A server data interaction network security monitoring processing method and device

Abstract

The application relates to the technical field of network security, and discloses a server data interaction network security monitoring processing method and device, wherein in a TLS / SSL handshake process between a server and a client, a non-sensitive parameter in a key negotiation process is extracted to generate a key fingerprint, and an initial risk score is obtained by combining preset risk knowledge bases to perform pre-risk evaluation; the application extracts the non-sensitive parameter to generate the key fingerprint in the TLS handshake stage, and dynamically analyzes abnormal association of handshake features and behavior modes in combination with subsequent ciphertext data transmission behaviors, so that a new detection paradigm for risk insight without decryption is constructed; when a new encryption attack occurs, time-consuming traffic decryption operation is not needed, and accurate threat identification can be realized only by analyzing abnormal association of handshake features and behavior modes, so that the performance bottleneck and privacy compliance problem of security detection under an encrypted traffic environment are fundamentally solved, huge calculation overhead caused by decryption is avoided, and the application is suitable for high-speed network environments.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for monitoring and processing network security for server data interaction. Background Technology

[0002] Server data interaction network security monitoring is mainly achieved through network traffic monitoring, log monitoring, intrusion detection, and security auditing to ensure the security, integrity, and availability of data during transmission. Real-time network traffic monitoring is the core means of ensuring the security of server data interaction. By analyzing network packets and connection status, abnormal traffic and potential attack behaviors can be detected in a timely manner. With the widespread adoption of encryption protocols such as TLS / SSL, most data interactions between servers and clients, and between servers themselves, are encrypted. While this effectively protects data privacy, it also brings unprecedented challenges to network security monitoring.

[0003] However, existing technologies completely decrypt encrypted traffic and then perform content inspection on plaintext. This method introduces network latency. After the monitoring system detects anomalies, it can only generate alarms, requiring manual judgment by security operations personnel or complex API linkage with firewalls and other systems to handle the situation. The computational efficiency needs to be improved. At the same time, centralized management of a large number of private keys also brings new security risks and privacy compliance issues. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method and apparatus for network security monitoring and processing of server data interaction, which solves the problems mentioned in the background art, namely, the inability to achieve real-time security monitoring, threat assessment and proactive handling of server data interaction, and the need to improve response efficiency in dealing with automated and fast-paced network attacks.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] In a first aspect, embodiments of the present invention provide a server data interaction network security monitoring and processing method, comprising the following steps:

[0007] S1: During the TLS / SSL handshake between the server and the client, extract non-sensitive parameters from the key negotiation process to generate a key fingerprint, and combine it with a pre-set risk knowledge base to perform a pre-risk assessment to obtain an initial risk score R_pre;

[0008] S2: During the encrypted data transmission phase, perform multi-dimensional behavioral analysis on the ciphertext data stream and extract behavioral feature vectors;

[0009] S3: Perform dynamic correlation analysis between the initial risk score R_pre and the behavioral feature vector to output the comprehensive threat score R_final;

[0010] S4: Automatically trigger a tiered response strategy based on the comprehensive threat score R_final.

[0011] Furthermore, the non-sensitive parameters in step S1 include at least one of the following: the list of cipher suites provided by the client and their order, the final cipher suite selected by the server, the extended list in the client message, the elliptic curve parameters or DH parameters used in the key exchange process, and the session recovery-related identifiers.

[0012] Furthermore, the multi-dimensional behavioral analysis in step S2 includes:

[0013] Timing behavior feature analysis is used to calculate the statistical characteristics of the data packet arrival time interval;

[0014] Traffic pattern feature analysis is used to statistically analyze the ratio of uplink to downlink traffic and the number of data packets within a session;

[0015] Interactive sequence feature analysis is used to encode data packet sequences according to direction and length ranges to form sequence patterns;

[0016] Entropy feature analysis of encrypted payloads is used to calculate the Shannon entropy of the encrypted payload.

[0017] Furthermore, the temporal behavior characteristics include the mean, variance, and burst index B of the data packet arrival time interval. The burst index B is calculated as the ratio of the mean of the product of the sizes of consecutive data packets to the square of the mean of the sizes.

[0018] Furthermore, in the encrypted entropy feature analysis, the formula for calculating the Shannon entropy H is:

[0019]

[0020] Where H represents the information entropy of the random variable, used to measure the degree of uncertainty or disorder of information; Σ is the summation symbol, representing the cumulative calculation of the contributions of all possible events; p_i is the frequency of the byte value i in the data segment.

[0021] Furthermore, the graded handling strategy in step S4 includes:

[0022] When the overall threat score R_final > θ1, perform observation-level actions, including marking suspicious sessions and logging detailed information.

[0023] When the overall threat score R_final > θ2, a restrictive action is taken, including connection rate limiting or bandwidth limiting of the session source IP.

[0024] When the overall threat score R_final > θ3, a blocking-level action is taken, including immediately terminating the session and adding the key fingerprint and source IP to a dynamic blacklist.

[0025] Where θ1, θ2 and θ3 are the set thresholds, and θ1 < θ2 < θ3.

[0026] Furthermore, the dynamic blacklist is used to block new connections from the same fingerprint or IP during the TLS handshake phase.

[0027] Secondly, embodiments of the present invention provide a server data interaction network security monitoring and processing device, comprising:

[0028] The key insight module is used to extract non-sensitive parameters during the key negotiation process during the TLS / SSL handshake between the server and the client to generate a key fingerprint, and combine it with a pre-built risk knowledge base to conduct a pre-risk assessment and obtain an initial risk score;

[0029] The behavior analysis engine is used to perform multi-dimensional behavior analysis on the encrypted data stream during the encrypted data transmission phase and extract behavior feature vectors.

[0030] The associated decision center is used to dynamically correlate the initial risk score with the behavioral feature vector, and make fusion decisions through machine learning models or rule engines to output a comprehensive threat score. The associated decision center has an adaptive weighted isolated forest model and rule engine built in, which are used to identify cross-stage combined risk scenarios.

[0031] A strategy executor is used to automatically trigger a tiered response strategy based on the comprehensive threat score.

[0032] An adaptive knowledge base is used to store and update risk knowledge bases, malicious fingerprint databases, normal behavior baselines, and machine learning model parameters;

[0033] Memory, used to store computer programs;

[0034] A processor for executing the computer program.

[0035] Furthermore, the policy executor provides standardized interfaces with host firewalls, SDN controllers, or cloud security platforms for performing tiered handling actions.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0037] 1. This invention generates a key fingerprint by extracting non-sensitive parameters during the TLS handshake phase and dynamically correlates it with subsequent encrypted data transmission behavior, thus constructing a novel detection paradigm that can detect risks without decryption. When new encryption attacks occur, there is no need for time-consuming traffic decryption operations; accurate threat identification can be achieved simply by analyzing the abnormal correlation between handshake features and behavioral patterns. This fundamentally solves the performance bottleneck and privacy compliance issues of security detection in encrypted traffic environments, avoids the huge computational overhead caused by decryption, and is suitable for high-speed network environments.

[0038] 2. This invention adopts a dynamic association decision-making mechanism based on multi-dimensional behavioral characteristics, which integrates key fingerprint risk scoring with multi-source information such as ciphertext stream time sequence characteristics, traffic patterns, and interaction sequences. When a new threat is detected, there is no need to retrain the model or update the rule base. The newly emerging threat characteristics are dynamically updated to the adaptive knowledge base, resulting in a rapid threat response and greatly improving the system's ability to respond quickly to unknown threats and its operational efficiency.

[0039] 3. This invention employs an intelligent hierarchical response mechanism. The system dynamically adjusts the response intensity based on threat scores, progressing from observation and recording to access restriction and then to complete blocking, forming a progressive response ladder. This ensures rapid containment of high-risk threats while avoiding accidental damage to normal business operations. It maximizes business continuity while guaranteeing security, achieving an organic unity of security and efficiency. Attached Figure Description

[0040] Figure 1 This is a flowchart illustrating the overall process of a server data interaction network security monitoring and processing method proposed in this invention.

[0041] Figure 2 This is a system architecture diagram of a server data interaction network security monitoring and processing device proposed in this invention;

[0042] Figure 3 This is a detailed flowchart of the key fingerprint extraction and pre-risk assessment (S1) of a server data interaction network security monitoring and processing method and device proposed in this invention;

[0043] Figure 4 This is a schematic diagram of the encrypted stream multi-dimensional behavior modeling (S2) of a server data interaction network security monitoring and processing method and device proposed in this invention;

[0044] Figure 5 This is a structural diagram of a server data interaction network security monitoring and processing device proposed in this invention. Detailed Implementation

[0045] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0046] Example 1, please refer to Figures 1 to 5 This is the first embodiment of the present invention, which provides a server data interaction network security monitoring and processing method, comprising the following steps:

[0047] S1: During the TLS / SSL handshake between the server and the client, extract non-sensitive parameters from the key negotiation process to generate a key fingerprint, and combine it with a pre-set risk knowledge base to perform a pre-risk assessment to obtain an initial risk score R_pre.

[0048] Usage: During the TLS / SSL handshake between the server and the client, a network bypass probe deployed in the server's operating system kernel extracts and parses non-sensitive key parameters in the handshake message to generate the "key fingerprint" of the encrypted session without interrupting normal communication or obtaining the complete plaintext session key.

[0049] Key fingerprints include, but are not limited to: a list of cipher suites provided by the client and their order; the cipher suite ultimately selected by the server; an extended list in the client's Hello message, such as the Server Name Indicator (SNI), Application Layer Protocol Negotiation (ALPN), supported elliptic curve groups, etc.; and the elliptic curve parameters or Diffie-Hellman (DH) parameters used during key exchange; and session recovery-related identifiers.

[0050] S2: During the encrypted data transmission phase, perform multi-dimensional behavioral analysis on the ciphertext data stream and extract behavioral feature vectors.

[0051] S3: Perform dynamic correlation analysis between the initial risk score R_pre and the behavioral feature vector to output the comprehensive threat score R_final.

[0052] Here, the initial risk score R_pre for the session is calculated by matching the key fingerprint with a pre-built risk knowledge base. The risk knowledge base contains known malware fingerprints, lists of weak cipher suites, and anomalous parameter combinations. The initial risk score R_pre obtained in step S1 is dynamically correlated and fused with the behavioral feature vector calculated in real time in step S2. A lightweight online machine learning model, such as an adaptive weighted isolated forest algorithm or a rule-based fusion engine, is used to make a comprehensive decision and output a comprehensive threat score R_final.

[0053] The core of the association decision model lies in identifying scenarios where a single dimension of S1 and S2 exhibits weak anomalies, but when combined, they constitute a high-risk scenario. For example, a session using an uncommon elliptic curve with a high R_pre will have its R_final significantly increased if its subsequent behavior exhibits an anomalous "short request-long response" pattern similar to SQL injection.

[0054] S4: Automatically trigger a tiered response strategy based on the comprehensive threat score R_final.

[0055] The non-sensitive parameters in step S1 include at least one of the following: the list of cipher suites provided by the client and their order, the final cipher suite selected by the server, the extended list in the client message, the elliptic curve parameters or DH parameters used during key exchange, and the identifiers related to session recovery.

[0056] The multidimensional behavioral analysis in step S2 includes:

[0057] Timing behavior feature analysis is used to calculate the statistical characteristics of the data packet arrival time interval;

[0058] Traffic pattern feature analysis is used to statistically analyze the ratio of uplink to downlink traffic and the number of data packets within a session;

[0059] Interactive sequence feature analysis is used to encode data packet sequences according to direction and length ranges to form sequence patterns;

[0060] Entropy feature analysis of encrypted payloads is used to calculate the Shannon entropy of the encrypted payload.

[0061] Temporal behavior characteristics include the mean, variance, and burst index B of the data packet arrival time interval. The burst index B is calculated as the ratio of the mean of the product of the sizes of consecutive data packets to the square of the mean of the sizes.

[0062] In ciphertext entropy feature analysis, the formula for calculating Shannon entropy H is:

[0063]

[0064] Where H represents the information entropy of the random variable, used to measure the degree of uncertainty or disorder of information; Σ is the summation symbol, representing the cumulative calculation of the contributions of all possible events; p_i is the frequency of the byte value i in the data segment.

[0065] The graded handling strategy in step S4 includes:

[0066] When the overall threat score R_final > θ1, perform observation-level actions, including marking suspicious sessions and logging detailed information.

[0067] When the overall threat score R_final > θ2, a restrictive action is taken, including connection rate limiting or bandwidth limiting of the session source IP.

[0068] When the overall threat score R_final > θ3, a blocking-level action is taken, including immediately terminating the session and adding the key fingerprint and source IP to a dynamic blacklist.

[0069] Where θ1, θ2 and θ3 are the set thresholds, and θ1 < θ2 < θ3.

[0070] Usage: Based on the comprehensive threat score R_final determined in step S3, the system automatically triggers a tiered response strategy, forming a closed loop between response actions and monitoring depth.

[0071] Observation-level handling R_final>θ1: Mark suspicious sessions, initiate more detailed traffic metadata recording and session log retention, and may perform traffic mirroring for subsequent in-depth forensic analysis.

[0072] Restriction level handling R_final>θ2: Sends instructions to the server's local firewall or software-defined network (SDN) controller to impose connection rate restrictions, bandwidth restrictions, or request frequency restrictions on the source IP address of the session.

[0073] Blocking level handling R_final>θ3: Immediately terminate the malicious TCP connection and add the session's "key fingerprint" and corresponding source IP information to the dynamic blacklist; the dynamic blacklist is used to block new connections from the same fingerprint or IP during the TLS handshake phase; thereafter, new connections from the same fingerprint or IP can be quickly blocked during the handshake phase S1.

[0074] Example 2, as Figures 1 to 5 This is a second embodiment of the present invention. Unlike the previous embodiment, this embodiment provides a server data interaction network security monitoring and processing device, comprising:

[0075] The key insight module is used to extract non-sensitive parameters during the key negotiation process to generate a key fingerprint during the TLS / SSL handshake between the server and the client, and to perform a pre-risk assessment by combining it with a pre-built risk knowledge base to obtain an initial risk score.

[0076] The process is used to perform step S1, which extracts TLS handshake parameters without loss to generate a key fingerprint and completes a pre-risk assessment.

[0077] The behavior analysis engine is used to perform multi-dimensional behavior analysis on the encrypted data stream during the encrypted data transmission phase and extract behavior feature vectors.

[0078] The process is used to execute the S2 step, receive metadata of encrypted traffic, and calculate multi-dimensional behavioral characteristics such as timing, traffic, interaction patterns, and entropy in real time.

[0079] The Association Decision Center is used to dynamically correlate the initial risk score with the behavioral feature vector, and to make fusion decisions through machine learning models or rule engines to output a comprehensive threat score. The Association Decision Center has a built-in adaptive weighted isolated forest model and rule engine to identify cross-stage combined risk scenarios.

[0080] The process is used to execute the S3 steps, with a built-in lightweight machine learning model and rule engine. It receives and integrates key fingerprint risk and behavioral characteristics, and outputs a comprehensive threat assessment result.

[0081] The policy executor is used to automatically trigger tiered response policies based on the comprehensive threat score; it is used to execute S4 steps and provides standardized interfaces with host security components, network devices, or cloud security platforms to perform tiered response actions.

[0082] An adaptive knowledge base is used to store and update risk knowledge bases, malicious fingerprint databases, normal behavior baselines, and machine learning model parameters, and has the ability to evolve automatically based on feedback.

[0083] Memory is used to store computer programs; processor is used to execute computer programs.

[0084] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.

Claims

1. A method for monitoring and processing network security of server data interaction, characterized in that, Includes the following steps: S1: During the TLS / SSL handshake between the server and the client, non-sensitive parameters from the key negotiation process are extracted to generate a key fingerprint, which is then combined with a pre-set risk knowledge base to perform a pre-risk assessment and obtain an initial risk score R_pre; the pre-risk assessment is based on observable parameters during the handshake phase and does not involve any decryption operations; S2: During the encrypted data transmission phase, perform multi-dimensional behavioral analysis on the ciphertext data stream and extract behavioral feature vectors; The multi-dimensional behavioral analysis in step S2 includes: Timing behavior feature analysis is used to calculate the statistical characteristics of the data packet arrival time interval; The timing behavior features include the mean, variance, and burst index B of the data packet arrival time interval. The burst index B is calculated as the ratio of the mean of the product of the sizes of consecutive data packets to the square of the mean of the sizes. Traffic pattern feature analysis is used to statistically analyze the ratio of uplink to downlink traffic and the number of data packets within a session; Interactive sequence feature analysis is used to encode data packet sequences according to direction and length ranges to form sequence patterns; Entropy feature analysis of ciphertext is used to calculate the Shannon entropy of the ciphertext payload; In the encrypted entropy feature analysis, the formula for calculating the Shannon entropy H is: Where H represents the information entropy of the random variable, used to measure the degree of uncertainty or disorder of information; Σ is the summation symbol, representing the cumulative calculation of the contributions of all possible events; p_i is the frequency of the byte value i in the data segment; S3: Dynamically correlate and fuse the initial risk score R_pre obtained in step S1 with the behavioral feature vector calculated in real time in step S2; make a comprehensive decision through a lightweight online machine learning model, such as an adaptive weighted isolated forest algorithm or a rule-based fusion engine, and output a comprehensive threat score R_final. The dynamic correlation analysis identifies cross-phase threat patterns by calculating the correlation between static risks during the handshake phase and dynamic behaviors during the data transmission phase in real time. The dynamic correlation analysis is initiated within the first data transmission time window after the TLS handshake is completed. S4: Based on the comprehensive threat score R_final, automatically trigger a tiered handling strategy within the lifecycle of the current session.

2. The server data interaction network security monitoring and processing method according to claim 1, characterized in that, The non-sensitive parameters in step S1 include at least one of the following: the list of cipher suites provided by the client and their order, the final cipher suite selected by the server, the extended list in the client message, the elliptic curve parameters or DH parameters used in the key exchange process, and the session recovery-related identifiers.

3. The server data interaction network security monitoring and processing method according to claim 1, characterized in that, The graded handling strategy in step S4 includes: When the overall threat score R_final > θ1, perform observation-level actions, including marking suspicious sessions and logging detailed information. When the overall threat score R_final > θ2, a restrictive action is taken, including connection rate limiting or bandwidth limiting of the session source IP. When the overall threat score R_final > θ3, a blocking-level action is taken, including immediately terminating the session and adding the key fingerprint and source IP to a dynamic blacklist. Where θ1, θ2 and θ3 are the set thresholds, and θ1 < θ2 < θ3.

4. The server data interaction network security monitoring and processing method according to claim 3, characterized in that, The dynamic blacklist is used to block new connections from the same fingerprint or IP during the TLS handshake phase.

5. A server data interaction network security monitoring and processing device, implemented based on the method described in any one of claims 1-4, characterized in that, include: The key insight module is used to extract non-sensitive parameters during the key negotiation process during the TLS / SSL handshake between the server and the client to generate a key fingerprint, and combine it with a pre-built risk knowledge base to conduct a pre-risk assessment and obtain an initial risk score; The behavior analysis engine is used to perform multi-dimensional behavior analysis on the encrypted data stream during the encrypted data transmission phase and extract behavior feature vectors. The associated decision center is used to dynamically correlate the initial risk score with the behavioral feature vector, and make fusion decisions through machine learning models or rule engines to output a comprehensive threat score. The associated decision center has an adaptive weighted isolated forest model and rule engine built in, which are used to identify cross-stage combined risk scenarios. A strategy executor is used to automatically trigger a tiered response strategy based on the comprehensive threat score. An adaptive knowledge base is used to store and update risk knowledge bases, malicious fingerprint databases, normal behavior baselines, and machine learning model parameters; Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the method as described in any one of claims 1-4.

6. The server data interaction network security monitoring and processing device according to claim 5, characterized in that, The policy executor provides a standardized interface to host firewalls, SDN controllers, or cloud security platforms for performing tiered handling actions.

Images