Protocol non-inductive dynamic adaptation method and system for government and enterprise data channels

Abstract

The invention discloses a protocol non-inductive dynamic adaptation method and system for government and enterprise data channels, and the method comprises the steps: collecting network resources, dividing business systems of all departments into security domains according to the institutions to which assets belong, business types and confidentiality levels, and abstracting the security domains into security domain nodes, according to an existing network access control rule, abstracting an allowed access relationship into a directed edge to form a security domain accessibility map; selecting the historical service flow of a stable security domain node in a preset statistical period in the security domain accessibility map, extracting protocol features, processing the protocol features to form credible anchoring sample features corresponding to each protocol category, and storing the credible anchoring sample features in a credible anchoring sample library; performing multi-dimensional credibility scoring according to the protocol characteristics of each piece of service flow collected in real time to obtain a credibility score; whether the traffic has a potential poisoning risk can be more accurately judged, and the poisoning traffic can be eliminated in time.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, in particular to a protocol non-sensing dynamic adaptation method and system for a government-enterprise data channel. BACKGROUND

[0002] With the rapid development of informatization, the security and intelligent level of protocol adaptation of the government-enterprise data channel, which is a key hub for data exchange between governments and enterprises, are facing unprecedented challenges. In particular, in the complex government-enterprise data channel environment of multiple security domains and multiple business tenants, the output of the protocol non-sensing self-learning model directly controls the reachability relationship between different security domains through protocol fingerprints and channel strategies. However, an attacker can long-term disguise as normal government access traffic, induce the protocol non-sensing self-learning model to maintain a high recognition accuracy on the surface, while quietly changing the feature distribution of certain protocol categories, and then open a cross-domain access path that should be prohibited at the strategy level, seriously threatening the security of the data channel.

[0003] In the online protocol self-learning scene lacking complete labels, how to combine the inherent security domain topology structure and business change information of the government-enterprise network to accurately identify and isolate the poisoned samples, so as to effectively prevent the protocol non-sensing self-learning model from being polluted by malicious traffic, has become an urgent need to solve the problems in the prior art.

[0004] Therefore, the protocol non-sensing dynamic adaptation method and system for a government-enterprise data channel are proposed to solve the problems in the prior art. SUMMARY

[0005] The purpose of the application is to provide a protocol non-sensing dynamic adaptation method and system for a government-enterprise data channel to solve the problems in the background art.

[0006] In order to achieve the above purpose, the application provides the following technical scheme: The protocol non-sensing dynamic adaptation method for a government-enterprise data channel comprises: Collecting network resources and dividing departmental business systems into security domains according to the institutions to which the assets belong, the business types and the security levels, and abstracting the security domains into security domain nodes, and according to the present network access control rules, abstracting the allowed access relationships into directed edges to form a security domain reachability graph; Selecting the historical business traffic of the security domain nodes that are stable in a preset statistical period in the security domain reachability graph, and extracting protocol features, and after processing, forming trusted anchor sample features corresponding to each protocol category, and storing them in a trusted anchor sample library; According to the protocol features of each piece of real-time collected business traffic, performing multi-dimensional trustworthiness scoring to obtain trustworthiness scores; and according to the trustworthiness scores, dividing the corresponding business traffic into high-trust samples, medium-trust samples and candidate poisoned samples; Under the constraints of high-trust sample set and business change event, according to the protocol category and access path in the protocol feature, the trusted anchor sample corresponding to the protocol category and access path in the trusted anchor sample library is called, a time sliding window is constructed for each protocol feature, a distribution difference measurement value in each time sliding window compared with the trusted anchor sample is calculated, and whether the corresponding high-trust sample is marked as a non-causal drift sample and added to the candidate poisoning sample set is determined according to the distribution difference measurement value. The candidate poisoning sample is divided into a plurality of feature clusters, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed for each feature cluster respectively, and whether the feature cluster is marked as a real poisoning sample cluster is determined based on the output difference of the two types of models, and is isolated from the training data.

[0007] Further, the historical business traffic of the security domain node in the preset time window is read, the historical business traffic is feature extracted according to the message length sequence, the handshake message sequence, the field value distribution, and the arrival time interval feature dimension, and the obtained protocol feature is denoised, cluster analyzed and statistically modeled to form the trusted anchor sample feature corresponding to each protocol category.

[0008] Further, the method for obtaining the trust score comprises: According to the protocol feature of each piece of business traffic, the historical alarm number of the source security domain, the certificate validity mark and the access time legality mark are obtained, and are jointly evaluated to output the trust score; according to the preset high-trust threshold and low-trust threshold, the business traffic corresponding to the trust score is divided into high-trust samples, medium-trust samples or candidate poisoning samples.

[0009] Further, the calculation method of the distribution difference measurement value comprises: After obtaining the protocol feature statistical vector in each time sliding window and the trusted anchor feature vector of the corresponding protocol category in the trusted anchor sample library, normalization processing is performed, so that each feature statistical quantity is expressed in the form of a probability vector, and the feature statistical vector includes the message length distribution feature, the handshake sequence pattern, the field value distribution feature and the arrival time interval distribution feature.

[0010] The protocol feature probability vector and the trusted anchor probability vector corresponding to the protocol category in the trusted anchor sample library are corresponded one by one, the difference in each dimension is calculated, and the distribution difference measurement value of the protocol feature is obtained by using the square difference accumulation method.

[0011] Further, for the message length distribution feature, the message length is divided into several preset intervals, the number of messages falling into each interval in the time sliding window is counted, and the total number of messages in the time sliding window is divided to obtain the probability vector of the time sliding window message length distribution; similarly, the frequency of each mode or each value interval is counted for the handshake sequence mode, field value distribution, and arrival time interval distribution, and normalized to a probability vector.

[0012] Further, the method of marking the non-causal drift samples comprises: In each time sliding window, the proportion of the number of high-confidence samples of the protocol category to the total number of samples of the protocol category is counted to obtain the high-confidence sample proportion of the time sliding window, and the deviation of the high-confidence sample proportion relative to the previous time sliding window and relative to the preset time average proportion of the protocol category is calculated. When the deviations of the high-confidence sample proportions of all time sliding windows do not exceed the preset proportion stability threshold, it is determined that the high-confidence sample proportion is stable. The distribution difference measure value of each time sliding window is compared with the preset difference threshold. When the distribution difference measure values of a protocol category in consecutive time sliding windows are all greater than the preset difference threshold, it is determined that the feature distribution of the protocol category in the consecutive time sliding windows deviates from the trusted anchor sample continuously. In the same continuous time sliding window, whether there is a business change work order related to the protocol category in the configuration management database and the change management system is queried. When no business change event that can explain the continuous deviation of the feature distribution is found, it is determined that there is no explainable business change event. When the high-confidence sample proportion deviation does not exceed the proportion stability threshold, the distribution difference measure value in the consecutive time sliding windows is greater than the preset difference threshold, and there is no related business change event record in the continuous time range, the high-confidence sample of the corresponding protocol category in the corresponding continuous time sliding window is marked as a non-causal drift sample.

[0013] Further, the method of dividing into multiple feature clusters comprises: For each sample in the candidate poisoning sample set, a division feature vector is constructed, which at least includes the protocol category identifier, the source security domain node identifier, the destination security domain node identifier, the access path identifier, the corresponding time sliding window identifier, and at least one of the message length distribution feature, the handshake sequence mode feature, the field value distribution feature, and the arrival time interval distribution feature. The feature vectors are initially grouped according to the protocol category identifier and the source security domain node identifier and the destination security domain node identifier, the distance between each feature vector is calculated based on a preset feature distance metric within each initial group, the feature vectors with a distance less than a preset clustering threshold are grouped into the same feature cluster, and one or more feature clusters are divided under each protocol category and source-destination security domain combination, and each feature cluster corresponds to a group of candidate poisoning samples with similar feature vectors under the same protocol category and access path.

[0014] Further, the method for constructing the reference model and the control model comprises: The reference model and the control model use the same initial model parameters, the same training process and the same evaluation sample set, and the difference in the training data includes the sample corresponding to the current feature cluster; The training data of the reference model is composed of high-trust samples and medium-trust samples, and the samples in the current feature cluster are excluded; the control model adds the samples in the current feature cluster based on the training data of the reference model; The output of the reference model and the control model is: for each evaluation sample in the same evaluation sample set, output the protocol category prediction result of the evaluation sample and the source security domain and destination security domain combination mapped according to the protocol category prediction result.

[0015] Further, the method for marking the real poisoning sample cluster comprises: The ratio of the number of samples predicted incorrectly by the reference model to the total number of predictions in the evaluation sample set is calculated to obtain the reference model misjudgment rate; the ratio of the number of samples predicted incorrectly by the control model to the total number of predictions is calculated to obtain the control model misjudgment rate, and the difference between the misjudgment rate of the control model on the evaluation sample set and the misjudgment rate of the reference model on the evaluation sample set is taken as the performance change indicator; According to the source security domain and destination security domain combination output of the reference model on the evaluation sample set, a reference access combination set is constructed; according to the source security domain and destination security domain combination output of the control model on the evaluation sample set, a control access combination set is constructed, the source security domain and destination security domain combination that only exists in the control access combination set but not in the reference access combination set is defined as a new access combination, and the number of new access combinations is counted; From the new access combination, the access combination whose destination security domain belongs to the pre-labeled high-sensitive security domain is selected, the number thereof is counted and taken as the cross-domain access change indicator; When the performance change indicator of a certain feature cluster satisfies the condition of exceeding the performance change threshold, and the cross-domain access change indicator satisfies the condition of exceeding the cross-domain access change threshold or there is a new high-sensitive security domain access combination, the feature cluster is marked as a real poisoning sample cluster.

[0016] The protocol non-susceptible dynamic adaptation system of the government-enterprise data channel is used for realizing the protocol non-susceptible dynamic adaptation method of the government-enterprise data channel, and the system comprises: A security domain modeling module is used for collecting network resources, dividing department business systems into security domains according to the institutions to which assets belong, the business types and the security levels, and abstracting the security domains into security domain nodes, abstracting the allowed access relations into directed edges according to the present network access control rules, and forming a security domain reachability graph; A sample construction module is used for selecting the historical business traffic of the stable security domain nodes in the preset statistical period in the security domain reachability graph, extracting protocol features, forming the trusted anchor sample features corresponding to each protocol category after processing, and storing the trusted anchor sample features into a trusted anchor sample library; An evaluation module is used for performing multi-dimensional trustworthiness scoring according to the protocol features of each piece of real-time collected business traffic, obtaining trustworthiness scores, and dividing the corresponding business traffic into high-trustworthy samples, medium-trustworthy samples and candidate poisoning samples according to the trustworthiness scores; A stable detection module is used for, under the constraint of the high-trustworthy sample set and the business change event, calling the trusted anchor samples corresponding to the protocol category and the access path in the trusted anchor sample library according to the protocol category and the access path in the protocol features, constructing a time sliding window for each protocol feature, calculating the distribution difference measurement value of each time sliding window compared with the trusted anchor samples, and judging whether the corresponding high-trustworthy sample is marked as a non-causal drift sample and added to the candidate poisoning sample set according to the distribution difference measurement value; An anti-poisoning detection module is used for dividing the candidate poisoning samples into a plurality of feature clusters, respectively constructing a control model containing the feature cluster and a reference model not containing the feature cluster for each feature cluster, judging whether the feature cluster is marked as a real poisoning sample cluster based on the output difference of the two types of models, and isolating from the training data.

[0017] The protocol non-susceptible dynamic adaptation method and system of the government-enterprise data channel provided by the application have the following technical effects and advantages: The application introduces the security domain reachability graph and the trusted anchor sample library, ensures that the protocol fingerprint and the policy update are not only based on the traffic features, but also combined with the network topology and the historical business traffic. The traditional method often only relies on static rules or simple training samples, cannot effectively adapt to the rapid changes of the network environment, and is easy to cause misjudgment. The application can evaluate the trustworthiness of the traffic in real time, fundamentally avoids the problem that the attacker induces the model to be biased towards the attack traffic features by means of pseudo traffic, enables the protocol non-susceptible self-learning model to maintain high adaptability and security when facing the dynamically changing network environment, and greatly improves the intelligent level of self-learning update.

[0018] By combining the time sliding window, the distribution difference measure and the correlation analysis of service change events, the difference between the poisoned traffic and the normal service traffic can be accurately identified. Existing schemes usually only perform poisoning detection in the model training stage, and fail to fully consider the credibility of traffic sources and possible service changes. By introducing multi-dimensional data evaluation, the present application can more accurately determine whether the traffic has potential poisoning risk, and timely eliminate the poisoned traffic, ensuring that the update of protocol fingerprints and strategies will not be disturbed by malicious traffic; not only improves the accuracy of traffic analysis, but also enhances the identification and isolation ability of the protection measures to the potential poisoned traffic, thereby effectively improving the stability and security of the protocol non-sensitive self-learning model.

[0019] In the traditional method, the protocol non-sensitive self-learning model usually fails to fully consider the security risks of cross-domain access, and the present application can effectively detect and prevent malicious traffic from accessing sensitive data through cross-domain paths by introducing a security domain reachability graph and combining the dynamic evaluation of the added reachable path and the attack path cost by the adversarial reachability simulation module, thereby avoiding the security risks caused by the failure to timely control the cross-domain access in the existing method; further improving the control ability of the protocol non-sensitive self-learning model on cross-domain access, and significantly reducing the risks caused by cross-domain security vulnerabilities. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed in the embodiments will be briefly introduced as follows. Obviously, the drawings described below are only some embodiments described in the present application, and other drawings can also be obtained by those skilled in the art based on these drawings.

[0021] Figure 1 A protocol non-sensitive dynamic adaptation system for a government-enterprise data channel of the present application; Figure 2 A protocol non-sensitive dynamic adaptation method flowchart for a government-enterprise data channel of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the embodiments of the present application more clear, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0023] It should be noted that when a component is said to be "fixed to" another component, it can be directly attached to the other component or there may be an intervening component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there may be an intervening component. Example 1

[0024] like Figure 1 As shown, the protocol-seamless dynamic adaptation system for the government and enterprise data channel in this embodiment includes a security domain modeling module, a sample construction module, an evaluation module, a stability detection module, and an anti-poisoning detection module. The modules are connected by wired and / or wireless means.

[0025] First, a security domain reachability graph and a trusted anchoring sample library are constructed for the government and enterprise network. This involves mapping each department and business system to multiple security domain nodes based on the existing network topology, access control policies, and asset classification information, and mapping the actual allowed access relationships to edges. At the same time, protocol features are extracted from long-term stable business traffic located only in the government intranet and government cloud private network to form a trusted anchoring sample library as a benchmark. All subsequent self-learning results are referenced to this graph and sample library. For example, the finance department intranet, tax intranet, and enterprise extranet are each built into security domain nodes, and only the edge that allows the finance department intranet to access the tax intranet is considered a legitimate path.

[0026] In this step, preferably, the security domain modeling module collects and abstracts the existing network resources of the government and enterprise network. Specifically, it first obtains the network topology, access control rules, and asset identification information from routing devices, switching devices, border security gateways, and access control devices. The asset identification information includes the asset's ownership organization, business type, and confidentiality level. Based on the asset's ownership organization, business type, and confidentiality level, the business systems of each department are divided into several security domains, and each security domain is abstracted as a security domain node in the security domain reachability graph. Subsequently, based on the existing access control rules and the approved business access policies, the allowed access relationships are abstracted as directed edges from the source security domain node to the target security domain node, and the business type, access direction, protocol category, and risk level are marked on each edge to form the security domain reachability graph.

[0027] The sample construction module is used to select historical business traffic of stable security domain nodes within a preset statistical period in the security domain reachability map, extract protocol features, process them to form trusted anchor sample features corresponding to each protocol category, and store them in the trusted anchor sample library.

[0028] Specifically, the read security domain node is in the preset time window of the history traffic, according to the message length sequence, the handshake message sequence, the field value distribution, the arrival time interval and other characteristic dimensions, the history traffic is carried out characteristic extraction, and the obtained protocol characteristic is carried out denoising processing, clustering analysis and statistical modeling, the trusted anchor sample feature corresponding to each protocol category is formed, and is stored in the trusted anchor sample library, which is used for subsequent self-learning process of online collection protocol feature for feature alignment and offset evaluation.

[0029] On the basis of the security domain reachability graph and the trusted anchor sample library, the protocol features of each real-time collected traffic are scored by the evaluation module in multiple dimensions, and the trust score is obtained; and according to the trust score, the corresponding traffic is divided into high trust sample, medium trust sample and candidate poisoned sample.

[0030] The method for obtaining the trust score comprises: According to the protocol features of each traffic, the historical alarm number of the source security domain, the certificate validity mark and the access time legality mark are obtained, and the trust score is output by joint evaluation.

[0031] Specifically, according to the source network address and port information in the protocol feature record, the corresponding source security domain node is located in the security domain reachability graph, and the historical alarm number of the source security domain in the preset time window is obtained from the security audit system; according to the certificate chain information carried by the protocol feature record, the certificate management system is inquired, the certificate validity mark is obtained, and according to the access time strategy configured in the business policy library, it is judged whether the access falls within the predefined business time window, and the access time legality mark is obtained.

[0032] The above historical alarm number, certificate validity mark and access time legality mark are input into the preset scoring function, and the trust score between zero and one is obtained by weighted summation and normalization; for example, the scoring function is as follows: In the formula, The trust score is, The historical alarm number is, The certificate validity mark is, The access time legality mark is, , , , and the preset weight is.

[0033] When the certificate is valid, the certificate validity is 1, and when the certificate is invalid, the certificate validity is 0; When the access falls within the predefined business time window, the access is within a predefined business time window, and a is a preset reduction constant less than one.

[0034] Subsequently, the evaluation module divides the credibility score into a high-trust sample, a medium-trust sample, or a candidate poisoning sample according to preset high-trust and low-trust thresholds. If the credibility score exceeds the high-trust threshold, the corresponding business traffic is divided into a high-trust sample; if the credibility score is below the low-trust threshold, the corresponding business traffic is divided into a candidate poisoning sample; and if the credibility score is between the high-trust threshold and the low-trust threshold, the corresponding business traffic is divided into a medium-trust sample.

[0035] Among them, the high-trust sample is marked as a reliable training sample and sent to the current protocol self-learning model training, the medium-trust sample carries the corresponding weight to participate in the training, and the candidate poisoning sample is collected to form a candidate poisoning sample set and sent to the anti-poisoning detection module for subsequent deep analysis.

[0036] For example, when a certain traffic from the tax internal network, the source security domain has no high-level security alarm in the last month, the certificate is within the valid period and the update frequency is normal, the access time falls within the preconfigured working day daytime period, and the traffic packet length distribution and handshake sequence mode are highly close to the anchor characteristics of the tax internal network to the finance internal network path, the credibility score output by the scoring function is close to one, and the traffic is divided into a high-trust sample directly entering the subsequent self-learning training set.

[0037] The stable detection module, under the constraint of the high-trust sample set and the business change event (i.e., whether there is a change order related to the protocol category within a recent predetermined time), according to the protocol category and access path in the protocol feature record, calls the trusted anchor sample corresponding to the protocol category and access path in the trusted anchor sample library, constructs a time sliding window for each protocol feature, calculates the distribution difference measurement value of each time sliding window compared with the trusted anchor sample, and if the high-trust sample proportion is basically stable, but the feature distribution deviates from the trusted anchor sample, and there is no explainable business change event within a preset time, the high-trust sample of the corresponding protocol category is marked as a non-causal drift sample and added to the candidate poisoning sample set.

[0038] The calculation method of the distribution difference measurement value includes: After obtaining the protocol feature statistical vector in each time sliding window and the trusted anchor feature vector of the corresponding protocol category in the trusted anchor sample library, normalization processing is performed to express each feature statistical quantity as a probability vector. The feature statistical vector includes packet length distribution characteristics, handshake sequence mode, field value distribution characteristics, and arrival time interval distribution characteristics.

[0039] For the message length distribution characteristics, the message length is divided into several preset intervals. The number of messages falling into each interval within the time sliding window is counted and divided by the total number of messages within the time sliding window to obtain the probability vector of the message length distribution of the time sliding window. Similarly, the frequency of each pattern or value interval is counted for the handshake sequence pattern, field value distribution, and arrival time interval distribution, and normalized into a probability vector.

[0040] The protocol feature probability vector is matched one by one with the trusted anchor probability vector of the corresponding protocol category in the trusted anchor sample library. The difference in each dimension is calculated, and the distribution difference measure of the protocol feature is obtained by summing the squared differences. That is, the sum of the squares of the differences in all intervals is calculated for each feature dimension, and then the different feature dimensions are weighted and summed according to the preset weights to obtain the overall distribution difference measure of the time sliding window relative to the anchor sample.

[0041] Business change events include new feature launches, access policy adjustments, etc.; each business change event is mapped to the corresponding time interval and the security domain node involved.

[0042] Methods for labeling causal drift samples include: First, within each time sliding window, the proportion of high-confidence samples of the protocol category to the total number of samples of the protocol category is counted to obtain the proportion of high-confidence samples in that time sliding window. Then, the deviation of the proportion of high-confidence samples relative to the previous time sliding window and the average proportion of the protocol category over a preset time (e.g., 2 to 7 days) is calculated. When the deviation of the proportion of high-confidence samples in all time sliding windows does not exceed the preset stable proportion threshold, the proportion of high-confidence samples is determined to be stable. The distribution difference metric of each time sliding window is compared with a preset difference threshold. When the distribution difference metric of a certain protocol category is greater than the preset difference threshold in several consecutive time sliding windows, it is determined that the feature distribution of the protocol category continues to deviate from the credible anchor sample in the consecutive time sliding windows. Within the same continuous time sliding window, query the configuration management database and change management system to see if there are any business change work orders related to the protocol category. If no business change event that can explain the continuous deviation of the feature distribution is found, it is determined that there is no explanatory business change event.

[0043] If all three conditions are met simultaneously, namely, the deviation of the proportion of high-confidence samples does not exceed the stability threshold of the proportion, the distribution difference metric is greater than the preset difference threshold in multiple consecutive time sliding windows, and there are no relevant business change event records in the continuous time range, then the high-confidence samples of the corresponding protocol category in the corresponding continuous time sliding window are marked as causal drift-free samples, and the causal drift-free samples are removed from the high-confidence sample set and transferred to the candidate poisoning sample set for subsequent analysis by the anti-poisoning detection module.

[0044] The continuous deviation of the feature distribution from the credible anchor sample is actually quantified by the distribution difference measure continuously exceeding the preset difference threshold. The determination of the sample without causal drift is based on the combination of the distribution difference measure continuously exceeding the difference threshold, the stable proportion of high-credibility samples, and the absence of business change events.

[0045] The anti-poisoning detection module divides candidate poisoning samples into multiple feature clusters. For each feature cluster, it constructs a control model containing that feature cluster and a reference model not containing it. Based on the difference in the outputs of the two models, it determines whether to mark the feature cluster as a real poisoning sample cluster and permanently isolate it from the training data. High-sensitivity security domains represent high-security-level security domain nodes in the security domain reachability graph. For example, high-sensitivity security domains store large-scale personal information, financial data, or confidential business data.

[0046] Methods for dividing into multiple feature clusters include: For each sample in the candidate poisoning sample set, a partitioning feature vector is constructed. This feature vector includes at least one of the following: protocol category identifier, source security domain node identifier, destination security domain node identifier, access path identifier, corresponding time sliding window identifier, and message length distribution features, handshake sequence pattern features, field value distribution features, and arrival time interval distribution features. Then, the partitioning feature vectors are initially grouped according to the protocol category identifier and the source and destination security domain node identifiers. Within each initial group, the distance between each partitioning feature vector is calculated based on a preset feature distance metric. Partitioning feature vectors with a distance less than a preset clustering threshold are grouped into the same feature cluster. One or more feature clusters are defined under each protocol category and source / destination security domain combination. Each feature cluster corresponds to a group of candidate poisoning samples with similar partitioning feature vectors under the same protocol category and access path, used for subsequent adversarial poisoning detection processing based on feature cluster granularity.

[0047] The methods for constructing the control model and the reference model include: For each feature cluster, a reference model and a control model are constructed. During the construction process, the reference model and the control model use the same initial model parameters, the same training process, and the same evaluation sample set. The only difference between the two in terms of training data is whether or not the samples corresponding to the current feature cluster are included.

[0048] Specifically, the training data of the reference model consists of high-confidence samples and medium-confidence samples, with samples from the current feature cluster removed; the control model adds samples from the current feature cluster to the training data of the reference model.

[0049] To facilitate comparative analysis, the outputs of the reference model and the control model are limited to: for each evaluation sample in the same evaluation sample set, outputting the protocol category prediction result of the evaluation sample and the combination of the source security domain and the destination security domain mapped according to the protocol category prediction result; ensuring that the correspondence between the reference model and the control model in the dimensions of input data and output data is clear, so that the subsequent performance change indicators and cross-domain access change indicators based on the evaluation sample set can be directly calculated from the outputs of the two types of models.

[0050] Methods for identifying clusters of samples as actual poisoning cases include: After obtaining the outputs of the reference model and the control model for the same evaluation sample set, each feature cluster is judged based on the preset performance change threshold and cross-domain access change threshold.

[0051] The misclassification rate of the reference model is obtained by calculating the ratio of the number of samples with incorrect predictions to the total number of predictions in the evaluation sample set. The misclassification rate of the control model is obtained by calculating the ratio of the number of samples with incorrect predictions to the total number of predictions. The difference between the misclassification rate of the control model on the evaluation sample set and the misclassification rate of the reference model on the evaluation sample set is used as a performance change indicator.

[0052] Based on the source security domain and destination security domain combination output of the reference model on the evaluation sample set, a reference access combination set is constructed; based on the source security domain and destination security domain combination output of the control model on the evaluation sample set, a control access combination set is constructed. The source security domain and destination security domain combination that only exists in the control access combination set but not in the reference access combination set is defined as a new access combination, and the number of new access combinations is counted.

[0053] From the newly added access combinations, select access combinations whose destination security domain belongs to the pre-marked high-sensitivity security domain, count their number and use it as a cross-domain access change indicator; when the cross-domain access change indicator is greater than the preset cross-domain access change threshold, or when the newly added access combination includes at least one access combination whose destination security domain belongs to the high-sensitivity security domain, it indicates that the security domain access relationship has changed to meet the preset conditions after the introduction of this feature cluster.

[0054] When the performance change index of the control model corresponding to a certain feature cluster exceeds the performance change threshold, it means that the misclassification rate increases to the preset condition after introducing the sample corresponding to the feature cluster into the current protocol's seamless self-learning model. Furthermore, if the cross-domain access change index meets the condition of exceeding the cross-domain access change threshold or the condition of adding a new high-sensitivity security domain access combination, then the feature cluster is marked as a real poisoning sample cluster, and the samples in the real poisoning sample cluster are removed from the training dataset. At the same time, the protocol category identifier, source security domain and destination security domain combination corresponding to the feature cluster are recorded.

[0055] This invention introduces a high-confidence sample set and a candidate poisoning sample set, combined with the monitoring of business change events, enabling the self-learning update mechanism to achieve accurate updates of the protocol fingerprint without introducing malicious traffic. Simultaneously, by combining high-confidence scoring and feature stability detection, this invention can automatically identify and isolate potential poisoning samples, avoiding the problem of erroneous updates in the self-learning model of traditional methods. By dynamically evaluating sample confidence and detecting feature changes, the self-learning update mechanism of this invention not only ensures the accuracy of the protocol fingerprint but also significantly reduces the impact of poisoning attacks on the protocol's imperceptible self-learning model. Example 2

[0056] Please see Figure 2 As shown, this embodiment provides a method for seamless dynamic adaptation of protocols for government and enterprise data channels. Details not described in Embodiment 1 are available. The method includes: Collect network resources and divide the business systems of each department into security domains according to the asset ownership organization, business type and confidentiality level, and abstract them into security domain nodes. Based on the existing network access control rules, the allowed access relationships are abstracted into directed edges to form a security domain reachability graph. Historical business traffic of stable security domain nodes within a preset statistical period is selected from the security domain reachability map, and protocol features are extracted. After processing, trusted anchoring sample features corresponding to each protocol category are formed and stored in the trusted anchoring sample library. Based on the protocol characteristics of each business traffic item collected in real time, a multi-dimensional credibility score is obtained; and based on the credibility score, the corresponding business traffic is divided into high-credibility samples, medium-credibility samples, and candidate poisoning samples. Under the constraints of a high-confidence sample set and business change events, based on the protocol category and access path in the protocol features, the trusted anchor sample in the trusted anchor sample library corresponding to the protocol category and access path is called. A time sliding window is constructed for each protocol feature, and the distribution difference measure value compared with the trusted anchor sample in each time sliding window is calculated. Based on the distribution difference measure value, it is determined whether to mark the corresponding high-confidence sample as a non-causal drift sample and add it to the candidate poisoning sample set. Candidate poisoning samples are divided into multiple feature clusters. For each feature cluster, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed. Based on the difference in the output of the two types of models, it is determined whether the feature cluster is marked as a real poisoning sample cluster and isolated from the training data.

[0057] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for seamless dynamic protocol adaptation of government and enterprise data channels, characterized in that, include: Collect network resources and divide the business systems of each department into security domains according to the asset ownership organization, business type and confidentiality level, and abstract them into security domain nodes. Based on the existing network access control rules, the allowed access relationships are abstracted into directed edges to form a security domain reachability graph. Historical business traffic of stable security domain nodes within a preset statistical period is selected from the security domain reachability map, and protocol features are extracted. After processing, trusted anchoring sample features corresponding to each protocol category are formed and stored in the trusted anchoring sample library. Based on the protocol characteristics of each business traffic item collected in real time, a multi-dimensional credibility score is obtained; and based on the credibility score, the corresponding business traffic is divided into high-credibility samples, medium-credibility samples, and candidate poisoning samples. Under the constraints of a high-confidence sample set and business change events, based on the protocol category and access path in the protocol features, the trusted anchor sample in the trusted anchor sample library corresponding to the protocol category and access path is called. A time sliding window is constructed for each protocol feature, and the distribution difference measure value compared with the trusted anchor sample in each time sliding window is calculated. Based on the distribution difference measure value, it is determined whether to mark the corresponding high-confidence sample as a non-causal drift sample and add it to the candidate poisoning sample set. Candidate poisoning samples are divided into multiple feature clusters. For each feature cluster, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed. Based on the difference in the output of the two types of models, it is determined whether the feature cluster is marked as a real poisoning sample cluster and isolated from the training data.

2. The protocol-seamless dynamic adaptation method for government and enterprise data channels according to claim 1, characterized in that, Read the historical business traffic of the security domain node within a preset time window, extract features of the historical business traffic according to the dimensions of message length sequence, handshake message sequence, field value distribution, and arrival time interval, and perform noise reduction, cluster analysis and statistical modeling on the obtained protocol features to form a trusted anchor sample feature that corresponds one-to-one with each protocol category.

3. The protocol-seamless dynamic adaptation method for government-enterprise data channels according to claim 1, characterized in that, Methods for obtaining credibility scores include: Based on the protocol characteristics of each service traffic, the historical alarm count, certificate validity mark, and access time legality mark of its source security domain are obtained, and a joint evaluation is performed to output a credibility score. Based on the preset high credibility threshold and low credibility threshold, the service traffic corresponding to the credibility score is divided into high credibility samples, medium credibility samples, or candidate poisoning samples.

4. The protocol-seamless dynamic adaptation method for government and enterprise data channels according to claim 1, characterized in that, Methods for calculating distribution difference measures include: After obtaining the protocol feature statistical vector within each time sliding window and the trusted anchor feature vector of the corresponding protocol category in the trusted anchor sample library, normalization processing is performed to represent each feature statistic as a probability vector. The feature statistical vector includes message length distribution features, handshake sequence patterns, field value distribution features, and arrival time interval distribution features. The protocol feature probability vector is matched one by one with the trusted anchor probability vector of the corresponding protocol category in the trusted anchor sample library. The difference in each dimension is calculated, and the distribution difference measure of the protocol feature is obtained by summing the squared differences.

5. The protocol-seamless dynamic adaptation method for government-enterprise data channels according to claim 4, characterized in that, For the message length distribution characteristics, the message length is divided into several preset intervals. The number of messages falling into each interval within the time sliding window is counted and divided by the total number of messages within the time sliding window to obtain the probability vector of the message length distribution of the time sliding window. Similarly, the frequency of each pattern or value interval is counted for the handshake sequence pattern, field value distribution, and arrival time interval distribution, and normalized into a probability vector.

6. The method for seamless dynamic adaptation of protocols for government and enterprise data channels according to claim 1, characterized in that, Methods for labeling causal drift samples include: Within each time sliding window, the proportion of high-confidence samples of the protocol category to the total number of samples of the protocol category is counted to obtain the proportion of high-confidence samples in that time sliding window. The deviation of the proportion of high-confidence samples relative to the previous time sliding window and relative to the preset time average proportion of the protocol category is calculated. When the deviation of the proportion of high-confidence samples in all time sliding windows does not exceed the preset proportion stability threshold, the proportion of high-confidence samples is determined to be stable. The distribution difference metric of each time sliding window is compared with a preset difference threshold. When the distribution difference metric of a certain protocol category is greater than the preset difference threshold in several consecutive time sliding windows, it is determined that the feature distribution of the protocol category continues to deviate from the credible anchor sample in the consecutive time sliding windows. Within the same continuous time sliding window, query the configuration management database and change management system to see if there are any business change work orders related to the protocol category. If no business change event that can explain the continuous deviation of the feature distribution is found, it is determined that there is no explainable business change event. When the deviation of the proportion of high-confidence samples does not exceed the proportion stability threshold, the distribution difference metric is greater than the preset difference threshold in multiple consecutive time sliding windows, and there are no relevant business change event records in the continuous time range, then the high-confidence samples of the corresponding protocol category in the corresponding continuous time sliding window are marked as causal drift-free samples.

7. The protocol-seamless dynamic adaptation method for government and enterprise data channels according to claim 1, characterized in that, Methods for dividing into multiple feature clusters include: For each sample in the candidate poisoning sample set, construct a partitioning feature vector. The partitioning feature vector shall include at least one of the following: protocol category identifier, source security domain node identifier, destination security domain node identifier, access path identifier, corresponding time sliding window identifier, message length distribution feature, handshake sequence pattern feature, field value distribution feature, and arrival time interval distribution feature. The feature vectors are initially grouped according to the protocol category identifier, source security domain node identifier, and destination security domain node identifier. Within each initial group, the distance between each feature vector is calculated based on a preset feature distance metric. Feature vectors with a distance less than a preset clustering threshold are grouped into the same feature cluster. One or more feature clusters are divided under each protocol category and source-destination security domain combination. Each feature cluster corresponds to a group of candidate poisoning samples with similar feature vectors under the same protocol category and access path.

8. The protocol-seamless dynamic adaptation method for government and enterprise data channels according to claim 7, characterized in that, The methods for constructing the control model and the reference model include: The reference model and the control model use the same initial model parameters, the same training process, and the same evaluation sample set. The difference in the training data is whether it includes samples corresponding to the current feature cluster. The training data for the reference model consists of high-confidence and medium-confidence samples, with samples from the current feature cluster removed; the control model adds samples from the current feature cluster to the training data of the reference model. The outputs of the reference model and the control model are as follows: for each evaluation sample in the same evaluation sample set, the output is the protocol category prediction result of the evaluation sample and the combination of the source security domain and the destination security domain mapped according to the protocol category prediction result.

9. The protocol-seamless dynamic adaptation method for government and enterprise data channels according to claim 8, characterized in that, Methods for identifying clusters of samples as actual poisoning cases include: The misclassification rate of the reference model is obtained by calculating the ratio of the number of samples that were incorrectly predicted by the reference model to the total number of predictions in the evaluation sample set. The misclassification rate of the control model is obtained by calculating the ratio of the number of samples that were incorrectly predicted by the control model to the total number of predictions. The difference between the misclassification rate of the control model on the evaluation sample set and the misclassification rate of the reference model on the evaluation sample set is used as a performance change indicator. Based on the source security domain and destination security domain combination output of the reference model on the evaluation sample set, a reference access combination set is constructed; based on the source security domain and destination security domain combination output of the control model on the evaluation sample set, a control access combination set is constructed. The source security domain and destination security domain combination that only exists in the control access combination set but not in the reference access combination set is defined as a new access combination, and the number of new access combinations is counted. From the newly added access combinations, select access combinations whose destination security domain belongs to the pre-marked high-sensitivity security domain, count their number, and use it as an indicator of cross-domain access changes. When the control model corresponding to a certain feature cluster meets the condition that the performance change index exceeds the performance change threshold, and the cross-domain access change index meets the condition that it exceeds the cross-domain access change threshold or there is a new high-sensitivity security domain access combination, then the feature cluster is marked as a real poisoning sample cluster.

10. A protocol-seamless dynamic adaptation system for government and enterprise data channels, characterized in that: The system for implementing the protocol-seamless dynamic adaptation method for government and enterprise data channels according to any one of claims 1-9 includes: The security domain modeling module is used to collect network resources and divide the business systems of each department into security domains according to the asset ownership organization, business type and confidentiality level, and abstract them into security domain nodes. According to the existing network access control rules, the allowed access relationships are abstracted into directed edges to form a security domain reachability graph. The sample construction module is used to select historical business traffic of stable security domain nodes within a preset statistical period in the security domain reachability map, extract protocol features, process them to form trusted anchor sample features corresponding to each protocol category, and store them in the trusted anchor sample library. The evaluation module is used to perform multi-dimensional credibility scoring based on the protocol characteristics of each business traffic item collected in real time, and obtain a credibility score; and to divide the corresponding business traffic into high-credibility samples, medium-credibility samples and candidate poisoning samples according to the credibility score; The stability detection module is used to, under the constraints of a high-confidence sample set and business change events, call the trusted anchor samples corresponding to the protocol category and access path in the trusted anchor sample library according to the protocol category and access path in the protocol features, construct a time sliding window for each protocol feature, calculate the distribution difference measure value compared with the trusted anchor samples in each time sliding window, and determine whether to mark the corresponding high-confidence sample as a non-causal drift sample and add it to the candidate poisoning sample set based on the distribution difference measure value. The anti-poisoning detection module is used to divide candidate poisoning samples into multiple feature clusters. For each feature cluster, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed. Based on the difference between the outputs of the two types of models, it is determined whether to mark the feature cluster as a real poisoning sample cluster and isolate it from the training data.

Images