Protocol non-sensing dynamic adaptation method and system for government-enterprise data channel

Abstract

The application discloses a protocol non-susceptible dynamic adaptation method and system of a government-enterprise data channel, the method comprising: collecting network resources and dividing each department business system into a security domain according to the asset belonging to the institution, the business type and the security level, and abstracting into a security domain node, abstracting the allowed access relationship into a directed edge according to the present network access control rule, and forming a security domain reachability graph; selecting the historical business traffic of the stable security domain node in the preset statistical period in the security domain reachability graph, and extracting the protocol features, forming the trusted anchor sample features corresponding to each protocol category after processing, and storing into a trusted anchor sample library; performing multidimensional trustworthiness scoring according to the real-time collection of the protocol features of each business traffic, and obtaining the trustworthiness score; and the method can more accurately judge whether the traffic has a potential poisoning risk, and timely eliminate the poisoning traffic.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method and system for seamless dynamic adaptation of protocols in government and enterprise data channels. Background Technology

[0002] With the rapid development of information technology, government-enterprise data channels, as key hubs for data exchange between governments and enterprises, face unprecedented challenges in terms of security and the level of intelligence in protocol adaptation. Especially in complex government-enterprise data channel environments with multiple security domains and business tenants, the output of the protocol-agnostic self-learning model directly controls the reachability relationships between different security domains through protocol fingerprints and channel policies. However, attackers can use traffic disguised as normal government access for extended periods to induce the protocol-agnostic self-learning model to maintain a seemingly high recognition accuracy while subtly altering the feature distribution of certain protocol categories. This allows attackers to open a cross-domain access path that should be prohibited at the policy level, seriously threatening the security of the data channel.

[0003] In online protocol self-learning scenarios lacking complete labels, how to combine the inherent security domain topology and business change information of government and enterprise networks to accurately identify and isolate poisoned samples, thereby effectively preventing the protocol's unaware self-learning model from being contaminated by malicious traffic, has become an urgent need to solve existing technical challenges.

[0004] Therefore, a method and system for seamless dynamic adaptation of protocols in government and enterprise data channels are proposed to address the problems existing in current technologies. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for seamless dynamic adaptation of protocols in government and enterprise data channels, so as to solve the shortcomings in the background technology.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] The method for seamless dynamic adaptation of protocols in government and enterprise data channels includes:

[0008] Collect network resources and divide the business systems of each department into security domains according to the asset ownership organization, business type and confidentiality level, and abstract them into security domain nodes. Based on the existing network access control rules, the allowed access relationships are abstracted into directed edges to form a security domain reachability graph.

[0009] Historical business traffic of stable security domain nodes within a preset statistical period is selected from the security domain reachability map, and protocol features are extracted. After processing, trusted anchoring sample features corresponding to each protocol category are formed and stored in the trusted anchoring sample library.

[0010] Based on the protocol characteristics of each business traffic item collected in real time, a multi-dimensional credibility score is obtained; and based on the credibility score, the corresponding business traffic is divided into high-credibility samples, medium-credibility samples, and candidate poisoning samples.

[0011] Under the constraints of a high-confidence sample set and business change events, based on the protocol category and access path in the protocol features, the trusted anchor sample in the trusted anchor sample library corresponding to the protocol category and access path is called. A time sliding window is constructed for each protocol feature, and the distribution difference measure value compared with the trusted anchor sample in each time sliding window is calculated. Based on the distribution difference measure value, it is determined whether to mark the corresponding high-confidence sample as a non-causal drift sample and add it to the candidate poisoning sample set.

[0012] Candidate poisoning samples are divided into multiple feature clusters. For each feature cluster, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed. Based on the difference in the output of the two types of models, it is determined whether the feature cluster is marked as a real poisoning sample cluster and isolated from the training data.

[0013] Furthermore, the historical business traffic of the security domain node within a preset time window is read, and features of the historical business traffic are extracted according to the dimensions of message length sequence, handshake message sequence, field value distribution, and arrival time interval. The obtained protocol features are then subjected to denoising, clustering analysis, and statistical modeling to form trusted anchoring sample features that correspond one-to-one with each protocol category.

[0014] Furthermore, methods for obtaining credibility scores include:

[0015] Based on the protocol characteristics of each service traffic, the historical alarm count, certificate validity mark, and access time legality mark of its source security domain are obtained, and a joint evaluation is performed to output a credibility score. Based on the preset high credibility threshold and low credibility threshold, the service traffic corresponding to the credibility score is divided into high credibility samples, medium credibility samples, or candidate poisoning samples.

[0016] Furthermore, the methods for calculating the distribution difference measure include:

[0017] After obtaining the protocol feature statistical vector within each time sliding window and the trusted anchor feature vector of the corresponding protocol category in the trusted anchor sample library, normalization processing is performed to represent each feature statistic as a probability vector. The feature statistical vector includes message length distribution features, handshake sequence patterns, field value distribution features, and arrival time interval distribution features.

[0018] The protocol feature probability vector is matched one by one with the trusted anchor probability vector of the corresponding protocol category in the trusted anchor sample library. The difference in each dimension is calculated, and the distribution difference measure of the protocol feature is obtained by summing the squared differences.

[0019] Furthermore, for the message length distribution characteristics, the message length is divided into several preset intervals, the number of messages falling into each interval within the time sliding window is counted, and then divided by the total number of messages within the time sliding window to obtain the probability vector of the message length distribution of the time sliding window; similarly, the frequency of each pattern or value interval is counted for the handshake sequence pattern, field value distribution, and arrival time interval distribution, and then normalized into a probability vector.

[0020] Furthermore, methods for labeling causal drift samples include:

[0021] Within each time sliding window, the proportion of high-confidence samples of the protocol category to the total number of samples of the protocol category is counted to obtain the proportion of high-confidence samples in that time sliding window. The deviation of the proportion of high-confidence samples relative to the previous time sliding window and relative to the preset time average proportion of the protocol category is calculated. When the deviation of the proportion of high-confidence samples in all time sliding windows does not exceed the preset proportion stability threshold, the proportion of high-confidence samples is determined to be stable.

[0022] The distribution difference metric of each time sliding window is compared with a preset difference threshold. When the distribution difference metric of a certain protocol category is greater than the preset difference threshold in several consecutive time sliding windows, it is determined that the feature distribution of the protocol category continues to deviate from the credible anchor sample in the consecutive time sliding windows.

[0023] Within the same continuous time sliding window, query the configuration management database and change management system to see if there are any business change work orders related to the protocol category. If no business change event that can explain the continuous deviation of the feature distribution is found, it is determined that there is no explainable business change event.

[0024] When the deviation of the proportion of high-confidence samples does not exceed the proportion stability threshold, the distribution difference metric is greater than the preset difference threshold in multiple consecutive time sliding windows, and there are no relevant business change event records in the continuous time range, then the high-confidence samples of the corresponding protocol category in the corresponding continuous time sliding window are marked as causal drift-free samples.

[0025] Furthermore, methods for dividing into multiple feature clusters include:

[0026] For each sample in the candidate poisoning sample set, construct a partitioning feature vector. The partitioning feature vector shall include at least one of the following: protocol category identifier, source security domain node identifier, destination security domain node identifier, access path identifier, corresponding time sliding window identifier, message length distribution feature, handshake sequence pattern feature, field value distribution feature, and arrival time interval distribution feature.

[0027] The feature vectors are initially grouped according to the protocol category identifier, source security domain node identifier, and destination security domain node identifier. Within each initial group, the distance between each feature vector is calculated based on a preset feature distance metric. Feature vectors with a distance less than a preset clustering threshold are grouped into the same feature cluster. One or more feature clusters are divided under each protocol category and source-destination security domain combination. Each feature cluster corresponds to a group of candidate poisoning samples with similar feature vectors under the same protocol category and access path.

[0028] Furthermore, the method for constructing the control model and the reference model includes:

[0029] The reference model and the control model use the same initial model parameters, the same training process, and the same evaluation sample set. The difference in the training data is whether it includes samples corresponding to the current feature cluster.

[0030] The training data for the reference model consists of high-confidence and medium-confidence samples, with samples from the current feature cluster removed; the control model adds samples from the current feature cluster to the training data of the reference model.

[0031] The outputs of the reference model and the control model are as follows: for each evaluation sample in the same evaluation sample set, the output is the protocol category prediction result of the evaluation sample and the combination of the source security domain and the destination security domain mapped according to the protocol category prediction result.

[0032] Furthermore, methods for identifying clusters of samples as actual poisoning cases include:

[0033] The misclassification rate of the reference model is obtained by calculating the ratio of the number of samples that were incorrectly predicted by the reference model to the total number of predictions in the evaluation sample set. The misclassification rate of the control model is obtained by calculating the ratio of the number of samples that were incorrectly predicted by the control model to the total number of predictions. The difference between the misclassification rate of the control model on the evaluation sample set and the misclassification rate of the reference model on the evaluation sample set is used as a performance change indicator.

[0034] Based on the source security domain and destination security domain combination output of the reference model on the evaluation sample set, a reference access combination set is constructed; based on the source security domain and destination security domain combination output of the control model on the evaluation sample set, a control access combination set is constructed. The source security domain and destination security domain combination that only exists in the control access combination set but not in the reference access combination set is defined as a new access combination, and the number of new access combinations is counted.

[0035] From the newly added access combinations, select access combinations whose destination security domain belongs to the pre-marked high-sensitivity security domain, count their number, and use it as an indicator of cross-domain access changes.

[0036] When the control model corresponding to a certain feature cluster meets the condition that the performance change index exceeds the performance change threshold, and the cross-domain access change index meets the condition that it exceeds the cross-domain access change threshold or there is a new high-sensitivity security domain access combination, then the feature cluster is marked as a real poisoning sample cluster.

[0037] A protocol-seamless dynamic adaptation system for government and enterprise data channels is used to implement the aforementioned protocol-seamless dynamic adaptation method for government and enterprise data channels. The system includes:

[0038] The security domain modeling module is used to collect network resources and divide the business systems of each department into security domains according to the asset ownership organization, business type and confidentiality level, and abstract them into security domain nodes. According to the existing network access control rules, the allowed access relationships are abstracted into directed edges to form a security domain reachability graph.

[0039] The sample construction module is used to select historical business traffic of stable security domain nodes within a preset statistical period in the security domain reachability map, extract protocol features, process them to form trusted anchor sample features corresponding to each protocol category, and store them in the trusted anchor sample library.

[0040] The evaluation module is used to perform multi-dimensional credibility scoring based on the protocol characteristics of each business traffic item collected in real time, and obtain a credibility score; and to divide the corresponding business traffic into high-credibility samples, medium-credibility samples and candidate poisoning samples according to the credibility score;

[0041] The stability detection module is used to, under the constraints of a high-confidence sample set and business change events, call the trusted anchor samples corresponding to the protocol category and access path in the trusted anchor sample library according to the protocol category and access path in the protocol features, construct a time sliding window for each protocol feature, calculate the distribution difference measure value compared with the trusted anchor samples in each time sliding window, and determine whether to mark the corresponding high-confidence sample as a non-causal drift sample and add it to the candidate poisoning sample set based on the distribution difference measure value.

[0042] The anti-poisoning detection module is used to divide candidate poisoning samples into multiple feature clusters. For each feature cluster, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed. Based on the difference between the outputs of the two types of models, it is determined whether to mark the feature cluster as a real poisoning sample cluster and isolate it from the training data.

[0043] The technical effects and advantages of the method and system for seamless dynamic adaptation of government and enterprise data channels provided by this invention are as follows:

[0044] This invention introduces a security domain reachability graph and a trusted anchoring sample library to ensure that protocol fingerprinting and policy updates are based not only on traffic characteristics but also on network topology and historical service traffic. Traditional methods often rely solely on static rules or simple training samples, which cannot effectively adapt to rapid changes in the network environment and are prone to misjudgment. This invention, however, can assess the credibility of traffic in real time, fundamentally avoiding the problem of attackers using disguised traffic to induce the model to favor attack traffic characteristics. This enables the protocol-unobtrusive self-learning model to maintain high adaptability and security in the face of dynamically changing network environments, significantly improving the intelligence level of self-learning updates.

[0045] By combining time-sliding windows, distribution difference metrics, and correlation analysis of business change events, the differences between poisoned traffic and normal business traffic can be accurately identified. Existing solutions typically only perform poisoning detection during the model training phase, failing to fully consider the credibility of the traffic source and potential business changes. By introducing multi-dimensional data evaluation, this invention can more accurately determine whether traffic has potential poisoning risks and promptly remove poisoned traffic, ensuring that protocol fingerprints and policy updates are not interfered with by malicious traffic. This not only improves the accuracy of traffic analysis but also enhances the ability of protective measures to identify and isolate potential poisoned traffic, thereby effectively improving the stability and security of the protocol's seamless self-learning model.

[0046] In traditional methods, protocol-insensitive self-learning models often fail to adequately consider the security risks of cross-domain access. This invention introduces a security domain reachability graph and combines it with an adversarial reachability simulation module to dynamically evaluate the costs of new reachable paths and attack paths. This effectively detects and prevents malicious traffic from accessing sensitive data through cross-domain paths, thereby avoiding the security risks caused by the lack of timely control over cross-domain access in existing methods. Furthermore, it enhances the protocol-insensitive self-learning model's ability to manage cross-domain access and significantly reduces the risks posed by cross-domain security vulnerabilities. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0048] Figure 1 This is a schematic diagram of the protocol-seamless dynamic adaptation system for government and enterprise data channels according to the present invention.

[0049] Figure 2 This is a flowchart of the protocol-seamless dynamic adaptation method for government and enterprise data channels according to the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] It should be noted that when a component is said to be "fixed to" another component, it can be directly attached to the other component or there may be an intervening component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there may be an intervening component. Example 1

[0052] like Figure 1 As shown, the protocol-seamless dynamic adaptation system for the government and enterprise data channel in this embodiment includes a security domain modeling module, a sample construction module, an evaluation module, a stability detection module, and an anti-poisoning detection module. The modules are connected by wired and / or wireless means.

[0053] First, a security domain reachability graph and a trusted anchoring sample library are constructed for the government and enterprise network. This involves mapping each department and business system to multiple security domain nodes based on the existing network topology, access control policies, and asset classification information, and mapping the actual allowed access relationships to edges. At the same time, protocol features are extracted from long-term stable business traffic located only in the government intranet and government cloud private network to form a trusted anchoring sample library as a benchmark. All subsequent self-learning results are referenced to this graph and sample library. For example, the finance department intranet, tax intranet, and enterprise extranet are each built into security domain nodes, and only the edge that allows the finance department intranet to access the tax intranet is considered a legitimate path.

[0054] In this step, preferably, the security domain modeling module collects and abstracts the existing network resources of the government and enterprise network. Specifically, it first obtains the network topology, access control rules, and asset identification information from routing devices, switching devices, border security gateways, and access control devices. The asset identification information includes the asset's ownership organization, business type, and confidentiality level. Based on the asset's ownership organization, business type, and confidentiality level, the business systems of each department are divided into several security domains, and each security domain is abstracted as a security domain node in the security domain reachability graph. Subsequently, based on the existing access control rules and the approved business access policies, the allowed access relationships are abstracted as directed edges from the source security domain node to the target security domain node, and the business type, access direction, protocol category, and risk level are marked on each edge to form the security domain reachability graph.

[0055] The sample construction module is used to select historical business traffic of stable security domain nodes within a preset statistical period in the security domain reachability map, extract protocol features, process them to form trusted anchor sample features corresponding to each protocol category, and store them in the trusted anchor sample library.

[0056] Specifically, the historical business traffic of the security domain node within a preset time window is read, and features of the historical business traffic are extracted according to feature dimensions such as message length sequence, handshake message sequence, field value distribution, and arrival time interval. The obtained protocol features are then subjected to denoising, clustering analysis, and statistical modeling to form trusted anchor sample features that correspond one-to-one with each protocol category. These features are then stored in a trusted anchor sample library for feature alignment and offset evaluation of online collected protocol features during subsequent self-learning processes.

[0057] Based on the security domain reachability map and the trusted anchoring sample library, the evaluation module performs multi-dimensional trustworthiness scoring on the protocol characteristics of each service traffic collected in real time to obtain a trustworthiness score; and according to the trustworthiness score, the corresponding traffic is divided into high-trustworthiness samples, medium-trustworthiness samples and candidate poisoning samples.

[0058] Methods for obtaining credibility scores include:

[0059] Based on the protocol characteristics of each business traffic, the historical alarm count, certificate validity flag, and access time legitimacy flag of its source security domain are obtained, and a joint evaluation is performed to output a credibility score.

[0060] Specifically, based on the source network address and port information in the protocol feature record, the corresponding source security domain node is located in the security domain reachability graph. The historical alarm count of the source security domain within a preset time window is obtained from the security audit system. Based on the certificate chain information carried by the protocol feature record, the certificate management system is queried to obtain the certificate validity mark. Based on the access time policy configured in the business policy library, it is determined whether the access falls within the predefined business time window to obtain the access time legality mark.

[0061] The historical alarm count, certificate validity flag, and access time legitimacy flag are input together into a pre-defined scoring function. A trust score between zero and one is obtained through weighted summation and normalization. An example of the scoring function is shown below:

[0062]

[0063] In the formula, To score credibility, This refers to the number of historical alerts. For certificate validity marking, To mark the validity of the access time, , , , are preset weights.

[0064]

[0065] A value of 1 indicates the certificate is valid; a value of 0 indicates the certificate is neither valid nor invalid. When the value is 1, the access falls within the predefined business time window; when the value is a, the access falls outside the predefined business time window. a is a preset reduction constant less than one.

[0066] Subsequently, the evaluation module divides the credibility score into high-credibility samples, medium-credibility samples, or candidate poisoning samples according to the preset high-credibility threshold and low-credibility threshold.

[0067] If the credibility score exceeds the high credibility threshold, the corresponding business traffic will be classified as a high credibility sample; if it is below the low credibility threshold, the corresponding business traffic will be classified as a candidate poisoning sample; and if the business traffic is between the high credibility threshold and the low credibility threshold, the corresponding business traffic will be classified as a medium credibility sample.

[0068] Among them, high-confidence samples are marked as reliable training samples and sent to the current protocol self-learning model for training, medium-confidence samples participate in training with corresponding weights, and candidate poisoning samples are collected to form a candidate poisoning sample set and sent to the adversarial poisoning detection module for subsequent in-depth analysis.

[0069] For example, if a traffic originating from the tax intranet has no high-level security alerts in its source security domain within the past month, its certificate is valid and updated at a normal frequency, the access time falls within a pre-configured weekday daytime period, and the packet length distribution and handshake sequence pattern of the traffic are highly similar to the anchoring characteristics of the path from the tax intranet to the finance intranet, the credibility score output by the scoring function is close to one, and the traffic is classified as a high-credibility sample and directly enters the subsequent self-learning training set.

[0070] The stability detection module, under the constraints of a high-confidence sample set and business change events (i.e., whether there are change orders related to the protocol category within a recent predetermined time), calls the trusted anchor samples corresponding to the protocol category and access path in the trusted anchor sample library according to the protocol category and access path in the protocol feature record. For each protocol feature, a time sliding window is constructed, and the distribution difference measure value compared with the trusted anchor samples in each time sliding window is calculated. If the proportion of high-confidence samples is basically stable, but the feature distribution continues to deviate from the trusted anchor samples, and there are no explanatory business change events within a preset time, then the high-confidence samples of the corresponding protocol category are marked as non-causal drift samples and added to the candidate poisoning sample set.

[0071] Methods for calculating distribution difference measures include:

[0072] After obtaining the protocol feature statistical vector within each time sliding window and the trusted anchor feature vector of the corresponding protocol category in the trusted anchor sample library, normalization processing is performed to represent each feature statistic as a probability vector. The feature statistical vector includes message length distribution features, handshake sequence patterns, field value distribution features, and arrival time interval distribution features.

[0073] For the message length distribution characteristics, the message length is divided into several preset intervals. The number of messages falling into each interval within the time sliding window is counted and divided by the total number of messages within the time sliding window to obtain the probability vector of the message length distribution of the time sliding window. Similarly, the frequency of each pattern or value interval is counted for the handshake sequence pattern, field value distribution, and arrival time interval distribution, and normalized into a probability vector.

[0074] The protocol feature probability vector is matched one by one with the trusted anchor probability vector of the corresponding protocol category in the trusted anchor sample library. The difference in each dimension is calculated, and the distribution difference measure of the protocol feature is obtained by summing the squared differences. That is, the sum of the squares of the differences in all intervals is calculated for each feature dimension, and then the different feature dimensions are weighted and summed according to the preset weights to obtain the overall distribution difference measure of the time sliding window relative to the anchor sample.

[0075] Business change events include the launch of new features and adjustments to access policies; each business change event is mapped to a corresponding time interval and the security domain node involved.

[0076] Methods for labeling causal drift samples include:

[0077] First, within each time sliding window, the proportion of high-confidence samples of the protocol category to the total number of samples of the protocol category is counted to obtain the proportion of high-confidence samples in that time sliding window. Then, the deviation of the proportion of high-confidence samples relative to the previous time sliding window and the average proportion of the protocol category over a preset time (e.g., 2 to 7 days) is calculated. When the deviation of the proportion of high-confidence samples in all time sliding windows does not exceed the preset stable proportion threshold, the proportion of high-confidence samples is determined to be stable.

[0078] The distribution difference metric of each time sliding window is compared with a preset difference threshold. When the distribution difference metric of a certain protocol category is greater than the preset difference threshold in several consecutive time sliding windows, it is determined that the feature distribution of the protocol category continues to deviate from the credible anchor sample in the consecutive time sliding windows.

[0079] Within the same continuous time sliding window, query the configuration management database and change management system to see if there are any business change work orders related to the protocol category. If no business change event that can explain the continuous deviation of the feature distribution is found, it is determined that there is no explanatory business change event.

[0080] If all three conditions are met simultaneously, namely, the deviation of the proportion of high-confidence samples does not exceed the stability threshold of the proportion, the distribution difference metric is greater than the preset difference threshold in multiple consecutive time sliding windows, and there are no relevant business change event records in the continuous time range, then the high-confidence samples of the corresponding protocol category in the corresponding continuous time sliding window are marked as causal drift-free samples, and the causal drift-free samples are removed from the high-confidence sample set and transferred to the candidate poisoning sample set for subsequent analysis by the anti-poisoning detection module.

[0081] The continuous deviation of the feature distribution from the credible anchor sample is actually quantified by the distribution difference measure continuously exceeding the preset difference threshold. The determination of the sample without causal drift is based on the combination of the distribution difference measure continuously exceeding the difference threshold, the stable proportion of high-credibility samples, and the absence of business change events.

[0082] The anti-poisoning detection module divides candidate poisoning samples into multiple feature clusters. For each feature cluster, it constructs a control model containing that feature cluster and a reference model not containing it. Based on the difference in the outputs of the two models, it determines whether to mark the feature cluster as a real poisoning sample cluster and permanently isolate it from the training data. High-sensitivity security domains represent high-security-level security domain nodes in the security domain reachability graph. For example, high-sensitivity security domains store large-scale personal information, financial data, or confidential business data.

[0083] Methods for dividing into multiple feature clusters include:

[0084] For each sample in the candidate poisoning sample set, a partitioning feature vector is constructed. This feature vector includes at least one of the following: protocol category identifier, source security domain node identifier, destination security domain node identifier, access path identifier, corresponding time sliding window identifier, and message length distribution features, handshake sequence pattern features, field value distribution features, and arrival time interval distribution features. Then, the partitioning feature vectors are initially grouped according to the protocol category identifier and the source and destination security domain node identifiers. Within each initial group, the distance between each partitioning feature vector is calculated based on a preset feature distance metric. Partitioning feature vectors with a distance less than a preset clustering threshold are grouped into the same feature cluster. One or more feature clusters are defined under each protocol category and source / destination security domain combination. Each feature cluster corresponds to a group of candidate poisoning samples with similar partitioning feature vectors under the same protocol category and access path, used for subsequent adversarial poisoning detection processing based on feature cluster granularity.

[0085] The methods for constructing the control model and the reference model include:

[0086] For each feature cluster, a reference model and a control model are constructed. During the construction process, the reference model and the control model use the same initial model parameters, the same training process, and the same evaluation sample set. The only difference between the two in terms of training data is whether or not the samples corresponding to the current feature cluster are included.

[0087] Specifically, the training data of the reference model consists of high-confidence samples and medium-confidence samples, with samples from the current feature cluster removed; the control model adds samples from the current feature cluster to the training data of the reference model.

[0088] To facilitate comparative analysis, the outputs of the reference model and the control model are limited to: for each evaluation sample in the same evaluation sample set, outputting the protocol category prediction result of the evaluation sample and the combination of the source security domain and the destination security domain mapped according to the protocol category prediction result; ensuring that the correspondence between the reference model and the control model in the dimensions of input data and output data is clear, so that the subsequent performance change indicators and cross-domain access change indicators based on the evaluation sample set can be directly calculated from the outputs of the two types of models.

[0089] Methods for identifying clusters of samples as actual poisoning cases include:

[0090] After obtaining the outputs of the reference model and the control model for the same evaluation sample set, each feature cluster is judged based on the preset performance change threshold and cross-domain access change threshold.

[0091] The misclassification rate of the reference model is obtained by calculating the ratio of the number of samples with incorrect predictions to the total number of predictions in the evaluation sample set. The misclassification rate of the control model is obtained by calculating the ratio of the number of samples with incorrect predictions to the total number of predictions. The difference between the misclassification rate of the control model on the evaluation sample set and the misclassification rate of the reference model on the evaluation sample set is used as a performance change indicator.

[0092] Based on the source security domain and destination security domain combination output of the reference model on the evaluation sample set, a reference access combination set is constructed; based on the source security domain and destination security domain combination output of the control model on the evaluation sample set, a control access combination set is constructed. The source security domain and destination security domain combination that only exists in the control access combination set but not in the reference access combination set is defined as a new access combination, and the number of new access combinations is counted.

[0093] From the newly added access combinations, select access combinations whose destination security domain belongs to the pre-marked high-sensitivity security domain, count their number and use it as a cross-domain access change indicator; when the cross-domain access change indicator is greater than the preset cross-domain access change threshold, or when the newly added access combination includes at least one access combination whose destination security domain belongs to the high-sensitivity security domain, it indicates that the security domain access relationship has changed to meet the preset conditions after the introduction of this feature cluster.

[0094] When the performance change index of the control model corresponding to a certain feature cluster exceeds the performance change threshold, it means that the misclassification rate increases to the preset condition after introducing the sample corresponding to the feature cluster into the current protocol's seamless self-learning model.

[0095] Furthermore, if the cross-domain access change index meets the condition of exceeding the cross-domain access change threshold or the condition of adding a new high-sensitivity security domain access combination, then the feature cluster is marked as a real poisoning sample cluster, and the samples in the real poisoning sample cluster are removed from the training dataset. At the same time, the protocol category identifier, source security domain and destination security domain combination corresponding to the feature cluster are recorded.

[0096] This invention introduces a high-confidence sample set and a candidate poisoning sample set, combined with the monitoring of business change events, enabling the self-learning update mechanism to achieve accurate updates of the protocol fingerprint without introducing malicious traffic. Simultaneously, by combining high-confidence scoring and feature stability detection, this invention can automatically identify and isolate potential poisoning samples, avoiding the problem of erroneous updates in the self-learning model of traditional methods. By dynamically evaluating sample confidence and detecting feature changes, the self-learning update mechanism of this invention not only ensures the accuracy of the protocol fingerprint but also significantly reduces the impact of poisoning attacks on the protocol's imperceptible self-learning model. Example 2

[0097] Please see Figure 2 As shown, this embodiment provides a method for seamless dynamic adaptation of protocols for government and enterprise data channels. Details not described in Embodiment 1 are available. The method includes:

[0098] Collect network resources and divide the business systems of each department into security domains according to the asset ownership organization, business type and confidentiality level, and abstract them into security domain nodes. Based on the existing network access control rules, the allowed access relationships are abstracted into directed edges to form a security domain reachability graph.

[0099] Historical business traffic of stable security domain nodes within a preset statistical period is selected from the security domain reachability map, and protocol features are extracted. After processing, trusted anchoring sample features corresponding to each protocol category are formed and stored in the trusted anchoring sample library.

[0100] Based on the protocol characteristics of each business traffic item collected in real time, a multi-dimensional credibility score is obtained; and based on the credibility score, the corresponding business traffic is divided into high-credibility samples, medium-credibility samples, and candidate poisoning samples.

[0101] Under the constraints of a high-confidence sample set and business change events, based on the protocol category and access path in the protocol features, the trusted anchor sample in the trusted anchor sample library corresponding to the protocol category and access path is called. A time sliding window is constructed for each protocol feature, and the distribution difference measure value compared with the trusted anchor sample in each time sliding window is calculated. Based on the distribution difference measure value, it is determined whether to mark the corresponding high-confidence sample as a non-causal drift sample and add it to the candidate poisoning sample set.

[0102] Candidate poisoning samples are divided into multiple feature clusters. For each feature cluster, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed. Based on the difference in the output of the two types of models, it is determined whether the feature cluster is marked as a real poisoning sample cluster and isolated from the training data.

[0103] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A protocol non-sensing dynamic adaptation method for a government-enterprise data channel, characterized in that, include: Collect network resources and divide the business systems of each department into security domains according to the asset ownership organization, business type and confidentiality level, and abstract them into security domain nodes. Based on network access control rules, the allowed access relationships are abstracted into directed edges to form a security domain reachability graph. Historical business traffic of stable security domain nodes within a preset statistical period is selected from the security domain reachability map, and protocol features are extracted. After processing, trusted anchoring sample features corresponding to each protocol category are formed and stored in the trusted anchoring sample library. A credibility score is obtained by performing multi-dimensional credibility scoring based on the protocol characteristics of each business traffic item collected in real time. Based on the credibility score, the corresponding business traffic is divided into high-credibility samples, medium-credibility samples, and candidate poisoning samples; Under the constraints of a high-confidence sample set and business change events, based on the protocol category and access path in the protocol features, the trusted anchor sample in the trusted anchor sample library corresponding to the protocol category and access path is called. A time sliding window is constructed for each protocol feature, and the distribution difference measure value compared with the trusted anchor sample in each time sliding window is calculated. Based on the distribution difference measure value, it is determined whether to mark the corresponding high-confidence sample as a non-causal drift sample and add it to the candidate poisoning sample set. Methods for calculating distribution difference measures include: After obtaining the protocol feature statistical vector within each time sliding window and the trusted anchor feature vector of the corresponding protocol category in the trusted anchor sample library, normalization processing is performed to represent each feature statistic as a probability vector. The feature statistical vector includes message length distribution features, handshake sequence pattern features, field value distribution features, and arrival time interval distribution features. The protocol feature probability vector is matched one by one with the trusted anchor probability vector of the corresponding protocol category in the trusted anchor sample library. The difference in each dimension is calculated, and the distribution difference measure of the protocol feature is obtained by summing the squared differences. Candidate poisoning samples are divided into multiple feature clusters. For each feature cluster, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed. Based on the difference in the output of the two types of models, it is determined whether the feature cluster is marked as a real poisoning sample cluster and isolated from the training data.

2. The protocol non-perception dynamic adaptation method of the government-enterprise data channel according to claim 1, characterized in that, Read the historical business traffic of the security domain node within a preset time window, extract features of the historical business traffic according to the dimensions of message length sequence, handshake message sequence, field value distribution, and arrival time interval, and perform noise reduction, cluster analysis and statistical modeling on the obtained protocol features to form a trusted anchor sample feature that corresponds one-to-one with each protocol category.

3. The protocol non-perception dynamic adaptation method of the government-enterprise data channel according to claim 1, characterized in that, Methods for obtaining credibility scores include: Based on the protocol characteristics of each service traffic, the historical alarm count, certificate validity mark, and access time legality mark of its source security domain are obtained, and a joint evaluation is performed to output a credibility score. Based on the preset high credibility threshold and low credibility threshold, the service traffic corresponding to the credibility score is divided into high credibility samples, medium credibility samples, or candidate poisoning samples.

4. The protocol non-perception dynamic adaptation method of the government-enterprise data channel according to claim 1, characterized in that, For the message length distribution characteristics, the message length is divided into several preset intervals. The number of messages falling into each interval within the time sliding window is counted and divided by the total number of messages within the time sliding window to obtain the probability vector of the message length distribution of the time sliding window. Similarly, the handshake sequence pattern characteristics, field value distribution characteristics, and arrival time interval distribution characteristics are counted for the frequency of each pattern or value interval and normalized into a probability vector.

5. The protocol non-perception dynamic adaptation method of the government-enterprise data channel according to claim 1, characterized in that, Methods for labeling causal drift samples include: Within each time sliding window, the proportion of high-confidence samples of the protocol category to the total number of samples of the protocol category is counted to obtain the proportion of high-confidence samples in that time sliding window. The deviation of the proportion of high-confidence samples relative to the previous time sliding window and relative to the preset time average proportion of the protocol category is calculated. When the deviation of the proportion of high-confidence samples in all time sliding windows does not exceed the preset proportion stability threshold, the proportion of high-confidence samples is determined to be stable. The distribution difference metric of each time sliding window is compared with a preset difference threshold. When the distribution difference metric of a certain protocol category is greater than the preset difference threshold in several consecutive time sliding windows, it is determined that the feature distribution of the protocol category continues to deviate from the credible anchor sample in the several consecutive time sliding windows. Within the same consecutive sliding time window, query the configuration management database and change management system to see if there are any business change work orders related to the protocol category. If no business change event that can explain the continuous deviation of the feature distribution is found, it is determined that there is no explainable business change event. When the deviation of the proportion of high-confidence samples does not exceed the proportion stability threshold, the distribution difference metric is greater than the preset difference threshold in several consecutive time sliding windows, and there are no relevant business change event records in the several consecutive time sliding windows, then the high-confidence samples of the corresponding protocol category in the several consecutive time sliding windows are marked as causal drift-free samples.

6. The protocol non-perception dynamic adaptation method of the government-enterprise data channel according to claim 1, characterized in that, Methods for dividing into multiple feature clusters include: For each sample in the candidate poisoning sample set, construct a partitioning feature vector. The partitioning feature vector shall include at least one of the following: protocol category identifier, source security domain node identifier, destination security domain node identifier, access path identifier, corresponding time sliding window identifier, message length distribution feature, handshake sequence pattern feature, field value distribution feature, and arrival time interval distribution feature. The feature vectors are initially grouped according to the protocol category identifier, source security domain node identifier, and destination security domain node identifier. Within each initial group, the distance between each feature vector is calculated based on a preset feature distance metric. Feature vectors with a distance less than a preset clustering threshold are grouped into the same feature cluster. One or more feature clusters are divided under each protocol category and source-destination security domain combination. Each feature cluster corresponds to a group of candidate poisoning samples with similar feature vectors under the same protocol category and access path.

7. The protocol non-perception dynamic adaptation method of the government-enterprise data channel according to claim 6, characterized in that, The methods for constructing the control model and the reference model include: The reference model and the control model use the same initial model parameters, the same training process, and the same evaluation sample set. The difference in the training data is whether it includes samples corresponding to the current feature cluster. The training data for the reference model consists of high-confidence and medium-confidence samples, with samples from the current feature cluster removed; the control model adds samples from the current feature cluster to the training data of the reference model. The outputs of the reference model and the control model are as follows: for each evaluation sample in the same evaluation sample set, the output is the protocol category prediction result of the evaluation sample and the combination of the source security domain and the destination security domain mapped according to the protocol category prediction result.

8. The protocol-seamless dynamic adaptation method for government and enterprise data channels according to claim 7, characterized in that, Methods for identifying clusters of samples as actual poisoning cases include: The misclassification rate of the reference model is obtained by calculating the ratio of the number of samples that were incorrectly predicted by the reference model to the total number of predictions in the evaluation sample set. The misclassification rate of the control model is obtained by calculating the ratio of the number of samples that were incorrectly predicted by the control model to the total number of predictions. The difference between the misclassification rate of the control model on the evaluation sample set and the misclassification rate of the reference model on the evaluation sample set is used as a performance change indicator. Based on the source security domain and destination security domain combination output of the reference model on the evaluation sample set, a reference access combination set is constructed; based on the source security domain and destination security domain combination output of the control model on the evaluation sample set, a control access combination set is constructed. The source security domain and destination security domain combination that only exists in the control access combination set but not in the reference access combination set is defined as a new access combination, and the number of new access combinations is counted. From the newly added access combinations, select access combinations whose destination security domain belongs to the pre-marked high-sensitivity security domain, count their number, and use it as an indicator of cross-domain access changes. When the control model corresponding to a certain feature cluster meets the condition that the performance change index exceeds the performance change threshold, and the cross-domain access change index meets the condition that it exceeds the cross-domain access change threshold or there is a new high-sensitivity security domain access combination, then the feature cluster is marked as a real poisoning sample cluster.

9. A protocol-seamless dynamic adaptation system for government and enterprise data channels, characterized in that: The system for implementing the protocol-seamless dynamic adaptation method for government and enterprise data channels according to any one of claims 1-8 includes: The security domain modeling module is used to collect network resources and divide the business systems of each department into security domains according to the asset ownership organization, business type and confidentiality level, and abstract them into security domain nodes. According to network access control rules, the allowed access relationships are abstracted into directed edges to form a security domain reachability graph. The sample construction module is used to select historical business traffic of stable security domain nodes within a preset statistical period in the security domain reachability map, extract protocol features, process them to form trusted anchor sample features corresponding to each protocol category, and store them in the trusted anchor sample library. The evaluation module is used to perform multi-dimensional credibility scoring based on the protocol characteristics of each business traffic piece collected in real time, and obtain a credibility score; and to divide the corresponding business traffic into high credibility samples, medium credibility samples and candidate poisoning samples according to the credibility score. The stability detection module, under the constraints of a high-confidence sample set and business change events, calls trusted anchor samples corresponding to the protocol category and access path from the trusted anchor sample library based on the protocol category and access path in the protocol features. For each protocol feature, a time sliding window is constructed, and the distribution difference metric compared to the trusted anchor samples within each time sliding window is calculated. Based on the distribution difference metric, it determines whether to mark the corresponding high-confidence sample as a causal drift-free sample and add it to the candidate poisoning sample set. The calculation method for the distribution difference metric includes: After obtaining the protocol feature statistical vector within each time sliding window and the trusted anchor feature vector of the corresponding protocol category in the trusted anchor sample library, normalization processing is performed to represent each feature statistic as a probability vector. The feature statistical vector includes message length distribution features, handshake sequence pattern features, field value distribution features, and arrival time interval distribution features. The protocol feature probability vector is matched one by one with the trusted anchor probability vector of the corresponding protocol category in the trusted anchor sample library. The difference in each dimension is calculated, and the distribution difference measure of the protocol feature is obtained by summing the squared differences. The anti-poisoning detection module is used to divide candidate poisoning samples into multiple feature clusters. For each feature cluster, a control model containing the feature cluster and a reference model not containing the feature cluster are constructed. Based on the difference between the outputs of the two types of models, it is determined whether to mark the feature cluster as a real poisoning sample cluster and isolate it from the training data.

Images