state machine transitions from normal to guardian.

[0286] 2) Execution actions:

[0287] Start a 30-minute timer to begin counting down.

[0288] Start the Netlink listener to monitor user IP addresses in real time for changes (e.g., WiFi switching to 4G).

[0289] Issue firewall rules through the Netfilter API to isolate the user to a whitelist safe ecosystem.

[0290] 3) Event listener:

[0291] Countdown event: 30-minute timer.

[0292] IP change event: Netlink detects IP changes.

[0293] False blocking rate monitoring: The false blocking rate is calculated every 5 seconds. If the false blocking rate is greater than 0.5, early release is triggered.

[0294] 3. Deactivate status;

[0295] 1) Triggering conditions (any one of them needs to be met):

[0296] Timer expired: 30-minute countdown ended.

[0297] IP Change: Netlink detected a change in the user's IP address.

[0298] High false blocking rate: Real-time monitoring detected a false blocking rate greater than 0.5, triggering early release.

[0299] 2) Perform the action:

[0300] Delete the firewall ACL rule corresponding to this IP address.

[0301] Stop the timer and Netlink listener.

[0302] Record the reason for lifting the ban (timeout / IP change / accidental blocking).

[0303] The state machine transitions from the guardian state to the deactivated state, and the user returns to the normal state.

[0304] 3) Follow-up processing: After the problem is resolved, the user will have normal network access, and the system will continue to monitor their behavior.

[0305] like Figure 9 As shown, this sequence diagram details the entire process of the system from activating protection to dynamic deactivation, and finally completing closed-loop optimization, involving the collaborative work of multiple service modules. The entire false blocking protection mechanism process is divided into four main stages:

[0306] Phase 1: Initial protection activated;

[0307] 1. Trigger detection: The user's device exhibits high-risk behavior (e.g., frequent access to investment-related pages).

[0308] 2. Reporting and Analysis: Behavioral data is sent to the behavior analysis module. This module calculates the risk and determines it to be extremely high (risk value = 0.92 in the example, which is greater than 0.8), and sends a high-risk report to the protection engine.

[0309] 3. Isolation Execution: Upon receiving the report, the protection engine immediately sends an instruction to the firewall control module to add a rule, isolating the user's IP address to the whitelist. The user's device access is blocked, and a customized blocking page is displayed, showing a countdown to inform the user of the remaining protection time.

[0310] 4. Start monitoring: The protection engine sends a command to the timer service to start a 30-minute countdown. It also registers with the IP monitoring service to monitor the user's IP for changes such as network switching.

[0311] Phase 2: Behavior monitoring during protection;

[0312] 1. Continuous monitoring: During protection, the user's device behavior data is continuously reported to the behavior analysis module.

[0313] 2. Calculate false sealing rate: The behavior analysis module calculates the real-time false sealing probability (P) of the current user every 5 seconds.

[0314] Calculation formula: P = (normal behavior times / total behavior times) × (1 - used time / 30).

[0315] Calculation logic: This formula takes into account the normalization trend of user behavior and the consumption of protection time. As user behavior returns to normal and protection time passes, the false sealing probability P will gradually increase.

[0316] Example value: P value may rise from 0.15 initially, to 0.35 in the middle, and to 0.62 later.

[0317] Phase 3: Dynamic response and strategy removal;

[0318] The system will automatically remove protection based on monitoring results in three cases:

[0319] Case 1: False sealing rate is too high (P > 0.5);

[0320] 1. When the P value calculated by the behavior analysis module exceeds the threshold value 0.5 (0.62 in the example), it will immediately issue a "false sealing removal" command to the protection engine.

[0321] 2. The protection engine will:

[0322] Notify the firewall control to delete rules and restore user network access.

[0323] Notify the timer service to cancel the countdown.

[0324] Notify the IP monitoring service to cancel monitoring of the IP.

[0325] Record the characteristics of this false sealing event and dynamically adjust the risk threshold according to the algorithm (for example: θ = θ - 0.1 * P), so that the system is more cautious in the future.

[0326] Case 2: Network switching (IP change) is detected;

[0327] 1. IP monitoring service detects user IP address change (e.g. from 192.168.1.100 to 10.20.30.40) and immediately notifies the protection engine.

[0328] 2. Protection engine forces de-protection, same as above: restore access, stop timer, cancel monitoring. This is because IP change usually means user network environment has changed, original risk may have disappeared.

[0329] Case three: timer timeout;

[0330] 1. 30-minute countdown ends, timer service notifies protection engine.

[0331] 2. Protection engine performs standard de-protection process: delete firewall rules, restore access, and cancel IP monitoring. This is the hard time limit for protection, ensuring that users will not be isolated indefinitely.

[0332] Phase four: subsequent optimization;

[0333] 1. Data collection: protection engine sends detailed feature data of mis-blocking events to behavior analysis module.

[0334] 2. Model iteration: behavior analysis module uses this feedback data:

[0335] Update model parameters: retrain models such as LSTM to optimize their feature weights.

[0336] Adjust decision threshold: dynamically lower risk threshold based on historical mis-blocking cases (e.g. from 0.75 to 0.68), so that the system is less likely to misjudge in subsequent judgments, achieving closed-loop optimization.

[0337] In this embodiment, the relevant model algorithm content is:

[0338] 1. Behavior analysis and risk identification model;

[0339] Model type: semi-supervised anomaly detection model, combining Isolation Forest and RNN (Recurrent Neural Network, such as LSTM).

[0340] Workflow:

[0341] Input: user behavior data stream (IP log, access sequence, timestamp).

[0342] Feature extraction: calculate vectors such as behavior feature vectors , specifically:

[0343] .

[0344] Risk Assessment: Calculate instantaneous anomaly score using Isolation Forest, if anomaly score > threshold, LSTM predicts sequence risk, outputs high-risk probability.

[0345] Output: Risk label and IP flag signal, trigger "Sunlight Guardian" mode.

[0346] Training / Optimization: Train LSTM using historical illegal data set (semi-supervised label), Adam optimizer, hyperparameter tuning through grid search. Combine document "illegal label" as prior knowledge.

[0347] In this embodiment, high-dimensional time series data is processed efficiently, supporting online updates to adapt to new patterns. Time complexity O(nlogn).

[0348] 2. Whitelist access control model;

[0349] Model Type: Rule Engine combined with Fuzzy Matching Model, using Trie tree and Fuzzy Logic.

[0350] Workflow:

[0351] Input: User request (such as URL or application ID).

[0352] Query Matching: Trie tree quickly retrieves whitelist, if not matched, use fuzzy logic to calculate similarity (Levenshtein distance).

[0353] Control Decision: If matched, release, otherwise block and record. Integrate time window check.

[0354] Output: Access permission / block signal.

[0355] Training / Optimization: Whitelist is statically constructed, dynamic optimization through feedback learning. Fuzzy threshold is set through ROC curve.

[0356] In this embodiment, query delay is less than 1ms, supporting large-scale whitelist, reducing false blocking. Suitable for application layer control.

[0357] 3. Protection state management and release model;

[0358] Model Type: Finite State Machine (FSM) combined with event-driven model.

[0359] Workflow:

[0360] State Definition: Normal, Guardian, Release.

[0361] Transition Rules: From Normal-Guardian (risk trigger), Guardian-Release (timeout or network switching).

[0362] Event monitoring: Real-time monitoring of time t (≤30min) and network changes (ΔIP).

[0363] Output: Status update signals and logs.

[0364] Training / Optimization: Unsupervised, rule-based. Optimization involves adjusting the transition probabilities through simulated testing.

[0365] In this embodiment, it is simple and reliable, supports asynchronous event processing, and integrates false blocking protection to calculate the false judgment rate.

[0366] These models can be implemented using Python / TensorFlow.

[0367] The relevant algorithm in this embodiment is:

[0368] 1. Risk probability calculation algorithm: based on Bayesian network model;

[0369] Description: Quantifies the probability that a user's behavior matches illegal characteristics, used for IP tagging.

[0370] Derivation and Application: By approximating Bayesian inference using the Evidence Lower Bound (ELBO), if the risk probability > 0.8, the IP is marked and enters the "Sunshine Guardian" mode. Threshold Optimization: Gradient descent is used to minimize the cross-entropy loss.

[0371] Complexity: O(n), where n is the number of features. Applications: Real-time scoring, integrating prior information to adjust for illegal document tags.

[0372] 2. Anomaly Isolation Score Algorithm: An extension of Isolation Forest;

[0373] Description: Isolate high-risk behavioral pathways for rapid detection.

[0374] Derivation and Application: Randomly split trees isolate outliers; a score less than 0.5 triggers protection. Extension to Temporal Sequence: Incorporate LSTM hidden states as input. Optimization: The number of trees is selected by minimizing variance.

[0375] Application: Processing document behavior patterns, outputting data for whitelist triggering.

[0376] 3. Time window optimization algorithm: dynamic threshold adjustment;

[0377] Description: Ensure protection lasts no more than 30 minutes and calculate the probability of false blocking.

[0378] Derivation and Application: Gradient descent is used to optimize the threshold, supporting network handover detection (the handover is lifted when ΔIP exceeds the threshold). An integrated document protection mechanism is also included.

[0379] Application: Adaptive deactivation reduces user interference.

[0380] The application realizes active protection of network illegal behavior based on behavior analysis by introducing the concept of "sunlight guardian mode". The core idea is to combine intelligent monitoring and advanced intervention: first, relying on real-time behavior analysis (such as access frequency, abnormal interaction sequence) to identify high-risk victims and automatically mark their internal IP addresses; second, in the key time window, the application layer white list control is forced, and only the access to the core application evaluated by security is allowed, so as to isolate the user in the safe digital ecological circle and block the illegal communication link with the remote illegal source. At the same time, the false seal protection (such as protection for no more than 30 minutes, network switching to release) is integrated to ensure efficient intervention and minimal interference. Because of the passivity and low precision of the prior art, the application combines machine learning models (such as anomaly detection algorithms) and state management mechanisms to form an active and accurate network illegal behavior prevention scheme, ultimately reducing the risk of high-risk users and achieving the stop-loss goal.

[0381] The application solves the problem of existing passive detection lag by behavior analysis + instant IP marking, realizes intervention time less than 1 minute, and improves stop-loss rate by 80%.

[0382] Through dynamic DPI white list, the problem of insufficient static coverage of existing white list is solved, and 98% of illegal communication is blocked, and the adaptation rate is 95%.

[0383] Through time window + network switching release, the problem of false judgment of existing technology solution without automatic release is solved, the false seal rate is less than 5%, and the user satisfaction is greater than 90%.

[0384] Through the fusion of LSTM and Isolation Forest, the problem of lack of precise intervention in the prior art is solved, the recognition accuracy is 95%, and the risk is reduced by 70%.

[0385] In order to verify the effectiveness of the application, a 10-day comparative experiment was carried out in the practical environment of a certain telecom operator. The application system (experimental group) and the existing mainstream UEBA system (control group) were compared, covering more than 1 million users. The key experimental results are as follows:

[0386] I. Experimental setup

[0387] 1. Data set: use the real desensitization user behavior data (including marked high-risk events and normal events) of the past month as the training and test set.

[0388] 2. Evaluation index: high-risk user recognition accuracy, false seal rate, intervention delay, system throughput, user complaint rate.

[0389] 3. Comparison baseline: existing commercial UEBA system (based on rule engine + static threshold).

[0390] II. Experimental results and data analysis

[0391] 1. Significant improvement in behavior recognition accuracy

[0392] The accuracy of the invention (Isolation Forest + LSTM fusion model) on the test set reached 96.2%, and the recall rate was 94.8%.

[0393] The accuracy of the control group (traditional rule engine) was 83.5%, and the recall rate was 79.1%.

[0394] Analysis: The multi-dimensional time series fusion model of the invention has stronger capture ability for complex and hidden illegal behavior patterns, and the accuracy is improved by about 12.7%.

[0395] 2. Active intervention delay is extremely low

[0396] From identifying risks to issuing ACL rules to complete isolation, the average delay of the invention is 180ms (P99<200ms).

[0397] The average delay from generating an alarm to manual intervention by the administrator in the control group is 8.5 minutes.

[0398] Analysis: Based on the real-time rule issuing mechanism of Netfilter API, the intervention action is reduced from "minute level" to "millisecond level", realizing truly "active" protection.

[0399] 3. Mis-sealing rate and user satisfaction optimization

[0400] The mis-sealing rate of the invention during the experiment is stable at 0.45%. The mis-sealing rate of the control group is about 5.2%.

[0401] User satisfaction survey shows that the user satisfaction score of the experimental group for protection measures is 4.7 / 5.0, much higher than the 3.0 / 5.0 of the control group.

[0402] Analysis: The dynamic mis-sealing protection mechanism (double trigger release + real-time probability calculation) effectively safeguards the rights and interests of normal users, greatly reducing excessive protection.

[0403] 4. System performance supports large-scale deployment

[0404] On a single node (32-core CPU, 128G memory), the system of the invention can process 10Gbps network traffic in real time, and process more than 2 billion behavior events per day.

[0405] Resource consumption: The Trie tree and Bloom filter structure reduces the memory usage of the whitelist query by 65%, and the query performance is maintained within 0.8ms.

[0406] Analysis: Distributed architecture and efficient algorithm design enable the system to be deployed on a large scale in the telecommunications industry, significantly reducing hardware costs.

[0407] III. Conclusion;

[0408] Through the above experimental verification and analysis, the following conclusions can be drawn:

[0409] 1. Effectiveness is proven: The dynamic ACL active protection method and system based on behavior analysis proposed by the present application is significantly superior to existing technologies in terms of high-risk user identification accuracy, real-time intervention, and false seal control, among other core indicators.

[0410] 2. Practicality and advancement: The system successfully addresses the three industry pain points of "passive defense lag", "white list coverage deficiency", and "serious false judgment interference" raised in the background technology, and through the complete closed loop of "accurate identification - active isolation - intelligent release - closed loop optimization", it realizes maximum security protection with minimal user interference.

[0411] 3. Large-scale application prospects: The experiment proves that the system has excellent performance and low resource consumption, and can effectively support the deployment of telecommunications networks with millions of users, and has broad application prospects in fields such as finance and the Internet of Things that require real-time risk control.

[0412] Example 2

[0413] The difference from Example 1 is that the present application proposes alternative implementation methods for some key modules in Example 1:

[0414] 1. Behavior analysis intelligent monitoring module;

[0415] Alternative solution 1: Graph Neural Network (GNN) replaces LSTM.

[0416] Principle: Abstract user behavior as a heterogeneous graph (node = user / application, edge = interaction frequency), aggregate multi-hop neighbor information to detect group illegal patterns through GNN.

[0417] Advantages: Solves the problem of insufficient capture of associated behavior by LSTM, suitable for social engineering illegal detection.

[0418] Alternative solution 2: Federated learning model.

[0419] Principle: User data is processed locally, only model gradients are uploaded to the central node for aggregation, protecting privacy.

[0420] Advantages: Complies with GDPR requirements, suitable for cross-border telecommunications operator scenarios.

[0421] 2. IP marking and protection triggering module;

[0422] Alternative 1: SDN (Software Defined Network) centralized control.

[0423] Principle: Dynamically issue flow table rules to switches through OpenFlow protocol, replacing kernel-level Netfilter (network filter or network screening system) hooks.

[0424] Advantages: Support unified policy management across regional networks, suitable for cloud network integration architecture.

[0425] Alternative 2: Blockchain storage marking;

[0426] Principle: Mark high-risk IP information on the chain (such as Hyperledger Fabric), ensuring tamper-proofing and audit traceability.

[0427] Advantages: Enhance judicial evidence collection capabilities.

[0428] 3, White list control module;

[0429] Alternative 1: Knowledge graph dynamic reasoning.

[0430] Principle: Build an application trust graph (entity = domain name / developer, relationship = security certification / user evaluation), and calculate the credibility score in real time.

[0431] Advantages: Cover long-tail applications, solve the problem of insufficient coverage of Trie tree static.

[0432] Alternative 2: Edge cache acceleration;

[0433] Principle: Deploy lightweight white list cache on the base station side to reduce central query delay.

[0434] Advantages: Suitable for rural / weak network areas, matching delay reduced from 1ms to 0.2ms.

[0435] 4, False seal protection module;

[0436] Alternative 1: Reinforcement learning dynamic parameter adjustment.

[0437] Principle: Build a DQN (Deep Q-Network) model, with false seal rate + user complaint volume as reward function, to automatically optimize protection time.

[0438] Advantages: Adapt to different user risk tolerance, dynamically adjust protection time (10-45 minutes).

[0439] Alternative 2: Multi-factor biometric verification;

[0440] Principle: When triggered, ask the user to perform voiceprint / face verification, and immediately release if passed.

[0441] Advantages: replace single IP change detection, suitable for fixed IP scenarios (such as enterprise intranet).

[0442] In this embodiment, other application scenarios suitable for the application are as follows:

[0443] 1. Financial field;

[0444] Scenario adaptation: replace "high-risk users" with "suspicious transaction accounts", and "whitelist" with "trusted transaction channels".

[0445] Behavior analysis focuses on abnormal transfer mode (such as short-term multi-account fund collection).

[0446] Innovation reuse: 30-minute active interception window to block money laundering transactions, and false seal protection to avoid freezing legal accounts.

[0447] 2. Security protection of Internet of Things devices;

[0448] Scenario adaptation:

[0449] Target device: smart home (such as camera), industrial sensor.

[0450] Behavior analysis: detect abnormal data upload (such as continuous transmission of encrypted traffic to unknown IP).

[0451] Innovation reuse: device-level whitelist (only allow access to vendor cloud platform), network switching (SIM card change) automatically released.

[0452] 3. Cloud desktop security isolation;

[0453] Scenario adaptation: in the enterprise cloud desktop environment, trigger isolation when employees access high-risk websites.

[0454] Innovation reuse: application layer whitelist control (only allow access to enterprise OA / CRM system), DPI deep analysis of RDP traffic.

[0455] The extended variants of the core technology are shown in Table 1 below.

[0456] Table 1 Extended variants

[0457]

[0458] The technical effect comparison of the alternatives is shown in Table 2 below.

[0459] Table 2 Technical effect comparison

[0460]

[0461] The application breaks the traditional passive defense mode and creates a closed-loop protection logic of "behavior triggering-real-time isolation-window release".

[0462] 1. Proactive defense mechanism design:

[0463] 1) High-risk behavior real-time identification based on double model fusion (Isolation Forest + LSTM).

[0464] 2) Dynamic IP marking system: risk score formula to achieve hierarchical protection (low-risk early warning / medium-risk limit / high-risk isolation).

[0465] 3) Time window forced release: hard upper limit of 30 minutes + network switching (IP change) automatic release of double insurance mechanism.

[0466] 2. Billion-level white list dynamic control:

[0467] Technical breakthrough:

[0468] 1) Trie tree + Bloom filter two-level index structure, realizing 300,000+ trusted address millisecond-level matching (delay <1ms).

[0469] 2) Fuzzy matching algorithm: Levenshtein distance calculation similarity (threshold <0.1 block), solving long-tail application coverage.

[0470] 3) Automatic rolling update: daily scanning + dynamic white list ecology of manual review.

[0471] 3. False seal protection system:

[0472] Core algorithm:

[0473] 1) Real-time calculation of false seal probability.

[0474] 2) Dynamic threshold adjustment model.

[0475] 3) State machine driven release: triple trigger conditions (behavior normalization / P>0.5, network switching, countdown end)

[0476] 4. High-performance architecture implementation (hardware-level optimization):

[0477] 1) DPDK accelerated 10Gbps traffic processing (Suricata probe).

[0478] 2) Distributed stream computing: Kafka ≥100K msg / s throughput + Flink window analysis (P99 delay ≤100ms).

[0479] 3) Rule straight-through injection: Netfilter kernel hook to achieve ≤200ms protection effect.

[0480] The above merely describes the preferred embodiments of the present application, and it should be pointed out that, for those skilled in the art, several improvements and refinements can be made without departing from the principles of the present application, and these improvements and refinements should also be considered as falling within the protection scope of the present application.

Claims

1. A proactive network risk protection method based on behavioral analysis using dynamic ACLs, characterized in that: Includes the following steps: S1: Data collection, real-time analysis of network traffic through DPI probe, extraction of user application access logs, interaction sequences and IP traffic data; S2: Based on the behavior analysis model, conduct behavior analysis and high-risk identification. The specific implementation content is as follows: S21: Extract features from the collected data to generate behavioral feature vectors; S22: Input the extracted behavioral feature vector into the fusion model, use the isolated forest anomaly detection algorithm to detect instantaneous anomaly scores, and use LSTM to analyze the time series pattern and calculate the time series probability; S3: Based on Bayesian networks, a risk score is obtained by combining the instantaneous anomaly score and temporal probability from S2, thereby performing IP tagging. The specific implementation details are as follows: Posterior probability The calculation is based on Bayes' theorem, specifically: ， ， ， ， in, Represents the eigenvector; Represents prior probability; Represents the likelihood ratio; Indicates the probability of evidence; This indicates the number of high-risk users in historical data; This represents the total number of users in the historical data. Representing the eigenvector The i-th feature component in the vector; n represents the dimension of the feature vector; This represents the mean of the i-th feature component obtained from historical high-risk user data; This represents the variance of the i-th feature component obtained from historical high-risk user data. This indicates that the feature vectors observed under normal user behavior conditions The likelihood probability; This represents the prior probability that the user's behavior is normal. S4: Dynamic whitelist isolation: Based on the network filter application programming interface, it issues firewall access control lists (ACLs) in real time to enforce whitelist policies; S5: Protection status monitoring and automatic deactivation, the specific implementation details are as follows: S51: State initialization, after marking high-risk IPs, the state machine transitions from normal to guardian mode, and a 30-minute timer and Netlink monitoring are started; S52: Real-time monitoring, calculates the false blocking rate every 5 seconds. If the false blocking rate is greater than 0.5, triggers the early release logic and deletes the ACL rule. S53: Automatic release. If the timer expires or Netlink detects an IP change, the state machine transitions to release, restoring normal network access for the user and recording the reason for release. S6: Closed-loop optimization: collect protection logs and false blocking events through a visual dashboard, reverse train the LSTM model, adjust feature weights and risk thresholds, and update the whitelist database daily.

2. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S21, the specific implementation details are as follows: The formula for calculating the behavioral feature vector is: ， in, Represents a behavioral feature vector; Indicates visit rate; Indicates the rate of abnormal keywords; This indicates fluctuations in traffic flow.

3. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S22, the isolated forest anomaly detection algorithm is used to calculate the instantaneous anomaly score, specifically as follows: The formula for calculating the instantaneous anomaly score s(x) is as follows: ， ， Where x represents the data sample to be detected; Indicates the path length. Indicates the integrated average. γ represents the normalization term; m represents the subsample size; γ represents the Euler constant.

4. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S22, LSTM is used to analyze user behavior time series patterns and predict time series probabilities. The specific content is as follows: The LSTM model takes a temporal sequence consisting of historical behavior feature vectors as input, extracts temporal features through a gating mechanism, and outputs the final hidden state. ; The time series sequence X is: ， Time series probability The calculation formula is: ， in, This represents the behavioral feature vector at time point t−T. This represents the behavioral feature vector at time point t−1, where t represents the current time point; T represents the size of the time window; and σ represents the Sigmoid function. and Indicates model parameters; This represents the final hidden state of the LSTM model at time t−1.

5. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S3, the risk score is calculated by fusing instantaneous anomaly scores with time-series probabilities, and the formula is as follows: ， in, This indicates the final risk score; Indicates the instantaneous anomaly score; α represents the time series probability; α and β both represent weighting coefficients.

6. The network risk dynamic ACL proactive protection method based on behavior analysis according to claim 1, characterized in that: In S4, the specific implementation process is as follows: S41: Rule issuance. After receiving a high-risk IP, the protection enforcement layer issues a firewall access control list (ACL) to the network filter application programming interface for executing whitelist policies. S42: Whitelist matching. When a user initiates an access request, it is first filtered by a Bloom filter. If a match is found, a precise query is performed on the Trie tree. If the match is successful, the request is allowed; otherwise, a fuzzy match is performed. S43: Fuzzy blocking. Calculate the edit distance between the requested URL and the whitelisted address. If the similarity is less than the set threshold, return a customized blocking page and record the blocking log.

7. A network risk dynamic ACL proactive protection system based on behavior analysis, implementing the network risk dynamic ACL proactive protection method based on behavior analysis as described in any one of claims 1 to 6, characterized in that: It includes a data acquisition layer, an analysis and decision-making layer, a protection execution layer, and a monitoring and feedback layer; Data Acquisition Layer: Collects intranet user behavior data in real time, including application access logs, interaction sequences, and IP traffic data, and supports distributed log collection; Analysis and Decision Layer: Based on user behavior data from the data collection layer, integrate machine learning models to detect abnormal behavior, calculate risk probabilities, and trigger IP tagging; Protection Execution Layer: Based on risk labeling instructions from the analysis and decision-making layer, application layer whitelist control and time window isolation mechanism, and DPI technology-based traffic filtering; Monitoring and feedback layer: Based on the protection status data of the protection execution layer, it performs log backtracking and adaptive optimization, and supports false blocking protection and automatic unblocking.

Images