Real-time monitoring and blocking methods and devices for abnormal data transmission in cross-border VPN environments

Abstract

This invention discloses a method and apparatus for real-time monitoring and blocking of abnormal data transmission in a cross-border VPN environment. Relating to the field of real-time monitoring and blocking, the method collects flow mirroring of the target VPN session at a mirror port or bypass probe to obtain a set of monitoring elements. For each type of control plane event, the occurrence time, type label, and intensity are obtained. The event occurrence time is mapped to a phase ring, and a VonMises kernel density projection is established on the phase ring for each type of event to obtain the control plane phase intensity field. Using the control plane phase intensity field and geometric evidence vector, local curves of the data plane and control plane are obtained. Triggering mechanism and causal timing-driven analysis are performed on the local curves of the data plane and control plane to generate handling trigger mapping rules. Based on the handling trigger mapping rules, geometric consistency and π-specific final calibration are performed to obtain the final adjustment measures, ensuring deterministic continuous transmission of cross-border data transmission in complex routing environments and high-frequency key rotation scenarios.

Description

Technical Field

[0001] This invention relates to the field of real-time monitoring and blocking, specifically to a method and apparatus for real-time monitoring and blocking of abnormal data transmission in a cross-border VPN environment. Background Technology

[0002] In existing cross-border VPN WAN interconnection scenarios, a subtle micro-anomaly that is difficult to detect by conventional methods is prevalent: within a very short time window around the hour or half-hour of the physical clock, the TLS heartbeat or application-layer keep-alive messages transmitted through the encrypted tunnel suddenly experience a one-way arrival interval that stretches to two to three times the normal period, forming a sub-second heartbeat gap, after which the link quickly heals itself. Because this anomaly does not cause continuous large-scale packet loss, and the statistical mean of end-to-end latency does not drift significantly, conventional macro-monitoring systems based on ICMP periodic probing or SNMP polling often treat it as random jitter smoothing, making it difficult to detect this time-series discretization phenomenon with strict phase-locking characteristics. This leads to occasional disconnections of critical services under seemingly normal network indicators.

[0003] The underlying mechanism of this anomaly lies in the fact that in cross-border transmission environments, the metric recalculation of the BGP routing process and the periodic rolling of IKE security associations overlap at the top of the hour, causing control plane jitter to trigger instantaneous physical path swings and encryption context switching. This compound interference causes some critical heartbeat packets to reach the gateway, but due to timing misalignment, they fall outside the IPsec protocol's ESP replay protection window and are mistakenly dropped as replay attacks. However, existing monitoring technologies mostly rely on statistical anomaly detection on a linear time axis, lacking geometric modeling capabilities. They cannot identify these microscopic gaps clustered around critical phases, nor can they establish a causal, timing-driven correlation between control plane events and data plane ESP sequence anomalies. Therefore, they cannot effectively monitor and defend against such non-congestion-related protocol layer blocking behaviors in real time.

[0004] To address the aforementioned shortcomings, a technical solution is provided. Summary of the Invention

[0005] To address the technical problems mentioned in the background section, this invention is proposed. This invention provides a method and apparatus for real-time monitoring and blocking of abnormal data transmission in a cross-border VPN environment.

[0006] This invention achieves its purpose through the following technical solution: a method for real-time monitoring and blocking of abnormal data transmission in a cross-border VPN environment, comprising the following steps:

[0007] The target VPN session's flow mirroring and splitting are collected on the mirror port or bypass probe to obtain a set of monitoring elements;

[0008] Geometric evidence vectors are obtained by performing geometric preprocessing on the monitoring element set using a time-direction-sequence perturbation cylindrical coordinate system.

[0009] Four types of control surface event data are acquired. For each type of control surface event, the occurrence time, type label, and intensity are obtained. The occurrence time is mapped to the phase loop. A VonMises kernel density projection is established on the phase loop for each type of control surface event to obtain the control surface phase intensity field.

[0010] By using the control surface phase intensity field and geometric evidence vector, local curves of the data surface and control surface are obtained. Triggering mechanism and causal time-series dominant analysis are performed on the local curves of the data surface and control surface to generate disposal triggering mapping rules.

[0011] Geometric consistency and π-specific final calibration are performed based on the handling trigger mapping rules to obtain the final adjustment measures.

[0012] Furthermore, the monitoring element set includes: heartbeat time series, directional statistics, and ESP sequence.

[0013] Furthermore, the geometric preprocessing includes:

[0014] A time-direction-sequence perturbation cylindrical coordinate system is established with the phase reference as the center, where the angular coordinates represent the time phase, the radial coordinates represent the sequence perturbation intensity, and the height coordinates represent the directional offset.

[0015] The monitoring element set M is mapped to a phase-direction-disturbance coordinate observation set;

[0016] Based on the phase-direction-perturbation coordinate observation set, a nearest local ring sector is constructed with the whole point and half point as the center. The ternary statistical characteristics of the nearest local ring sector are statistically analyzed, including density, radial concentration and directional polarity. They are then spliced ​​together in a predetermined order to form a six-dimensional ternary statistical feature vector.

[0017] Furthermore, the geometric preprocessing also includes:

[0018] The curvature sequence of the nearest local annular sector is obtained by performing three-point second-order difference calculation on the arrival time series in the nearest local annular sector. The heart rate interval curvature index, including the curvature peak and the peak duration width, is extracted from the curvature sequence.

[0019] The six-dimensional ternary statistical feature vector and the heart rate interval curvature index are concatenated to form a geometric evidence vector.

[0020] Furthermore, the sequence perturbation intensity includes:

[0021] Calculate the adjacent differences for sequence numbers in the same direction, and calculate the number of windowing and significant gaps that occur within the time slice, as well as the root mean square of the difference deviation from the expected set, based on the adjacent differences;

[0022] The sequence perturbation intensity is obtained by statistically combining the number of window breaks and significant gaps that occur within the time slice with the root mean square of the difference deviation from the expected set.

[0023] Furthermore, the four types of control plane event data include: metric recalculation, path switching, policy updates, and IKE session scrolling.

[0024] Furthermore, obtaining the local curves of the data surface and the local curves of the control surface includes:

[0025] Multiplicative aggregation of sector density, radial concentration and directional polarity is performed based on a six-dimensional ternary statistical eigenvector to obtain a data surface anomaly energy scalar.

[0026] The phase angle width coefficient is obtained by dividing the total angle width of a local ring sector by the number of intrabeat events in that sector.

[0027] Multiply the phase angle width coefficient by the peak duration width and apply upper and lower bounds and smoothing to obtain the sector window angle width. Based on the sector window angle width, establish a local window with the sector center angle.

[0028] The local curve of the data surface is obtained by normalizing the window function based on the local small window, the sector small window angle width, and the data surface anomaly energy scalar.

[0029] Within the same local window, the local curve of the control surface is synthesized by weighting the components of the phase intensity field of the control surface.

[0030] Furthermore, the triggering mechanism and causal timing-driven analysis include:

[0031] Within a local window of the strongly coupled candidate region, a standardized cross-correlation curve is calculated with the relative displacement of the local curve of the control plane relative to the local curve of the data plane as the independent variable, and the maximum value of the standardized cross-correlation curve is taken as the local coherence coefficient.

[0032] Based on the data surface anomaly energy scalar and local coherence coefficient, a dual threshold rule is used to determine strongly coupled candidate regions.

[0033] Evidence verification is performed on the strong coupling candidate region within a local small window. The evidence verification includes normalized cross-correlation peak coherence test and phase difference distribution concentration test to determine whether the phase coupling evidence is valid.

[0034] Based on the standardized cross-correlation curves of strongly coupled candidate regions where phase coupling evidence has been established, the optimal alignment displacement is determined to obtain the time lead.

[0035] By performing sign discrimination and numerical extraction on the time lead, the causal temporal dominance of the control observation link is obtained.

[0036] Furthermore, the final adjustment measures include:

[0037] Based on the handling trigger mapping rules, the trigger mechanism is re-typed, and geometric consistency and π specificity are finally checked, including main lobe polarity verification, π window consistency judgment, and directional consistency review. If the verification passes, the current handling is maintained; if the verification fails, the corresponding adjustment measures are implemented.

[0038] A real-time monitoring and blocking device for abnormal data transmission in a cross-border VPN environment, used to implement the real-time monitoring and blocking method for abnormal data transmission in the cross-border VPN environment, including:

[0039] The data acquisition module is used to collect the stream mirroring and splitting of the target VPN session on the mirror port or bypass probe to obtain a set of monitoring elements;

[0040] The geometric processing module is used to perform geometric preprocessing on the monitoring element set in a time-direction-sequence perturbation cylindrical coordinate system to obtain a geometric evidence vector;

[0041] The control intensity module is used to acquire four types of control surface event data. For each type of control surface event, the occurrence time, type label and intensity are acquired. The occurrence time is mapped to the phase loop. A VonMises kernel density projection is established on the phase loop for each type of control surface event to obtain the control surface phase intensity field.

[0042] The disposal triggering module uses the control surface phase intensity field and geometric evidence vector to analyze the local curves of the data surface and the control surface, performs triggering mechanism and causal time-series-driven analysis on the local curves of the data surface and the control surface, and generates disposal triggering mapping rules.

[0043] The final adjustment module performs geometric consistency and π-specific final calibration based on the disposal trigger mapping rules to obtain the final adjustment measures.

[0044] Compared with the prior art, the beneficial effects of the present invention are:

[0045] This invention acquires a monitoring element set by collecting flow mirroring and splitting of the target VPN session at the mirror port or bypass probe. Geometric preprocessing of the monitoring element set using a time-direction-sequence perturbation cylindrical coordinate system yields a geometric evidence vector. Four types of control plane event data are obtained. For each type of control plane event, the occurrence time, type label, and intensity are acquired. The event occurrence time is mapped to a phase ring, and a VonMises kernel density projection is established on the phase ring for each type of event to obtain the control plane phase intensity field. Using the control plane phase intensity field and the geometric evidence vector, local curves of the data plane and control plane are obtained. Triggering mechanism and causal timing-driven analysis are performed on the local curves of the data plane and control plane to generate handling trigger mapping rules. By constructing an ESP sequence window slippage monitoring model based on the physical clock's hourly phase, it can accurately capture and identify sub-second heartbeat void phenomena masked by traditional mean statistical monitoring. Unlike existing technologies that only focus on physical packet loss at the link layer, this invention delves into the IPsec protocol processing logic, effectively distinguishing between physical congestion packet loss and accidental dropping due to path sway causing packets to fall outside the ESP playback protection window. This enables the system to keenly detect and characterize discrete transmission anomalies caused by control plane jitter in the absence of significant end-to-end latency drift, filling the technical gap for microscopic monitoring of timing logic conflicts in cross-border VPN encrypted tunnels.

[0046] This invention establishes a time-linked blocking mechanism for routing control plane metric recalculation and IKE security association rolling by performing geometric consistency and π-specific final calibration based on handling trigger mapping rules to obtain the final adjustment measures. This fundamentally eliminates the encryption context switching oscillations caused by the temporal superposition of two types of periodic events at the hour. By implementing preemptive blocking of abnormal behavior or dynamically adjusting the replay window tolerance within a specific phase window, this invention avoids unnecessary connection resets for long-connection services due to protocol-level sequence number verification failures. It ensures deterministic continuous transmission of cross-border data in complex routing environments and high-frequency key rotation scenarios, and solves the persistent problem of occasional silent interruptions of critical services at the hour. Attached Figure Description

[0047] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. The following drawings are not drawn to scale according to the actual size, but are intended to show the main idea of ​​the present invention.

[0048] Figure 1 This is a flowchart of the method of the present invention;

[0049] Figure 2 This is a system block diagram of the present invention;

[0050] Figure 3This is a flowchart of step S3 of the present invention. Detailed Implementation

[0051] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are also within the scope of protection of the present invention.

[0052] Example 1

[0053] like Figure 1 As shown, this invention provides a method for real-time monitoring and blocking of abnormal data transmission in a cross-border VPN environment, comprising:

[0054] Step S1: Collect the stream mirroring of the target VPN session on the mirror port or bypass probe to obtain the monitoring element set. Perform geometric preprocessing on the monitoring element set in the time-direction-sequence perturbation cylindrical coordinate system to obtain the geometric evidence vector.

[0055] Step S1 further includes:

[0056] Step S11: Collect the stream mirroring of the target VPN session on the mirror port or bypass probe, set a uniform sampling period, and obtain a set of monitoring elements, including heartbeat time series, directional statistics, and ESP sequence.

[0057] A mirror port is a port mirroring output interface on a switch, router, or VPN gateway, used to copy transit packets from a specified port or session in their original order and send them to the monitoring device. A bypass probe is a collection device that bypasses the service link via an optical splitter or switch mirroring, receiving but not forwarding packets. These are deployed in parallel outside the service forwarding path, and collection is performed here to obtain the original packet sequence traversing the link without altering service behavior and maintaining temporal integrity. A target VPN session refers to an encrypted communication session at the gateway identified by source address, destination address, transport protocol, port, and security parameters, typically corresponding to a tunnel flow between two endpoints. Flow mirroring is the process of copying the packet flow of this session and exporting it to the collection port without changing the original packet routing and timing relationships. To ensure the temporal comparability of multi-point data, the system sets a uniform sampling period, meaning all probes use the same measurement time interval. The measurement start points are aligned using the network time protocol to ensure data acquisition synchronization. Through these steps, a monitoring element set is obtained, which is a core set of data used for in-depth analysis of network status. Specifically, this includes: a heartbeat time series, which is a set of consecutive arrival times of periodic small packets within the same session. ;in, The first in the sequence The arrival timestamp of each heartbeat message; and the adjacent interval calculated based on this. This is used to jointly characterize the periodic pattern and micro-jitter of the heartbeat; directional statistics are used to count the incoming and outgoing message counts or rates and calculate the difference or percentage difference in each sampling period to reflect the unilaterality and tilt of the direction; the ESP sequence is a number sequence extracted from the sequence number field of the tunnel encryption encapsulation. .

[0058] Step S12: Establish a time-direction-sequence perturbation cylindrical coordinate system centered on the phase reference, with angular coordinates representing time phase, radial coordinates representing sequence perturbation intensity, and height coordinates representing directional offset; map the monitoring element set M into a phase-direction-perturbation coordinate observation set.

[0059] Specifically, the steps for sequence perturbation intensity analysis are as follows:

[0060] Calculate the adjacent differences for sequence numbers in the same direction, and calculate the number of windowing and significant gaps that occur within the time slice, as well as the root mean square of the difference deviation from the expected set, based on the adjacent differences;

[0061] The sequence perturbation intensity is obtained by statistically combining the number of window breaks and significant gaps that occur within the time slice with the root mean square of the difference deviation from the expected set.

[0062] During the analysis phase, a preset cycle is used. Adaptive determination of phase reference And establish a time-direction-sequence perturbation cylindrical coordinate system: based on the collected heartbeat time series. For each candidate base point within the sliding observation window Evaluate phase alignment ,in, Index for heartbeat samples, The robust weights for this sample can be set as non-negative constants, such as by package size or detection confidence, and cos(˙) is the cosine function. express The difference between it and the rounded-down value, i.e., the decimal part, will cause [the value] to [be affected] in multiple consecutive viewing windows. To obtain a stable global maximum Recorded as Align the phase zero point with the heartbeat clusters within a very short time before and after the hour; and record the arrival time of any given time. Mapped to time phase To ensure that the nearest neighbors at the hour and half-hour ( and Subsequent sector analysis of ) has unified angular coordinates; directional bias Based on the collected directional statistics, in terms of time... Centered on, with a length of The rate (or percentage) of incoming and outgoing heartbeats or messages within a time slice. and ,definition It is obtained from the monitoring element set, where "within time slice" and "within slice" both refer to the length of the time slice. Statistical window; sequence perturbation intensity Based on the collected ESP sequence numbers and directional statistics, the definition is... ,in These are non-negative coefficients used to normalize two components to a comparable scale. Used to quantify notch / window crossing intensity: for serial numbers in the same direction , The sequence number is obtained by splitting the ESP sequence according to the direction markers into inbound and outbound directions, and then arranging them in ascending order of arrival time. For the sequence, calculate the adjacent differences. , For the sample index in the direction sequence, and in relation to time Define the window-crossing event within the corresponding time slice. , where the symbol Indicates an indicator function, with values... The conditions for representation are met. The representation is invalid; the constant in the formula is invalid. This represents the expected step size of consecutive data packets under ideal conditions. The maximum allowable out-of-order step size for the playback buffer can be obtained from the device specifications or offline calibration, such as by adjusting the normal segment. The distribution is estimated by its upper quantiles to determine the distribution. This indicates the number of window breaks and significant gaps that occur within the film; To quantify the magnitude of local disorder, a single robust approach is employed: the difference deviation from the expected set is evaluated within the same direction and time slice. Calculate the root mean square Where max represents the maximum value. The number of samples involved in the calculation within the film, and the coefficients. The method of obtaining the data is to first estimate the values ​​on representative normal samples. and The steady-state scale is determined and scale-matched, such as the median absolute deviation or standard deviation, for example, let... , and These represent the number of window breaks and gaps obtained statistically from a representative normal sample, respectively. Standard deviation and root mean square index of difference deviation from expected set Standard deviation; based on collected heartbeat time series Directional statistics ESP sequences split by direction Calculate separately , and Map each record to a cylindrical coordinate point ,in Adaptive Align key phases, angular coordinates The value is the time phase. radial coordinates The value is the sequence perturbation strength. height coordinates The value is a directional bias. This provides a reproducible coordinate basis for the statistical analysis and anomaly cluster identification of local ring sectors surrounding the hour and half-hour points.

[0063] Since the anomalies occur near the hour or half-hour, step S12, which uses a linear time axis, cannot intuitively aggregate periodic patterns. Therefore, an adaptive phase reference is used to determine the phase reference. A cylindrical coordinate system is established, mapping linear time to angular coordinates. It can align the hourly times of different periods to or The sector; mapping the ESP sequence perturbation intensity reflecting packet loss and out-of-order delivery to radial coordinates. The directional bias reflecting unidirectionality is mapped to height coordinates. This process transforms the discrete set of monitored elements into a set of points in geometric space. Its core function is to provide a unified mathematical and geometric foundation for subsequent identification of clustered points. This step is indispensable because without establishing this coordinate system, the system cannot integrate temporal periodicity, spatial directionality, and protocol-based sequence anomalies into a single measurable model. Subsequent statistical and phase alignment analyses based on sector density will lack a coordinate reference and will be unable to accurately locate extremely short-term anomalies near the integer points.

[0064] Step S13: Based on the phase-direction-perturbation coordinate observation set, construct the nearest local ring sector with the whole point and half point as the center respectively, and count the ternary statistical features of the nearest local ring sector respectively, including density, radial concentration and directional polarity, and splice them into a six-dimensional ternary statistical feature vector in a predetermined order.

[0065] In the phase-direction-perturbation coordinate observation set Construct a local ring sector above, in which It is an index of the observation point. The first The angular coordinates, radial coordinates, and height coordinates of each observation point For the corresponding raw arrival time, each record in the phase-direction-perturbation coordinate observation set is marked one by one. A symmetrical annular sector window is set around the two physical key phases of the hour and half-hour, specifically the central phase. Half width of the angle ,Pick ,Right now ,default radius range When conducting statistics, the threshold can be truncated to the upper bound of experience. To achieve robustness, the height coordinates are not geometrically clipped and are used only for statistical purposes. The two local annular sectors are defined as follows: and ,in Indicates the nearest neighbor sector at the top of the hour. Indicates the nearest sector at half a point. These two positions, representing the minimum arc difference, were chosen because the invention aims to identify extremely short time events before and after the hour, and many heartbeat / retransmission / playback mechanisms operate on a periodic basis. Concentrated disturbances occur around the hour and half-hour, therefore the statistical window is locked at... and This can improve the signal-to-noise ratio and positioning accuracy. The nearest local ring sector is the set of observation points within the aforementioned angular bandwidth range; for any local ring sector... Calculate the ternary statistical characteristics, density ,in The number of points within the sector, and the equivalent annular area. , , Indicates median; radial concentration Used to measure the clustering of disturbance intensity in the radial dimension, taking the form of a robust ratio. ,in The mean, This represents the absolute deviation of the median. To avoid small constants that divide by zero; directional polarity Used to measure inbound / outbound consistency, defined as Its range The closer This indicates dominance in one direction. The sign function is represented; the output is used to select the ternary statistical features of the annular sector of the geometric evidence vector as: and The above are calculated and concatenated into a six-dimensional ternary statistical feature vector. , yes and The ternary statistical characteristics are density characterizing the degree of clustering of events in the critical phase, radial concentration characterizing whether the disturbance intensity is significantly concentrated, and directional polarity characterizing whether the anomaly is unidirectionally biased. This six-dimensional quantity is complete, repeatable, and can directly support subsequent phase localization, intensity assessment, and directionality discrimination.

[0066] Step S13 at the critical phase integer point and half a point Constructing local ring sectors and calculating their density, radial concentration, and directional polarity allows for the quantification of anomaly morphology. The raw data consists of discrete points; only through statistical feature vectorization can the intuitive image be transformed into a computer-processable numerical indicator. Without this step, subsequent steps cannot assess the intensity and morphology of the anomaly, nor can they distinguish between random noise and genuine anomalies with specific structures.

[0067] Step S14: Perform three-point second-order difference calculation on the arrival time series in the nearest local ring sector to obtain the curvature sequence of the nearest local ring sector, and extract the heartbeat interval curvature index from the curvature sequence, including the curvature peak and the peak duration width.

[0068] Within a defined nearest-neighbor local ring sector, the heartbeat time series is periodically folded onto the phase axis. Heartbeat events whose phases fall within that sector are selected based on the angular range of the nearest-neighbor local ring sector. The timestamps of these events are then sorted chronologically, resulting in an ordered timestamp sequence representing the arrival time series for that sector. j is the index number. The sector sorted by time Calculate the heartbeat interval between two consecutive arrival times. To suppress the influence of outliers, robust standardization is performed on the interval sequence, defining... ,in for robust standardized value, For all the median of The median absolute deviation is given; the discrete curvature is defined on the standardized interval sequence using the three-point second-order difference. The curvature sequence within this sector is obtained. ,in and These represent the sequence number in the time-sorted sequence, respectively. The and the first A robust standardized value; extract the heart rate interval curvature index from the sequence, including the peak curvature. and peak duration width Peak duration width Defined as satisfying The length of the shortest consecutive index interval, The peak threshold coefficient can be, for example, 0.5, where the peak curvature refers to the curvature value with the largest value in the curvature sequence calculated over time within the sector.

[0069] Step S14 calculates curvature using a three-point second-order difference, which can keenly capture abrupt changes in time intervals in a heartbeat sequence and extract the curvature peak. and continuous width The aforementioned statistical characteristics reflect macroscopic aggregation, while the curvature index reflects the degree of microscopic temporal abrupt change. Without this step, the system may only perceive "anomaly" but cannot accurately identify it as a specific type of latency abrupt change like "heartbeat void," which can easily be confused with ordinary network congestion, leading to misjudgment.

[0070] Step S15: Concatenate the six-dimensional ternary statistical feature vector and the heart rate interval curvature index to form a geometric evidence vector.

[0071] Methods for real-time monitoring and blocking of abnormal data transmission in cross-border VPN environments also include:

[0072] Step S2: Obtain four types of control surface event data. For each type of control surface event, obtain the occurrence time, type label, and intensity. Map the event occurrence time to the phase loop. Establish a VonMises kernel density projection on the phase loop for each type of event to obtain the control surface phase intensity field.

[0073] Step S2 acquires four types of control surface event logs and uses VonMises kernel density projection to map discrete event times onto the same phase loop as the data surface, generating a continuous intensity field. This step is a prerequisite for causal analysis. The core of this solution is to address data surface anomalies caused by control surface jitter. Without S2, the system only monitors data surface phenomena, completely lacking awareness of the underlying causes. Subsequent cross-correlation analysis cannot be performed to confirm that the control surface caused the anomaly, making targeted rerouting or strategy adjustments impossible.

[0074] Specifically, the four types of control plane event data include: metric weight calculation, path switching, policy updates, and IKE session scrolling.

[0075] Four types of control plane event data are precisely extracted from auditable logs: metric recalculation, path switching, policy updates, and IKE session rolling. Metric recalculation data comes from the metric recalculation logs of the routing / forwarding process, such as the recalculation trigger count and timestamp of the routing process for link / prefix metrics. Path switching data comes from the switching logs of routing protocols or tunnel orchestration, recording the next-hop / tunnel primary / backup switch trigger count and timestamp. Policy updates come from the policy engine or ACL / routing policy issuance logs, recording the number of entries added, deleted, or modified in the policy / ACL / routing policy, as well as timestamps. IKE session rolling data comes from the VPN / IKE negotiation logs, recording the number of SA renegotiations or reconstructions, as well as timestamps. For each type of control plane event... Get the time of occurrence Type tags and intensity Normalized from the original count, for example Where min represents the minimum value. 0 represents the calibration threshold. The number of changes refers to the quantified value of the event directly extracted from the auditable logs, corresponding to each event type, such as the recalculation trigger count of link / prefix metrics by the routing process, etc.; based on the phase reference determined by the aforementioned phase analysis. With preset cycle Mapping event time to phase ring ,That This function extracts the decimal part of a time point within a period. The relative phase shift within the phase domain; kernel projection of similar events in the phase domain using the VonMises kernel. Perform nuclear projection, where the concentration parameter , For zero-order modified Bessel functions, It is an exponential function. Cross-validation or likelihood maximization are existing and common parameter selection methods, which will not be elaborated here. = , It is the phase difference between the query location and the event location; then the phase intensity curve of each tag is... , The type label variable represents the control surface event, used to distinguish different event categories. Its physical meaning is the intensity density of that type of event in the phase θ neighborhood. The four types of curves are arranged in order to form a vector field. The phase intensity field of the control surface is obtained, where , , and They represent the phases respectively. At this point, the normalized intensity density values ​​of four specific events—metric recalculation, path switching, policy update, and IKE session scrolling—obtained through VonMises kernel density projection calculation, are arranged in order to form the control surface phase intensity field vector.

[0076] Methods for real-time monitoring and blocking of abnormal data transmission in cross-border VPN environments also include:

[0077] like Figure 3 As shown, in step S3, the local curves of the data plane and the local curves of the control plane are analyzed using the phase intensity field of the control plane and the geometric evidence vector. Triggering mechanism and causal time-series dominant analysis are performed on the local curves of the data plane and the local curves of the control plane to generate disposal triggering mapping rules. Based on the disposal triggering mapping rules, geometric consistency and π specificity final calibration are performed to obtain the final adjustment measures.

[0078] Specifically, step S3 also includes:

[0079] Step S31: Multiplicatively aggregate the density, radial concentration and directional polarity within the sector based on the six-dimensional ternary statistical feature vector to obtain the data surface anomaly energy scalar;

[0080] The phase angle width coefficient is obtained by dividing the total angle width of the local ring sector by the number of intrabeat events in that sector; the phase angle width coefficient is multiplied by the peak duration width and upper and lower bounds are applied and smoothed to obtain the sector window angle width; a local window is established based on the sector center angle based on the sector window angle width.

[0081] The local curve of the data surface is obtained by normalizing the window function based on the local small window, the sector small window angle width, and the data surface anomaly energy scalar.

[0082] Within the same local window, the local curve of the control surface is synthesized by weighted summation of the components of the phase intensity field of the control surface;

[0083] Based on a six-dimensional ternary statistical feature vector, for any local ring sector Normalize the three scalars in ternary statistics to remove their dimensions and unify them to the standard. Mapping density to intervals Radial concentration mapping to interval The directional polarity itself is already in the range. The three factors are dimensionlessly removed through max-min normalization. Following the multiplicative principle that higher density × higher concentration × stronger consistency indicates greater anomaly, the three normalized quantities are multiplied to obtain a dimensionless anomaly intensity. This intensity is then multiplied by a positive scaling constant to obtain a data surface anomaly energy scalar. This scalar is placed within a range comparable to the control surface intensity, and any component that is too low will suppress the intensity, thus reflecting the joint constraint of necessary conditions. The total angle width of the local ring sector is divided by the number of intrabeat events in that sector to obtain the phase angle width coefficient. The phase angle width coefficient is multiplied by the peak duration width and bounded and smoothed to obtain the sector window angle width. ,in For peak duration, Phase angle width factor, and These are the lower and upper limits of the corner window, respectively. This is the scaling factor. This refers to a numerical clipping / truncating operation, which restricts a number to a given range. If the target value is less than the lower limit, the lower limit is used; if the target value is greater than the upper limit, the upper limit is used; if the target value is within the range, it remains unchanged, based on the sector center angle. Create a local window This allows the small window to cover the main lobe without excessive diffusion; based on local small windows The sector window angle width and the data surface anomaly energy scalar are used to obtain the local curve of the data surface through a normalized window function. , among which, Normalized window function Window lumped parameters ,make φ is an angular variable, representing the phase angle along the circumferential direction. The anomalous energy scalar of the preceding data surface; the local curve of the control surface is synthesized by weighting the components of the phase intensity field within the same local window. ,

[0084] Among them, the weighting coefficient , These include metric recalculation in the control surface phase intensity field, path switching, policy updates, and IKE session scrolling at angles. The normalization strength is obtained by removing dimensions and unifying them through max-min normalization. This allows the curve amplitude to directly reflect the composite intensity of the control surface at each angle;

[0085] Step S31 requires reducing the multidimensional features into comparable energy waveforms. This is achieved by multiplicatively aggregating the density, concentration, and directional polarity of the six-dimensional feature vectors to obtain the abnormal energy of the data surface, and then generating local curves using a window function. Simultaneously, weighted synthesis of local curves for the control surface is performed. Its indispensability lies in its ability to unify heterogeneous data into two waveform curves within the same phase window. Without this step, the data surface and control surface would be like two different languages, making subsequent mathematical comparisons impossible and hindering the determination of their temporal compatibility.

[0086] Step S32: Within a local window of the strongly coupled candidate region, calculate the standardized cross-correlation curve with the relative displacement of the local curve of the control plane relative to the local curve of the data plane as the independent variable, and take the maximum value of the standardized cross-correlation curve as the local coherence coefficient.

[0087] Based on the data surface anomaly energy scalar and local coherence coefficient, a dual threshold rule is used to determine strongly coupled candidate regions.

[0088] The normalized cross-correlation peak refers to the relative displacement of the local curve of the control surface relative to the local curve of the data surface within a small local window of the strongly coupled candidate region. Calculate the standardized cross-correlation using as the independent variable. , obtained NCC – The standardized cross-correlation curve; the maximum value of this curve is called the normalized cross-correlation peak, i.e., the local coherence coefficient, and its corresponding position... For optimal alignment displacement. Specifically... The calculation employs the conventional curve correlation method, which will not be elaborated here. A dual-threshold rule is used to determine strong coupling candidate regions: when the abnormal energy scalar and local coherence coefficient of the data surface exceed their respective thresholds, it is determined to be a strong coupling candidate region. The thresholds are derived from statistical calibration of historical samples or the validation set. Specifically, using manually labeled positive and negative samples as a reference, ROC / PR curves are plotted for each quantity during the training phase, and the split point that optimizes the comprehensive index (such as Youden index, F1, or cost minimization) is selected, or the quantile corresponding to the target false negative rate / false alarm rate is used as a fixed threshold. The abnormal energy scalar characterizes whether it is sufficiently strong (high density, good concentration, consistent direction) as amplitude evidence, while the local coherence coefficient characterizes whether it is aligned with the control surface as phase evidence. Both constrain amplitude and shape alignment, respectively. Insufficient performance in either area should result in a strong coupling candidate region. Joint judgment can simultaneously suppress false anomalies with high noise but poor alignment, and weak perturbations with good alignment but insufficient energy, thus more robustly identifying strong coupling candidate regions.

[0089] Step S33: Perform evidence verification on the strong coupling candidate region within a local small window. The evidence verification includes normalized cross-correlation peak coherence test and phase difference distribution concentration test to determine whether the phase coupling evidence is valid.

[0090] Normalized cross-correlation peak coherence refers to the correlation coefficient between the peak cross-correlation value and the peak cross-correlation value within a small local window of a strongly coupled candidate region, expressed as a function of relative displacement variables. Calculate the standardized cross-correlation curve The location of its global maximum value is defined as the cross-correlation peak position. This position is the optimal alignment displacement; The main lobe interval is determined based on the peak width criterion, and the main lobe angular width is obtained using the half-peak width. This gives the main lobe interval. ; small partial window in The complement of the dimension, that is, using a small window interval Set after peak removal The non-peak region is obtained, among which This indicates the relative displacement variable when performing cross-correlation calculations within a local small window. The effective range of values ​​for is the lower bound of the displacement search interval. With the upper realm , From a local window The boundary determines the specific local small window corner width. The relative displacement range, i.e. , This is used to define the effective angular domain for cross-correlation calculations. The high quantile (e.g., 90th percentile) of the NCC samples in this region is used as the noise floor level, constructing the peak-to-noise ratio (PNR) as the local coherence coefficient divided by the high quantile of the noise floor. Phase difference distribution concentration refers to fixing the relative phase of two curves at the optimal alignment displacement, extracting the local phase of each real-valued curve within a local window using the zero-crossing / gradient phase method, and calculating the standard deviation of their differences to obtain the phase difference distribution width. A smaller width indicates more stable and consistent phases. The criterion for valid phase coupling evidence is: PNR ≥ And the phase difference distribution width ≤ ,in, This is the peak-to-noise ratio threshold. The thresholds for the phase difference distribution width are determined by scanning different data points on labeled historical data or validation datasets using a grid search. and The combination of parameters calculates the precision and recall of the model for identifying abnormal associations, and selects the combination that maximizes the F1 score as the final system operating parameters. Peak-to-noise ratio ensures strong matching, while phase difference width ensures that the matching is stable and consistent within a local window. The combination of the two can reduce misjudgments caused by occasional spikes and local noise.

[0091] Step S33 involves correlating causality. Within the strongly coupled candidate region, the normalized cross-correlation peak value and phase difference distribution of the two local curves are calculated to verify whether the control plane event and the data plane anomaly are highly consistent in time and phase-locked. This is legal-level evidence to determine whether the anomaly was caused by the control plane event. Without this step, the system may erroneously trigger coordinated actions when the two events merely coincide, or miss the truly related events, leading to the false triggering or failure of the blocking strategy.

[0092] Step S34: Based on the standardized cross-correlation curve of the strongly coupled candidate region where the evidence of phase coupling has been determined, determine the optimal alignment displacement to obtain the time lead.

[0093] By performing sign discrimination and numerical extraction on the time lead, the causal temporal dominance of the control observation link is obtained.

[0094] Within a strong coupling candidate region where phase coupling evidence has been established, a standardized cross-correlation curve is calculated within the same local window using the relative displacement of the control plane relative to the data plane as the independent variable. The position corresponding to the maximum value is the optimal alignment displacement, as it provides the relative translation amount required for the two local curves to match best. This is equivalent to how much the control plane must be moved forward or backward relative to the data plane on the time axis. This displacement is the time lead. The sign of this time lead is determined and its value is extracted. If the sign is positive, it is determined that the control plane is leading; if it is negative, it is determined that it is lagging. This yields the causal temporal dominance of the control observation link.

[0095] Step S35: Within a local small window, determine the main lobe interval based on the peak width criterion, with the cross-correlation peak position as the center;

[0096] The absolute area of ​​the main lobe is calculated from the local curve of the control surface within the main lobe region, and the consistency coefficient is determined by the local coherence coefficient.

[0097] The equivalent perturbation energy is obtained by multiplying the absolute area of ​​the main lobe by the consistency coefficient.

[0098] The relative magnitudes of equivalent perturbation energy and peak curvature are used to determine the triggering mechanism type, including event-dominant, data surface sensitive, composite, and no significant event.

[0099] The triggering mechanism is used to determine the type, control the causal timing dominance and time lead of the observation link, and the main lobe interval mapping as the triggering mapping rules for handling.

[0100] The absolute area of ​​the main lobe is calculated from the local curves of the control surface within the main lobe region. Characterize the net disturbance intensity; calculate the consistency coefficient using the local coherence coefficient. ,in The local coherence coefficient is within a small window on the main lobe. The circular squared error is the local phase difference between two local curves on the data plane, used to measure phase consistency. The local phase difference refers to the phase difference between the two curves at the same independent variable position within the main lobe interval of the local window. The equivalent perturbation energy is obtained by multiplying the absolute area of ​​the main lobe by the consistency coefficient. .

[0101] Equivalent perturbation energy With peak curvature Determine the relative magnitudes of the two: Perform robust standardization on their respective distributions within the current batch / sliding window (e.g., using quantile thresholds), and set the thresholds... Each of them is their respective first quantile and first Percentage, commonly taken Alternatively, the median absolute deviation can be normalized to the threshold. Fractions; if and It is determined to be event-driven, with strong external triggering and moderate geometric response; if and It is determined to be data surface sensitive, with significant geometric / curvature anomalies and general equivalent energy; if and It is determined to be a composite type; if and If no significant event is found, it is determined that there is no significant event. The final type is used for subsequent strategies. For event-driven types, the peak area is expanded and noise suppression is enhanced. For data-sensitive types, the alignment is fine-tuned and the peak area width is limited. For composite types, both coherence and geometric consistency tests are strengthened. If there is no significant event, no corresponding operation is performed.

[0102] Type determination based on triggering mechanism And combined with the control observation link causal time dominance output in step S34 and time lead volume Main lobe region Mapping the judgment type and dominance to the handling trigger mapping rule: when At that time, by Determine the trigger and priority, if Then in the safety buffer Prioritize routing changes or policy alterations and session reconstruction, and issue targeted blocking or short-term black holes to hit the five-tuple. The duration of the short-term black hole is [duration missing]. Takes a fixed value, defaults to 3 minutes, can be configured as follows: If the control plane lags behind (L=) for 5 minutes, the data plane will initiate the process, limiting bandwidth and degrading queues within the main lobe interval. The bandwidth limit refers to reducing the bandwidth to 10% of the link capacity, which can be configured to 5%–20%. If the following upgrade conditions are met, the process will be upgraded to blocking. Continuous after treatment Each sampling period was no lower than the high threshold of the pre-treatment baseline, using a fixed numerical method, specifically based on the recent stable period. mean with standard deviation Calculate threshold ,default ,when The upgrade conditions are met; when At this time, by default, it is driven by the data plane, and performs bandwidth limits and queue degradation within the main lobe interval, without directly creating a black hole. The bandwidth limit is similar to the link capacity. Only when Simultaneous control surface fine-tuning is only recommended when the significance threshold is exceeded. The significance threshold is determined using both absolute value and robust standardization: a condition is considered significant if either condition is met. Condition one is... , This represents the minimum significant time difference threshold, used to define the significance of causal time series on a physical time scale. (Default) Condition two is the robustly standardized z-score. ;when At the same time, speed limit and isolation are activated, and the control surface is redirected or IKE renegotiation is triggered; if the equivalent energy Higher than a fixed high threshold (also using) Then, a short-term block will be executed on the hit session and settings will be configured. The fixed high threshold is also adopted. ;when It does not trigger any action at any time, but only continues to monitor.

[0103] Step S35 determines the processing strategy based on who is in control and who initiates the event. It calculates the equivalent energy by measuring the main lobe area and consistency coefficient, and compares the curvature peak to classify anomalies into event-driven, data-surface-sensitive, etc. It then uses the time lead to determine the causal sequence, mapping this to specific actions such as rerouting, black-hole blocking, or rate limiting. This step is the decision-making brain of the entire system. Without it, even if anomalies and their causes are detected, the system will not know what measures to take, whether to reroute traffic or simply limit the rate, thus failing to achieve closed-loop automatic defense and blocking.

[0104] Step S36: Based on the handling trigger mapping rules, re-determine the trigger mechanism type, and perform final calibration of geometric consistency and π specificity, including main lobe polarity verification, π window consistency determination, and direction consistency review. If the verification passes, maintain the current handling; if the verification fails, execute the corresponding adjustment measures.

[0105] After processing based on the trigger mapping rules, the trigger mechanism is re-evaluated using monitoring data after the processing takes effect. Geometric consistency and π-specificity final calibration are only performed when three scenarios occur: event-driven, data-sensitive, or a combination thereof. Event-driven refers to mandatory triggers caused by explicit scene changes or operational instructions from external / upstream monitoring. Data-sensitive refers to significant abnormal fluctuations in the main lobe characteristics or quality indicators of the current batch, such as energy, width, offset, or polarity exceeding the alarm threshold. Combination refers to both conditions being met simultaneously or sequentially and mutually corroborating each other to increase confidence. This final calibration is not performed when there are no significant events. The final calibration step introduces additional calculations and threshold determination; excessive frequency can amplify random noise and lead to false detections. Furthermore, geometric consistency and π-specificity essentially serve change confirmation and peak removal; their benefits are limited in the steady-state, event-free phase, and may even reduce processing throughput and stability.

[0106] Within the same local small window, based on the cross-correlation peak position and main lobe region Based on this, the final calibration consists of three parts: main lobe polarity verification, Window consistency determination and directional consistency verification. The main lobe polarity verification involves calculating the radial concentration of the main lobe interval. With directional polarity Check whether the energy is concentrated in the main lobe and whether the sign is unidirectionally dominant; the threshold is set using the inner quantile, that is, statistical analysis is performed within the same batch or sliding window. and The empirical distribution is used to determine the lower inner quantile of each distribution. and The minimum acceptable threshold is the condition that must be met to pass. and . The content of the window consistency determination is: preset Window width As a geometric prior, this width is given by system calibration or theoretical geometric relationships and remains fixed during operation; the compatibility of the main lobe width and position with this prior is checked. The compatibility criteria are that both width compatibility and position compatibility are met simultaneously and the peak region does not cross the boundary. The threshold is also set using the inner quantile, for example, the lower quantile in the 0.6 to 0.8 interval is taken by default. The relative width difference sequence is calculated in the historical samples. With relative offset sequence ,in It means The central angle position, and the upper bound of the inner quantiles of their respective distributions. , As the upper limit of allowable limits, and based on this, a judgment is made. and At the same time, the main lobe interval is required Completely fall into Window support The internal direction consistency check involves: taking the phase difference between the local curves of the control plane and the local curves of the data plane point by point within the main lobe interval to form a phase difference sequence. That is, for each sampling point Calculate phase difference ,in and This represents the local control plane curve and the local data plane curve within the main lobe interval. "Wrap" refers to wrapping the angle or phase values ​​back to the control plane. The average amplitude of the circle is obtained. and circular variance U is the total number of sampling points, and o represents the index variable of the discrete sampling points within the main lobe interval. Its threshold is also set using the inner quantile, for example, the lower quantile of the interval 0.6 to 0.8 is used by default. and Also given according to the configurable quantile parameter value, This represents the lower limit threshold of the circular average amplitude, used to set the minimum concentration requirement for phase consistency. It only applies when the calculated... Only when the value is greater than or equal to this threshold is it considered that the control plane and the data plane maintain sufficient phase-locked strength within this window. This represents the upper limit threshold of the circular variance, used to set the maximum allowable dispersion of phase consistency. It only applies when the calculated circular variance... Only when the phase difference is less than or equal to this threshold is the fluctuation between the two considered to be within an acceptable stable range. Specifically, a circular average amplitude sequence of historical samples is collected within a sliding window. With circular variance sequence ,Pick , ,in These are configurable lower quantile parameters; the default value is [value missing]. The lower quantile of the interval is used as the lower bound (for...) ) and allowed upper limit (for ),satisfy and Only if the above main lobe polarity verification is met will it pass. The window consistency determination and direction consistency review determine that the final verification has passed, maintain the current handling until the retention time required by the strategy ends, and record the audit.

[0107] If the final calibration fails, and the triggering mechanism is event-driven, then it reverts to S33, increasing the stringency threshold for the current batch (e.g., increasing the quantile parameter by +0.1). Events may be accompanied by actual drift, so false alarms need to be suppressed. If the triggering mechanism is data-sensitive, then it reverts to S33, lowering the threshold (e.g., decreasing the quantile by 0.1). Fluctuations are mostly due to noise, so the threshold needs to be relaxed to reduce missed detections. If the triggering mechanism is complex, then it reverts to S33, performing a quick review first, repeating the calculation, and if it still fails, performing adaptive checks, simultaneously tightening the polarity / concentration and phase consistency thresholds. Increased by +0.05 A 10% reduction is needed, as both triggering simultaneously is more likely to indicate a genuine anomaly, requiring stricter filtering.

[0108] Step S36 is a high-risk operation requiring secondary confirmation. This confirmation is made either before or after the procedure, by checking the main lobe polarity. Window compatibility and direction consistency verification provide the final validation of the decision results. This constitutes the system's safety valve and adaptive feedback mechanism. Due to the complexity of the network environment, noise may lead to misjudgments. Without S36, the system may incorrectly maintain unnecessary blocking or frequent jitter due to single calculation errors. Through final verification, if the validation fails, it rolls back and adjusts the threshold, ensuring the system's robustness and low false alarm rate during long-term operation.

[0109] Example 2

[0110] like Figure 2 As shown, the device for real-time monitoring and blocking of abnormal data transmission in a cross-border VPN environment according to the present invention includes a data acquisition module, a geometric processing module, a control strength module, a handling trigger module, and a final adjustment module.

[0111] The data acquisition module is used to collect the stream mirroring and splitting of the target VPN session on the mirror port or bypass probe to obtain a set of monitoring elements;

[0112] The geometric processing module is used to perform geometric preprocessing on the monitoring element set in a time-direction-sequence perturbation cylindrical coordinate system to obtain a geometric evidence vector;

[0113] The control intensity module is used to acquire four types of control surface event data. For each type of control surface event, the occurrence time, type label and intensity are acquired. The occurrence time of the event is mapped to the phase loop. A VonMises kernel density projection is established on the phase loop for each type of event to obtain the control surface phase intensity field.

[0114] The disposal triggering module uses the control surface phase intensity field and geometric evidence vector to analyze the local curves of the data surface and the control surface, performs triggering mechanism and causal time-series-driven analysis on the local curves of the data surface and the control surface, and generates disposal triggering mapping rules.

[0115] The final adjustment module performs geometric consistency and π-specific final verification based on the disposal trigger mapping rules to obtain the final adjustment measures;

[0116] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0117] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0118] The foregoing description is illustrative of the invention and should not be construed as limiting it. Although several exemplary embodiments of the invention have been described, those skilled in the art will readily understand that many modifications can be made to the exemplary embodiments without departing from the novel teachings and advantages of the invention. Therefore, all such modifications are intended to be included within the scope of the invention as defined in the claims. It should be understood that the foregoing description is illustrative of the invention and should not be construed as limiting it to the specific embodiments disclosed, and modifications to the disclosed embodiments and other embodiments are intended to be included within the scope of the appended claims. The invention is defined by the claims and their equivalents.

Claims

1. A method for real-time monitoring and blocking of data transmission anomalies in a cross-border VPN environment, characterized in that, The method comprises the following steps: Collecting flow mirror shunts of target VPN sessions on mirror ports or bypass probes to obtain a set of monitoring elements; Geometrically preprocessing the set of monitoring elements to obtain a geometric evidence vector in a time-direction-sequence perturbation column coordinate system; Obtaining four types of control plane event data, obtaining the occurrence time, type label and intensity of each type of control plane event, mapping the occurrence time to a phase ring, and establishing a Von Mises kernel density projection for each type of control plane event on the phase ring to obtain a control plane phase intensity field; Using the control plane phase intensity field and the geometric evidence vector to obtain a data plane local curve and a control plane local curve, performing trigger mechanism and causal timing dominant analysis on the data plane local curve and the control plane local curve to generate a treatment trigger mapping rule; Based on the treatment trigger mapping rule, geometric consistency and π specificity final calibration are performed to obtain a final adjustment measure; The geometric preprocessing comprises: Establishing a time-direction-sequence perturbation column coordinate system with a phase reference as the center, the angular coordinate being a time phase, the radial coordinate being a sequence perturbation intensity, and the height coordinate being a directional bias; Mapping the set of monitoring elements M into a phase-direction-perturbation coordinate observation set; Based on the phase-direction-perturbation coordinate observation set, constructing a near-neighbor local ring sector with a whole point and a half point as the center respectively, respectively counting the three-element statistical characteristics of the near-neighbor local ring sector, including density, radial concentration degree and direction polarity, and splicing into a six-dimensional three-element statistical feature vector in a predetermined order; The geometric preprocessing further comprises: In the near-neighbor local ring sector, a three-point second-order difference calculation is performed on the arrival time sequence to obtain a curvature sequence of the near-neighbor local ring sector, and a heartbeat interval curvature index is extracted from the curvature sequence, including a curvature peak value and a peak value duration width; The six-dimensional three-element statistical feature vector and the heartbeat interval curvature index are spliced to form a geometric evidence vector; The four types of control plane event data include: metric recalculation, path switching, policy update and IKE session rolling; The final adjustment measure comprises: Based on the treatment trigger mapping rule, re-performing trigger mechanism judgment, performing geometric consistency and π specificity final calibration, including main lobe polarity verification, π window consistency determination, direction consistency review, verifying that the current treatment is maintained if the verification is passed, and executing the corresponding adjustment measure if the verification is not passed.

2. The method for real-time monitoring and blocking of data transmission anomaly in cross-border VPN environment according to claim 1, characterized in that, The set of monitoring elements comprises: a heartbeat time sequence, a directionality statistic and an ESP sequence.

3. The method of claim 2, wherein the method further comprises: The sequence perturbation intensity comprises: Calculating the adjacent difference of the same direction sequence number, calculating the number of over-windows and significant gaps occurring within a time slice and the root mean square of the difference deviation from the expected set based on the adjacent difference; The number of over-windows and significant gaps occurring within a time slice and the root mean square of the difference deviation from the expected set are statistically combined to obtain the sequence perturbation intensity.

4. The method of claim 3, wherein the method further comprises: The data plane local curve and the control plane local curve are obtained by: Based on the six-dimensional three-element statistical feature vector, the density, radial concentration degree and direction polarity within the sector are multiplied to obtain a data plane abnormal energy scalar; The total angular width of the local ring sector is divided by the number of heartbeat events in the sector to obtain a phase angular width coefficient; The sector small window angle width is obtained by multiplying the phase angle width coefficient with the peak duration width, applying upper and lower bounds and smoothing; the sector center angle is used to establish a local small window based on the sector small window angle width; The data plane local curve is obtained by using a normalized window function based on the local small window, the sector small window angle width and the data plane abnormal energy scalar; The control plane local curve is synthesized by weighting the components of the control plane phase intensity field in the same local small window.

5. The method of claim 4, wherein the method further comprises: The trigger mechanism and causal time sequence dominant analysis includes: In the local small window of the strong coupling candidate area, the relative displacement of the control plane local curve relative to the data plane local curve is used as the independent variable to calculate the normalized cross-correlation curve, and the maximum value of the normalized cross-correlation curve is used as the local coherence coefficient; Based on the data plane abnormal energy scalar and the local coherence coefficient, the strong coupling candidate area is determined by a double threshold rule; The evidence test is performed on the strong coupling candidate area in the local small window, and the evidence test includes normalized cross-correlation peak coherence test and phase difference distribution concentration test to determine whether the phase coupling evidence is valid; Based on the normalized cross-correlation curve of the strong coupling candidate area for which the phase coupling evidence is determined to be valid, the best alignment displacement is determined to obtain the time lead; The sign of the time lead is determined and the numerical value is extracted to obtain the causal time sequence dominance of the control observation link.

6. The real-time monitoring and blocking device for data transmission anomaly in cross-border VPN environment, characterized in that, The method for real-time monitoring and blocking of data transmission anomalies in a cross-border VPN environment according to any one of claims 1-5 includes: The data acquisition module is used to collect flow mirror shunts of target VPN sessions on mirror ports or bypass probes to obtain a set of monitoring elements; The geometric processing module is used to perform geometric preprocessing on the set of monitoring elements in a time-direction-sequence perturbation column coordinate system to obtain a geometric evidence vector; The control intensity module is used to obtain four types of control plane event data, obtain the occurrence time, type label and intensity of each type of control plane event, map the occurrence time to a phase ring, and establish a Von Mises kernel density projection on the phase ring for each type of control plane event to obtain a control plane phase intensity field; The disposal trigger module uses the control plane phase intensity field and the geometric evidence vector to analyze the data plane local curve and the control plane local curve, performs trigger mechanism and causal time sequence dominant analysis on the data plane local curve and the control plane local curve, and generates a disposal trigger mapping rule; The final adjustment module performs geometric consistency and π specificity final calibration based on the disposal trigger mapping rule to obtain final adjustment measures.

Images