Covert communication flow identification method and system based on reinforcement learning dynamic feature screening

Abstract

The invention discloses a covert communication flow identification method and system based on reinforcement learning dynamic feature screening, and relates to the network security technology, and the method comprises the steps: capturing a VPN tunnel data packet at a gateway or terminal side in a mirroring manner, and carrying out the preprocessing operation of the captured data packet; analyzing the preprocessed message sequence, and outputting an original high-dimensional feature vector; performing data processing on the original high-dimensional feature vector to generate a multi-dimensional advanced statistical feature vector for describing a VPN encrypted traffic behavior; according to correlation indexes and system resource overhead of the high-level statistical feature vectors under the current recognition task, outputting contribution degree scores of all features by using a reinforcement learning engine; according to the contribution degree score and an adaptive threshold strategy, generating an optimal feature subset, and synchronously pushing the optimal feature subset to a classifier; and performing incremental application type identification on the VPN encrypted traffic by using the optimal feature subset. According to the method, the accuracy and the stability of encrypted traffic identification can be improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and system for identifying covert communication traffic based on reinforcement learning dynamic feature filtering. Background Technology

[0002] With the widespread adoption of VPN technology, network traffic is generally transmitted using encrypted encapsulation. Traditional static detection methods, relying on port identification or packet content characteristics, are no longer sufficient to accurately identify the applications actually running within the encrypted tunnel. This limitation is becoming increasingly apparent in today's dynamically changing network environment.

[0003] However, existing solutions primarily rely on manually predefined feature sets to train classification models, which has significant shortcomings. First, static feature libraries cannot adapt to dynamic changes in network environments, application versions, or user behavior, leading to a sharp drop in recognition accuracy after concept drift. Second, the redundant data brought by high-dimensional features not only increases the computational and storage burden but may also introduce noise that affects the model's generalization ability. More importantly, existing systems lack real-time quantitative evaluation and dynamic update mechanisms for feature importance, making it difficult to achieve self-correction and continuous optimization. Summary of the Invention

[0004] To address the problem of insufficient adaptability of existing static feature sets in dynamic network environments, this application provides a method and system for identifying covert communication traffic based on reinforcement learning dynamic feature selection. This method can analyze VPN encrypted traffic characteristics in real time, dynamically adjust feature selection strategies, and continuously optimize the classification model. Through reinforcement learning mechanisms, the classifier can continuously evolve, thereby improving the accuracy and stability of encrypted traffic identification.

[0005] This application provides a method for identifying covert communication traffic based on reinforcement learning dynamic feature filtering, including: Mirror captured VPN tunnel packets on the gateway or terminal side and perform preprocessing operations on the captured packets to obtain a clean one-way or two-way message sequence. The preprocessed message sequence is parsed to output the original high-dimensional feature vector, which includes the message length sequence, arrival timestamp, direction marker and TLS handshake metadata. Data processing is performed on the original high-dimensional feature vector to generate a multi-dimensional high-level statistical feature vector that describes the behavior of VPN encrypted traffic. Using the reinforcement learning engine, the correlation index and system resource cost of the advanced statistical feature vector under the current recognition task are used to output the contribution score of each feature. Based on the contribution score and adaptive threshold strategy, an optimal feature subset is generated and synchronously pushed to the classifier. Incremental application type identification is performed on VPN encrypted traffic using the optimal feature subset.

[0006] This application provides a covert communication traffic identification system based on reinforcement learning dynamic feature filtering, including: The traffic acquisition and preprocessing module is used to mirror and capture VPN tunnel packets on the gateway or terminal side, and perform preprocessing operations on the captured packets to obtain clean one-way or two-way packet sequences. The multi-dimensional original feature extraction module is communicatively connected to the traffic acquisition and preprocessing module. It is used to parse the preprocessed message sequence and output the original high-dimensional feature vector. The original high-dimensional feature vector includes the message length sequence, arrival timestamp, direction marker and TLS handshake metadata. The advanced feature processing module is communicatively connected to the multi-dimensional original feature extraction module and is used to process the original high-dimensional feature vector to generate a multi-dimensional advanced statistical feature vector that describes the behavior of VPN encrypted traffic. The feature importance evaluation module has a built-in reinforcement learning engine. It inputs the relevance index of the high-level statistical feature vector under the current recognition task and the system resource overhead into the reinforcement learning engine to output the contribution score of each feature. The feature selection and update module is communicatively connected to the feature importance evaluation module. It is used to generate an optimal feature subset based on the contribution score and the adaptive threshold strategy, and to synchronously push the optimal feature subset to the classifier. The classifier reinforcement module communicates bidirectionally with the feature selection and update module and the feature importance evaluation module. It uses the optimal feature subset to perform incremental application type identification on VPN encrypted traffic and feeds the identification results back to the reinforcement learning engine to form an autonomously updated closed-loop control loop.

[0007] Traditional VPN traffic identification methods rely on static feature libraries and rule engines, making it difficult to adapt to the dynamic changes in encrypted traffic. Existing technologies suffer from high feature redundancy, weak model generalization ability, and poor system adaptability, resulting in limited identification accuracy and high resource consumption. This application's embodiments introduce a dynamic feature evaluation mechanism, combined with reinforcement learning algorithms, to achieve real-time optimization of feature weights, effectively improving the feature set's adaptability to changes in the network environment and overcoming the performance bottleneck of traditional static feature sets in complex dynamic scenarios.

[0008] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0009] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a schematic diagram of the covert communication traffic identification method based on reinforcement learning dynamic feature screening according to an embodiment of this application; Figure 2 This is a schematic diagram of the workflow of the traffic acquisition and preprocessing module in an embodiment of this application; Figure 3 This is a schematic diagram of the workflow of the multi-dimensional original feature extraction module in an embodiment of this application; Figure 4 This is a schematic diagram of the feature importance assessment module in an embodiment of this application. Figure 5 This is a schematic diagram of the feature filtering and updating module in an embodiment of this application; Figure 6 This is a comparison of the effects of the enhanced classifier model before and after the upgrade in the embodiments of this application. Detailed Implementation

[0010] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0011] This application provides a method for identifying covert communication traffic based on reinforcement learning-based dynamic feature selection. The reinforcement identification method includes the following steps: S1, collecting encrypted traffic from a VPN tunnel; S2, parsing the collected PCAP files to extract basic original features of packets and flows; S3, preprocessing the original feature data and extracting multi-dimensional high-level statistical features such as packet statistics, time, frequency domain, entropy, and flow statistics through machine learning operations; S4, sampling real-world traffic to be tested and calculating the contribution threshold of environmental traffic features; S5, constructing a feature importance evaluation model based on a reinforcement learning framework, calculating the contribution of each feature to the current identification task in real time, and dynamically generating an optimal feature subset based on the contribution threshold; S6, using this subset to update the reinforcement classifier online to complete application type identification; S7, continuously detecting concept drift events, triggering processes S4-S6 when an event occurs to achieve autonomous model updates. This application can adaptively select the most effective features in scenarios with dynamically changing encrypted traffic features, overcoming the identification failure problem caused by feature drift in static classifiers, and improving the accuracy and robustness of VPN covert communication traffic identification. The method in this application adopts a modular design, with each module forming a complete data processing flow, such as... Figure 1 As shown, where: The traffic acquisition and preprocessing module is responsible for capturing and preprocessing network data packets, converting the raw data packets into standardized data packet information; the multi-dimensional feature extraction module extracts the original high-dimensional feature vector from the preprocessed data packets. The original high-dimensional feature vector includes message length, timestamp, direction mark and TLS handshake metadata. The advanced feature processing module is used to process the original high-dimensional feature vectors and generate multi-dimensional advanced statistical feature vectors to describe the behavior of VPN encrypted traffic. Specifically, it generates multi-dimensional advanced statistical feature vectors such as packet statistics, time domain, frequency domain, entropy, and flow statistics.

[0012] The feature importance evaluation module uses a reinforcement learning engine to evaluate the relevance and computational cost of high-level statistical feature vectors, providing a basis for feature selection. The feature selection and update module generates the optimal feature subset in real time based on importance scores and adaptive threshold strategies, and pushes it to the downstream classifier simultaneously. The classifier reinforcement module uses the optimal feature subset to perform incremental VPN traffic identification and feeds the identification results back to the reinforcement learning engine to achieve a closed-loop control process of autonomous updating.

[0013] In some embodiments of this application, the workflow of the traffic acquisition and preprocessing module described in this application is as follows: Figure 2As shown, during traffic acquisition, packet monitoring is first performed on the specified network interface; then, TCP and UDP traffic are differentiated and filtered based on the BPF mechanism. Real-time packet capture is performed using the sniff() function of the Scapy library. Finally, a queue buffer mechanism with a specified packet capacity is constructed for temporary storage and sequential processing of packets. In some specific examples, the specified packet capacity can be, for example, 10,000 packets.

[0014] During packet preprocessing, packet deduplication is first performed. A hash value is generated based on the source IP address, destination IP address, transport layer protocol, packet length, and identifier using a hash algorithm, and a deduplication window containing 1000 packets is maintained.

[0015] Next, flow identification and grouping processing are implemented. Flow identifiers are generated using 5-tuples, a unified identification mechanism for bidirectional flows is established, and a dynamic flow table is maintained to record the state of each flow.

[0016] Furthermore, header stripping is performed to remove the Ethernet header and IP header information, retaining the transport layer payload data and removing link layer padding data. The inbound and outbound traffic directions are identified by comparing the source IP address and the destination IP address; the smaller value is marked as the outbound direction, and the larger value as the inbound direction.

[0017] Perform flow management processing, build a flow table maintenance mechanism that includes timeout thresholds, set timeout thresholds, and perform flow table cleanup operations every minute to ensure the timeliness of flow status information.

[0018] In some embodiments of this application, the workflow of the multi-dimensional feature extraction module described in this application is as follows: Figure 3 As shown, the feature extraction module of this application relates to a network traffic analysis method based on multi-dimensional feature extraction.

[0019] In the process of extracting the original features, the network traffic data packets are first deeply parsed by the TLS handshake parser to extract key metadata such as TLS record type, version, cipher suite, session ID, as well as basic information such as message length, arrival timestamp, and transmission direction.

[0020] Subsequently, the original feature extractor is used to calculate five types of features in the preprocessed data packets, including statistical features of message length (mean, standard deviation, minimum, maximum, median, variance, skewness, peak), interval distribution features of time (average interval, interval variance, minimum and maximum interval), statistical features of direction (outbound and inbound ratio, number of direction changes), statistical features of protocol (number of TLS handshake messages, number of application packets and number of cipher suites), and statistical features of sequence (message length sequence, timestamp sequence and direction sequence).

[0021] Finally, a polling scheduling mechanism is used to allocate multi-dimensional feature extraction tasks, and the features generated by each extraction module are integrated into a unified high-dimensional feature vector, thereby achieving comprehensive feature extraction of network traffic.

[0022] In some embodiments of this application, the advanced feature processing module relates to a traffic behavior modeling method based on multi-dimensional feature analysis. This method achieves refined advanced feature extraction of network traffic through staged feature extraction and integration. Specifically: The raw traffic data undergoes packet statistical feature enhancement processing. A packet statistics calculator is used to add quantile features to the basic statistics mentioned above, providing a more detailed representation of packet distribution characteristics. A time-domain analyzer is used to extract flow duration, time interval distribution characteristics, and burstiness features. A frequency-domain analyzer uses frequency domain transformation techniques to perform Fast Fourier Transform on the packet length sequence and time interval sequence to obtain spectral feature parameters. An entropy calculator is used to calculate the Shannon entropy, joint entropy, and mutual information entropy features of the traffic, and a sliding window technique is used to calculate the variation characteristics of local entropy values. Based on flow statistical analysis, behavioral features such as flow duration, packet rate, and direction change rate are obtained.

[0023] Finally, the characteristic parameters of each stage are integrated into a unified feature vector that includes statistical features, time domain features, frequency domain features, entropy features, and flow features, thereby achieving a fine quantitative characterization of VPN encrypted traffic behavior.

[0024] In some embodiments of this application, the processing flow of the feature importance evaluation module involved in this application is as follows: Figure 4As shown, the process includes receiving the original feature dataset and corresponding label information, calculating the correlation index between each feature and the true label using the Pearson correlation coefficient algorithm, evaluating computational complexity based on feature type, constructing a reinforcement learning environment, using feature relevance and system resource overhead as the state space to represent the current state of the feature set, defining feature selection operations using feature retention and removal decisions as the action space, and using a weighted sum of the accuracy improvement and computational overhead penalty as the reward function. The reward function is dynamically adjusted based on the performance index of the feature subset, and reinforcement learning algorithms (including PPO, DQN, and A2C models) are used to train the feature selection strategy model. After training, the reward function is calculated to construct a classification model, followed by a feature importance evaluation process, and finally outputting the importance scores of each feature, the computational system resource overhead, and the optimal feature subset combination.

[0025] In a specific example, this application employs a customized reward function design based on multi-objective optimization. The core formula of the reward function is constructed as follows:

[0026] In some specific examples, the initialization parameter is accuracy weight. Set as Cost weight Baseline accuracy Baseline overhead .

[0027] accuracy pass:

[0028] Simulation calculations are performed, including feature quantity rewards. The bonus is based on the number of added features, and the feature type bonus is calculated separately according to the feature attribute type.

[0029] Computational overhead pass

[0030] The cost of each feature is summed up; The overhead of different types of features is set separately according to feature types such as frequency domain features, entropy features, flow statistics features, and other features.

[0031] Feature importance score for:

[0032] It is used to balance feature relevance and computational cost.

[0033] The reward function in this embodiment provides intelligent feedback to the reinforcement learning environment by weighted summing of accuracy improvement and overhead penalty, guiding the feature selection process to converge toward the optimal balance between performance and efficiency, and achieving the dual optimization goals of accuracy improvement and computational overhead control.

[0034] The processing flow of the feature filtering and updating module involved in the embodiments of this application is as follows: Figure 5 As shown, this includes dynamically adjusting the feature selection threshold based on sampled data and feature distribution characteristics; First, the feature importance score and the current performance metric are received as input. Then, in some examples, a new threshold is calculated based on an adaptive thresholding strategy that dynamically adjusts the threshold according to the most recent 3 performance histories: when the average performance is greater than 0.8, the threshold is lowered to the 60th percentile to select more features; when the performance is less than 0.6, the threshold is raised to the 85th percentile to select more important features; otherwise, the 75th percentile balance strategy is maintained.

[0035] The updated threshold is used for feature selection, filtering out features with importance scores greater than the threshold and sorting them by score. The minimum and maximum feature number constraints are applied to obtain the final feature subset.

[0036] The selected features are used for model training and performance evaluation, and the evaluation results are fed back to the threshold manager as performance metrics, forming a closed loop of continuous optimization.

[0037] In some specific examples, threshold stability is also determined by checking the standard deviation of the most recent 5 threshold changes. When the standard deviation is less than 0.05, the threshold is considered to have converged and stabilized.

[0038] The candidate features are iteratively optimized using the obtained feature subset. If they do not meet the threshold expectation and exceed the iteration limit, the quality of the feature set is improved by introducing high-value features and removing redundant features. The feature selection strategy is periodically updated and synchronized to the downstream processing module. At the same time, the system receives classifier performance feedback data and dynamically adjusts the feature selection strategy parameters through the feedback mechanism to achieve continuous optimization of system performance.

[0039] from Figure 6 The comparison results of the classifier model tests before and after enhancement show that the upgraded model of this application has achieved improved performance. While maintaining high confidence, the key performance indicators of the method in this application have all been improved for the new network traffic environment. Specifically: accuracy increased from 64.0% to 72.0%, an improvement of 12.50%; precision increased from 33.3% to 61.5%, an improvement of 84.62%; recall increased from 5.9% to 47.1%; and F1 score also increased from 10.0% to 53.3%.

[0040] Meanwhile, the method in this application achieves a 97.2% improvement in prediction efficiency by adding 10 features and optimizing the algorithm, reducing the prediction time from 47.94ms to 1.35ms, while increasing the training time by only 0.25 seconds. The overall performance of the updated model is significantly improved.

[0041] This application employs an adaptive feature selection strategy and a gradient boosting algorithm, which not only improves detection coverage but also reduces false alarm rate, achieving a dual optimization of detection accuracy and coverage. In particular, the reduced performance overhead in real-time traffic detection and analysis makes this method advantageous in meeting the real-time VPN traffic monitoring needs of high-concurrency network environments.

[0042] This application provides a covert communication traffic identification system based on reinforcement learning dynamic feature filtering, including: The traffic acquisition and preprocessing module is used to mirror and capture VPN tunnel packets on the gateway or terminal side, and perform preprocessing operations on the captured packets to obtain clean one-way or two-way packet sequences. The multi-dimensional original feature extraction module is communicatively connected to the traffic acquisition and preprocessing module. It is used to parse the preprocessed message sequence and output the original high-dimensional feature vector. The original high-dimensional feature vector includes the message length sequence, arrival timestamp, direction marker and TLS handshake metadata. The advanced feature processing module is communicatively connected to the multi-dimensional original feature extraction module and is used to process the original high-dimensional feature vector to generate a multi-dimensional advanced statistical feature vector that describes the behavior of VPN encrypted traffic. The feature importance evaluation module has a built-in reinforcement learning engine. It inputs the relevance index of the high-level statistical feature vector under the current recognition task and the system resource overhead into the reinforcement learning engine to output the contribution score of each feature. The feature selection and update module is communicatively connected to the feature importance evaluation module. It is used to generate an optimal feature subset based on the contribution score and the adaptive threshold strategy, and to synchronously push the optimal feature subset to the classifier. The classifier reinforcement module communicates bidirectionally with the feature selection and update module and the feature importance evaluation module. It uses the optimal feature subset to perform incremental application type identification on VPN encrypted traffic and feeds the identification results back to the reinforcement learning engine to form an autonomously updated closed-loop control loop.

[0043] It should be noted that, in the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0044] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0045] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0046] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A method for identifying covert communication traffic based on reinforcement learning dynamic feature selection, characterized in that, include: Mirror captured VPN tunnel packets on the gateway or terminal side and perform preprocessing operations on the captured packets to obtain a clean one-way or two-way message sequence. The preprocessed message sequence is parsed to output the original high-dimensional feature vector, which includes the message length sequence, arrival timestamp, direction marker and TLS handshake metadata. Data processing is performed on the original high-dimensional feature vector to generate a multi-dimensional high-level statistical feature vector that describes the behavior of VPN encrypted traffic. Using the reinforcement learning engine, the correlation index and system resource cost of the advanced statistical feature vector under the current recognition task are used to output the contribution score of each feature. Based on the contribution score and adaptive threshold strategy, an optimal feature subset is generated and synchronously pushed to the classifier. Incremental application type identification is performed on VPN encrypted traffic using the optimal feature subset.

2. The covert communication traffic identification method based on reinforcement learning dynamic feature selection as described in claim 1, characterized in that, The reinforcement learning engine takes as input the correlation index of the high-level statistical feature vector under the current recognition task and the system resource overhead, and its action space is the decision of retaining or eliminating each feature dimension. The reward function is a weighted sum of the improvement in recognition accuracy and the penalty for computational overhead.

3. The covert communication traffic identification method based on reinforcement learning dynamic feature selection as described in claim 1, characterized in that, Performing incremental application type identification on VPN encrypted traffic using the optimal feature subset includes: Incremental learning is achieved by integrating machine learning algorithms such as random forest, gradient boosting, logistic regression, SVM, and neural networks. Combined with feedback mechanisms and online self-updating capabilities, a closed-loop control loop is formed.

4. The covert communication traffic identification method based on reinforcement learning dynamic feature selection as described in claim 1, characterized in that, It also includes feeding back the incremental application type identification results to the reinforcement learning engine to form an autonomously updated closed-loop control loop.

5. The covert communication traffic identification method based on reinforcement learning dynamic feature selection as described in claim 1, characterized in that, Preprocessing operations on the captured packets include deduplication, stream-based framing, stripping of outer IP headers, and removal of link layer padding.

6. The covert communication traffic identification method based on reinforcement learning dynamic feature selection as described in claim 5, characterized in that, The preprocessed message sequence is parsed, and the original high-dimensional feature vector is output, including: Based on the traffic packet parsing method, multi-dimensional information such as packet length sequence, arrival timestamp, direction marker and TLS handshake metadata is extracted from the preprocessed packet sequence, and the original multi-dimensional feature vector is output.

7. The covert communication traffic identification method based on reinforcement learning dynamic feature selection as described in claim 6, characterized in that, Data processing of the original high-dimensional feature vector includes: Through multivariate statistical operations such as packet statistics, time domain analysis, frequency domain analysis, entropy calculation, and flow statistics, the original feature vector is transformed into a multi-dimensional high-level statistical feature vector that deeply characterizes the behavior pattern of VPN encrypted traffic.

8. The covert communication traffic identification method based on reinforcement learning dynamic feature selection as described in claim 1, characterized in that, The process of synchronously pushing the optimal feature subset to the classifier includes: Based on a fixed, percentile, adaptive, and dynamic threshold calculation method, the feature subset is optimized in real time and simultaneously pushed to the downstream classifier, realizing intelligent feature selection based on contribution score.

9. A covert communication traffic identification system based on reinforcement learning dynamic feature selection, characterized in that, include: The traffic acquisition and preprocessing module is used to mirror and capture VPN tunnel packets on the gateway or terminal side, and perform preprocessing operations on the captured packets to obtain clean one-way or two-way packet sequences. The multi-dimensional original feature extraction module is communicatively connected to the traffic acquisition and preprocessing module. It is used to parse the preprocessed message sequence and output the original high-dimensional feature vector. The original high-dimensional feature vector includes the message length sequence, arrival timestamp, direction marker and TLS handshake metadata. The advanced feature processing module is communicatively connected to the multi-dimensional original feature extraction module and is used to process the original high-dimensional feature vector to generate a multi-dimensional advanced statistical feature vector that describes the behavior of VPN encrypted traffic. The feature importance evaluation module has a built-in reinforcement learning engine. It inputs the relevance index of the high-level statistical feature vector under the current recognition task and the system resource overhead into the reinforcement learning engine to output the contribution score of each feature. The feature selection and update module is communicatively connected to the feature importance evaluation module. It is used to generate an optimal feature subset based on the contribution score and the adaptive threshold strategy, and to synchronously push the optimal feature subset to the classifier. The classifier reinforcement module communicates bidirectionally with the feature selection and update module and the feature importance evaluation module. It uses the optimal feature subset to perform incremental application type identification on VPN encrypted traffic and feeds the identification results back to the reinforcement learning engine to form an autonomously updated closed-loop control loop.

Images