A security protection method and system for communication networks

Abstract

This invention discloses a security protection method and system for communication networks, relating to the field of network security technology. The method includes: identifying encrypted and unencrypted data streams in the transmitted data stream of the communication network for potential vulnerability analysis; identifying potential intrusion attempt information based on terminal device activity records, and conducting a security risk assessment of the communication network in conjunction with target potential vulnerability information; determining an initial defense strategy based on the security risk assessment results, and generating a strategy intent summary based on the initial defense strategy for analyzing the device-side policy carrying capacity; optimizing the initial defense strategy based on the device-side policy carrying capacity information; monitoring the real-time execution effect information of the target defense strategy when protecting the communication network, and adjusting the target defense strategy based on the real-time execution effect information. This invention can effectively cope with the dynamic and complex nature of network attacks, improving the overall security protection capability and response efficiency of the communication network.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a security protection method and system for communication networks. Background Technology

[0002] As network architecture becomes increasingly complex, the volume of business and data it carries is also experiencing explosive growth. Simultaneously, security threats in cyberspace are becoming more diverse, covert, and sophisticated. Traditional network security protection systems are typically based on static rules or known signature databases. These components often lack effective collaboration and information sharing, resembling isolated islands operating independently. This siloed defense model struggles to achieve a real-time and accurate understanding of the overall network security situation when facing dynamically changing and multi-stage modern cyberattacks, resulting in delayed protective actions, rigid strategies, and an inability to adapt to the rapidly evolving threat environment.

[0003] Meanwhile, the security operation and maintenance of current communication networks generally faces several core challenges. First, key security elements such as network traffic data and terminal behavior logs are scattered across different systems, lacking unified correlation analysis. This makes it difficult for security analysts to accurately identify genuine attack clues from massive amounts of alert information. Furthermore, existing security status assessments often focus on only a single dimension, such as vulnerabilities or intrusion behavior, failing to correlate attacker behavior with the network's inherent vulnerabilities over time, thus hindering an accurate assessment of the true risk level facing the network. Simultaneously, the formulation and adjustment of current security policies heavily rely on administrators' manual judgment and intervention, resulting in slow response times and difficulty in automatically generating and executing optimal defense strategies based on real-time security assessments. This leads to either overly lenient protective measures, leaving hidden vulnerabilities, or overly stringent measures, impacting normal business communications. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art. This invention provides a security protection method and system for communication networks, which can effectively cope with the dynamic and complex nature of network attacks and improve the overall security protection capability and response efficiency of communication networks.

[0005] To address the aforementioned technical problems, this invention provides a security protection method for communication networks, the method comprising:

[0006] The system acquires transmission data streams and terminal device activity records in the communication network, identifies encrypted and unencrypted data streams in the transmission data streams, and performs potential vulnerability analysis based on the encrypted and unencrypted data streams to obtain target potential vulnerability information.

[0007] Based on the activity records of the terminal device, potential intrusion attempt information is identified, and based on the target potential vulnerability information and potential intrusion attempt information, a security risk assessment of the communication network is performed to obtain the security risk assessment result.

[0008] An initial defense strategy is determined based on the security risk assessment results. A strategy intent summary is generated based on the initial defense strategy. The device-side strategy carrying capacity is analyzed based on the strategy intent summary to obtain device-side strategy carrying capacity information.

[0009] The initial defense strategy is optimized based on the device-side policy carrying capacity information to obtain the target defense strategy;

[0010] The target defense strategy is used to protect the security of the communication network, and the real-time execution effect information of the target defense strategy on the communication network is monitored. The target defense strategy is then adjusted based on the real-time execution effect information.

[0011] Optionally, the step of identifying encrypted and unencrypted data streams in the transmitted data stream, and performing potential vulnerability analysis based on the encrypted and unencrypted data streams to obtain target potential vulnerability information, includes:

[0012] The transmitted data stream is subjected to protocol type identification to obtain a protocol type identification result, and encrypted data streams and unencrypted data streams in the transmitted data streams are distinguished based on the protocol type identification result;

[0013] Deep protocol parsing is performed on the unencrypted data stream to obtain information on the first potential vulnerability.

[0014] Behavioral feature extraction is performed on the encrypted data stream to obtain behavioral feature information;

[0015] Identify the covert service type in the encrypted data stream based on the aforementioned behavioral feature information;

[0016] Based on the aforementioned covert service type, covert service response behavior analysis is performed to obtain covert service response behavior information, and second potential vulnerability information is determined based on the covert service response behavior information.

[0017] Target potential vulnerability information is generated based on the first and second potential vulnerability information.

[0018] Optionally, the step of extracting behavioral features from the encrypted data stream to obtain behavioral feature information includes:

[0019] Obtain the transport layer header information of the encrypted data stream, and extract the handshake sequence, port number and IP address pair information based on the transport layer header information, and generate connection establishment mode feature information based on the handshake sequence, port number and IP address pair information;

[0020] The encrypted data stream is subjected to packet length measurement to obtain packet length information, and packet size sequence information is constructed based on the packet length information;

[0021] Determine the arrival timestamp of each data packet in the encrypted data stream, calculate the time interval between adjacent data packets in the encrypted data stream, and generate transmission timing features based on the arrival timestamps and time intervals;

[0022] Obtain the session start time, session end time, and total number of bytes transmitted for the encrypted data stream, and determine the session duration based on the session start time, session end time, and total number of bytes transmitted;

[0023] Based on the connection establishment mode feature information, data packet size sequence information, transmission timing features and session duration, a multi-dimensional feature set is determined, and traffic behavior pattern recognition is performed based on the multi-dimensional feature set to obtain traffic behavior pattern information;

[0024] Behavioral feature information is determined based on the traffic behavior pattern information and the multi-dimensional feature set.

[0025] Optionally, the step of performing traffic behavior pattern recognition based on the multi-dimensional feature set to obtain traffic behavior pattern information includes:

[0026] The multi-dimensional feature set is subjected to dimensionality reduction processing to obtain a dimensionality-reduced multi-dimensional feature set;

[0027] Cluster analysis is performed on the multidimensional feature set after dimensionality reduction to obtain several flow clusters, and the internal dispersion of each flow cluster is calculated.

[0028] The internal dispersion of each traffic cluster is compared with a preset dispersion threshold. Traffic clusters with an internal dispersion greater than or equal to the preset dispersion threshold are identified as potential threat traffic clusters, while traffic clusters with an internal dispersion less than the preset dispersion threshold are identified as normal traffic clusters.

[0029] Traffic behavior features are extracted from potential threat traffic clusters to obtain traffic behavior feature information. The traffic behavior feature information is then compared with the behavior pattern features of malicious traffic to obtain the comparison results. Based on the comparison results and normal traffic clusters, traffic behavior pattern information is determined.

[0030] Optionally, the step of performing dimensionality reduction processing on the multi-dimensional feature set to obtain a dimensionality-reduced multi-dimensional feature set includes:

[0031] Obtain feature source information of the multi-dimensional feature set, and divide the multi-dimensional feature set into several subsets based on the feature source information;

[0032] Determine the data distribution characteristics of each subset, and determine the dimensionality reduction method corresponding to each subset based on the data distribution characteristics. Perform dimensionality reduction processing on each subset based on the dimensionality reduction method to obtain the dimensionality-reduced subset.

[0033] All the dimensionality-reduced subsets are integrated to obtain a multi-dimensional feature set after dimensionality reduction.

[0034] Optionally, the step of conducting a security risk assessment of the communication network based on the target potential vulnerability information and potential intrusion attempt information to obtain a security risk assessment result includes:

[0035] The target potential vulnerability information and potential intrusion attempt information are structured to obtain structured target potential vulnerability information and potential intrusion attempt information;

[0036] Determine the topology, asset distribution, and logical connections of network devices in the communication network, and construct the graph structure of the communication network based on the topology, asset distribution, and logical connections of network devices;

[0037] Based on the graph structure, attack path analysis is performed using the structured target potential vulnerability information and potential intrusion attempt information to obtain attack path information;

[0038] Attack chain pattern analysis is performed based on the attack path information to obtain attack chain pattern information, and a security risk assessment of the communication network is conducted based on the attack chain pattern information to obtain the security risk assessment results.

[0039] Optionally, the step of generating a policy intent summary based on the initial defense strategy and performing device-side policy carrying capacity analysis based on the policy intent summary to obtain device-side policy carrying capacity information includes:

[0040] Based on the initial defense strategy, a strategy intent summary is generated using a preset summary template;

[0041] Real-time resource analysis of network boundary devices is performed based on the policy intent summary to obtain real-time resource information;

[0042] Based on the policy intent summary, the policy processing capability of the network boundary device is analyzed to obtain policy processing capability information. Based on the real-time resource information and policy processing capability information, the device-side policy carrying capacity is analyzed to obtain device-side policy carrying capacity information.

[0043] Optionally, optimizing the initial defense strategy based on the device-side policy carrying capacity information to obtain the target defense strategy includes:

[0044] A capability feedback message is generated based on the device-side policy carrying capacity information;

[0045] Based on the capability feedback message, the initial defense strategy is optimized using preset execution logic to obtain the target defense strategy.

[0046] Optionally, the real-time execution effect information of the monitoring target defense strategy when providing security protection for the communication network, and the adjustment of the target defense strategy based on the real-time execution effect information, includes:

[0047] The system acquires network traffic data, terminal activity records, and security event records when the target defense strategy protects the communication network, and generates real-time execution effect information based on the network traffic data, terminal activity records, and security event records.

[0048] Based on the real-time execution effect information, attack address change analysis is performed to obtain attack address change information; based on the real-time execution effect information, attack timing change analysis is performed to obtain attack timing change information.

[0049] Based on the real-time execution effect information, attack protocol change analysis is performed to obtain attack protocol change information. Based on the attack address change information, attack timing change information, and attack protocol change information, attack chain change stage analysis is performed to obtain attack chain change stage information.

[0050] The target defense strategy is adjusted based on the attack chain change stage information.

[0051] In addition, the present invention also provides a security protection system for a communication network, the system comprising:

[0052] Vulnerability Analysis Module: Used to acquire transmission data streams and terminal device activity records in the communication network, identify encrypted and unencrypted data streams in the transmission data streams, and perform potential vulnerability analysis based on the encrypted and unencrypted data streams to obtain target potential vulnerability information;

[0053] Security risk assessment module: used to identify potential intrusion attempt information based on the activity records of the terminal device, and to conduct a security risk assessment of the communication network based on the target potential vulnerability information and potential intrusion attempt information, so as to obtain the security risk assessment result;

[0054] Capability Analysis Module: Used to determine the initial defense strategy based on the security risk assessment results, generate a strategy intent summary based on the initial defense strategy, and perform device-side strategy carrying capacity analysis based on the strategy intent summary to obtain device-side strategy carrying capacity information;

[0055] Strategy optimization module: used to optimize the initial defense strategy based on the device-side policy carrying capacity information to obtain the target defense strategy;

[0056] Security Protection Module: Used to perform security protection of the communication network based on the target defense strategy, monitor the real-time execution effect information of the target defense strategy when performing security protection of the communication network, and adjust the target defense strategy based on the real-time execution effect information.

[0057] In this embodiment of the invention, data streams and terminal device activity records in the communication network are acquired, and encrypted and unencrypted data streams are identified within the data streams for potential vulnerability analysis. This enables a more comprehensive and accurate discovery of potential vulnerabilities in the network. Potential intrusion attempt information is identified based on terminal device activity records, and a security risk assessment of the communication network is performed based on the target potential vulnerability information and potential intrusion attempt information. This achieves a comprehensive and dynamic assessment of network security risks, overcoming the limitations of single-dimensional assessments. An initial defense strategy is determined based on the security risk assessment results, and a strategy intent summary is generated based on the initial defense strategy to analyze the device-side policy carrying capacity. The initial defense strategy is optimized based on the device-side policy carrying capacity information, ensuring that the final determined defense strategy is both effective and does not exceed the device's performance limitations. Security protection of the communication network is performed based on the target defense strategy, and the real-time execution effect information of the target defense strategy is monitored. The target defense strategy is adjusted based on the real-time execution effect information, achieving adaptive and intelligent defense. This effectively addresses the dynamic and complex nature of network attacks, improving the overall security protection capability and response efficiency of the communication network. Attached Figure Description

[0058] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 This is a flowchart illustrating the security protection method for a communication network in an embodiment of the present invention;

[0060] Figure 2This is a flowchart illustrating a security protection method for a communication network according to another embodiment of the present invention.

[0061] Figure 3 This is a schematic diagram of the structural composition of the security protection system for the communication network in an embodiment of the present invention. Detailed Implementation

[0062] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] Example 1

[0064] Please see Figure 1 , Figure 1 This is a flowchart illustrating a security protection method for a communication network according to an embodiment of the present invention. The method includes:

[0065] S11: Obtain the transmission data stream and terminal device activity records in the communication network, identify the encrypted data stream and unencrypted data stream in the transmission data stream, and perform potential vulnerability analysis based on the encrypted data stream and unencrypted data stream to obtain target potential vulnerability information;

[0066] In the specific implementation of this invention, the transmission data stream and terminal device activity records in the communication network are acquired. Protocol type identification is performed on the transmission data stream to obtain the protocol type identification result. Based on the protocol type identification result, encrypted and unencrypted data streams are distinguished within the transmission data stream. Deep protocol parsing is performed on the unencrypted data stream to obtain first potential vulnerability information. Behavioral feature extraction is performed on the encrypted data stream to obtain behavioral feature information. Based on the behavioral feature information, covert service types in the encrypted data stream are identified. Covert service response behavior analysis is performed based on the covert service types to obtain covert service response behavior information. Based on the covert service response behavior information, second potential vulnerability information is determined. Target potential vulnerability information is generated based on the first and second potential vulnerability information. This method can meticulously distinguish between encrypted and unencrypted traffic and perform targeted deep analysis, thereby more comprehensively and accurately discovering potential vulnerabilities in the network, including risks posed by covert services, thus overcoming the shortcomings of traditional methods in analyzing encrypted traffic.

[0067] S12: Identify potential intrusion attempt information based on the activity records of the terminal device, and conduct a security risk assessment of the communication network based on the target potential vulnerability information and the potential intrusion attempt information to obtain the security risk assessment result;

[0068] In the specific implementation of this invention, potential intrusion attempt information is identified based on the activity records of the terminal device. The target potential vulnerability information and potential intrusion attempt information are then structured to obtain structured target potential vulnerability information and potential intrusion attempt information. The topology, asset distribution, and logical connections of network devices of the communication network are determined, and a graph structure of the communication network is constructed based on the topology, asset distribution, and logical connections of network devices. Attack path analysis is performed using the structured target potential vulnerability information and potential intrusion attempt information based on the graph structure to obtain attack path information. Attack chain pattern analysis is performed based on the attack path information to obtain attack chain pattern information, and a security risk assessment of the communication network is conducted based on the attack chain pattern information. This approach combines vulnerability and intrusion attempt information with the network topology to perform attack path and attack chain analysis, thereby achieving a comprehensive and dynamic assessment of network security risks and overcoming the limitations of single-dimensional assessment.

[0069] S13: Determine an initial defense strategy based on the security risk assessment results, generate a strategy intent summary based on the initial defense strategy, and perform a device-side strategy carrying capacity analysis based on the strategy intent summary to obtain device-side strategy carrying capacity information;

[0070] In the specific implementation of this invention, an initial defense strategy is determined based on the security risk assessment results. A policy intent summary is generated based on the initial defense strategy using a preset summary template. Real-time resource analysis of network boundary devices is performed based on the policy intent summary to obtain real-time resource information. Policy processing capability analysis of network boundary devices is performed based on the policy intent summary to obtain policy processing capability information. Finally, device-side policy carrying capacity analysis is performed based on the real-time resource information and policy processing capability information. This process transforms abstract defense strategies into policy intent summaries that devices can understand. Combined with the device's real-time resources and processing capabilities, the carrying capacity analysis ensures the feasibility and effectiveness of the defense strategy and avoids policy deployment failures or performance bottlenecks.

[0071] S14: Optimize the initial defense strategy based on the device-side policy carrying capacity information to obtain the target defense strategy;

[0072] In the specific implementation of this invention, a capability feedback message is generated based on the device-side policy carrying capacity information; the initial defense strategy is optimized based on the capability feedback message using preset execution logic, which can intelligently optimize the initial defense strategy according to the actual carrying capacity of the device side, ensuring that the final deployed defense strategy can effectively protect without exceeding the performance limits of the device, thus realizing the adaptive adjustment of the strategy.

[0073] S15: Perform security protection of the communication network based on the target defense strategy, monitor the real-time execution effect information of the target defense strategy when performing security protection of the communication network, and adjust the target defense strategy based on the real-time execution effect information.

[0074] In the specific implementation of this invention, the security protection of the communication network is performed based on the target defense strategy. Network traffic data, terminal activity records, and security event records are acquired when the target defense strategy protects the communication network. Real-time execution effect information is generated based on the network traffic data, terminal activity records, and security event records. Attack address change analysis is performed based on the real-time execution effect information to obtain attack address change information. Attack timing change analysis is performed based on the real-time execution effect information to obtain attack timing change information. Attack protocol change analysis is performed based on the real-time execution effect information to obtain attack protocol change information. Attack chain change stage analysis is performed based on the attack address change information, attack timing change information, and attack protocol change information to obtain attack chain change stage information. The target defense strategy is adjusted based on the attack chain change stage information. This allows for real-time monitoring of the execution effect of the defense strategy and dynamic adjustment of the defense strategy according to changes in attack behavior, achieving continuous optimization and adaptive response of the defense, effectively addressing the dynamic changes of attackers.

[0075] In this embodiment of the invention, data streams and terminal device activity records in the communication network are acquired, and encrypted and unencrypted data streams are identified within the data streams for potential vulnerability analysis. This enables a more comprehensive and accurate discovery of potential vulnerabilities in the network. Potential intrusion attempt information is identified based on terminal device activity records, and a security risk assessment of the communication network is performed based on the target potential vulnerability information and potential intrusion attempt information. This achieves a comprehensive and dynamic assessment of network security risks, overcoming the limitations of single-dimensional assessments. An initial defense strategy is determined based on the security risk assessment results, and a strategy intent summary is generated based on the initial defense strategy to analyze the device-side policy carrying capacity. The initial defense strategy is optimized based on the device-side policy carrying capacity information, ensuring that the final determined defense strategy is both effective and does not exceed the device's performance limitations. Security protection of the communication network is performed based on the target defense strategy, and the real-time execution effect information of the target defense strategy is monitored. The target defense strategy is adjusted based on the real-time execution effect information, achieving adaptive and intelligent defense. This effectively addresses the dynamic and complex nature of network attacks, improving the overall security protection capability and response efficiency of the communication network.

[0076] Example 2

[0077] Please see Figure 2 , Figure 2This is a flowchart illustrating a security protection method for a communication network according to another embodiment of the present invention, the method comprising:

[0078] S201: Obtain the transmission data stream and terminal device activity record in the communication network, identify the protocol type of the transmission data stream, obtain the protocol type identification result, and distinguish the encrypted data stream and unencrypted data stream in the transmission data stream based on the protocol type identification result;

[0079] In the specific implementation of this invention, the transmission data stream and terminal device activity records in the communication network are acquired. The communication network refers to a system in which various network devices are interconnected for data transmission and information exchange. It can be a local area network, a wide area network, a data center network, or a cloud network, etc. The transmission data stream refers to the data sequence flowing in the communication network, including data packets of various protocol types, such as TCP / IP traffic, HTTP requests, DNS queries, etc. The terminal device activity records refer to the operation logs, connection records, access behaviors, and other information generated by various terminal devices in the network.

[0080] The transmitted data stream is subjected to protocol type identification to obtain the protocol type identification result. Protocol type identification refers to determining the specific application layer or transport layer protocol used by the data stream by analyzing multiple dimensions such as the header information, port number, and payload characteristics of the data packets. For example, deep packet inspection technology can be used to identify the protocol type by matching preset protocol signatures or behavior patterns. Based on the protocol type identification result, encrypted and unencrypted data streams in the transmitted data stream are distinguished. For example, data streams identified with protocols such as TLS / SSL, SSH, and IPSec are classified as encrypted data streams, while data streams with protocols such as HTTP, FTP, and DNS are classified as unencrypted data streams.

[0081] S202: Perform deep protocol parsing on the unencrypted data stream to obtain information on the first potential vulnerability;

[0082] In the specific implementation of this invention, deep protocol parsing of the unencrypted data stream refers to detailed content analysis of the identified unencrypted data stream. Since the content of the unencrypted data stream is visible in plaintext, it can undergo complete protocol field parsing, content keyword matching, and abnormal pattern detection to discover potential known vulnerabilities, configuration errors, malicious payloads, or behaviors that do not comply with security policies. This allows for the acquisition of first-order potential vulnerability information, such as SQL injection vulnerabilities, cross-site scripting vulnerabilities, and buffer overflow vulnerabilities.

[0083] S203: Extract behavioral features from the encrypted data stream to obtain behavioral feature information;

[0084] In a specific implementation of this invention, the step of extracting behavioral features from the encrypted data stream to obtain behavioral feature information includes: acquiring the transport layer header information of the encrypted data stream, and extracting handshake sequence, port number, and IP address pair information based on the transport layer header information; generating connection establishment mode feature information based on the handshake sequence, port number, and IP address pair information; measuring the data packet length of the encrypted data stream to obtain data packet length information, and constructing data packet size sequence information based on the data packet length information; determining the arrival timestamp of each data packet in the encrypted data stream, calculating the time interval between adjacent data packets in the encrypted data stream, and generating transmission timing features based on the arrival timestamps and time intervals; acquiring the session start time, session end time, and total number of transmitted bytes of the encrypted data stream, and determining the session duration based on the session start time, session end time, and total number of transmitted bytes; determining a multi-dimensional feature set based on the connection establishment mode feature information, data packet size sequence information, transmission timing features, and session duration, and performing traffic behavior pattern recognition based on the multi-dimensional feature set to obtain traffic behavior pattern information; and determining behavioral feature information based on the traffic behavior pattern information and the multi-dimensional feature set.

[0085] Specifically, the transport layer header information of the encrypted data stream is obtained. This transport layer header information, such as the header information of TCP or UDP protocols, contains key metadata for establishing a network connection. Based on this transport layer header information, handshake sequence, port number, and IP address pairs are extracted. The handshake sequence refers to the order and characteristics of data packet exchange during connection establishment, such as the TCP three-way handshake. The port number includes the source port and destination port, used to identify the communicating application or service. The IP address pair refers to the source IP address and destination IP address of the communicating parties. Connection establishment mode characteristic information is generated based on the handshake sequence, port number, and IP address pairs. For example, it determines whether the connection is established normally, abnormally interrupted, or involves scanning behavior. The purpose is to identify potential abnormal behavior at the connection level.

[0086] The encrypted data stream is subjected to packet length measurement to obtain packet length information, and packet size sequence information is constructed based on this information. Packet length measurement refers to the precise statistical analysis of the payload length of each packet in the encrypted data stream. Packet size sequence information refers to the sequence formed by arranging the lengths of all packets in a complete communication session according to their transmission order. Different types of applications or protocols often exhibit specific statistical patterns in their packet length distribution and sequence patterns when transmitting data. Even if the data content is encrypted, these external characteristics can still be used for behavioral analysis, with the aim of inferring the application type through the granular characteristics of the packets.

[0087] The arrival timestamps of each data packet in the encrypted data stream are determined, the time intervals between adjacent data packets in the encrypted data stream are calculated, and transmission timing characteristics are generated based on the arrival timestamps and time intervals. The arrival timestamps record the precise time point at which each data packet is received. By calculating the time intervals between adjacent data packets, the rate, rhythm, and burstiness of data transmission can be reflected. Transmission timing characteristics, such as the periodicity, burstiness, or jitter of data packets, are crucial for identifying the application type or behavioral patterns behind encrypted traffic. For example, video streams typically have continuous and relatively stable transmission timing, while interactive applications may exhibit intermittent transmission patterns. The aim is to characterize the dynamic behavior of the traffic through time-dimensional features.

[0088] The session start time, session end time, and total number of bytes transmitted for the encrypted data stream are obtained. The session duration is determined based on these times, and the session start time and end time define the lifecycle of a complete communication session. The total number of bytes transmitted represents the total amount of data transmitted during the session. The session duration is the difference between the session end time and the session start time.

[0089] Based on the connection establishment mode characteristics, data packet size sequence information, transmission timing characteristics, and session duration, a multi-dimensional feature set is determined. Traffic behavior pattern recognition is then performed based on this multi-dimensional feature set to obtain traffic behavior pattern information. The multi-dimensional feature set integrates the extracted connection establishment mode characteristics, data packet size sequence information, transmission timing characteristics, and session duration, forming a comprehensive feature vector. Traffic behavior pattern recognition refers to using machine learning algorithms to analyze these multi-dimensional features to identify specific behavioral patterns exhibited by encrypted traffic, such as distinguishing between web browsing, file transfer, video conferencing, and malicious communication. Its purpose is to identify the inherent behavioral patterns of encrypted traffic through comprehensive analysis of multiple features.

[0090] Based on the aforementioned traffic behavior pattern information and multi-dimensional feature set, behavioral feature information is determined. This behavioral feature information is a more representative and discriminative feature description obtained by integrating traffic behavior pattern information and the original multi-dimensional feature set. It not only includes the identified specific behavioral patterns but also retains the original feature details supporting these patterns for more refined analysis and judgment. Its purpose is to provide a comprehensive description of encrypted traffic behavior that can be used for subsequent analysis. This overcomes the limitations of traditional methods in performing in-depth analysis of encrypted data streams. Even when the data content is encrypted, it is possible to effectively identify the behavioral patterns of encrypted traffic by extracting multi-dimensional external features such as connection establishment pattern features, packet size sequence information, transmission timing features, and session duration. This multi-dimensional feature extraction and pattern recognition method eliminates the need for decryption in the analysis of encrypted data streams, thereby improving the ability to detect potential threats in communication networks without infringing on user privacy.

[0091] Furthermore, the step of identifying traffic behavior patterns based on the multi-dimensional feature set to obtain traffic behavior pattern information includes: performing dimensionality reduction processing on the multi-dimensional feature set to obtain a dimensionality-reduced multi-dimensional feature set; performing cluster analysis on the dimensionality-reduced multi-dimensional feature set to obtain several traffic clusters, and calculating the internal dispersion of each traffic cluster; comparing the internal dispersion of each traffic cluster with a preset dispersion threshold, identifying traffic clusters with internal dispersion greater than or equal to the preset dispersion threshold as potential threat traffic clusters, and identifying traffic clusters with internal dispersion less than the preset dispersion threshold as normal traffic clusters; extracting traffic behavior features from the potential threat traffic clusters to obtain traffic behavior feature information, comparing the traffic behavior feature information with the behavior pattern features of malicious traffic to obtain comparison results, and determining traffic behavior pattern information based on the comparison results and normal traffic clusters.

[0092] Specifically, the multi-dimensional feature set is subjected to dimensionality reduction processing to obtain a dimensionality-reduced multi-dimensional feature set. Dimensionality reduction aims to reduce data redundancy and noise while retaining key information, thereby improving the efficiency and accuracy of subsequent clustering analysis. The dimensionality-reduced multi-dimensional feature set is the result of processing the original feature set using feature selection or feature extraction algorithms. For example, principal component analysis, linear discriminant analysis, or t-SNE methods can be used for dimensionality reduction.

[0093] Cluster analysis is performed on the dimensionality-reduced multi-dimensional feature set to obtain several traffic clusters. The internal dispersion of each traffic cluster is then calculated. Cluster analysis refers to dividing traffic data points in the dimensionality-reduced multi-dimensional feature set into different groups or traffic clusters based on their similarity. The internal dispersion of each traffic cluster is used to measure the density of data points within the cluster. For example, it can be calculated using indicators such as intra-cluster variance and average distance. Traffic clusters with higher internal dispersion may contain multiple behavioral patterns, or even anomalous behaviors, while traffic clusters with lower internal dispersion usually indicate more consistent behavioral patterns.

[0094] The internal dispersion of each traffic cluster is compared with a preset dispersion threshold. Traffic clusters with an internal dispersion greater than or equal to the preset threshold are identified as potentially threatening traffic clusters, while those with an internal dispersion less than the preset threshold are identified as normal traffic clusters. The preset dispersion threshold is a key parameter, and its setting can be optimized based on historical data analysis, expert experience, or machine learning methods. Identifying traffic clusters with an internal dispersion greater than or equal to the preset threshold as potentially threatening traffic clusters is based on the assumption that abnormal behavior usually exhibits higher variability or more irregular patterns. Conversely, traffic clusters with an internal dispersion less than the preset threshold are considered normal traffic clusters, representing regular and predictable traffic behavior in the communication network.

[0095] Traffic behavior features are extracted from potential threat traffic clusters to obtain traffic behavior feature information, aiming to identify more specific features related to malicious activities from these suspicious traffic. This traffic behavior feature information is compared with the behavior pattern features of malicious traffic to obtain comparison results. Based on the comparison results and normal traffic clusters, traffic behavior pattern information is determined. This traffic behavior feature information is then compared with the behavior pattern features of known malicious traffic. The comparison results can indicate which type of malicious behavior the potential threat traffic cluster is similar to. Finally, based on the comparison results and the identification of normal traffic clusters, the traffic behavior pattern information of the communication network can be comprehensively determined, providing a basis for subsequent security risk assessment. Dimensionality reduction improves the efficiency and accuracy of data analysis; cluster analysis and dispersion comparison enable effective screening and differentiation of potential threat traffic, avoiding false positives on a large number of normal traffic; comparison with malicious traffic behavior pattern features further enhances the detection capability of hidden threats in encrypted traffic, thereby enabling more accurate and efficient identification of abnormal traffic behavior in communication networks, providing more reliable traffic behavior pattern information for subsequent potential vulnerability analysis and security risk assessment.

[0096] Furthermore, the step of performing dimensionality reduction processing on the multi-dimensional feature set to obtain a dimensionality-reduced multi-dimensional feature set includes: obtaining feature source information of the multi-dimensional feature set, and dividing the multi-dimensional feature set into several subsets based on the feature source information; determining the data distribution characteristics of each subset, and determining the dimensionality reduction method corresponding to each subset based on the data distribution characteristics; performing dimensionality reduction processing on each subset based on the dimensionality reduction method to obtain a dimensionality-reduced subset; and integrating all the dimensionality-reduced subsets to obtain a dimensionality-reduced multi-dimensional feature set.

[0097] Specifically, the feature source information of the multi-dimensional feature set is obtained, and the multi-dimensional feature set is divided into several subsets based on the feature source information. The feature source information can be understood as information describing the original generation method or category of each feature in the multi-dimensional feature set. For example, in communication network traffic analysis, features may originate from the connection establishment process, the data packet transmission process, or session statistics. Based on this feature source information, the multi-dimensional feature set can be divided into several subsets, such as a connection feature subset, a data packet feature subset, and a session feature subset.

[0098] The data distribution characteristics of each subset are determined, and based on these characteristics, a corresponding dimensionality reduction method is identified for each subset. The subsets are then subjected to dimensionality reduction using this method to obtain the dimensionality-reduced subsets. Data distribution characteristics refer to the statistical features exhibited by the data within each subset, such as the mean, variance, skewness, kurtosis, data type, data sparsity, and the presence of outliers. These characteristics are crucial for selecting an appropriate dimensionality reduction method. For example, principal component analysis may be an effective dimensionality reduction method for continuous data with linear correlation; manifold learning may be more suitable for data with nonlinear structures; and feature selection or encoding transformation methods can be used for categorical or discrete data. Dimensionality reduction methods refer to techniques that map high-dimensional data to a low-dimensional space, aiming to reduce data dimensionality while preserving as much important information as possible. Specifically, the most suitable dimensionality reduction method can be determined and applied to each subset based on its data distribution characteristics. For example, connection establishment pattern features may contain many discrete or categorical features, which can be reduced in dimensionality using feature selection methods based on information gain or multidimensional scaling analysis; packet size sequence information and transmission time sequence features may have time series characteristics, which can be extracted and reduced in dimensionality using wavelet transform, Fourier transform, or deep learning-based autoencoders; and for statistical features such as session duration, if their distribution is close to a Gaussian distribution and there is a linear correlation between features, principal component analysis can be used for dimensionality reduction.

[0099] The process involves integrating all the dimensionality-reduced subsets to obtain a new, unified set of multi-dimensional features. Integration refers to recombining all subsets after their respective dimensionality reduction processes into a single, unified set of multi-dimensional features. This integration can be a simple concatenation or a weighted fusion, depending on the needs of the subsequent analysis. This approach maximizes the preservation of key information from each subset, avoiding the loss of effective information or the introduction of noise caused by a one-size-fits-all approach to dimensionality reduction.

[0100] For example, suppose in a communication network, we collect a multi-dimensional feature set including: connection establishment pattern features (such as TCP handshake flag sequence, source / destination port numbers, and IP address pairs), packet size sequence information (such as the length of 10 consecutive packets), transmission timing features (such as the arrival time interval of 10 consecutive packets), and session duration. First, based on the feature source information, these features can be divided into three subsets: 1. **Connection Feature Subset:** Contains connection establishment pattern features, which are typically discrete or categorical. 2. **Packet Sequence Feature Subset:** Contains packet size sequence information and transmission timing features, which have time-series characteristics. 3. **Session Statistical Feature Subset:** Contains session duration, which is typically a continuous numerical feature.

[0101] Secondly, based on the data distribution characteristics of each subset, the corresponding dimensionality reduction methods are determined: 1. **For the connectivity feature subset:** Considering its discreteness and categoricality, a feature selection method based on information gain can be used to select the connectivity features that contribute most to traffic behavior pattern recognition, or multidimensional scaling analysis can be used to map it to a lower-dimensional space. 2. **For the data packet sequence feature subset:** Considering its time-series characteristics and potential nonlinear structure, an autoencoder based on a convolutional neural network can be used for feature extraction and dimensionality reduction, or wavelet transform can be used to extract its frequency domain features. 3. **For the session statistics feature subset:** Considering its continuity and possible linear correlation, principal component analysis can be used for dimensionality reduction to extract the main directions of change. Finally, the three subsets processed by the above different dimensionality reduction methods are integrated, for example, through simple feature concatenation, to form a new multidimensional feature set with lower dimensionality but more complete information retention.

[0102] S204: Identify the covert service type in the encrypted data stream based on the behavioral feature information, perform covert service response behavior analysis based on the covert service type, obtain covert service response behavior information, and determine the second potential vulnerability information based on the covert service response behavior information.

[0103] In the specific implementation of this invention, identifying the covert service type in the encrypted data stream based on the aforementioned behavioral feature information refers to using machine learning or pattern matching algorithms to compare the extracted behavioral feature information with the behavioral patterns of known covert services (such as VPN, Tor, C2 communication, tunneling protocols, etc.). In this way, even if the data stream is encrypted, the type of covert service it may be carrying can be identified. Analyzing the covert service response behavior based on the identified covert service type means that once the covert service type in the encrypted data stream is identified, its response behavior in the network is further analyzed based on the characteristics of that service type. For example, for identified C2 communication, its periodic heartbeat packets, abnormal data transmission volume, and communication with specific malicious IP addresses can be analyzed. Through these analyses, covert service response behavior information can be obtained. Based on the covert service response behavior information, second potential vulnerability information is determined, such as covert channel abuse, data theft, and remote control.

[0104] S205: Generate target potential vulnerability information based on the first potential vulnerability information and the second potential vulnerability information;

[0105] In the specific implementation of this invention, generating target potential vulnerability information based on the first and second potential vulnerability information refers to integrating and associating vulnerabilities discovered from unencrypted data streams and encrypted data streams. This integration provides a comprehensive, multi-dimensional view of potential vulnerabilities in the communication network, ensuring that potential security risks can be effectively identified regardless of whether the data stream is encrypted. By identifying the protocol type of the transmitted data stream, encrypted and unencrypted data streams can be accurately distinguished, allowing for different analysis strategies for different types of data streams. For unencrypted data streams, deep protocol parsing can directly uncover their internal potential vulnerabilities. For encrypted data streams, behavioral feature extraction and covert service type identification indirectly but effectively reveal potential vulnerabilities in their potential covert services and response behaviors. This approach comprehensively covers all types of transmitted data streams in the communication network, avoiding security blind spots caused by encryption and ensuring the completeness and accuracy of potential vulnerability analysis.

[0106] S206: Identify potential intrusion attempt information based on the activity records of the terminal device, and conduct a security risk assessment of the communication network based on the target potential vulnerability information and the potential intrusion attempt information to obtain a security risk assessment result;

[0107] In the specific implementation of this invention, the step of conducting a security risk assessment of the communication network based on the target potential vulnerability information and potential intrusion attempt information to obtain a security risk assessment result includes: performing structured processing on the target potential vulnerability information and potential intrusion attempt information to obtain structured target potential vulnerability information and potential intrusion attempt information; determining the topology, asset distribution, and logical connections of network devices of the communication network, and constructing a graph structure of the communication network based on the topology, asset distribution, and logical connections of network devices; performing attack path analysis based on the graph structure using the structured target potential vulnerability information and potential intrusion attempt information to obtain attack path information; performing attack chain pattern analysis based on the attack path information to obtain attack chain pattern information, and conducting a security risk assessment of the communication network based on the attack chain pattern information to obtain a security risk assessment result.

[0108] Specifically, potential intrusion attempt information is identified based on the terminal device activity logs. Potential intrusion attempt information refers to records of attackers attempting unauthorized access to, control of, or disruption of the communication network, such as port scanning, brute-force attacks, and malicious login attempts. This can be achieved by analyzing the terminal device's login logs, file access records, process startup information, and network connection records. For example, if a terminal device repeatedly fails to log in within a short period or accesses sensitive files that should not normally be accessed, it can be identified as a potential intrusion attempt. This information can be compared with known attack patterns or identified using anomaly detection algorithms.

[0109] The process of structuring the target's potential vulnerability information and potential intrusion attempt information to obtain structured information involves uniformly parsing, standardizing, and converting the raw, potentially inconsistent information to ensure its effective identification and processing by subsequent analysis modules. For example, text-described vulnerabilities can be converted into unified vulnerability identifiers, and intrusion attempt logs can be converted into structured data containing fields such as attack source, target, time, and type. The aim is to provide standardized input for subsequent graph structure construction and attack path analysis.

[0110] Determining the topology, asset distribution, and logical connections of a communication network, and constructing its graph structure based on these elements, involves abstracting various entities within the network, such as servers, terminal devices, network devices, and application services, as nodes in the graph. The physical connections, logical connections, dependencies, identified vulnerabilities, and potential intrusion attempts between these entities are then abstracted as edges. For example, a node can represent a server, and an edge can represent the connection between that server and a switch, or a vulnerability present on that server. This graph structure visually represents the relationships between various elements in the network, providing a visual and computational foundation for attack path analysis.

[0111] Attack path analysis based on the graph structure, utilizing structured information on potential vulnerabilities and intrusion attempts, yields attack path information. This involves simulating potential vulnerabilities and intrusion attempts by attackers on a constructed communication network graph, using graph traversal or shortest path algorithms combined with the structured vulnerability and intrusion attempt information, to trace the path from the potential attack origin to the potential attack target. These paths represent sequences of potential attacker penetration and lateral movement, thus revealing potential attack chains.

[0112] Attack chain pattern analysis based on the attack path information yields attack chain pattern information, which is then used to conduct a security risk assessment of the communication network, resulting in a security risk assessment result. This involves further abstracting and summarizing the identified attack paths to form attack chains with specific patterns. For example, an attack chain might include stages such as "initial access -> privilege escalation -> lateral movement -> data theft." By analyzing the length, complexity, severity of vulnerabilities exploited, and importance of the attack targets of these attack chains, a quantitative assessment of the overall security risk faced by the communication network can be achieved. For instance, a risk score can be assigned to each attack chain, and the risks of all chains can be combined to arrive at the final security risk assessment result. This approach can simulate the attacker's thinking and behavior patterns, revealing potential, multi-step attack sequences, thereby more accurately assessing the deep-seated security risks existing in the network. In-depth analysis of attack chain patterns can identify key attack nodes and weaknesses, providing precise guidance for subsequent defense strategy formulation.

[0113] S207: Determine an initial defense strategy based on the security risk assessment results, generate a strategy intent summary based on the initial defense strategy, and perform a device-side strategy carrying capacity analysis based on the strategy intent summary to obtain device-side strategy carrying capacity information;

[0114] In a specific implementation of this invention, the step of generating a policy intent summary based on the initial defense strategy and performing device-side policy carrying capacity analysis based on the policy intent summary to obtain device-side policy carrying capacity information includes: generating a policy intent summary using a preset summary template based on the initial defense strategy; performing real-time resource analysis of network boundary devices based on the policy intent summary to obtain real-time resource information; performing policy processing capability analysis of network boundary devices based on the policy intent summary to obtain policy processing capability information; and performing device-side policy carrying capacity analysis based on the real-time resource information and policy processing capability information to obtain device-side policy carrying capacity information.

[0115] Specifically, an initial defense strategy is determined based on the security risk assessment results. This initial defense strategy consists of preliminary protective measures formulated to address the currently identified risks. For example, if the assessment results indicate that a certain service poses a high risk, the initial defense strategy might include restricting access to that service, patching, upgrading software versions, or deploying a Web Application Firewall (WAF). These strategies can be predefined templates or dynamically generated based on the risk level and type.

[0116] Based on the initial defense strategy, a strategy intent summary is generated using a preset summary template. This template can be understood as a predefined structured format or rule set used to transform the complex initial defense strategy into a concise and standardized strategy intent summary. The template may include key information fields such as the strategy type, target, action, and priority, ensuring that the generated summary clearly and accurately expresses the core intent of the strategy, while also facilitating subsequent automated processing and analysis.

[0117] Real-time resource analysis of network boundary devices is performed based on the policy intent summary to obtain real-time resource information. Real-time resource analysis of network boundary devices refers to the real-time monitoring and evaluation of the current operating status of devices deployed at the communication network boundary. This includes, but is not limited to, key performance indicators such as CPU utilization, memory usage, network bandwidth consumption, and concurrent connections. By acquiring this real-time resource information, the current load and resource reserves of the devices can be understood, providing foundational data for subsequent policy capacity assessment.

[0118] Based on the policy intent summary, the policy processing capability of network boundary devices is analyzed to obtain policy processing capability information. This analysis assesses the number, complexity, and rate at which network boundary devices can effectively process and execute security policies under current configuration and resource conditions. Policy processing capability information may include the maximum number of policy entries supported by the device, the number of policy update requests that can be processed per second, and the processing performance of different policy types (such as deep packet inspection policies). This analysis aims to determine whether the device has sufficient processing capacity to handle and execute new defense policies, avoiding policy failures or network performance degradation due to device performance bottlenecks.

[0119] Based on the aforementioned real-time resource information and policy processing capability information, device-side policy carrying capacity analysis is performed to obtain device-side policy carrying capacity information. This analysis comprehensively considers real-time resource information and policy processing capability information to evaluate the ability of network boundary devices to effectively carry and execute initial defense policies under current and expected loads. Its purpose is to determine whether the device can meet the deployment requirements of the initial defense policy and to identify potential carrying bottlenecks. It comprehensively evaluates the device's carrying potential from multiple dimensions, avoiding the bias that may arise from evaluating a single indicator. Therefore, it can more accurately identify potential resource bottlenecks or performance limitations when deploying new policies, thus providing more precise guidance for subsequent policy optimization, ensuring the effective deployment and execution of defense policies, and improving the overall security level of the communication network.

[0120] S208: Optimize the initial defense strategy based on the device-side policy carrying capacity information to obtain the target defense strategy;

[0121] In a specific implementation of the present invention, optimizing the initial defense strategy based on the device-side policy carrying capacity information to obtain the target defense strategy includes: generating a capability feedback message based on the device-side policy carrying capacity information; and optimizing the initial defense strategy based on the capability feedback message using preset execution logic to obtain the target defense strategy.

[0122] Specifically, a capability feedback message is generated based on the device-side policy carrying capacity information. This message can be understood as a structured data packet or message carrying detailed information about the device-side policy carrying capacity, such as the device's current resource utilization, policy rule quantity limits, and processing performance bottlenecks. The purpose of generating this message is to transform the complex device-side policy carrying capacity information into a standardized format that can be directly understood and processed by the policy optimization module. In practical applications, the capability feedback message can be automatically generated by the network management system or a dedicated policy carrying capacity analysis module based on the device-side policy carrying capacity information. For example, it can be encapsulated using JSON, XML, or other custom protocol formats, with the aim of providing clear and accurate input for subsequent policy optimization.

[0123] Based on the capability feedback message, the initial defense strategy is optimized using preset execution logic to obtain the target defense strategy. The preset execution logic can be understood as a series of predefined rules, algorithms, or decision-making processes used to guide how to adjust and optimize the initial defense strategy according to the capability feedback message. Specifically, this logic can include various optimization strategies. For example, when the capability feedback message indicates that a device is experiencing resource constraints, the preset execution logic may suggest offloading some defense tasks to other devices or adjusting the granularity of the strategy to reduce resource consumption; when the capability feedback message indicates that a device has sufficient processing capacity, the preset execution logic may suggest increasing the device's defense strength or coverage. The aim is to ensure the automation, intelligence, and efficiency of the optimization process, so that the generated final target defense strategy can adapt to the actual carrying capacity of the network devices to the greatest extent possible.

[0124] For example, suppose a security risk assessment of a communication network indicates the need to deploy a new intrusion detection policy, which is identified as the initial defense policy. After generating a policy intent summary and performing device-side policy capacity analysis, device-side policy capacity information is obtained. For instance, the CPU utilization of a core router has reached 80%, and its maximum number of policy rules is limited to 1000, with 950 currently configured. At this point, the system generates a capability feedback message based on this device-side policy capacity information. This message may contain specific information such as "router CPU high load" or "router policy rules nearing the limit." Subsequently, the policy optimization module receives this capability feedback message and processes it according to preset execution logic. The preset execution logic may include the following rules: 1. If the device CPU utilization exceeds 75%, attempt to offload the computationally intensive portion of the new policy to other devices with lower loads. 2. If the number of device policy rules exceeds the 90% limit, attempt to merge existing policies or simplify the rule set of the new policy to reduce the number of rules. 3. If offloading or simplification is not possible, assess whether it is necessary to upgrade the device or adjust the network topology. Based on the aforementioned preset execution logic, the system will determine that the initial defense strategy cannot be entirely carried out by the router alone. Therefore, the preset execution logic will suggest deploying the traffic analysis portion of the intrusion detection strategy to a dedicated security analysis server, while only deploying simple blocking rules to the router. At the same time, the system will review and merge existing policies on the router to free up some rule space.

[0125] S209: Perform security protection of the communication network based on the target defense strategy, monitor the real-time execution effect information of the target defense strategy when performing security protection of the communication network, and adjust the target defense strategy based on the real-time execution effect information.

[0126] In the specific implementation of this invention, the monitoring of the real-time execution effect information of the target defense strategy when it provides security protection for the communication network, and the adjustment of the target defense strategy based on the real-time execution effect information, includes: acquiring network traffic data, terminal activity records, and security event records when the target defense strategy provides security protection for the communication network, and generating real-time execution effect information based on the network traffic data, terminal activity records, and security event records; performing attack address change analysis based on the real-time execution effect information to obtain attack address change information; performing attack timing change analysis based on the real-time execution effect information to obtain attack timing change information; performing attack protocol change analysis based on the real-time execution effect information to obtain attack protocol change information; and performing attack chain change stage analysis based on the attack address change information, attack timing change information, and attack protocol change information to obtain attack chain change stage information; and adjusting the target defense strategy based on the attack chain change stage information.

[0127] Specifically, the security protection of the communication network is carried out based on the target defense strategy, that is, the target defense strategy is deployed on the corresponding network devices and begins to execute the security protection task.

[0128] Acquiring network traffic data, terminal activity logs, and security event logs when the target defense strategy protects the communication network, and generating real-time execution effect information based on this data, refers to continuously collecting data packets flowing through the network, login, access, and operation logs of each terminal device, as well as various alarms and event logs generated by security devices during the effective period of the target defense strategy. This data is integrated and processed to form comprehensive real-time execution effect information for subsequent analysis.

[0129] Attack address change analysis is performed based on the real-time execution effect information to obtain attack address change information. Attack address change analysis can be understood as identifying whether the attacker has changed the attack initiation point by comparing identifiers such as the attack source IP address and MAC address detected in different time periods. For example, a historical attack address database can be used to match the current attack address, or cluster analysis can be used to discover new attack address clusters. Its purpose is to discover attacker attempts to circumvent defenses. Attack timing change analysis is also performed based on the real-time execution effect information to obtain attack timing change information. Attack timing change analysis specifically refers to analyzing the time patterns of attack events, such as attack frequency, attack duration, and attack intervals. By comparing with historical attack timing patterns, it can be identified whether the attacker has adjusted the attack rhythm or attack window. Its purpose is to reveal the attacker's strategic adjustments in the time dimension.

[0130] Attack protocol change analysis is performed based on the real-time execution effect information to obtain attack protocol change information. Attack protocol change analysis refers to monitoring and analyzing the network protocols used in the attack. For example, an attacker may switch from HTTP to HTTPS, or from a common application layer protocol to a more covert tunneling protocol. By identifying protocol types and their changes, attempts by attackers to circumvent protocol filtering or detection can be discovered. Its purpose is to discover changes in the attacker's protocol selection. Attack chain change stage analysis is performed based on the attack address change information, attack timing change information, and attack protocol change information to obtain attack chain change stage information. Attack chain change stage analysis refers to comprehensively analyzing the attack address change information, attack timing change information, and attack protocol change information to determine which stage of the attack chain the current attack behavior is in, and what changes have occurred at this stage compared to previous attack behaviors. For example, if both the attack address and protocol have changed, it may mean that the attacker is trying new delivery or command and control methods. Its purpose is to comprehensively understand the attacker's tactical adjustments.

[0131] Adjusting the target defense strategy based on the attack chain change phase information refers to dynamically modifying or updating the existing defense strategy according to the results of attack chain change phase analysis. For example, if it is discovered that the attacker is conducting a new reconnaissance phase, the defense strategy can be adjusted to strengthen the monitoring and blocking of external scanning behavior; if it is discovered that the attacker is trying a new command and control protocol, the firewall rules can be updated to block the traffic of that protocol. By introducing attack address change analysis, attack sequence change analysis, and attack protocol change analysis, the evolution trend of attack behavior can be captured more meticulously. This multi-dimensional and in-depth analysis makes the adjustment of the defense strategy more targeted, effectively responding to the attacker's constantly changing attack methods, and significantly improving the adaptability and effectiveness of the defense strategy. In addition, through attack chain change phase analysis, the overall attack situation can be grasped from a macro perspective, thereby making more forward-looking and global strategy adjustments, avoiding defense blind spots that may be caused by local optimization, and further enhancing the overall security resilience of the communication network.

[0132] In this embodiment of the invention, data streams and terminal device activity records in the communication network are acquired, and encrypted and unencrypted data streams are identified within the data streams for potential vulnerability analysis. This enables a more comprehensive and accurate discovery of potential vulnerabilities in the network. Potential intrusion attempt information is identified based on terminal device activity records, and a security risk assessment of the communication network is performed based on the target potential vulnerability information and potential intrusion attempt information. This achieves a comprehensive and dynamic assessment of network security risks, overcoming the limitations of single-dimensional assessments. An initial defense strategy is determined based on the security risk assessment results, and a strategy intent summary is generated based on the initial defense strategy to analyze the device-side policy carrying capacity. The initial defense strategy is optimized based on the device-side policy carrying capacity information, ensuring that the final determined defense strategy is both effective and does not exceed the device's performance limitations. Security protection of the communication network is performed based on the target defense strategy, and the real-time execution effect information of the target defense strategy is monitored. The target defense strategy is adjusted based on the real-time execution effect information, achieving adaptive and intelligent defense. This effectively addresses the dynamic and complex nature of network attacks, improving the overall security protection capability and response efficiency of the communication network.

[0133] Example 3

[0134] Please see Figure 3 , Figure 3 This is a schematic diagram of the structural composition of a security protection system for a communication network according to an embodiment of the present invention. The system includes:

[0135] Vulnerability analysis module 31: used to acquire transmission data streams and terminal device activity records in the communication network, identify encrypted and unencrypted data streams in the transmission data streams, and perform potential vulnerability analysis based on the encrypted and unencrypted data streams to obtain target potential vulnerability information;

[0136] Security risk assessment module 32: used to identify potential intrusion attempt information based on the activity records of the terminal device, and to conduct a security risk assessment of the communication network based on the target potential vulnerability information and the potential intrusion attempt information, so as to obtain the security risk assessment result;

[0137] Capability Analysis Module 33: Used to determine an initial defense strategy based on the security risk assessment results, generate a strategy intent summary based on the initial defense strategy, and perform device-side strategy carrying capacity analysis based on the strategy intent summary to obtain device-side strategy carrying capacity information;

[0138] Strategy optimization module 34: used to optimize the initial defense strategy based on the device-side policy carrying capacity information to obtain the target defense strategy;

[0139] Security protection module 35: used to perform security protection of the communication network based on the target defense strategy, and to monitor the real-time execution effect information of the target defense strategy when performing security protection of the communication network, and to adjust the target defense strategy based on the real-time execution effect information.

[0140] In the specific implementation of this invention, the specific implementation methods of the system items can be referred to the implementation methods of the above-mentioned method items, and will not be repeated here.

[0141] In this embodiment of the invention, data streams and terminal device activity records in the communication network are acquired, and encrypted and unencrypted data streams are identified within the data streams for potential vulnerability analysis. This enables a more comprehensive and accurate discovery of potential vulnerabilities in the network. Potential intrusion attempt information is identified based on terminal device activity records, and a security risk assessment of the communication network is performed based on the target potential vulnerability information and potential intrusion attempt information. This achieves a comprehensive and dynamic assessment of network security risks, overcoming the limitations of single-dimensional assessments. An initial defense strategy is determined based on the security risk assessment results, and a strategy intent summary is generated based on the initial defense strategy to analyze the device-side policy carrying capacity. The initial defense strategy is optimized based on the device-side policy carrying capacity information, ensuring that the final determined defense strategy is both effective and does not exceed the device's performance limitations. Security protection of the communication network is performed based on the target defense strategy, and the real-time execution effect information of the target defense strategy is monitored. The target defense strategy is adjusted based on the real-time execution effect information, achieving adaptive and intelligent defense. This effectively addresses the dynamic and complex nature of network attacks, improving the overall security protection capability and response efficiency of the communication network.

[0142] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc.

[0143] Furthermore, the security protection method and system for a communication network provided by the embodiments of the present invention have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A security protection method for a communication network, characterized in that, The method includes: The system acquires transmission data streams and terminal device activity records in the communication network, identifies encrypted and unencrypted data streams in the transmission data streams, and performs potential vulnerability analysis based on the encrypted and unencrypted data streams to obtain target potential vulnerability information. Based on the activity records of the terminal device, potential intrusion attempt information is identified, and based on the target potential vulnerability information and potential intrusion attempt information, a security risk assessment of the communication network is performed to obtain the security risk assessment result. An initial defense strategy is determined based on the security risk assessment results. A strategy intent summary is generated based on the initial defense strategy. The device-side strategy carrying capacity is analyzed based on the strategy intent summary to obtain device-side strategy carrying capacity information. The initial defense strategy is optimized based on the device-side policy carrying capacity information to obtain the target defense strategy; The target defense strategy is used to protect the security of the communication network, and the real-time execution effect information of the target defense strategy on the communication network is monitored. The target defense strategy is then adjusted based on the real-time execution effect information.

2. The security protection method for communication networks according to claim 1, characterized in that, The process of identifying encrypted and unencrypted data streams in the transmitted data stream, and performing potential vulnerability analysis based on the encrypted and unencrypted data streams to obtain target potential vulnerability information, includes: The transmitted data stream is subjected to protocol type identification to obtain a protocol type identification result, and encrypted data streams and unencrypted data streams in the transmitted data streams are distinguished based on the protocol type identification result; Deep protocol parsing is performed on the unencrypted data stream to obtain information on the first potential vulnerability. Behavioral feature extraction is performed on the encrypted data stream to obtain behavioral feature information; Identify the covert service type in the encrypted data stream based on the aforementioned behavioral feature information; Based on the aforementioned covert service type, covert service response behavior analysis is performed to obtain covert service response behavior information, and second potential vulnerability information is determined based on the covert service response behavior information. Target potential vulnerability information is generated based on the first and second potential vulnerability information.

3. The security protection method for communication networks according to claim 2, characterized in that, The step of extracting behavioral features from the encrypted data stream to obtain behavioral feature information includes: Obtain the transport layer header information of the encrypted data stream, and extract the handshake sequence, port number and IP address pair information based on the transport layer header information, and generate connection establishment mode feature information based on the handshake sequence, port number and IP address pair information; The encrypted data stream is subjected to packet length measurement to obtain packet length information, and packet size sequence information is constructed based on the packet length information; Determine the arrival timestamp of each data packet in the encrypted data stream, calculate the time interval between adjacent data packets in the encrypted data stream, and generate transmission timing features based on the arrival timestamps and time intervals; Obtain the session start time, session end time, and total number of bytes transmitted for the encrypted data stream, and determine the session duration based on the session start time, session end time, and total number of bytes transmitted; Based on the connection establishment mode feature information, data packet size sequence information, transmission timing features and session duration, a multi-dimensional feature set is determined, and traffic behavior pattern recognition is performed based on the multi-dimensional feature set to obtain traffic behavior pattern information; Behavioral feature information is determined based on the traffic behavior pattern information and the multi-dimensional feature set.

4. The security protection method for a communication network according to claim 3, characterized in that, The process of identifying traffic behavior patterns based on the multi-dimensional feature set to obtain traffic behavior pattern information includes: The multi-dimensional feature set is subjected to dimensionality reduction processing to obtain a dimensionality-reduced multi-dimensional feature set; Cluster analysis is performed on the multidimensional feature set after dimensionality reduction to obtain several flow clusters, and the internal dispersion of each flow cluster is calculated. The internal dispersion of each traffic cluster is compared with a preset dispersion threshold. Traffic clusters with an internal dispersion greater than or equal to the preset dispersion threshold are identified as potential threat traffic clusters, while traffic clusters with an internal dispersion less than the preset dispersion threshold are identified as normal traffic clusters. Traffic behavior features are extracted from potential threat traffic clusters to obtain traffic behavior feature information. The traffic behavior feature information is then compared with the behavior pattern features of malicious traffic to obtain the comparison results. Based on the comparison results and normal traffic clusters, traffic behavior pattern information is determined.

5. The security protection method for a communication network according to claim 4, characterized in that, The step of performing dimensionality reduction processing on the multi-dimensional feature set to obtain a dimensionality-reduced multi-dimensional feature set includes: Obtain feature source information of the multi-dimensional feature set, and divide the multi-dimensional feature set into several subsets based on the feature source information; Determine the data distribution characteristics of each subset, and determine the dimensionality reduction method corresponding to each subset based on the data distribution characteristics. Perform dimensionality reduction processing on each subset based on the dimensionality reduction method to obtain the dimensionality-reduced subset. All the dimensionality-reduced subsets are integrated to obtain a multi-dimensional feature set after dimensionality reduction.

6. The security protection method for a communication network according to claim 1, characterized in that, The security risk assessment of the communication network based on the target potential vulnerability information and potential intrusion attempt information, to obtain the security risk assessment results, includes: The target potential vulnerability information and potential intrusion attempt information are structured to obtain structured target potential vulnerability information and potential intrusion attempt information; Determine the topology, asset distribution, and logical connections of network devices in the communication network, and construct the graph structure of the communication network based on the topology, asset distribution, and logical connections of network devices; Based on the graph structure, attack path analysis is performed using the structured target potential vulnerability information and potential intrusion attempt information to obtain attack path information; Attack chain pattern analysis is performed based on the attack path information to obtain attack chain pattern information, and a security risk assessment of the communication network is conducted based on the attack chain pattern information to obtain the security risk assessment results.

7. The security protection method for a communication network according to claim 1, characterized in that, The process of generating a policy intent summary based on the initial defense strategy and performing device-side policy carrying capacity analysis based on the policy intent summary to obtain device-side policy carrying capacity information includes: Based on the initial defense strategy, a strategy intent summary is generated using a preset summary template; Real-time resource analysis of network boundary devices is performed based on the policy intent summary to obtain real-time resource information; Based on the policy intent summary, the policy processing capability of the network boundary device is analyzed to obtain policy processing capability information. Based on the real-time resource information and policy processing capability information, the device-side policy carrying capacity is analyzed to obtain device-side policy carrying capacity information.

8. The security protection method for a communication network according to claim 1, characterized in that, The optimization of the initial defense strategy based on the device-side policy carrying capacity information to obtain the target defense strategy includes: A capability feedback message is generated based on the device-side policy carrying capacity information; Based on the capability feedback message, the initial defense strategy is optimized using preset execution logic to obtain the target defense strategy.

9. The security protection method for a communication network according to claim 1, characterized in that, The monitoring target defense strategy provides real-time performance information on the security protection of the communication network, and adjusts the target defense strategy based on the real-time performance information, including: The system acquires network traffic data, terminal activity records, and security event records when the target defense strategy protects the communication network, and generates real-time execution effect information based on the network traffic data, terminal activity records, and security event records. Based on the real-time execution effect information, attack address change analysis is performed to obtain attack address change information; based on the real-time execution effect information, attack timing change analysis is performed to obtain attack timing change information. Based on the real-time execution effect information, attack protocol change analysis is performed to obtain attack protocol change information. Based on the attack address change information, attack timing change information, and attack protocol change information, attack chain change stage analysis is performed to obtain attack chain change stage information. The target defense strategy is adjusted based on the attack chain change stage information.

10. A security protection system for a communication network, characterized in that, The system includes: Vulnerability Analysis Module: Used to acquire transmission data streams and terminal device activity records in the communication network, identify encrypted and unencrypted data streams in the transmission data streams, and perform potential vulnerability analysis based on the encrypted and unencrypted data streams to obtain target potential vulnerability information; Security risk assessment module: used to identify potential intrusion attempt information based on the activity records of the terminal device, and to conduct a security risk assessment of the communication network based on the target potential vulnerability information and potential intrusion attempt information, so as to obtain the security risk assessment result; Capability Analysis Module: Used to determine the initial defense strategy based on the security risk assessment results, generate a strategy intent summary based on the initial defense strategy, and perform device-side strategy carrying capacity analysis based on the strategy intent summary to obtain device-side strategy carrying capacity information; Strategy optimization module: used to optimize the initial defense strategy based on the device-side policy carrying capacity information to obtain the target defense strategy; Security Protection Module: Used to perform security protection of the communication network based on the target defense strategy, monitor the real-time execution effect information of the target defense strategy when performing security protection of the communication network, and adjust the target defense strategy based on the real-time execution effect information.

Images