Method and system for encrypted traffic monitoring based on multi-modal perception and confidence assessment

Abstract

The application provides an encrypted traffic monitoring method and system based on multi-modal perception and confidence evaluation, belonging to the technical field of network data security. The system comprises: a data preprocessing engine for preprocessing and feature extraction of encrypted traffic data to obtain a session feature vector; a feature sample dynamic compressor for adaptively switching compression strategies according to data flow destination and resource occupancy rate, and compressing the session feature vector according to the switched compression strategy; a global system coordination and scheduling controller for scheduling the session feature vector to a processing module group; the processing module group comprises an asymmetric adversarial defense perception module, a multi-granularity flow interaction graph construction module and a dynamic confidence fitting and topology perception analyzer; and a task polling type model training engine forms a model evolution feedback cycle with model files and structured knowledge stored in a model warehouse and a knowledge base and the processing module group. The application can solve the problems of reduced detection capability, unreliable decision and poor adaptability in the prior art.

Description

Technical Field

[0001] This application belongs to the field of network data security technology, specifically relating to an encrypted traffic monitoring method and system based on multimodal perception and confidence assessment. Background Technology

[0002] With the widespread adoption of encryption for network data communication, encryption protocols such as HTTPS and TLS have become the mainstream, rendering traditional traffic detection techniques based on plaintext parsing increasingly ineffective. Against this backdrop, intelligent monitoring of encrypted traffic has become a crucial means of ensuring network data security.

[0003] Existing typical solutions for encrypted traffic monitoring rely on deep learning models to classify and identify the statistical characteristics or temporal patterns of encrypted traffic, combining session reconstruction and feature extraction to determine abnormal behavior. Some advanced systems introduce graph structures to model the relationships between network entities and update the detection model through periodic offline training to cope with traffic evolution. These methods improve detection accuracy to some extent, but are still limited to single-point analysis and static model architecture. This is because existing intelligent encrypted traffic monitoring solutions mostly adopt adversarial defense methods, which often employ a symmetrical approach, meaning the defender needs to simulate attacker behavior or obtain attack samples for training, resulting in high defense costs and difficulty in dealing with unknown attacks.

[0004] In summary, current encrypted traffic monitoring systems generally suffer from three major defects: First, they lack adversarial sample defense mechanisms, allowing attackers to mislead model outputs through minor perturbations, resulting in security blind spots; second, the decision-making process relies on the confidence level of a single model, failing to integrate contextual information such as network topology, path strategies, and historical behavioral characteristics, leading to frequent false positives and false negatives; and third, model updates are lagging behind, making it impossible to respond in a closed loop to new attack variants and protocol evolutions, thus hindering long-term effectiveness. Summary of the Invention

[0005] This application aims to provide a method and system for monitoring encrypted traffic data based on multimodal perception and confidence assessment, which can solve the problems of decreased detection capability, unreliable decision-making, and poor adaptability of existing encrypted traffic monitoring systems when facing adversarial attacks, missing context, and model drift.

[0006] According to a first aspect of this application, this application provides an encrypted traffic monitoring system based on multimodal perception and confidence assessment, comprising: a data preprocessing engine, a feature sample dynamic compressor, a global system coordination and scheduling controller, a processing module group, a task polling model training engine, and a model repository and knowledge base, connected in sequence; wherein,

[0007] The data preprocessing engine is used to preprocess and extract features from encrypted traffic data to obtain session feature vectors;

[0008] The feature sample dynamic compressor is used to adaptively switch compression strategies based on the current data flow destination and the real-time resource utilization of the system, and compress the session feature vectors according to the switched compression strategies.

[0009] The global system coordination and scheduling controller is used to schedule the compressed session feature vectors to the processing module group;

[0010] The processing module group includes an asymmetric adversarial defense perception module, a multi-granularity flow interaction graph construction module, and a dynamic confidence fitting and topology-aware analyzer. The asymmetric adversarial defense perception module applies perturbations to the input feature vectors to obtain robustly enhanced session feature vectors. The multi-granularity flow interaction graph construction module constructs a multi-granularity flow interaction graph of the session feature vectors, uses a graph neural network algorithm to learn the multi-granularity flow interaction graph, and generates node embedding vectors. The dynamic confidence fitting and topology-aware analyzer performs multi-source verification on the node embedding vectors based on the multi-granularity flow interaction graph and calculates the calibration confidence using a fitting function.

[0011] The task-based polling model training engine uses model files and structured knowledge stored in the model repository and knowledge base to form a model evolution feedback loop with the processing module group.

[0012] Preferably, in the above system, the data preprocessing engine is configured to: identify the encryption protocol type of the encrypted traffic data; perform session-level segmentation of the transmission control protocol stream of the encrypted traffic data to obtain multiple session streams; clean and filter abnormal data in the session streams, and extract the session feature vector in each session stream.

[0013] Preferably, in the above system, the feature sample dynamic compressor is configured to: adaptively select a lossy compression strategy or a lossless compression strategy based on the current data flow destination and the system's real-time load, in order to balance data flow efficiency and feature fidelity; wherein, when the current data flow destination is online analysis and the system's real-time load is less than or equal to a preset load threshold, a lossless compression strategy is selected to ensure the feature integrity of the session feature vector; when the current data flow destination is offline training or the system load exceeds the preset load threshold, a lossy compression algorithm is selected to compress or reduce the dimensionality of the session feature vector.

[0014] Preferably, in the above system, the global system coordination and scheduling controller is configured to: perform cross-module task distribution, resource allocation, circuit breaking for abnormal states, and lifecycle management on the compressed session feature vector; wherein, the global system coordination and scheduling controller adopts an event-driven architecture and supports publish-subscribe and request-response dual-mode communication; the global system coordination and scheduling controller is used to continuously monitor the health status of each module in the processing module group through a heartbeat detection mechanism, and dynamically adjust the priority and concurrency of scheduling tasks according to the preset service level agreement strategy.

[0015] Preferably, in the above system, the asymmetric adversarial defense perception module is configured to: load the target classification model and freeze the model parameters of the target classification model; apply a perturbation that conforms to the infinite norm constraint to the input session feature vector, and generate adversarial samples containing the perturbation using a gradient-based adversarial sample generation method; input the adversarial samples into the target classification model and extract the perturbated features output by the target classification model; and generate robust session feature vectors by comparing the difference in the response of the target classification model to the original features and the perturbated features, and the entire process of generating session feature vectors is completed independently at the monitoring end.

[0016] Preferably, in the above system, the multi-granularity flow interaction graph construction module is configured to: construct a flow interaction graph containing flow nodes, terminal nodes, and network topology nodes; wherein, flow nodes represent data flows, terminal nodes represent hosts, and network topology nodes represent routers or switches; in the flow interaction graph, the edge relationships between nodes are constructed based on one or more of the following relationships: communication relationships, service semantics, physical path constraints, and time window proximity; and the flow interaction graph is learned using a graph neural network algorithm to generate node embedding vectors.

[0017] Preferably, in the above system, the dynamic confidence fitting and topology-aware analyzer is configured to: receive the classification output of the node embedding vector from the preliminary classification model; perform multi-source verification on the classification output based on the topological consistency of the flow interaction graph, the path rationality specified by the network policy library, and the baseline of historical behavior patterns; wherein, the multi-source verification is achieved through three-level weighted fusion, which includes the first-level verification of topological consistency, the second-level verification of path rationality, and the third-level verification of deviation from the behavioral baseline; calculate the calibration confidence of the classification output after multi-source verification through a fitting function, and convert the binary classification decision result corresponding to the calibration confidence into a multi-level decision output containing at least three confidence levels.

[0018] Preferably, in the above system, the task polling model training engine includes a task scheduler, a data quality pipeline, and a model evaluation and deployment unit; wherein, the task scheduler is used to automatically trigger the model training process according to a preset schedule or event-driven approach; the data quality pipeline is used to filter, denoise, and standardize the observable data throughout the system operation process; and the model evaluation and deployment unit is used to determine the deployment, archiving, or rollback of new models based on preset performance index thresholds to address model drift.

[0019] Preferably, in the above system, the model repository is used to store model files and related metadata tags for each version of the model; the knowledge base is used to store structured knowledge of network policies, attack behavior patterns and protocol specifications, as well as metadata tags; the model repository and the knowledge base adopt a loosely coupled design and are associated with each other through a unified resource identifier and metadata tags to support the co-evolution of models.

[0020] According to a second aspect of this application, this application provides an encrypted traffic monitoring method based on multimodal perception and confidence assessment. This method is based on the system provided by any of the aforementioned technical solutions. The method includes: preprocessing and extracting features from encrypted traffic data using a data preprocessing engine to obtain a session feature vector; adaptively switching compression strategies according to the current data flow destination and the system's real-time resource occupancy rate using a feature sample dynamic compressor, and compressing the session feature vector according to the switched compression strategy; and scheduling the compressed session feature vector to the asymmetric adversarial defense perception module and the multi-granularity traffic exchange module using a global system coordination and scheduling controller. The system is processed by an inter-graph construction module; an asymmetric adversarial defense perception module applies perturbations to the input features and generates robust conversation feature vectors; a multi-granularity flow interaction graph construction module constructs the multi-granularity flow interaction graph corresponding to the conversation feature vectors and generates node embedding vectors; a dynamic confidence fitting and topology-aware analyzer performs multi-source verification on the node embedding vectors based on the multi-granularity flow interaction graph and calculates the calibration confidence using a fitting function; a final security decision is generated and executed based on the confidence level; and a task-polling model training engine automatically triggers the model update process within the processing module group based on system feedback data, achieving closed-loop evolution of the system.

[0021] Preferably, in the above method, the asymmetric adversarial defense perception module applies perturbation to the input features and generates a robust session feature vector, including: generating a slight perturbation under an infinite norm constraint; calculating the target model's response to the original features and the perturbated features respectively; and generating a robust feature vector by weighted fusion based on the response differences.

[0022] Preferably, in the above method, the system feedback data includes: confidence calibration results, security decision execution logs, false alarm rate and false negative rate statistics, and manually reviewed and labeled data.

[0023] The encrypted traffic monitoring scheme based on multimodal perception and confidence assessment provided in this application uses a data preprocessing engine to preprocess and extract features from encrypted traffic data to obtain session feature vectors. This allows for data filtering, noise reduction, and standardization, effectively reducing data pollution. A dynamic feature sample compressor adaptively switches compression strategies based on the data flow destination and real-time system resource utilization, compressing the session feature vectors according to the adaptively switched compression strategies. This allows for adaptive lossy or lossless compression based on data flow and system load, balancing data flow efficiency and feature fidelity. After the session feature vectors are scheduled to the processing module group, the asymmetric defense perception module of the processing module group... The input side applies perturbations to the session feature vector to obtain a robust session feature vector. This allows the monitoring end to proactively generate perturbations and verify response differences through an asymmetric adversarial defense mechanism, improving the model's anti-interference capability. By constructing a multi-granularity flow interaction graph and fusing topology, policy, and historical behavior for multi-source verification, and calibrating confidence through a fitting function, the reliability and interpretability of decisions are enhanced. Finally, the task-polling model training engine forms a model evolution feedback loop through model files stored in the model repository and knowledge base, along with structured knowledge and processing modules, driving periodic model iteration. This effectively addresses the evolution of encrypted traffic and model drift, achieving high security, high adaptability, and sustainable intelligent monitoring capabilities. In summary, the above methods solve the problems of existing technologies lacking adversarial sample defense mechanisms, leading to attackers misleading model outputs with minor perturbations and creating security blind spots; the decision-making process relying on a single model confidence level without integrating contextual information such as network topology, path policies, and historical feature behavior, resulting in frequent false positives and false negatives; and the technical problems of lagging model updates, inability to respond to new attack variants and protocol evolutions in a closed loop, and difficulty in maintaining long-term effectiveness. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0025] Figure 1 A schematic diagram of the structure of an encrypted traffic monitoring system based on multimodal perception and confidence assessment provided in an embodiment of this application;

[0026] Figure 2 for Figure 1 The illustrated embodiment provides a schematic diagram of the processing flow of a main application system;

[0027] Figure 3A flowchart illustrating an encrypted traffic monitoring method based on multimodal perception and confidence assessment, provided for an embodiment of this application;

[0028] Figure 4 A schematic diagram illustrating the workflow of a feature sample dynamic compressor provided in this application embodiment;

[0029] Figure 5 A processing flowchart of an asymmetric adversarial defense perception module provided in an embodiment of this application;

[0030] Figure 6 A processing flowchart of a multi-granularity flow interaction graph construction module provided in an embodiment of this application;

[0031] Figure 7 A flowchart of a dynamic confidence fitting and topology sensing analyzer provided in this application embodiment;

[0032] Figure 8 This is a flowchart illustrating the processing of a task polling-based model training engine provided in an embodiment of this application. Detailed Implementation

[0033] To more clearly illustrate the overall concept of this application, a detailed explanation is provided below with reference to the accompanying drawings.

[0034] Many specific details are set forth in the following description to provide a thorough understanding of this application. However, this application may also be implemented in other ways different from those described herein. Therefore, the scope of protection of this application is not limited to the specific embodiments disclosed below. It should be noted that, unless otherwise specified, the embodiments of this application and the features thereof can be combined with each other.

[0035] In this application, unless otherwise expressly specified and limited, the descriptions using terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0036] The existing technology has the following technical problems:

[0037] Current encrypted traffic monitoring systems generally suffer from three major defects: First, they lack adversarial sample defense mechanisms, allowing attackers to mislead model outputs through minor perturbations, resulting in security blind spots; second, the decision-making process relies on the confidence level of a single model, failing to integrate contextual information such as network topology, path strategies, and historical behavioral characteristics, leading to frequent false positives and false negatives; and third, the models are outdated, unable to respond in a closed loop to new attack variants and protocol evolutions, making it difficult to maintain long-term effectiveness.

[0038] To address the aforementioned technical challenges, this application provides an encrypted traffic monitoring scheme based on multimodal perception and confidence assessment. This scheme enables asymmetric adversarial defense without requiring model retraining or attack sample acquisition. The multi-granularity flow interaction graph and confidence calibration mechanism work together, and the task polling engine enables closed-loop model evolution. By combining these solutions, the scheme can solve the problems of decreased detection capability, unreliable decision-making, and poor adaptability in existing encrypted traffic monitoring systems when facing adversarial attacks, missing context, and model drift. This approach balances the real-time performance, robustness, and long-term effectiveness of traffic monitoring.

[0039] To achieve the above objectives, see [link to relevant documentation]. Figure 1 , Figure 1 This is a schematic diagram illustrating the structure of an encrypted traffic monitoring system based on multimodal sensing and confidence assessment, provided as an embodiment of this application. Figure 1 As shown, the encrypted traffic monitoring system based on multimodal perception and confidence assessment includes: a data preprocessing engine 100, a feature sample dynamic compressor 200, a global system coordination and scheduling controller 300, a processing module group 400, a task polling model training engine 500, and a model warehouse and knowledge base 600, which are connected in sequence.

[0040] The data preprocessing engine 100, the feature sample dynamic compressor 200, the global system coordination and scheduling controller 300, the processing module group 400, the task polling model training engine 500, and the model warehouse and knowledge base 600 are connected in sequence. This constructs a closed-loop architecture that includes data preprocessing, feature compression, multimodal analysis, collaborative decision-making, and model self-evolution capabilities, solving the problems of weak robustness under adversarial attacks, single decision basis, and lagging model updates in traditional systems.

[0041] Through the organic coupling and bidirectional feedback mechanism of the aforementioned hierarchical functional modules, unified orchestration of data flow, control flow, and model flow can be achieved. Specifically, starting with the data preprocessing engine 100, dynamic compression and intelligent scheduling drive the multimodal analysis engine to work collaboratively, and confidence calibration is used to complete the decision output. Finally, the task-polling training engine triggers iterative model updates based on actual operational feedback, maintaining the long-term effectiveness of the system without relying on manual intervention. The modules are not loosely stacked, but rather form a strongly correlated architecture through clear data interface protocols, temporal constraints, and state synchronization mechanisms, ensuring determinism, observability, and traceability throughout the entire processing chain.

[0042] like Figure 1 and Figure 2 As shown, in the above hierarchical functional modules:

[0043] The data preprocessing engine 100 is used to preprocess and extract features from encrypted traffic data to obtain session feature vectors.

[0044] The data preprocessing engine 100 is used to perform protocol identification, session reassembly, data cleaning, timestamp alignment, and basic statistical feature extraction on the raw encrypted traffic data packets. Through preprocessing processes such as cleaning, noise reduction, and standardization of encrypted traffic data, data drift can be reduced and clear and accurate session feature vectors can be obtained.

[0045] Specifically, as a preferred embodiment, Figure 1 In the encrypted traffic monitoring system based on multimodal perception and confidence assessment shown, the data preprocessing engine 100 is configured to: identify the encryption protocol type of the encrypted traffic data; perform session-level segmentation of the transmission control protocol stream of the encrypted traffic data to obtain multiple session streams; clean and filter abnormal data in the session streams, and extract the session feature vector in each session stream.

[0046] The data preprocessing engine 100 is implemented in ways including, but not limited to: using Deep Packet Inspection (DPI) technology to parse the handshake fields of Transport Layer Security (TLS) and Secure Sockets Layer (SSL) to identify the encryption protocol type of encrypted traffic data; employing a sliding window method to perform session-level segmentation of the Transmission Control Protocol (TCP) stream; and obtaining multiple session streams through these methods. Unencrypted traffic (such as plaintext DNS queries), invalid or incomplete session streams, and abnormal data packets that clearly do not conform to protocol specifications are cleaned and filtered out. After obtaining the cleaned and filtered multiple session streams, 128-dimensional lightweight statistical features, such as byte distribution entropy, packet length sequence, round-trip time jitter, and TLS extension field combinations, are extracted for each session as session feature vectors.

[0047] It should be noted that the data preprocessing engine 100 supports hardware acceleration cards (such as Intel DPUs) to offload part of the computing load, and can also be deployed in software-defined networking (SDN) controllers as a northbound analysis plugin; its output is a structured session feature vector sequence, the format of which conforms to the Apache Avro Schema definition, making it easy for downstream modules to consume directly.

[0048] Figure 1 The encrypted traffic monitoring system based on multimodal perception and confidence assessment provided in the illustrated embodiment further includes:

[0049] The Feature Sample Dynamic Compressor 200, also known as the Traffic Feature Sample Dynamic Fitting Compressor, is used to adaptively switch compression strategies based on the current data flow destination and the real-time system resource utilization rate, and compress session feature vectors according to the switched compression strategies.

[0050] As the core module of the system, the feature sample dynamic compressor 200 can adaptively select lossy or lossless compression strategies to process feature vectors based on the current data flow destination (online analysis or offline training) and the real-time load of the system, so as to balance data flow efficiency and feature fidelity.

[0051] Specifically, as a preferred embodiment, combined with Figure 4 As shown in the processing flow of the feature sample dynamic compressor, in the encrypted traffic monitoring system based on multimodal perception and confidence assessment provided in this application embodiment, the feature sample dynamic compressor 200 is configured to: adaptively select a lossy compression strategy or a lossless compression strategy according to the current data flow destination and the real-time system load, so as to balance data flow efficiency and feature fidelity; wherein, when the current data flow destination is online analysis and the real-time system load is less than or equal to a preset load threshold, a lossless compression strategy is selected to ensure the feature integrity of the session feature vector; when the current data flow destination is offline training or the system load exceeds the preset load threshold, a lossy compression algorithm is selected to compress or reduce the dimensionality of the session feature vector.

[0052] The feature sample dynamic compressor 200 receives feature vectors from the data preprocessing engine 100 and automatically switches compression strategies based on the current data flow destination (i.e., whether the target is real-time online analysis or offline model training) and the system's real-time resource utilization (specifically triggered by any one of the following conditions: CPU utilization ≥ 85%, memory bandwidth utilization ≥ 90%, and GPU memory utilization ≥ 75%).

[0053] The adaptive switching compression strategy of the feature sample dynamic compressor 200 includes: when the current data flow destination is online analysis and the system load is at a low to medium level (e.g., CPU utilization less than 85%, memory bandwidth utilization less than 90%, and GPU memory utilization less than 75%), the lossless compression algorithm LZ4 is enabled, which has a compression ratio of approximately 1:2.3, ensuring feature integrity; when the target is offline training or the system load exceeds the above threshold, the lossy compression algorithm Principal Component Analysis (PCA) dimensionality reduction (retaining the first 95% of variance) or Vector Quantization (VQ) is enabled to compress the original 50-dimensional features to 8–16 dimensions, sacrificing some fine-grained differences in exchange for increased throughput; the feature sample dynamic compressor 200 has a built-in policy decision unit, whose decision logic is embedded in the field-programmable gate array (FPGA) logic unit, with a response latency of less than 10μs; alternative solutions include: using an attention-based learnable compression head LCH, which optimizes the compression fidelity weights through end-to-end backpropagation.

[0054] Figure 1 The global system coordination and scheduling controller 300 shown is used to schedule the compressed session feature vector to the processing module group 400.

[0055] The global system coordination and scheduling controller 300, as the system's central hub, is responsible for cross-module task distribution, resource quota allocation, circuit breaking in abnormal states, and lifecycle management. It can schedule compressed session feature vectors to the asymmetric adversarial defense perception module 401, the multi-granularity flow interaction graph construction module 402, or the dynamic confidence fitting and topology-aware analyzer 403 within the processing module group 400.

[0056] Specifically, as a preferred embodiment, in the aforementioned encrypted traffic monitoring system based on multimodal perception and confidence assessment, the global system coordination and scheduling controller 300 is configured to: perform cross-module task distribution, resource allocation, circuit breaking for abnormal states, and lifecycle management on the compressed session feature vector; wherein, the global system coordination and scheduling controller 300 adopts an event-driven architecture and supports publish-subscribe and request-response dual-mode communication; the global system coordination and scheduling controller 300 is used to continuously monitor the health status of each module in the processing module group 400 through a heartbeat detection mechanism, and dynamically adjust the priority and concurrency of scheduling tasks according to a preset service level agreement strategy.

[0057] The Global System Coordination and Scheduling Controller 300, acting as the system's central hub, is responsible for cross-module task distribution, resource quota allocation, circuit breaking in case of abnormal states, and lifecycle management. The Global System Coordination and Scheduling Controller 300 adopts an event-driven architecture and incorporates a lightweight message bus based on the asynchronous messaging library ZeroMQ. This lightweight message bus supports dual-mode communication of publish-subscribe and request-response. Through a heartbeat mechanism, the Global System Coordination and Scheduling Controller 300 continuously monitors the health status of each module within the processing module group 400 and dynamically adjusts task priorities and concurrency based on preset Service Level Agreement (SLA) policies (e.g., single analysis latency ≤200ms, confidence calibration failure rate <0.5%). Its scheduling strategies support multiple modes, including weighted round-robin, Shortest Remaining Time First (SRTF), and topology-aware routing (prioritizing traffic within the same subnet to locally deployed modules). It should be noted that the Global System Coordination and Scheduling Controller 300 can be deployed as an independent microservice container or embedded in the Kubernetes Operator (an extension based on custom K8s resources and controllers) to achieve cloud-native orchestration.

[0058] like Figure 1 and Figure 2 As shown, the processing module group 400 includes an asymmetric adversarial defense perception module 401, a multi-granularity flow interaction graph construction module 402, and a dynamic confidence fitting and topology perception analyzer 403.

[0059] In the technical solution provided in this application embodiment, the processing module group 400 can realize multi-module collaboration, specifically including an asymmetric adversarial defense perception module 401, a multi-granularity flow interaction graph construction module 402, and a dynamic confidence fitting and topology perception analyzer 403. Additionally... Figure 1 The encrypted traffic monitoring system shown also includes a task-polling model training engine 500 that forms a feedback loop with the processing module group 400, as well as a model repository and knowledge base 600; thus, the entire system constitutes a complete closed loop from data perception, multimodal analysis, decision execution to model evolution feedback. It should be noted that in the asymmetric adversarial defense perception module 401, the "asymmetric" characteristic is reflected in the fact that the entire system only actively generates adversarial perturbations and analyzes the model response at the defense end (monitoring side), without needing to obtain attack samples or simulate attacker behavior, thereby achieving unidirectional defense enhancement.

[0060] like Figure 1 As shown, the asymmetric adversarial defense perception module 401 is used to apply perturbation to the session feature vector on the input side to obtain a robust session feature vector.

[0061] See Figure 1 In the technical solution provided in this application embodiment, the asymmetric adversarial defense perception module 401, namely... Figure 2Module A in the model employs a gradient-based adversarial example generation method, which applies a slight perturbation to the input traffic features that conforms to the infinite norm (also known as the maximum norm, L∞ norm) constraint. By comparing the difference in the target model's response to the original features and the perturbated features, a robust feature vector is generated, and this process can be completed independently at the monitoring end.

[0062] The multi-granularity flow interaction graph construction module 402 is used to construct a multi-granularity flow interaction graph of session feature vectors. The graph neural network algorithm is used to learn the multi-granularity flow interaction graph and generate node embedding vectors.

[0063] See Figure 1 Multi-granularity flow interaction graph construction module 402, namely Figure 2 In module B, the flow interaction graph includes flow nodes representing data flows, terminal nodes representing hosts, and network topology nodes representing routers and switches. The edges between nodes are constructed based on one or more of the following relationships: communication relationship, service semantics, physical path constraints, and time window proximity. The graph neural network algorithm is used to learn this multi-granularity flow interaction graph to generate node embedding vectors.

[0064] The dynamic confidence fitting and topology-aware analyzer 403 is used to perform multi-source verification of node embedding vectors based on multi-granularity flow interaction graphs and calculate calibration confidence through a fitting function.

[0065] See Figure 1 Dynamic confidence fitting and topology-aware analyzer 403 (i.e. Figure 2 Module C receives the output from the preliminary classification model and performs multi-source verification based on the topological consistency of the flow interaction graph, the rationality of the path specified by the network policy library, and the baseline of historical behavior patterns. It calculates the calibrated final confidence score or level through a fitting function and upgrades the binary classification decision to a multi-level confidence decision.

[0066] In summary, the technical solution provided in this application embodiment comprises an asymmetric adversarial defense perception module 401 (module A above), a multi-granularity flow interaction graph construction module 402 (module B above), and a dynamic confidence fitting and topology perception analyzer 403 (module C above). It receives compressed and scheduled feature data, completes dedicated analysis tasks, and then integrates intermediate results into a unified analysis bus. The processing module group 400 adopts a loosely coupled design, and the modules exchange structured data through standardized API interfaces (e.g., REST over gRPC), supporting hot-swappable replacement.

[0067] Specifically, the asymmetric adversarial defense perception module 401 outputs enhanced feature vectors, and the multi-granularity flow interaction graph construction module 402 outputs node embedding vectors. Both are encapsulated using a data serialization protocol (e.g., Protocol Buffer v3) for unified use by subsequent analyzers. This design allows for heterogeneous deployment of modules—for example, deploying the graph construction module on a GPU cluster and the adversarial perception module on a low-latency FPGA node. The asymmetric adversarial defense perception module 401 and the multi-granularity flow interaction graph construction module 402 adopt a loosely coupled parallel architecture: the former handles single-flow feature robustness enhancement, while the latter constructs cross-flow topology relationships; the two have no direct data dependency. The global system coordination and scheduling controller allocates independent computing resources to both modules and merges the processing results through an asynchronous message bus. When resources are limited, the real-time requirements of the adversarial defense module (latency ≤ 10ms) are prioritized, allowing the graph construction module to adopt an incremental update strategy.

[0068] Furthermore, as a preferred embodiment, in the above-described encrypted traffic monitoring system, the asymmetric adversarial defense sensing module 401 is configured as follows:

[0069] Load the target classification model and freeze its parameters; apply a perturbation to the input session feature vector that conforms to the infinite norm constraint, and generate adversarial examples containing the perturbation using a gradient-based adversarial example generation method; input the adversarial examples into the target classification model and extract the perturbated features output by the target classification model; generate robust session feature vectors by comparing the differences in the target classification model's responses to the original features and the perturbated features, and complete the process independently at the monitoring end.

[0070] See Figure 1 Asymmetric Adversarial Defense Perception Module 401 ( Figure 2 Module A) implements lightweight robustness enhancements for the encrypted traffic feature space, without altering the original model structure, applying perturbations only to the input side. Specifically, it loads the target classification model to be protected (e.g., the gradient boosting decision tree framework LightGBM or the small self-attention-based deep learning model framework Transformer), freezes its parameters, and calculates the gradient on the input feature vector x. x L(f(x),y) generates a perturbation δ under the L∞ norm constraint ‖δ‖∞≤ε (ε ranges from 0.01 to 0.05), constructing an adversarial example x′ = x +δ; then x and x′ are input into the target model respectively, and the outputs h and h′ of the last hidden layer are extracted. The results are then analyzed using cosine similarity sim(h,h′) or relative entropy (KL divergence) D. kl (f(x)‖f(x′)) quantifies the response difference and generates a robust enhancement vector z = α·h + (1 α)·h′(α∈[0.6,0.8];This module runs entirely within the monitoring end (input side) device without accessing the cloud model or original training data; its alternative implementations include: using the Projected Gradient Descent (PGD) method for multi-step iterative perturbation generation, or using L2 norm constraints (ridge regression constraints) to adapt to different feature scales.

[0071] In addition, as a preferred embodiment, in the above-mentioned encrypted traffic monitoring system, the multi-granularity flow interaction graph construction module 402 is configured to: construct a flow interaction graph containing flow nodes, terminal nodes, and network topology nodes; wherein, flow nodes represent data flows, terminal nodes represent hosts, and network topology nodes represent routers or switches; in the flow interaction graph, the edge relationships between nodes are constructed based on one or more of the following relationships: communication relationships, service semantics, physical path constraints, and time window proximity; and the flow interaction graph is learned using a graph neural network algorithm to generate node embedding vectors.

[0072] like Figure 1 As shown, the multi-granularity flow interaction graph construction module 402 (core module B) constructs a heterogeneous network graph structure. Its node types include three categories: Flow Nodes, which represent a single encrypted session, with attributes including a 5-tuple hash value, TLS fingerprint, cipher suite ID, and session duration; Terminal Nodes, which represent host devices, with attributes including IP address class, Autonomous System Number (AS number), operating system fingerprint, and set of open ports; and Topology Nodes, which represent routers or switches, with attributes including the number of BGP neighbors (the number of remote devices that have established peer (neighbor) relationships through the BGP protocol), the Open Shortest Path First (OSPF) regional autonomous system identifier used for classification, and the number of physical ports. Edge relationships between nodes are established based on one or a combination of four rules: communication relationships (bidirectional message exchange within the same 5-tuple), service semantics (HTTP / 2 flows). The module includes several key features: association with backend API gateway nodes, physical path constraints (connecting nodes with ≤3 hops based on Traceroute), and temporal window proximity (connecting terminal nodes that initiate a session within a sliding time window Δt=60s). The graph neural network uses an unsupervised / semi-supervised GNN algorithm (e.g., GraphSAGE) architecture with an aggregation radius of 2 layers, each hidden layer having a dimension of 128, and the activation function being Gaussian error linear unit (GELU). The output node embedding vector is used for subsequent topology consistency verification. This module supports incremental graph construction; new incoming sessions only trigger local subgraph updates, avoiding full graph recalculation.

[0073] In addition, as a preferred embodiment, such as Figure 1As shown, in the above-mentioned encrypted traffic monitoring system, the dynamic confidence fitting and topology-aware analyzer 403 is configured as follows:

[0074] The system receives the classification output of the node embedding vectors from the preliminary classification model; based on the topological consistency of the flow interaction graph, the path rationality specified by the network policy library, and the baseline of historical behavior patterns, it performs multi-source verification on the classification output; the multi-source verification is achieved through three-level weighted fusion, which includes the first level of topological consistency verification, the second level of path rationality verification, and the third level of behavior baseline deviation verification; the system calculates the calibration confidence of the classification output after multi-source verification through a fitting function, and converts the binary classification decision result corresponding to the calibration confidence into a multi-level decision output containing at least three confidence levels.

[0075] like Figure 1 and Figure 2 As shown, in the technical solution provided in this application embodiment, the dynamic confidence fitting and topology-aware analyzer 403 (core module C) receives the output of the preliminary classification model (such as binary classification labels and original confidence scores), and simultaneously accesses the topology information of the multi-granularity flow interaction graph, the predefined legal path rules in the network policy library (such as "database servers must not be directly connected to the Internet exit"), and the historical behavior pattern baseline (such as the average number of outbound domain names of a certain office terminal per day ±2σ); its multi-source verification is achieved through three-level weighted fusion: the first level verifies the consistency of the topology structure by calculating the Euclidean distance between the current session's corresponding flow node and its associated terminal node and topology node in the graph embedding space, the smaller the distance, the more the path conforms to the network physical layout; the second level verifies the rationality of the path by performing a directed acyclic graph (DAG) matching between the actual communication path and the whitelisted paths in the policy library, and triggering a penalty item if the matching fails; the third level verifies the deviation of the behavior baseline by using the Holt-Winters exponential smoothing method to predict the baseline value of the current period and calculating the standardized residual between the actual observed value and the predicted value; finally, it is fitted by a learnable function:

[0076] F(·) = σ(w1·d1+ w2·p2+ w3·b3+ b)

[0077] The calibration confidence score is calculated, where σ is the Sigmoid function, d1∈[0,1] represents the topology consistency score (a larger value indicates better conformity to the network physical layout), p2∈{0,1} represents the path rationality score (1 indicates conformity to the path specified by the policy library), b3∈[0,1] represents the historical behavior baseline conformity (1 minus the absolute value of the standardized residual), w1, w2, and w3 are trainable weights, and b is a bias term; this analyzer supports online fine-tuning of the weights w i The learning rate η = 1e -4 It is updated once every 10,000 decisions.

[0078] Figure 1 The encrypted traffic monitoring system provided in the illustrated embodiment also includes: a task polling model training engine 500, which uses model files and structured knowledge stored in the model repository and knowledge base 600 to form a model evolution feedback loop with the processing module group 400.

[0079] The technical solution provided in this application embodiment, because the task polling model training engine 500 and the above-mentioned model warehouse and knowledge base 600 form a feedback closed loop, enables the encrypted traffic monitoring system to continuously optimize the model and rules based on real operation feedback, effectively cope with model drift caused by encryption protocol upgrades and new attack variants, and fundamentally overcome the capability degradation bottleneck of the traditional system's "deployment is fixed".

[0080] Specifically, as a preferred embodiment, in the above-described encrypted traffic monitoring system, the task polling model training engine 500 includes:

[0081] The system comprises a task scheduler, a data quality pipeline, and a model evaluation and deployment unit. The task scheduler automatically triggers the model training process according to a preset schedule or event-driven mechanisms. The data quality pipeline filters, denoises, and standardizes observable data throughout the system's operation. The model evaluation and deployment unit determines whether to deploy, archive, or roll back a new model based on preset performance thresholds to address model drift. The task-polling model training engine 500 automatically triggers model training processes for different monitoring tasks according to a preset schedule; filters, denoises, and standardizes training data; and determines whether to deploy, archive, or roll back a new model based on preset performance thresholds, thereby addressing model drift issues.

[0082] In the technical solution provided in this application embodiment, the task polling model training engine 500 and the processing module group 400 form a feedback loop. Its input data comes from observable data throughout the system's operation: including raw traffic snapshots, intermediate outputs of each module, decision results, manual review and annotation, and false positive / false negative logs. The engine comprises three logical components: a task scheduler, a data quality pipeline, and a model evaluation and deployment unit. The task scheduler automatically triggers model retraining tasks according to a preset period (e.g., 2:00 AM daily, 9:00 AM every Monday), and also supports event-driven triggering (e.g., a decrease in the average confidence level of >15% over 10 consecutive minutes). The data quality pipeline performs three levels of filtering.

[0083] The first level is based on metadata verification (discarding samples with missing key fields), the second level is based on statistical anomaly detection (removing outlier features with Z-score > 3), and the third level is based on adversarial example identification (using Fast Gradient SignMethod to detect and label potential perturbation samples). The model evaluation and deployment unit determines the status of the new model based on a preset set of indicator thresholds (e.g., F1-score ≥ 0.92, AUC ≥ 0.95, or inference latency ≤ 150ms): if the thresholds are met, the model is released in a canary release; if the thresholds are not met, the model is archived for later use; if the model degrades severely (F1 score drops > 0.05), it is rolled back to the previous stable version. This engine supports federated learning mode, which allows multiple edge nodes to collaboratively train the global model without sharing the original data.

[0084] For model repository and knowledge base 600, as a preferred embodiment, Figure 1 In the encrypted traffic monitoring system provided in the embodiment shown, the model repository is used to store model files and related metadata tags for each version of the model; the knowledge base is used to store structured knowledge of network policies, attack behavior patterns and protocol specifications, as well as metadata tags; the model repository and the knowledge base 600 adopt a loosely coupled design and are associated with each other through a unified resource identifier and metadata tags to support the co-evolution of models.

[0085] In the technical solution provided in this application embodiment, the model repository and knowledge base 600 adopt a loosely coupled design, establishing a connection through a Uniform Resource Identifier (URI) and metadata tags. The model repository stores model files in ONNX format, and the knowledge base stores structured knowledge in RDF triples. When the task-polling model training engine 500 completes the training of a new model, it simultaneously generates corresponding metadata tags and injects them into the knowledge base, realizing the co-evolution of the model and domain knowledge. The model repository and knowledge base 600 serve as the system memory hub, adopting a hybrid storage architecture: the model repository persistently stores model files of various versions in ONNX format, accompanied by metadata tags (such as training time, dataset version, evaluation metrics, or signature hash); the knowledge base stores structured domain knowledge, including a library of cryptographic protocol behavior patterns (such as TLS 1.3 early data exception triggering conditions), and a mapping table of attack tactics and techniques (TTPs). The system includes a traffic feature pattern and a network topology semantic rule base (e.g., "core switch - firewall - DMZ zone" constitutes a standard three-layer path); the two are linked through a unified knowledge graph ID (e.g., KG-ID) and support SPARQL queries; the knowledge base supports both manual editing and automatic summarization modes, the latter of which extracts new rules by analyzing high-frequency misjudgment cases and submits them for review.

[0086] In summary, in the encrypted traffic monitoring system based on multimodal perception and confidence assessment provided by the above-mentioned technical solution of this application, the various modules of the encrypted traffic monitoring system are tightly coupled through data flow and control flow: the output of the data preprocessing engine 100 serves as the sole input to the core module feature sample dynamic compressor 200; the compressor output is distributed to the processing module group 400 via the global system coordination and scheduling controller; the output of the processing module group 400 converges to the core module C dynamic confidence fitting and topology perception analyzer 403; the security decisions output by the analyzer simultaneously drive the execution of actions (such as blocking, alarming, and rate limiting) and serve as key feedback signals for the task polling model training engine 500; the new model version produced by the training engine is injected into the model repository, and the rules for updating the knowledge base are synchronously distributed to the analyzer and graph construction module, forming a complete closed loop. This closed loop can autonomously complete the entire cycle of "perception-analysis-decision-evolution" without external human intervention.

[0087] Through the above technical solutions, this application achieves a synergistic improvement in real-time performance, robustness, and self-evolution capabilities of the encrypted traffic monitoring system. Because the data preprocessing engine 100 and the feature sample dynamic compressor 200 jointly construct a load-aware feature flow channel, the system can still guarantee the timeliness of online analysis under high-concurrency scenarios, solving the problems of "accuracy collapse under high load" or "resource waste under low load" caused by fixed compression strategies in traditional solutions. Because the asymmetric adversarial defense perception module 401 independently completes lightweight feature enhancement at the monitoring end, it avoids the overhead of model retraining and improves immunity to adversarial attacks, alleviating the technical defect that the model is easily misled under encrypted traffic. Furthermore, the multi-granularity flow interaction graph construction module... Together with the dynamic confidence fitting and topology-aware analyzer 403, the 402 module establishes semantic associations and structural constraints between network entities, enabling the decision-making process to break through the single session dimension and possess contextual understanding capabilities across sessions, devices, and time, significantly reducing false alarms caused by normal protocol variations. Since the task polling model training engine 500, model repository, and knowledge base form a feedback loop, the system can continuously optimize models and rules based on real-world operational feedback, effectively addressing model drift caused by encryption protocol upgrades and new attack variants, fundamentally overcoming the capability degradation bottleneck of traditional systems where "deployment is fixed".

[0088] Furthermore, the beneficial effects of the embodiments provided in the following embodiments of this application are the same as the beneficial effects of the encrypted traffic monitoring system based on multimodal perception and confidence assessment provided in the above embodiments, and other technical features in the following embodiments are the same as the features disclosed in the methods of the above embodiments, and will not be repeated here.

[0089] See Figure 2 , Figure 2 for Figure 1 The illustrated embodiment provides a schematic diagram of the processing flow of a main application system. For example... Figure 2 As shown, this processing flow is based on Figure 1 The encrypted traffic monitoring system provided in the illustrated embodiment includes the following method:

[0090] S110: Encrypted traffic input (port mirroring / network splitting).

[0091] S120: Data preprocessing engine (traffic parsing / session reassembly / data cleaning and feature extraction).

[0092] S130: Dynamic fitter for flow characteristic samples.

[0093] S140: Global System Coordination and Scheduling Controller.

[0094] S150: Processing module group to perform multi-module collaboration.

[0095] S151: Module A: Asymmetric adversarial defense perception module (feature perturbation enhancement).

[0096] S152: Module B: Multi-granularity flow interaction graph construction module (graph neural network analysis).

[0097] S153: Module C: Dynamic Confidence Fitting and Topology-Aware Analyzer (Multi-Source Validation).

[0098] S160: System decision center, determine the confidence level; high confidence level (greater than 0.8), then execute step S171; medium confidence level (0.2-0.8), then execute step S173; low confidence level (less than 0.2), then execute step S172.

[0099] S171: Confirm the flow of traffic during the journey.

[0100] S172: Confirm abnormal blocking and issue an alarm.

[0101] S173: Module D: Task polling model training engine, model archiving regression, to model repository and knowledge base version management steps; or receive feedback data input from model repository and knowledge base.

[0102] S180: RESTful API alarm output, output to the Security Operations Center (SOC) and / or SIEM system.

[0103] S190: Model repository and knowledge base version management.

[0104] Figure 2 The encrypted traffic monitoring method provided in the illustrated embodiment has already been described in detail in the above embodiments, and will not be repeated here.

[0105] In summary, this application provides an intelligent monitoring method for encrypted traffic based on multimodal perception and dynamic confidence assessment. Its core lies in achieving unified orchestration of data flow, control flow, and model flow through the organic coupling of hierarchical functional modules and a bidirectional feedback mechanism. Starting with data preprocessing, dynamic compression and intelligent scheduling drive the multimodal analysis engine to work collaboratively. Decision output is completed based on confidence calibration, and finally, a task-polling training engine triggers iterative model updates based on actual operational feedback, thereby maintaining the long-term effectiveness of the system without relying on manual intervention. The modules are not loosely stacked but rather form a strongly correlated architecture through explicit data interface protocols, temporal constraints, and state synchronization mechanisms, ensuring determinism, observability, and traceability throughout the entire processing chain.

[0106] See also: Figure 3 , Figure 3 This is a flowchart illustrating an encrypted traffic monitoring method based on multimodal perception and confidence assessment, provided as an embodiment of this application. Figure 3 As shown, the encrypted traffic monitoring method includes:

[0107] S210: The encrypted traffic data is preprocessed and features extracted by the data preprocessing engine to obtain the session feature vector. S220: The dynamic feature sample compressor adaptively switches compression strategies based on the current data flow destination and real-time system resource utilization, compressing the session feature vector according to the switched compression strategy. S230: The compressed session feature vector is scheduled to the asymmetric adversarial defense perception module and the multi-granularity flow interaction graph construction module for processing by the global system coordination and scheduling controller. S240: The asymmetric adversarial defense perception module applies perturbations to the input features and generates robustly enhanced session feature vectors. S250: The multi-granularity flow interaction graph construction module constructs the multi-granularity flow interaction graph corresponding to the session feature vector and generates node embedding vectors. S260: The node embedding vectors are multi-source verified based on the multi-granularity flow interaction graph using a dynamic confidence fitting and topology-aware analyzer, and the calibration confidence is calculated using a fitting function. S270: A final security decision is generated and executed based on the confidence level. S280: Through a task-polling model training engine, the system automatically triggers the model update process within the processing module group based on system feedback data, thereby achieving closed-loop evolution of the system.

[0108] Specifically, as a preferred embodiment, in the above-mentioned encrypted traffic monitoring method, step S240: applying perturbation to the input features and generating a robust session feature vector through the asymmetric adversarial defense perception module, including: generating a slight perturbation under the infinite norm constraint; calculating the response of the target model to the original features and the perturbated features respectively; and generating a robust feature vector by weighted fusion based on the response difference.

[0109] Specifically, as a preferred embodiment, in the above-mentioned encrypted traffic monitoring method, the system feedback data includes: confidence calibration results, security decision execution logs, false alarm rate and false negative rate statistical indicators, and manually reviewed and labeled data.

[0110] In summary, the encrypted traffic monitoring method based on multimodal perception and confidence assessment provided in this application uses a data preprocessing engine to preprocess and extract features from encrypted traffic data to obtain session feature vectors. This enables preprocessing such as filtering, denoising, and standardization of the data, effectively reducing data pollution. The feature sample dynamic compressor adaptively switches compression strategies based on the data flow destination and the real-time system resource occupancy rate, compressing the session feature vectors according to the adaptively switched compression strategies. This allows for adaptive lossy or lossless compression based on data flow and system load, balancing data flow efficiency and feature fidelity. After the session feature vectors are scheduled to the processing module group, the asymmetric defense perception of the processing module group is utilized. The module applies perturbations to the session feature vector on the input side to obtain a robust session feature vector. This allows the monitoring end to actively generate perturbations and verify response differences through an asymmetric adversarial defense mechanism, improving the model's anti-interference capability. By constructing a multi-granularity flow interaction graph and fusing topology, policy, and historical behavior for multi-source verification, and by using a fitting function for confidence calibration, the reliability and interpretability of decisions can be enhanced. Finally, the task-polling model training engine forms a model evolution feedback loop through model files stored in the model repository and knowledge base, as well as structured knowledge and processing modules, thereby driving the model to iterate periodically. This effectively addresses the evolution of encrypted traffic and model drift, thus achieving intelligent monitoring capabilities with high security, high adaptability, and sustainable evolution. In summary, the above methods can solve the problems of existing technologies lacking adversarial sample defense mechanisms, which allows attackers to mislead model outputs through minor perturbations, resulting in security blind spots; the decision-making process relying on a single model confidence level without integrating contextual information such as network topology, path strategies, and historical characteristics and behaviors, leading to frequent false positives and false negatives; and the lagging model updates, which make it impossible to respond in a closed loop to new attack variants and protocol evolutions, and thus difficult to maintain long-term effectiveness.

[0111] Additionally, see Figure 4 , Figure 4 This is a schematic diagram illustrating the workflow of a feature sample dynamic compressor provided in an embodiment of this application. Figure 4 As shown, the workflow of this feature sample dynamic compressor includes:

[0112] S310: Input: Standardized feature vector.

[0113] S320: Compression strategy decision; High load: Offline model training, in which case step S330 is executed; If the load is low, real-time online analysis is performed, in which case step S340 is executed.

[0114] S330: Lossy compression channel (Top-k channel is retained).

[0115] S340: Lossless compression channel.

[0116] S350: Quantization bit width adaptive (FP32→FP16→INT8).

[0117] S360: Flow particle size sparsification.

[0118] S370: Principal Component Analysis (PCA) dimensionality reduction or Vector Quantization (VQ) encoding.

[0119] S380: Integer discrete, highly repetitive strings, structured features.

[0120] S390: Embedded compressed data header (such as CRC-32C).

[0121] S3100: Lossless compression LZ4.

[0122] S3110: Compressed feature data & metadata.

[0123] S3120: Output: Compressed feature samples.

[0124] The technical solution provided in this application embodiment offers further technical details regarding the feature sample dynamic compressor as follows:

[0125] Depending on the destination of the data (online analysis or offline training) and the real-time load of the system, a lossy or lossless compression strategy is adaptively selected to process the feature vectors in order to balance data flow efficiency and feature fidelity.

[0126] The feature sample dynamic compressor is a key intermediate processing unit deployed between the data preprocessing engine and the global system coordination and scheduling controller. Its core function is to perform differentiated and controllable compression operations on high-dimensional encrypted traffic feature vectors according to different downstream task requirements and runtime resource states. This compressor does not adopt a fixed strategy, but instead constructs a two-dimensional decision mechanism: the first dimension is the "data destination", which clearly distinguishes whether the batch of feature vectors will be used for real-time online analysis (such as millisecond-level anomaly alarms) or offline model training (such as daily granular model iteration); the second dimension is the "system real-time load", which forms a dynamic load score by collecting multi-source indicators such as CPU utilization, memory usage, network throughput margin, and queue waiting latency, and maps it to three state ranges: light load (≤40%), medium load (40%–80%), and heavy load (>80%). Among them, the "online analysis" destination corresponds to the requirements of low latency and high responsiveness, and it is necessary to ensure that the key discriminative dimensions of the feature vector (such as the entropy value of the TLS handshake field, the timing of the stream, and the accuracy of the packet length distribution histogram bin) do not suffer substantial degradation; the "offline training" destination focuses on the scale and coverage of data, and allows the sacrifice of some fine-grained features within a controllable range in exchange for improved storage compression ratio and batch processing throughput; while the "system real-time load" status directly affects the feasibility and cost of the compression strategy execution - for example, under heavy load, even if the destination is online analysis, lightweight lossy compression (such as principal component analysis PCA to reduce dimensionality to the first 16 dimensions, or feature mask pruning based on perceived importance) can be enabled to avoid scheduling blockage; under light load, even if the destination is offline training, lossless compression (such as the LZ77 + Huffman coding joint scheme, or differential coding of integer features + run-length compression) can be switched to retain all information for subsequent backtracking verification.

[0127] The "lossy compression strategies" include, but are not limited to: attention-weighted feature channel pruning (sorting by gradient sensitivity of each dimension in historical false positive / false negative samples, retaining the Top-K channels), adaptive quantization bit width adjustment (for floating-point feature vectors, using FP32→FP16→INT8 three-level quantization based on joint decision of destination and load), and stream granular sparsity (retaining only feature dimensions with a change rate >5% in each session stream, setting the rest to zero and storing them in CSR format); all lossy compression strategies support runtime hot switching without requiring module restart. The "lossless compression strategies" include, but are not limited to: Delta encoding + Zstandard (zstd) dictionary compression for integer discrete features, LZ4 dictionary preloading compression for highly repetitive string features (such as SNI domain names, ALPN protocol identifiers), and Protocol Buffer binary serialization compression for structured feature vectors; all lossless strategies embed checksums (such as CRC-32C) into the compressed data header to ensure bit-level consistency of the decompressed feature vectors. Adaptive selection is achieved through an embedded policy decision engine, which receives dual inputs from the destination tag and the load monitor agent. The rule engine matches the preset policy table and outputs the compression algorithm ID, parameter set, and whether to enable the parallel compression pipeline. The policy table supports online hot updates and new rule versions can be distributed through the model repository.

[0128] The feature sample dynamic compressor communicates with the data preprocessing engine using zero-copy shared memory, and with the global system coordination and scheduling controller using a gRPC streaming channel with QoS tags. Its internal cache employs a two-level design: a high-speed SRAM cache for temporarily storing the raw feature vectors to be compressed; and a DDR4 cache pool, logically partitioned by destination type (online / offline) with independent watermarks. When a partition reaches its threshold, the corresponding compression strategy is automatically preloaded and warmed up. The compressor supports various feature vector input formats, including but not limited to: fixed-length vectors (e.g., 4096-dimensional TLS fingerprint vectors), variable-length sequences (e.g., packet-length sequences based on time windows), and nested structures (e.g., tree-like features with sub-stream relationships). Its output is uniformly encapsulated as a standardized feature container, containing a metadata header (including compression type identifier, original dimensions, compression ratio, and checksum) and a compressed payload for downstream modules to parse.

[0129] The synergistic effect of various technical features is manifested in the following ways: destination determination provides semantic constraints for compression targets, and load status provides resource constraints for compression execution; both jointly drive strategy selection. The compression strategy type determines the lower limit of feature fidelity and the upper limit of processing overhead. Meanwhile, the compressor's hardware acceleration interfaces (such as integrating the AES-NI instruction set for hash verification acceleration and AVX-512 for SIMD parallel quantization) and software configurable pipelines (supporting single-stage / two-stage cascaded compression) ensure the real-time performance and flexibility of strategy implementation. This collaborative mechanism does not rely on external model feedback and completes closed-loop decision-making entirely locally.

[0130] Through the above technical solution, this application achieves the following: In encrypted traffic monitoring scenarios, when the system simultaneously undertakes online real-time analysis and background model training, the feature sample dynamic compressor autonomously selects and uses lossy or lossless compression paths based on the actual task semantics and instantaneous resource conditions. This significantly reduces cross-module data transmission bandwidth usage (measured reduction of 37%–62%), shortens end-to-end feature transfer latency (P99 latency reduced to ≤8.3ms), and reduces offline training data storage redundancy (compression ratio reaches 4.1:1–8.7:1) while ensuring the feature quality of key analysis links. It also effectively alleviates feature backlog and packet loss problems caused by sudden load increases, enhancing the robustness and scalability of the system in high-concurrency, heterogeneous task mixed load environments.

[0131] See also: Figure 5 , Figure 5 This is a flowchart illustrating the processing of an asymmetric adversarial defense perception module provided in an embodiment of this application. Figure 5 As shown, the processing flow of this asymmetric adversarial defense perception module is as follows:

[0132] S410: Input the original flow characteristics x.

[0133] S420: Calculate the model gradient.

[0134] S430: Generating perturbation FGSM / PGD algorithm.

[0135] S440: Apply a disturbance to satisfy the constraint conditions.

[0136] S450: Compare the differences between the original features and the perturbation features output.

[0137] S460: Determine whether the difference is significant; if yes, proceed to step S470; if no, proceed to step S480.

[0138] S470: Mark the vulnerability of the model.

[0139] S480: Feature robustness verification.

[0140] S490: Generate robust enhancement features.

[0141] S4100: Outputs enhanced feature vectors.

[0142] The technical solution provided in this application adopts a gradient-based adversarial example generation method, which applies a slight perturbation to the input flow features under the constraint of the infinite norm (also known as the maximum norm, L∞ norm); by comparing the difference in the response of the target model to the original features and the perturbed features, a robust feature vector is generated; this process is completed independently at the monitoring end.

[0143] The asymmetric adversarial defense perception module is a functional unit within the processing module group dedicated to enhancing the model's anti-interference capabilities. Its core principle is to construct defensive feature representations solely based on the gradient information of the locally deployed monitoring model, without relying on the attacker's prior knowledge or introducing external collaboration mechanisms. This module does not alter the original classification model structure or participate in model weight updates; instead, it is embedded in the inference path as a pre-feature enhancement layer, and its output serves as the input basis for subsequent multi-granularity flow interaction graph construction and confidence fitting analysis. This module is preferably deployed on edge gateways, probe devices, or cloud-side analysis nodes. Its hardware carriers include, but are not limited to, network processing units (NPUs) with GPU acceleration capabilities, FPGAs, or ASIC chips supporting INT8 / FP16 mixed-precision inference. At the software level, it runs in a lightweight container environment (such as a Docker+Kubernetes microservice architecture) and achieves low-latency state synchronization with the global system coordination and scheduling controller via the gRPC protocol.

[0144] Among them, gradient-based adversarial example generation methods refer to using the gradient information of the input features obtained by backpropagation of the loss function of the target model after forward propagation to guide the allocation of perturbation direction and magnitude. Typical implementations include Fast Gradient Sign Method (FGSM), Iterative FGSM, and Projected Gradient Descent (PGD). In this embodiment, Projected Gradient Descent (PGD) can be selected as the backbone algorithm because it can approximate the worst perturbation on the L∞ spherical boundary within a finite number of steps and supports dynamic step size adjustment to adapt to the sensitivity differences of feature vectors of different dimensions. As a variant, a gradient-free alternative can also be adopted—such as a black-box attack simulator based on differential evolution. In scenarios where the model is not differentiable or the gradient is masked, a proxy gradient approximation is constructed by querying feedback, which still meets the functional requirement of "completing independently at the monitoring end".

[0145] The infinity norm (also known as the maximum norm, L∞ norm) constraint applies a uniform upper bound ε to the absolute value of each element in the perturbation vector δ, i.e., ||δ||∞ = max i |δ i The constraint | ≤ ε ensures that the perturbation remains subpixel-level / submillisecond-level / subbyte-level small in each feature dimension, thereby maintaining the semantic integrity of traffic and protocol compliance. In this embodiment, the value of ε ranges from 0.001 to 0.05, and the specific value is dynamically set according to the normalization scale of the encrypted traffic feature vector: when the variance of the feature after Z-score standardization is greater than 1.5, ε is set to 0.01; when the feature is scaled to the [0,1] interval by Min-Max and the peak signal-to-noise ratio (PSNR) is less than 35dB, ε is set to 0.03. This parameter can be manually configured through the system management interface, or it can be automatically calibrated and issued by the task polling model training engine based on recent false alarm rate fluctuations. As an optional alternative, perturbation generation under L2 norm constraint can also be used. In this case, the perturbation projection operator needs to be adjusted synchronously to ensure that the perturbation energy is controllable.

[0146] The "input traffic features" in the context of applying slight perturbations to input traffic features specifically refer to high-dimensional sparse vectors output by the data preprocessing engine and adaptively compressed by the feature sample dynamic compressor. These vectors have at least 256 dimensions and encompass more than 20 protocol-independent features, including TLS handshake field entropy, certificate chain length, SNI domain name length distribution, QUIC header flag combination frequency, and cipher suite preference sequences. The "slight perturbation" is reflected not only in the upper bound of the L∞ norm but also in the locality of the perturbation's domain—perturbations are applied only to the top 30% of the features in terms of absolute gradient value. This ensures the perturbation's physical feasibility while focusing on the most sensitive feature dimensions to the model output, balancing computational efficiency and defense effectiveness. Other dimensions remain unchanged, thus avoiding feature drift caused by global distortion. As a variation, the perturbation can be superimposed on the original byte stream of the original traffic (e.g., modifying the padding bytes of unencrypted fields in TLS ClientHello), and then generated after the same preprocessing procedure, still falling within the protection scope of this embodiment.

[0147] In the comparison of the target model's response differences to the original features and the perturbed features, the "target model" refers to the preliminary classification model deployed upstream of the dynamic confidence fitting and topology-aware analyzer. Its type includes, but is not limited to, LightGBM binary classifier, Graph Convolutional Network (GCN) classifier head, or Transformer-based temporal anomaly detector. The "response difference" is specifically quantified as KL divergence, cosine distance, or JS divergence of the predicted probability distribution. When the difference value exceeds the preset threshold θ (θ∈[0.1, 0.45]), it is determined that the feature has potential adversarial vulnerability and triggers the robustness enhancement mechanism. The threshold θ can decrease linearly with the aging of the model or be dynamically interpolated and corrected by the historical adversarial sample response baseline stored in the model repository and knowledge base.

[0148] The generation of robustly enhanced feature vectors is not a simple concatenation of the original and perturbed features, but rather employs a weighted fusion strategy: let x be the original feature vector, x′ be the perturbed feature vector, and the final output z = α·x + (1 α)·x′, where the weighting coefficient α is obtained by normalizing the response difference value d, α = max(0.3, 1 d / θ) ensures that more original feature semantics are preserved in high-discretion scenarios, while strengthening the perturbation-guided generalization representation in low-discretion scenarios. As an alternative implementation, a contrastive learning framework can also be used, for example, constructing a model containing the original feature `x`, the perturbation feature `x′`, and similar normal samples `x`. + The system uses triples to train a feature encoder by minimizing the triple loss function. This encoder receives the original features `x` during the inference phase and outputs a robustly enhanced embedding vector `z`, achieving a similar functional effect to the weighted fusion scheme.

[0149] The process is completed independently at the monitoring end, emphasizing that the entire process of disturbance generation, response comparison, and feature enhancement does not rely on cloud collaboration, does not call third-party APIs, and does not access external knowledge graphs or threat intelligence platforms. All calculations are performed in a closed loop within the memory of a single monitoring device and the weights of the local model. Communication overhead is controlled to increase the latency of a single inference by no more than 8ms (based on actual testing in an Intel Xeon Silver 4314 + Tesla T4 environment), and the memory increment is no more than 128MB. This limitation excludes federated learning schemes that require cross-node gradient exchange or joint modeling, as well as distributed defense architectures that rely on CDN node collaboration for disturbance injection. However, it does not exclude deploying this module as a microservice on multiple Pod instances in a Kubernetes cluster, with each instance remaining fully autonomous.

[0150] The synergistic effects of the aforementioned technical features are as follows: the gradient-based adversarial example generation method provides mathematical interpretability and convergence guarantees for perturbation construction; the L∞ norm constraint ensures the physical feasibility of the perturbation and the compatibility with traffic protocols; the local perturbation design for input traffic features balances computational efficiency and semantic fidelity; the response difference comparison mechanism establishes vulnerability identification criteria; the weighted fusion strategy of robustness-enhancing feature vectors achieves a dynamic balance between defense strength and original discriminative power; and independent monitoring at the monitoring end establishes deployment boundaries and security responsibility domains at the system architecture level. Each stage forms a deterministic processing chain of "perturbation generation → vulnerability identification → feature recalibration → local closed loop," without introducing random sampling, relying on external feedback, or changing the interface protocols of downstream modules.

[0151] Through the above technical solutions, this application achieves the following: without modifying the original classification model structure or interrupting real-time monitoring services, the asymmetric adversarial defense perception module can actively simulate the worst-case input disturbances, forcing the target model to focus on essential discrimination patterns such as TLS fingerprint stability and encryption behavior temporal consistency, rather than easily manipulated surface statistical features; since the disturbance construction and response analysis are both completed at the monitoring end, defense failures caused by network transmission delays, unavailability of third-party services, or cross-domain data compliance risks are avoided; thus, when facing covert encrypted tunnels generated based on GANs, adversarial payloads injected using TLS 1.3 early data fields, or protocol-level disturbances designed for QUIC connection migration mechanisms, the system can still maintain a high detection rate and low false alarm rate for malicious C2 communication and data leakage behavior, significantly improving the robustness and engineering availability of the encrypted traffic detection model in real network adversarial environments.

[0152] See also: Figure 6 , Figure 6 This is a flowchart illustrating the processing of a multi-granularity flow interaction graph construction module provided in an embodiment of this application. Figure 6 As shown, the processing flow of this multi-granularity flow interaction graph construction module is as follows:

[0153] S510: Input network traffic data packets.

[0154] S520: Generate sequence transformation heterogeneity graph.

[0155] S530: Node construction, including flow nodes, host nodes, and network topology nodes.

[0156] S540: The basic unit of encrypted data stream.

[0157] S550: Host entity participating in the communication.

[0158] S560: Forwarding and Control Entity.

[0159] S570: Request-response or active connection-passive response relationship.

[0160] S580: Communication frequency or data throughput.

[0161] S590: Physically accessible sexual desire strategy constraint.

[0162] S5100: Edge construction mechanism; including communication facts, service logic, physical topology and time dynamics.

[0163] S5110: Multi-relationship heterogeneous graph.

[0164] S5120: Graph Neural Network Learning.

[0165] S5130: Output node embedding vector.

[0166] This embodiment provides further technical details regarding the multi-granularity flow interaction graph construction module:

[0167] The constructed flow interaction graph includes flow nodes representing data flows, terminal nodes representing hosts, and network topology nodes representing routers and switches. In the flow interaction graph, the edges between nodes are constructed based on one or more of the following relationships: communication relationship, service semantics, physical path constraints, and time window proximity. The graph neural network algorithm is used to learn the heterogeneous graph and generate node embedding vectors.

[0168] This embodiment proposes a multi-granularity flow interaction graph construction mechanism for encrypted traffic analysis. Its core lies in upgrading the traditional discrete traffic representation, based on single sessions or IP quintuples, into a heterogeneous graph structure that integrates entity semantics, topology, and dynamic temporal sequence. Structure-aware feature encoding is achieved through graph neural networks. This mechanism does not rely on plaintext payload parsing, nor is it limited to port or protocol identifiers. Instead, it starts from the multidimensional relational nature of network behavior, constructing a graph representation foundation with learnability, scalability, and semantic interpretability, providing structured input support for subsequent topology-aware analysis and confidence calibration.

[0169] In this context, flow nodes are the basic units representing encrypted data flows. Each flow node corresponds to a complete TLS / QUIC or other encrypted session instance after session reassembly. Its attributes include, but are not limited to, undecryptable but observable metadata such as: start timestamp, duration, number of data packets, byte distribution, TLS handshake parameter hash value, certificate fingerprint digest, and client / server random number fragments. Flow nodes are directed nodes in the graph, with the direction reflecting a request-response or active connection-passive response relationship. In optional embodiments, flow nodes can be further clustered according to application layer protocol fingerprints and abstracted into super nodes to support higher-granularity business flow modeling; or multiple short-lifecycle flows can be aggregated using a sliding time window to form "micro-flow cluster nodes" to enhance the ability to capture low-frequency probing behaviors.

[0170] In this context, terminal nodes represent host entities participating in communication, including computing devices such as servers, workstations, IoT devices, and mobile terminals. Terminal node attributes include: IP address family (IPv4 / IPv6), AS number, geographical location information (such as country, region, city level), operating system fingerprint inference results, known asset importance level (from CMDB synchronization), and historical active service port set. Terminal nodes in the graph are undirected or bidirectional nodes, and their connection strength can be weighted to reflect communication frequency or data throughput. In optional embodiments, terminal nodes can be further subdivided according to role, such as being divided into "management terminal," "database access terminal," and "API gateway front-end terminal." Their type labels are injected by the network policy library or zero-trust identity directory, thereby enhancing the explicit expression of service semantics.

[0171] In this context, network topology nodes represent forwarding and control entities in the network infrastructure, including but not limited to routers, Layer 3 switches, load balancers, and southbound interface proxy nodes of SDN controllers. In deployment environments where network topology information is available (such as integration with the SDN controller or deployment within network devices), network topology node attributes may include control plane information such as the number of BGP neighbors and OSPF area IDs. In pure traffic mirroring deployment mode, the network topology nodes are constructed using limited topology information obtained through IP hop count estimation (such as TTL value analysis), MAC address prefix identification, or passive discovery via LLDP / CDP protocols. Network topology nodes act as intermediary nodes in the graph, connecting terminal nodes and flow nodes, reflecting physical reachability and policy constraints. In optional embodiments, network topology nodes can be extended to stateful "policy anchor nodes," with their edge weights dynamically coupled to ACL rule hit counts or QoS policy execution logs, enabling the graph structure to implicitly carry policy execution trajectories.

[0172] In the aforementioned flow interaction graph, "the edges between nodes are constructed based on one or more of the following relationships: communication relationship, service semantics, physical path constraint, and time window proximity" refers to:

[0173] The communication relationship edges represent directly observable bidirectional / unidirectional data interactions, generated by the association of 5-tuples captured by NetFlow / IPFIX or eBPF kernel probes, and the edge attributes include total bytes, round-trip delay estimate, and retransmission rate;

[0174] Service semantic edges are established based on predefined service dependency graphs. For example, "Web server A → database server B" is explicitly connected due to the existence of SQL injection detection rules. This edge is injected by service dependency relationships synchronized by the network policy library or microservice registry.

[0175] Physical path constraint edges are automatically derived from the Layer 2 / Layer 3 topology discovered by the SDN controller's northbound API or LLDP / CDP protocol. This ensures that if communication exists between any two terminal nodes, the path must pass through at least one network topology node, and the edge direction conforms to the actual forwarding path (e.g., constructing parallel edges under ECMP multipathing). (Note: These edges focus on reflecting the actual forwarding path of data packets in the network infrastructure, rather than the policy execution state. Policy execution state belongs to 'service semantics' or can be used as an attribute of 'policy anchor nodes'.)

[0176] Temporal proximity edges are constructed based on the time intervals and sequence patterns between multiple flow nodes initiated by the same terminal node within a sliding time window (e.g., 300 seconds). They are used to characterize lateral movement links (e.g., if terminal C establishes TLS connections with terminals A and B successively within 120 seconds, then temporal proximity edges are added between A, B, and C). The above four types of edges can exist independently or can be superimposed with weights (e.g., communication relationship edge weight × service semantic credibility coefficient) to form a heterogeneous multi-relational graph.

[0177] The phrase "using graph neural network algorithms to learn heterogeneous graphs and generate node embedding vectors" refers to: employing a hierarchical message passing mechanism to distinguish different node types and edge relationship types in each aggregation round, such as using R-GCN (Relational Graph Convolutional Network) or HAN (Heterogeneous Graph Attention Network) architectures; for flow nodes, their neighbor messages come from connected terminal nodes and network topology nodes, and the information of "service semantics" edges and "physical path constraint" edges are weighted during aggregation; for terminal nodes, their neighbor messages include all flow nodes communicating with them and the network topology nodes they pass through, and a time decay factor is introduced in the aggregation process to weaken the influence of old flows; the final output node embedding vector is a dense real-number vector with a fixed dimension (e.g., 128 dimensions), preserving the topological proximity, semantic similarity, and temporal continuity of the original graph structure; in optional embodiments, the graph neural network can be pre-trained using an unsupervised contrastive learning objective (e.g., GraphSAGE+InfoNCE loss), requiring only a small number of labeled samples to complete the fine-tuning of downstream tasks, adapting to the actual scenario where encrypted traffic labels are scarce.

[0178] The node types and edge relationship types are not defined in isolation, but rather form an organic whole within a unified modeling framework: flow nodes are the carriers of behavior, terminal nodes assign identity to the behavior subject, and network topology nodes anchor the infrastructure context in which the behavior occurs; communication relationships provide basic connectivity, service semantics inject business logic constraints, physical path constraints ensure that the model conforms to the physical laws of real networks, and time window proximity introduces a dynamic evolution dimension. The combined effect of these four types of edges allows for differentiated encoding of the behavior representation of the same terminal node under different time periods, different service contexts, and different network path conditions, avoiding semantic confusion caused by node flattening in traditional homogeneous graph modeling.

[0179] Through the above technical solution, this application achieves the following: without cracking the encrypted content, it transforms encrypted traffic from isolated data packet sequences into a heterogeneous graph representation with rich semantic hierarchy and structural constraints, and generates node embedding vectors with both local sensitivity and global consistency through graph neural networks. Since the three types of entities—flow nodes, terminal nodes, and network topology nodes—are explicitly modeled and differentiated, and the construction of edges is strictly coupled with four constraints: communication facts, service logic, physical topology, and temporal dynamics, it can effectively identify cross-host covert communication links (such as redirecting to a C2 server through a legitimate DNS tunnel), lateral penetration behaviors that circumvent path strategies (such as bypassing firewalls to directly connect to database terminals), and slow attacks disguised as normal service calls (such as segmented command delivery under HTTP / 2 stream multiplexing), which are difficult to detect using traditional methods. The embedding vectors output by this module are used as structured feature inputs to subsequent confidence fitting and topology-aware analyzers, providing an irreplaceable graph structure basis for multi-source verification and confidence upgrades, significantly improving the early identification capability of long-term, multi-stage attack behaviors of APT organizations.

[0180] See also: Figure 7 , Figure 7 This document presents a flowchart illustrating the processing of a dynamic confidence fitting and topology sensing analyzer, as provided in an embodiment of this application. Figure 7 As shown, the processing flow of the dynamic confidence fitting and topology sensing analyzer includes:

[0181] S610: Input preliminary classification results.

[0182] S620: Multi-source verification classification.

[0183] S630: Graph structure consistency check.

[0184] S640: Network path validity check.

[0185] S650: Historical behavior pattern verification.

[0186] S660: Calculation Figure 1 Consistency score.

[0187] S670: Calculate the path rationality score.

[0188] S680: Calculate historical behavior scores.

[0189] S690: Confidence fitting function.

[0190] S6100: Confidence threshold judgment; including sure it is normal, suspected it is normal, and sure it is abnormal.

[0191] S6110: Output the final confidence level.

[0192] This embodiment provides further technical details regarding the dynamic confidence fitting and topology sensing analyzer:

[0193] It receives the output from the initial classification model and performs multi-source verification based on the topological consistency of the flow interaction graph, the rationality of the path specified by the network policy library, and the baseline of historical behavior patterns. It calculates the calibrated final confidence score or level through a fitting function and upgrades the binary classification decision to a multi-level confidence decision.

[0194] The technical solution involved in this embodiment focuses on improving the reliability and interpretability of model output decisions in encrypted traffic monitoring. Its core lies in: instead of directly adopting the original output results of the preliminary classification model, it introduces three independent and orthogonal external verification dimensions—topology consistency, path strategy rationality, and historical behavior baseline—to cross-validate the model output, and achieves dynamic calibration and granular refinement of confidence through a fitting function. Here, "dynamic confidence fitting" means that the calibration process is not based on static threshold determination, but rather adaptively adjusts the output distribution based on the strength of multi-source evidence input in real time; "topology awareness" emphasizes that the verification logic is deeply coupled with the physical and logical constraints of the network infrastructure, rather than relying solely on statistical features.

[0195] The "preliminary classification model" refers to a machine learning model deployed at the system front end to complete the first round of traffic category discrimination. Its output is the raw probability distribution or hard labels. Typical implementations include lightweight convolutional neural networks (CNN), gated recurrent units (GRU), or ensemble tree models (such as XGBoost), used to identify typical characteristics of encrypted traffic such as TLS handshake features, QUIC frame structure, and DNS over HTTPS (DoH) session patterns. This model can be deployed on edge nodes or central analysis platforms, and its output can be a single-dimensional confidence value (such as 0.83), a multi-class probability vector (such as [0.12, 0.76, 0.12]), or a binary label (malicious / normal). As an optional implementation, the preliminary classification model can also adopt an online incremental learning architecture to continuously absorb new samples and fine-tune parameters during system operation to cope with short-term concept drift.

[0196] "Topology consistency of the flow interaction graph" refers to verifying the logical consistency between the preliminary classification results and the inherent connection relationships between nodes in the graph after mapping the results to a multi-granularity flow interaction graph. For example, if a traffic is initially identified as C2 (command and control) communication, but the source host and the target host have no historical communication edges in the flow interaction graph and belong to different security domains (such as office network and production network), and all intermediate network topology nodes (such as firewalls and load balancers) on this path in the graph are not configured with policies that allow this type of protocol to pass, then this determination is considered "topology inconsistency". This consistency verification is implemented through graph traversal algorithms (such as breadth-first search BFS) or subgraph isomorphic matching. As an optional implementation, consistency judgment can also introduce weighted logic. For example, if the communication occurs within the same VLAN but crosses a Layer 3 device, a lower inconsistency penalty weight is given; if the communication crosses the DMZ and the target port is a high-risk port (such as TCP / 6667), a higher weight is given.

[0197] The "path rationality defined by the network policy base" refers to the consistency between the actual transmission path of traffic and the preset network access control policy. The network policy base is stored in a knowledge base and contains a structured set of policy rules. Each rule defines the source IP segment, destination IP segment, protocol type, port number, service semantic tag (such as "database synchronization" or "video conferencing"), allow / deny action, and effective time window. The path rationality verification is completed by comparing the traffic quintuple with the policy base execution matching engine (such as the policy matching module based on OpenFlow flow tables or eBPF programs) in real time. When there is at least one explicit allow policy covering the traffic and there is no higher priority deny policy conflict, the path is determined to be rational. As an optional implementation, the path rationality can also be extended to dynamic policy evaluation, that is, combining the real-time flow table entry status issued by the SDN controller to determine whether the current path is in the policy gray release stage or temporary circuit breaker state.

[0198] The "historical behavior pattern baseline" refers to a host / service / network segment-level behavior fingerprint template built based on long-term observation, including time-series and statistical characteristics such as communication frequency distribution (e.g., standard deviation of HTTP request volume per unit time), median session duration, target port entropy, and TLS certificate update cycle. The baseline data comes from the historical training dataset archived in the model repository, generated after sliding window aggregation and outlier removal, and is updated every 7×24 hours. During verification, the real-time behavior feature vector of the current traffic subject (e.g., source IP) is compared with the corresponding baseline template by distance measurement (e.g., Mahalanobis distance, Wasserstein distance). If the distance exceeds a preset threshold, a baseline deviation alarm is triggered. As an optional implementation, the historical behavior baseline can also be built using a federated learning framework, with each branch maintaining its own sub-baseline and only uploading encrypted gradients to the central node to aggregate and generate a global baseline, in order to meet the compliance requirement of data not leaving the domain.

[0199] Among them, "multi-source verification" refers to the parallel execution of the above three types of verification processes, which are independent of each other and each outputs an independent verification signal (Boolean value or normalized score), which is then processed uniformly by the fusion layer; the fusion methods include weighted summation, DS evidence theory synthesis, or gating attention mechanism; the weight of each verification channel can be dynamically adjusted according to the system operation stage, for example, increasing the weight of topology consistency during attack and defense exercises, and increasing the weight of historical behavior baseline during zero-day vulnerability outbreaks; as an optional implementation method, multi-source verification can also support manual intervention interface, and security operations personnel can temporarily disable a certain verification channel or adjust its sensitivity parameters through the management interface.

[0200] Here, the "fitting function" refers to the mathematical mapping relationship that maps the output of the initial classification model to the three-class validation results and then to the final confidence level. It is a non-linear differentiable function, and a typical implementation includes a weighted combination of Sigmoid functions with a bias term.

[0201]

[0202] in The confidence level of the original model. These are the topology consistency score (0–1), path rationality score (0–1), and historical baseline deviation score (1–0), respectively. - For learnable weights, For bias terms, The fitting function is a Sigmoid function; the parameters of this fitting function are obtained through offline mini-batch calibration training, and the training objective is to minimize the KL divergence between the final confidence level and the "true confidence level" labeled by experts; as an optional implementation, the fitting function can also adopt a piecewise linear function or a decision tree model to improve interpretability and deployment lightweightness.

[0203] The "final confidence score or level" refers to the continuous value (e.g., 0.02–0.98) or discrete level (e.g., "low confidence (L, confidence < 0.2)", "medium confidence (M, 0.2 <= confidence <= 0.8)" and "high confidence (H, confidence > 0.8)" output by the fitted function). This output directly drives subsequent response actions; for example, "L" level triggers blocking and SOC linkage alarm, "M" level triggers traffic sampling and sandbox reanalysis, and "H" level allows normal passage.

[0204] Among them, "upgrading binary classification decision-making to multi-level credibility decision-making" refers to breaking through the traditional hard division paradigm of "malicious / normal" and establishing a progressive response system oriented towards operational closed loop. This upgrade is not simply about adding threshold cut-off points, but about reconstructing the decision-making basis through multi-source evidence fusion, so that the same original model output produces differentiated confidence outputs under different context conditions. For example, the same TLS ClientHello feature may output "L" in short-distance communication scenarios within the data center, but upgrades to "M" in cross-border long-distance communication where the target domain name has just been registered within 72 hours. As an optional implementation method, multi-level decision-making can be integrated with the SOAR (Security Orchestration Automated Response) platform.

[0205] The above-mentioned technical features work together as follows: the preliminary classification model provides initial discrimination hypotheses; the topological consistency verification of the flow interaction graph verifies the spatial feasibility of the hypothesis from the perspective of network connectivity; the path rationality verification specified by the network policy library verifies its institutional feasibility from the perspective of policy compliance; the baseline verification of historical behavior patterns verifies its behavioral stability from the perspective of time evolution; the four together constitute a three-dimensional verification space (space-institution-time), which is uniformly measured by a fitting function and outputs a structured confidence score, ultimately supporting the accurate triggering of multi-level response strategies.

[0206] Through the above technical solutions, this application achieves the following: by introducing three heterogeneous verification dimensions of topology consistency, path rationality, and historical behavior baseline, it overcomes the defects of single model output being susceptible to distribution offset, resistance to disturbances, and cold start bias. It also solves the technical problems of unreliable confidence of encrypted traffic monitoring results, high false alarm and false negative rates, and lack of operational guidance in the background technology. Therefore, it achieves the technical effects of improving decision reliability and interpretability, reducing false alarm and false negative rates, supporting the implementation of hierarchical response strategies, and strengthening the system's adaptability to unknown threats.

[0207] See also: Figure 8 , Figure 8 This document provides a flowchart of a task-polling model training engine as an embodiment of this application. Figure 8 As shown, the processing flow of this task-polling model training engine is as follows:

[0208] S710: System operation data collection.

[0209] S720: Task Scheduler.

[0210] S730: Trigger training task types; including fixed strategies, business event-driven strategies, and hybrid strategies.

[0211] S740: Data Quality Pipeline Management.

[0212] S750: Data filtering, noise reduction, and normalization blocking.

[0213] S760: Model parameters updated.

[0214] S770: Model performance evaluation, main evaluation track, and auxiliary evaluation track.

[0215] S780: Deployment decision; if yes, proceed to step S790; if pending, proceed to step S7100; if no, proceed to step S7110.

[0216] S790: Deploy the new model.

[0217] S7100: Model Archive.

[0218] S7110: Model rollback.

[0219] S7120: Update the model repository.

[0220] S7130: Knowledge base is updated synchronously.

[0221] This embodiment of the needle-based task polling model training engine provides further technical details, including:

[0222] The system includes a task scheduler, a data quality pipeline, and a model evaluation and deployment unit. The task scheduler triggers the model training process for different monitoring tasks according to a preset schedule. The data quality pipeline filters, denoises, and standardizes the training data. The model evaluation and deployment unit determines whether to deploy, archive, or roll back the new model based on preset performance index thresholds to address model drift.

[0223] The model training uses security decision results, false positive / false negative logs, and manually reviewed annotations as feedback data, based on the output of the dynamic confidence analyzer. The feedback data sources are divided into three levels: L1 level is real-time feedback (current decision confidence and execution results), L2 level is short-cycle feedback (false positive / false negative statistics over the past 24 hours), and L3 level is long-cycle feedback (typical samples with manual review annotations). The task scheduler determines the training priority based on the decay index of the three levels of feedback data. When the L1 level feedback anomaly rate suddenly increases by more than 15%, an emergency training process is triggered.

[0224] The task-polling model training engine is the key execution unit for achieving closed-loop evolution in the encrypted traffic intelligent monitoring system. Its core lies in constructing an automated model iteration mechanism with controllable cycles, reliable data, and traceable decisions. This engine can continuously adapt to the dynamic evolution of encrypted traffic characteristic distribution without human intervention. Through a structured division of labor—task scheduling, data governance, and model decision-making—it ensures the stability, robustness, and auditability of the model update process. Specifically, the task scheduler provides deterministic triggering capabilities in the time dimension, the data quality pipeline constructs the quality baseline at the training input end, and the model evaluation and deployment unit establishes the risk control boundary at the output end. Together, these three components constitute a lightweight engineering framework for model lifecycle management.

[0225] The task scheduler is used to automatically trigger model training processes for different monitoring tasks according to a preset schedule. This scheduler uses a lightweight timing engine based on Cron expressions, supporting millisecond-level precision time strategy configuration. The schedule can be set according to a fixed period (e.g., every 6 hours), business event-driven (e.g., detecting three consecutive false alarm rate increases exceeding 5%), or a hybrid strategy (e.g., "every 4 hours on weekdays + every 12 hours on non-weekdays"). Its scheduling objects cover multiple types of monitoring tasks, including but not limited to TLS fingerprint anomaly identification tasks, QUIC protocol behavior modeling tasks, and DNS-over-HTTPS traffic classification tasks. Each task corresponds to an independent training context, including a dedicated data source interface, feature engineering pipeline, model architecture template, and hyperparameter search space. (Note: 'Millisecond-level precision' here refers to the timing precision of the scheduler in starting the training task. The actual training data is obtained by the data quality pipeline from historical data slices according to a preset time window (e.g., the past 24 hours), not limited to the millisecond-level data stream at the moment of scheduling trigger.)

[0226] As a variant implementation, the task scheduler can be replaced with an asynchronous trigger based on an event bus. When it receives a "model performance degradation alarm" message issued by the global system coordination and scheduling controller, it immediately starts the training process of the corresponding task, thereby realizing an adaptive switch from cycle-driven to performance-driven.

[0227] The data quality pipeline is used to filter, denoise, and standardize training data. This pipeline consists of three interconnected modules: The first stage is a semantic consistency filter, which removes samples that clearly violate domain common sense based on legal communication patterns defined in the network policy library (e.g., HTTP / 2 is only allowed to run on TLS 1.3 and above) and the frequency distribution of protocol usage statistically analyzed in historical behavior baselines (e.g., the proportion of SNI fields containing ".bank" domain names in the outbound traffic of a certain IDC has remained stable at 0.8%±0.15%). The second stage is a noise suppression module, which uses the sliding window local outlier factor algorithm (LOF) to identify and remove outliers with significantly lower density than their neighbors in the multidimensional feature space, while also actively reducing the weight of weakly labeled samples with a label confidence score below 0.9. The third stage is a standardization module, which performs Z-score normalization on numerical features and uses target encoding instead of one-hot encoding for categorical features to preserve label statistics and compress dimensionality. As a variant implementation, the data quality pipeline can integrate a differential privacy mechanism, adding Laplace noise with ε=1.0 to the feature vector before standardization, in order to balance data availability with the need to protect the privacy of the original traffic.

[0228] The model evaluation and deployment unit determines whether to deploy, archive, or roll back a new model based on preset performance index thresholds to address model drift. This unit has a built-in dual-track evaluation mechanism: the main evaluation track uses online A / B testing, running the new model alongside the current online model to serve 10% of real-time encrypted traffic, simultaneously collecting four core metrics: accuracy, F1-score, inference latency, and memory usage; the auxiliary evaluation track uses offline backtracking verification, performing stress tests using a recently collected (e.g., past 7 days) set of typical drift samples (including scenarios such as protocol version mutations, obfuscated traffic injection, and new encrypted tunnels) that have been manually verified. The deployment decision rules are as follows: If the new model improves the F1-score by ≥0.5 percentage points and the latency increase by ≤15% in the main evaluation track, and improves the recall rate of drift samples by ≥8% in the auxiliary evaluation track, then automatic deployment is triggered; if any metric fails to meet the standard but all metrics show no deterioration, the model is archived for further review; if the accuracy decreases by ≥0.3 percentage points in the main evaluation track or the recall rate of key scenarios decreases by ≥5% in the auxiliary evaluation track, then a rollback to the previous stable version is immediately executed. As a variant implementation, the model evaluation and deployment unit can introduce an uncertainty quantification module. Based on the Monte Carlo Dropout output prediction entropy value, when the calibration error (ECE) of the new model in the high-entropy region (entropy>0.8) is better than that of the old model, even if the overall F1 score decreases slightly, it can still be determined to have stronger generalization robustness and be approved for deployment.

[0229] There is a strict temporal coupling and data contract relationship between the task scheduler, data quality pipeline, and model evaluation and deployment unit: the training task instances output by the task scheduler carry a unique task ID and a data time window identifier, which is used by the data quality pipeline as a data slicing index to ensure that the processed data is strictly limited to a specified time period; the cleaned dataset output by the data quality pipeline includes an integrity hash value and a quality score (0–100), which is used by the model evaluation and deployment unit during the evaluation phase to verify the consistency of the training input; the deployment decision log generated by the model evaluation and deployment unit is injected back into the task scheduler to dynamically adjust the scheduling priority of subsequent similar tasks. The three components register their interaction contract through a unified metadata service, avoiding hard-coded dependencies and supporting independent upgrades and horizontal scaling of each module.

[0230] Through the above technical solutions, a closed-loop engineering management system for the entire lifecycle of the encrypted traffic monitoring model is achieved. Because the task scheduler periodically triggers the training process according to a preset schedule, the system can proactively respond to external changes such as the evolution of encryption protocols and variations in attack methods, avoiding performance degradation caused by long-term silent model operation. The data quality pipeline performs three-level processing of training data—filtering, denoising, and standardization—effectively blocking the contamination of model training by noisy samples, incorrect annotations, and distribution offset data, ensuring the correct direction of model parameter updates. The model evaluation and deployment unit makes rigid decisions based on multi-dimensional performance index thresholds and supports a rollback mechanism, significantly reducing the security risks of false blocking or missed detections caused by degraded models going live. Therefore, this embodiment effectively alleviates the model drift problem caused by the inability of static models to adapt to the rapid evolution of encrypted traffic without increasing the burden of manual operation and maintenance, maintaining the long-term detection stability and reliability of the system.

[0231] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram can represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or can be implemented using a combination of dedicated hardware and computer instructions.

[0232] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0233] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0234] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. An encrypted traffic monitoring system based on multimodal sensing and confidence assessment, characterized in that, include: The system consists of, in sequence, a data preprocessing engine, a dynamic feature sample compressor, a global system coordination and scheduling controller, a processing module group, a task-polling model training engine, and a model repository and knowledge base; among which... The data preprocessing engine is used to preprocess and extract features from encrypted traffic data to obtain session feature vectors. The feature sample dynamic compressor is used to adaptively switch compression strategies according to the current data flow destination and the real-time resource occupancy rate of the system, and to compress the session feature vector according to the switched compression strategy. The global system coordination and scheduling controller is used to schedule the compressed session feature vector to the processing module group; The processing module group includes an asymmetric adversarial defense perception module, a multi-granularity flow interaction graph construction module, and a dynamic confidence fitting and topology-aware analyzer. The asymmetric adversarial defense perception module applies perturbation to the input feature vector to obtain a robustly enhanced session feature vector. The multi-granularity flow interaction graph construction module constructs a multi-granularity flow interaction graph of the session feature vector, uses a graph neural network algorithm to learn the multi-granularity flow interaction graph, and generates node embedding vectors. The dynamic confidence fitting and topology-aware analyzer performs multi-source verification on the node embedding vectors based on the multi-granularity flow interaction graph and calculates the calibration confidence using a fitting function. The task polling model training engine uses the model files and structured knowledge stored in the model repository and knowledge base to form a model evolution feedback loop with the processing module group.

2. The system according to claim 1, characterized in that, The data preprocessing engine is configured as follows: Identify the encryption protocol type of the encrypted traffic data; perform session-level segmentation on the transmission control protocol stream of the encrypted traffic data to obtain multiple session streams; Clean and filter out abnormal data in the session stream, and extract the session feature vector from each session stream.

3. The system according to claim 1, characterized in that, The feature sample dynamic compressor is configured to adaptively select a lossy compression strategy or a lossless compression strategy based on the current data flow destination and the system's real-time load, in order to balance data flow efficiency and feature fidelity; wherein, When the current data flow is destined for online analysis and the real-time load of the system is less than or equal to a preset load threshold, a lossless compression strategy is selected to ensure the feature integrity of the session feature vector. When the current data flow destination is offline training, and the system load exceeds a preset load threshold, a lossy compression algorithm is selected to compress or reduce the dimensionality of the session feature vector.

4. The system according to claim 1, characterized in that, The global system coordination and scheduling controller is configured to: perform cross-module task distribution, resource allocation, circuit breaking for abnormal states, and lifecycle management on the compressed session feature vector; wherein... The global system coordination and scheduling controller adopts an event-driven architecture and supports both publish-subscribe and request-response dual-mode communication. The global system coordination and scheduling controller is used to continuously monitor the health status of each module in the processing module group through a heartbeat detection mechanism, and dynamically adjust the priority and concurrency of scheduling tasks according to a preset service level agreement strategy.

5. The system according to claim 1, characterized in that, The asymmetric adversarial defense perception module is configured to: load the target classification model and freeze the model parameters of the target classification model; A perturbation conforming to the infinite norm constraint is applied to the input session feature vector, and an adversarial sample containing the perturbation is generated using a gradient-based adversarial sample generation method. The adversarial sample is input into the target classification model, and the perturbed features output by the target classification model are extracted. By comparing the differences in the response of the target classification model to the original features and the perturbed features, a robust session feature vector is generated, and the session feature vector generation process is completed independently at the monitoring end.

6. The system according to claim 1, characterized in that, The multi-granularity flow interaction graph construction module is configured to: construct a flow interaction graph containing flow nodes, terminal nodes, and network topology nodes; wherein, the flow nodes represent data flows, the terminal nodes represent hosts, and the network topology nodes represent routers or switches; in the flow interaction graph, the edge relationships between nodes are constructed based on one or more of the following relationships: communication relationships, service semantics, physical path constraints, and time window proximity; and the flow interaction graph is learned using a graph neural network algorithm to generate the node embedding vectors.

7. The system according to claim 1, characterized in that, The dynamic confidence fitting and topology-aware analyzer is configured to: receive the classification output of the node embedding vector from the preliminary classification model; perform multi-source verification on the classification output based on the topological consistency of the flow interaction graph, the path rationality specified by the network policy library, and the historical behavior pattern baseline; wherein the multi-source verification is achieved through three-level weighted fusion, which includes a first-level verification of topological consistency, a second-level verification of path rationality, and a third-level verification of deviation from the behavior baseline; calculate the calibration confidence of the classification output after multi-source verification using a fitting function, and convert the binary classification decision result corresponding to the calibration confidence into a multi-level decision output containing at least three confidence levels.

8. The system according to claim 1, characterized in that, The task-polling model training engine includes: a task scheduler, a data quality pipeline, and a model evaluation and deployment unit; wherein... The task scheduler is used to automatically trigger the model training process according to a preset schedule or event-driven mechanism; the data quality pipeline is used to filter, denoise, and standardize the observable data throughout the system operation process; the model evaluation and deployment unit is used to determine the deployment, archiving, or rollback of a new model based on preset performance index thresholds to address model drift.

9. The system according to claim 1, characterized in that, The model repository is used to store model files and related metadata tags for each version of the model; The knowledge base is used to store structured knowledge of network policies, attack behavior patterns and protocol specifications, as well as the metadata tags; The model repository and knowledge base are loosely coupled and linked through a unified resource identifier and metadata tags to support the co-evolution of models.

10. A method for encrypted traffic monitoring based on multimodal sensing and confidence assessment, characterized in that, The method is based on any one of the encrypted traffic monitoring systems of claims 1 to 9. The method includes: preprocessing and extracting features from encrypted traffic data using a data preprocessing engine to obtain a session feature vector; using a feature sample dynamic compressor to adaptively switch compression strategies based on the current data flow destination and the system's real-time resource occupancy rate, and compressing the session feature vector according to the switched compression strategy; scheduling the compressed session feature vector to the asymmetric adversarial defense perception module and the multi-granularity flow interaction graph construction module for processing using a global system coordination and scheduling controller; and using the asymmetric adversarial defense perception module to perform data compression. The system employs a knowledge module to perturb input features and generate robust session feature vectors. A multi-granularity flow interaction graph construction module constructs the multi-granularity flow interaction graph corresponding to the session feature vectors and generates node embedding vectors. A dynamic confidence fitting and topology-aware analyzer performs multi-source verification on the node embedding vectors based on the multi-granularity flow interaction graph and calculates calibration confidence using a fitting function. A final security decision is generated and executed based on the confidence level. A task-polling model training engine automatically triggers model update processes within the processing module group based on system feedback data, achieving closed-loop evolution of the system.

Images