TCP encryption communication portrait and risk identification method and system based on application layer feature identification

Abstract

The invention belongs to the technical field of power grids, and particularly relates to a TCP encryption communication portrait and risk identification method and system for application layer feature identification. The invention discloses a TCP encryption communication portrait and risk identification method and system based on application layer feature identification. The method comprises the following steps: acquiring network exit traffic by using a bypass; protocol types are detected, attribute analysis is carried out, and user attributes are classified; generating a portrait of each connection based on the connection features; and judging the risk level according to the connection portrait, and carrying out early warning on high-risk connection. According to the invention, application layer feature identification, portrait identification and risk identification are carried out on TCP encrypted communication, so that the accuracy and real-time performance of application identification, the efficiency and effect of risk identification, the network security protection capability, and the adaptability and expandability of the system are improved; according to the invention, refined management and control of encrypted communication, timely discovery and early warning of potential risks, effective blocking and isolation of malicious behaviors, and accurate identification and response of new threat modes are realized.

Description

Technical Field

[0001] This invention belongs to the field of power grid technology, specifically relating to a TCP encrypted communication profiling and risk identification method and system based on application layer feature recognition. Background Technology

[0002] While communication encryption technology is widely used to ensure network security, it cannot guarantee that the other party using encryption is not a malicious attacker. In this scenario, traditional deep packet inspection (DPI) techniques, which intercept and analyze data packets, become ineffective, such as those used in firewalls, gateway-type intrusion detection systems, and antivirus gateways. This invention uses big data analytics and mining techniques to address security in this scenario.

[0003] The basic unit of TCP / IP network communication is the communication connection, currently dominated by TCP connections. A TCP connection contains a wealth of information: at the physical layer, it provides information such as MAC address, Ethernet type, access method, physical location of the IP address, and access time; at the network layer, it contains information such as IP address, port, and traffic data; and at the user layer, it provides information such as user identity, digital certificate, and terminal type. All intrusion attempts must connect to the system, but traditional security detection techniques fail when using encrypted communication. New detection technologies are needed to assess and identify security risks. Although the content of the communication cannot be known, normal and illegitimate TCP connections will not belong to the same category. By selecting connection information as points in a multi-dimensional space and clustering these points, the discrete points become abnormal connections.

[0004] Encrypted TCP secure communication includes stages such as authentication, connection establishment, key negotiation, encrypted communication, and connection closure. The two parties in a TCP communication, the client and the server, complete this process by sending a series of TCP packets. This process is called the TCP connection process, and one communication session constitutes one TCP connection. A TCP connection contains information including: access method, IP addresses of both parties, communication ports, application layer protocol, electronic identities of both parties, cryptographic algorithms (such as signature algorithms, session encryption algorithms, hash algorithms, etc.), etc. The process of establishing a TCP connection also involves multiple states: establishing the TCP connection after a three-way handshake, authentication completed, key negotiation completed, key update, and secure communication. Commonly used encrypted communication protocols include HTTPS, SSH, SSL VPN, and IPSec VPN. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the technical problem solved by this invention is: how to solve the current technical problem of lacking a profiling mechanism for TCP encrypted communication and lacking effective technical control measures for encrypted communication anomaly analysis and early warning.

[0007] To address the aforementioned technical problems, this invention provides the following technical solution: a TCP encrypted communication profiling and risk identification method based on application layer feature recognition, comprising: collecting network egress traffic using a bypass; detecting protocol types, performing attribute analysis, and classifying user attributes; generating a profile for each connection based on connection features; determining the risk level based on the connection profile, and issuing warnings for high-risk connections.

[0008] As a preferred embodiment of the TCP encrypted communication profiling and risk identification method for application layer feature recognition described in this invention, the method of using bypass to collect network egress traffic includes using a data packet capture tool, configuring filtering rules, and capturing data packets containing encrypted TCP connections for a time range of 1-5 seconds.

[0009] Packets belonging to the same connection are grouped according to source IP, destination IP, source port, destination port, and protocol type.

[0010] As a preferred embodiment of the TCP encrypted communication profiling and risk identification method based on application layer feature identification described in this invention, the detection protocol type includes rapid identification of protocol types through data features, and the protocol types include TLS 1.0 to 1.3 and TLCP protocols, SSH protocols, and IPSec-type encryption protocols;

[0011] Based on application layer characteristics, identify the security protocol used by the TCP connection, and check the ContentType, ProtocolVersion, and Length fields of the TCP data packet to determine whether it is an HTTPS connection;

[0012] Check the value of the ProtocolVersion field to determine if it is a Chinese national standard TLCP or TLS 1.0~1.3;

[0013] Detect ISAKMP packets to determine if it is an IPSec connection;

[0014] Detect the negotiation characteristics and data packet format characteristics of TCP packet payloads to determine whether it is an SSH connection.

[0015] As a preferred embodiment of the TCP encrypted communication profiling and risk identification method based on application layer feature identification described in this invention, the attribute analysis includes further analysis of the identified protocol, and collection and extraction of the cryptographic algorithm used in TCP encrypted communication, the public keys or electronic identity information of both parties.

[0016] At the same time, the access methods, terminal types, MAC addresses, physical locations, electronic identities, or public key information used by both parties are extracted from the data frames;

[0017] Extract digital certificate, server random number, client random number, key exchange algorithm, and key parameters from TLCP handshake protocol data packets;

[0018] Extract encryption algorithms, data integrity algorithms, key exchange algorithms, and session keys from SSH key exchange protocol data packets;

[0019] Extract the identity certificate, security parameter index, Diffie-Hellman parameters, and authentication signature from IPSec IKE protocol messages;

[0020] Extract the source IP address, destination IP address, source MAC address, and destination MAC address from IP data packets.

[0021] As a preferred embodiment of the TCP encrypted communication profiling and risk identification method based on application-layer feature recognition described in this invention, the classification of user attributes includes:

[0022] The collected information is categorized into physical attributes, communication attributes, and user attributes;

[0023] The physical attributes include Ethernet type, terminal type, access method, physical location, and MAC address;

[0024] The communication attributes include IP address, port, and traffic data;

[0025] The user attributes include the protocol used, identity information, algorithm used, and communication connection time.

[0026] As a preferred embodiment of the TCP encrypted communication profiling and risk identification method for application layer feature recognition described in this invention, wherein: generating a profile for each connection includes constructing a TCP connection dataset, storing the dataset on a big data platform, and performing data preprocessing to standardize the dataset;

[0027] The standardized dataset is analyzed using clustering algorithms, and the clustering results are integrated.

[0028] The clustering algorithms include K-Means clustering, DBSCAN clustering, HDBSCAN clustering, Whisper clustering, ChineseWhisper clustering, and AGNES clustering;

[0029] Using an ensemble learning model, the result depends on the common clustering results of each model, as represented by:

[0030]

[0031] Where b i En(x) records the clustering results of x using different models, En(x) records the total clustering results of x, and M is the number of models;

[0032] Perform Bayesian estimation and output the evaluation results.

[0033] As a preferred embodiment of the TCP encrypted communication profiling and risk identification method for application layer feature recognition described in this invention, the step of determining the risk level based on the connection profile and issuing a warning for high-risk connections includes using a deep learning-based evaluation model to evaluate the profile of each generated connection and obtain a risk score for the connection.

[0034] The risk scores of the connections are mapped to points in the discrete cluster diagram. Based on the location, distribution, and density of the points, the discrete cluster diagram is generated and analyzed. Using risk assessment techniques based on multidimensional data analysis, the points in the discrete cluster diagram are compared with predefined risk characteristics and behavioral patterns to identify potential risks.

[0035] When the system detects abnormal IP addresses or illegal geographical locations in a TCP connection, it will record detailed connection logs, extract key features, compare them with known malicious features, and once a match is found, the system will generate a high-risk warning message and notify technical personnel via email and SMS. It will also use firewall isolation to block and drop the connection traffic.

[0036] When a TCP connection is initiated during non-business hours or via an unregistered terminal, the system will activate an emergency response procedure to immediately isolate the connection and analyze its data flow in detail to obtain possible malicious behavior patterns and characteristics, so as to facilitate subsequent security research and countermeasure formulation. The isolation method is to use VLAN isolation to cut off the connection communication.

[0037] When a TCP connection uses a known insecure encryption algorithm or an application layer protocol with security vulnerabilities, the system will automatically intercept the connection and store the associated source IP address, destination IP address, and protocol type information in the security event database for further analysis and processing by the security team. The interception method is to use a network gateway to isolate and perform security checks and filtering on the data.

[0038] When the system detects frequent connection requests or abnormally large data packets, it automatically triggers an advanced security scan. It uses deep packet inspection technology to parse and analyze the payload of the data packets, extracting the application layer features of the data packets. These application layer features include protocol type, data format, and content semantics. The system then compares these features with known malicious patterns. If a match is found, a high-risk warning is generated. The system then uses a one-way data transmission isolation method to transmit the data from the external network to the internal network to prevent data leakage and tampering.

[0039] When a new cybersecurity threat pattern is identified, the system updates the threat database in a timely manner and adjusts the parameters and rules of the risk assessment model to ensure that the system can accurately identify and respond to the new threat pattern.

[0040] For connections identified as high-risk, record all relevant network behaviors, communication content, and associated attributes in detail, and organize and analyze the data to form a complete risk report so that the security team can take specific security measures.

[0041] As a preferred embodiment of the TCP encrypted communication profiling and risk identification method based on application layer feature recognition described in this invention, wherein:

[0042] Another objective of this invention is to provide a TCP encrypted communication profiling and risk identification system based on application-layer feature recognition. This system uses application-layer feature recognition technology to profile and identify risks in TCP encrypted communication, solving the technical problem that traditional protocol identification technologies cannot accurately control encrypted communication. The method of this invention can effectively extract the physical, communication, and user attributes of TCP encrypted communication, construct a profile for each connection, and use a deep learning-based evaluation model to assess and determine the risk of the connection, providing early warnings and responses for high-risk connections, thereby improving network security protection capabilities.

[0043] To solve the above technical problems, the present invention provides the following technical solution: a TCP encrypted communication profiling and risk identification system based on application layer feature recognition, comprising: a data acquisition module, a data preprocessing module, a protocol identification module, an attribute analysis module, a user classification module, a connection profiling module, a risk judgment module, an early warning response module, a threat update module, and a risk reporting module;

[0044] The data acquisition module is used to capture data packets of encrypted TCP connections;

[0045] The data preprocessing module is used to aggregate and standardize datasets;

[0046] The protocol identification module is used to identify the security protocol used by the TCP connection;

[0047] The attribute analysis module is used to extract the cryptographic algorithm, public keys, or electronic identity information of both parties in TCP encrypted communication.

[0048] The user classification module is used to classify the collected information into physical attributes, communication attributes, and user attributes;

[0049] The connection profiling module is used to generate a profile for each connection using clustering algorithms and ensemble learning models;

[0050] The risk assessment module is used to evaluate the generated profile of each connection using a deep learning-based evaluation model, obtain the risk score of the connection, and identify potential risks.

[0051] The early warning response module is used to generate high-risk early warning information when the system detects a risk in a TCP connection, and to use isolation methods to intercept and discard the connection's traffic, isolate the connection in real time, and analyze its data flow in detail to obtain possible malicious behavior patterns and characteristics.

[0052] The threat update module is used to update the threat database in a timely manner and adjust the parameters and rules of the risk assessment model when new network security threat patterns are identified.

[0053] The risk reporting module is used to record in detail all relevant network behaviors, communication content and associated attributes of connections identified as high-risk, and to generate a complete risk report.

[0054] A computer device includes a memory and a processor, the memory storing a computer program, characterized in that the processor executes the computer program to implement the steps of an application-layer feature recognition method for TCP encrypted communication profiling and risk identification.

[0055] A computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of an application-layer feature-based TCP encrypted communication profiling and risk identification method.

[0056] The beneficial effects of this invention are as follows: This invention provides a method for profiling and identifying risks in TCP encrypted communication based on application-layer feature recognition. The method and system of this invention can perform application-layer feature recognition, profiling, and risk identification on TCP encrypted communication, improving the accuracy and real-time performance of application identification, the efficiency and effectiveness of risk identification, network security protection capabilities, system adaptability and scalability. It enables refined control over encrypted communication, timely detection and early warning of potential risks, effective blocking and isolation of malicious behavior, and accurate identification and response to new threat patterns, providing valuable data and information for security teams to take specific security measures. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0058] Figure 1 This is an overall flowchart of an application-layer feature recognition method for profiling and identifying risks in TCP encrypted communication, provided as an embodiment of the present invention.

[0059] Figure 2 This is a flowchart illustrating the communication profiling process of an application-layer feature-based TCP encrypted communication profiling and risk identification method, provided as an embodiment of the present invention.

[0060] Figure 3 This is a schematic diagram of a TCP connection profile provided by an application layer feature recognition method for TCP encrypted communication and risk identification, according to an embodiment of the present invention.

[0061] Figure 4 This is a schematic diagram of TLS / TLCP secure communication, which is an application-layer feature recognition TCP encrypted communication profile and risk identification method provided in one embodiment of the present invention.

[0062] Figure 5 This is a schematic diagram of outliers in an application-layer feature recognition method for TCP encrypted communication profiling and risk identification, provided as an embodiment of the present invention.

[0063] Figure 6 This is a probability diagram of an application-layer feature recognition method for TCP encrypted communication profiling and risk identification, provided as an embodiment of the present invention.

[0064] Figure 7 This diagram illustrates the differences between HTTP and HTTPS in an application-layer feature-based TCP encrypted communication profiling and risk identification method, as provided in one embodiment of the present invention.

[0065] Figure 8 This is a schematic diagram of the TLS protocol for an application-layer feature-based TCP encrypted communication profiling and risk identification method, provided as an embodiment of the present invention.

[0066] Figure 9 This is a schematic diagram of the TCP encrypted connection communication principle of an application layer feature recognition TCP encrypted communication profile and risk identification method provided in one embodiment of the present invention.

[0067] Figure 10This is a structural diagram of a TCP encrypted communication profiling and risk identification system based on application layer feature recognition, provided as an embodiment of the present invention. Detailed Implementation

[0068] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0069] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0070] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0071] This invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of this invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not adhering to the usual scale. Furthermore, the schematic diagrams are merely examples and should not be construed as limiting the scope of protection of this invention. In actual fabrication, the three-dimensional spatial dimensions of length, width, and depth should be included.

[0072] Furthermore, in the description of this invention, it should be noted that the terms "upper," "lower," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used solely for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. In addition, the terms "first," "second," or "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0073] Unless otherwise explicitly specified and limited, the terms "installation," "connection," and "joining" in this invention should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; similarly, they can refer to mechanical connections, electrical connections, or direct connections, or indirect connections through an intermediate medium, or internal connections between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0074] Example 1

[0075] Reference 1- Figure 9 As an embodiment of the present invention, a TCP encrypted communication profiling and risk identification method based on application layer feature recognition is provided, comprising:

[0076] S1: Use a bypass to collect network egress traffic;

[0077] Furthermore, the method of using bypass to collect network egress traffic includes using a data packet capture tool, configuring filtering rules, and capturing data packets containing encrypted TCP connections within a time range of 1-5 seconds.

[0078] Packets belonging to the same connection are grouped according to source IP, destination IP, source port, destination port, and protocol type.

[0079] S2: Detect protocol type, perform attribute analysis, and classify user attributes;

[0080] Furthermore, the detection protocol type includes quickly identifying the protocol type through data characteristics, and the protocol type includes TLS 1.0 to 1.3 and TLCP protocols, SSH protocols, and IPSec-type encryption protocols;

[0081] It should be noted that, regarding application security in B / S architecture, the standard GB / T38636-2020 Information Security Technology Transport Layer Cryptography Protocol (TLCP) (hereinafter referred to as the National Cryptography TLCP) has been formulated. This standard clearly stipulates that web servers must support the algorithm suite specified by the State Cryptography Administration and the process for establishing secure connections. Whether a web server supports national cryptographic algorithms (referring to commercial cryptographic algorithms in China) and meets the corresponding specifications has become one of the requirements for information system compliance.

[0082] This invention describes how to detect whether a web server supports Chinese cryptographic algorithms, specifically how to detect whether a web server supports the "GB / T38636-2020 Information Security Technology Transport Layer Cryptography Protocol (TLCP)" protocol. Through packet capture, parsing, and analysis, it can be determined whether the web server has enabled this protocol to ensure communication security.

[0083] In addition to the aforementioned national cryptographic algorithms, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3, and the "SSL VPN Technical Specification GM / T 0024-2014" can also be identified using this method, although the parsing methods differ slightly between different versions.

[0084] Overview of Chinese Cryptographic TLCP

[0085] HTTPS stands for HyperTextTransfer Protocol over Secure SocketLayer, which is essentially HTTP+TLS (SSL 1.0, SSL 2.0, and SSL 3.0 are deprecated). Figure 6 As shown;

[0086] The TLS protocol is divided into two layers: the lower layer is the record layer protocol, and the upper layer is the handshake protocol suite, such as... Figure 7 As shown;

[0087] The record layer protocol data is as follows:

[0088] ContentType: 1 byte, 0 indicates invalid, 20 indicates the upper-layer handshake protocol family is a cryptographic specification change protocol, 21 indicates the upper layer is a warning protocol, 22 is the handshake protocol, and 23 is the application data protocol.

[0089] ProtocolVersion: 2 bytes. {3,1} represents TSLv1.0, {3,2} represents TSLv1.1, {3,3} represents TSLv1.2, and so on, up to {3,4} which represents TSLv1.3. Specifically, the Chinese national standard version of TLS specifies the use of {1,1}. That is, the TLCP protocol uses {1,1} for this field.

[0090] Length: 2 bytes, with the most significant byte first, representing the length of the data that follows.

[0091] Fragments: Handshake protocol family data.

[0092] Based on the ContentType value, Fragment data is parsed in different formats. At the handshake protocol family layer, different versions of TLS (including the Chinese national cryptographic standard TLCP) are basically the same; the main differences lie in the different cipher suites specified by TLCP and the data structure after determining the cipher suites. Currently, the values ​​corresponding to the cipher suites supported by TLCP are:

[0093] Table 1: List of cipher suites supported by the Chinese national cryptographic TLCP protocol

[0094] Package Name value ECDHE_SM4_CBC_SM3 {0xe0,0x11} ECDHE_SM4_GCM_SM3 {0xe0,0x51} ECC_SM4_CBC_SM3 {0xe0,0x13} ECC_SM4_GCM_SM3 {0xe0,0x51} IBSDH_SM4_CBC_SM3 {0xe0,0x15} IBSDH_SM4_GCM_SM3 {0xe0,0x55} IBC_SM4_CBC_SM3 {0xe0,0x17} IBC_SM4_GCM_SM3 {0xe0,0x51} RSA_SM4_CBC_SM3 {0xe0,0x19} RSA_SM4_GCM_SM3 {0xe0,0x1e} RSA_SM4_CBC_SHA256 {0xe0,0x5a}

[0095] In TLSv1.2, the first byte of a cipher suite value is always 0x00 or 0xc0, etc. In TLSv1.3, the first byte of a cipher suite is always 0x13, and the second byte ranges from 0x01 to 0x05. The value of the cipher suite is unique and exclusive, and can be used as a basis for detection and identification.

[0096] The key differences between the Chinese national cryptographic standard TLCP and the international standards TLSv1.2 and TLSv1.3 are:

[0097] 1) The ProvocolVersion field of the TLS record protocol is different. The Chinese national cryptographic TLCP is {1,1}, while TLSv1.2 and TLSv1.3 are {3,3} and {3,4} respectively;

[0098] 2) The values ​​of the supported cipher suites are different. The first byte of the Chinese national standard TLCP cipher suite is 0xe0.

[0099] Based on application layer characteristics, identify the security protocol used by the TCP connection, check the ContentType, ProtocolVersion, and Length fields of the TCP datagram to determine if it is an HTTPS connection; check the value of the ProtocolVersion field to determine if it is the Chinese national cryptographic standard TLCP and TLS 1.0~1.3;

[0100] To determine whether an HTTPS data packet is a data packet using the Chinese national cryptographic TLCP protocol, you first need to know whether it is an HTTPS protocol.

[0101] Based on the above description of HTTPS principles, the logic for detecting HTTPS protocol packets is as follows:

[0102] The HTTPS protocol must be built on top of the TCP protocol.

[0103] The TCP payload must conform to the data format of the record layer protocol.

[0104] Therefore, in the absence of context (meaning a single data packet is sufficient for judgment; TCP communication involves "three-way handshake and four-way handshake," which is one layer of context; additionally, the TLS connection establishment process involves negotiating algorithms and keys, which is another layer of context), given TCP layer payload data, the following judgment is made:

[0105] The first byte is not a value other than 0, 20, 21, 22, or 23.

[0106] The second and third bytes cannot be any value other than {1,1}, {3,2}, {3,3}, or {3,4} (other versions of SSL / TLS have security vulnerabilities and have been deprecated). If it is the Chinese national cryptographic TLCP protocol, it can only be {1,1}.

[0107] The integer formed by the 4th and 5th bytes (highest byte first) is equal to the length of the following data (the integer formed by the 4th and 5th bytes represents the number of bytes following, i.e., the second meaning—the remaining data length in this data packet).

[0108] If all three conditions mentioned above are met simultaneously, it is considered an HTTPS protocol data packet, and it can be basically determined that it is an HTTPS protocol.

[0109] Lemma: For A to be B, three conditions must be met: condition 1, condition 2, and condition 3.

[0110] The probabilities of conditions 1, 2, and 3 occurring are p1, p2, and p3, respectively.

[0111] Therefore, when conditions 1, 2, and 3 all occur, the probability that A is not B is less than p1p2p3. For example... Figure 5 As shown;

[0112] The square represents the total probability. The three circles represent the probabilities of conditions 1, 2, and 3 occurring, respectively. The intersection of the three circles represents the probability of conditions 1, 2, and 3 occurring simultaneously. The hexagon represents the probability of event A occurring. Clearly, the probability of conditions 1, 2, and 3 occurring simultaneously, but not event A, is the intersection of the three circles minus the hexagon, which is smaller than the intersection of the three circles.

[0113] Therefore, assuming that TCP packet data follows a uniform distribution, the probability of satisfying the first condition is: The probability of satisfying the second condition is The probability of satisfying the third condition is Therefore, the probability of a packet that meets the above conditions but is not HTTPS is no greater than (assuming TCP data is evenly distributed):

[0114]

[0115] Obviously, it is easy to deduce that if the above three conditions are used to determine whether a data packet is a Chinese national cryptographic TLCP protocol packet, the probability of error will not be greater than:

[0116]

[0117] To determine if a packet is an HTTPS packet, check factors such as the context port number (HTTPS connections use port 443 by default, so if either the source or destination port is 443, this can also be used for confirmation. Other cases are discussed in the "Further Confirmation" section later) or further parse the Fragment data following the record protocol to see if it conforms to the protocol specifications.

[0118] By checking the value of ProtocolVersion, it is determined whether the packet is a Chinese national cryptographic TLCP packet or another type of TLS packet (this solution attempts to determine whether a packet is a TLCP protocol packet by peeling off the header and parsing the data layer by layer from an IP packet without context. Therefore, it is necessary to determine whether the packet is an HTTPS protocol packet based on the self-consistency of the packet data format itself, and then determine whether the packet is a Chinese national cryptographic algorithm packet).

[0119] The above method determines whether it's an HTTPS protocol at the record layer. Above the record layer, there are only four possibilities. Further verification is possible. These are described below:

[0120] Key specification change protocol: Length must be 1 and Fragments must also be 1; otherwise, it is not a valid Chinese national cryptographic TLCP packet, nor is it another TLS protocol packet.

[0121] Warning: Length must be 2, and the first byte of Fragments can only be 1 or 2; otherwise, it is not a valid Chinese national cryptographic TLCP packet, nor is it a packet of any other TLS protocol.

[0122] Application data protocol; if the first step determines that it is an application data protocol, it means that the subsequent payload is encrypted data, and no further judgment is needed.

[0123] Handshake Protocol: If the first step is determined to be a handshake protocol, then based on different types, further identification can be made of the encryption algorithms, identity information, and exchanged random numbers of the communicating parties.

[0124] More user attributes can be obtained by analyzing the handshake protocol: user identity information (digital certificate), the version of the communication protocol used (TLSv1.1, TLSv1.2, TLSv1.3, or TLCPv1.1, etc.), the random number exchanged for keys, and the cipher suites used for encrypted communication.

[0125] Detect the negotiation characteristics and data packet format characteristics of TCP packet payloads to determine whether it is an SSH connection.

[0126] It should be noted that the TCP packet payload of the SSH protocol has two significant characteristics: version negotiation and packet format.

[0127] Version negotiation characteristics: After the TCP three-way handshake, the version negotiation content contains the string "SSH-", and this string ends with a newline character, that is, the hexadecimal form of the last two bytes is 0d0a.

[0128] The data packet format characteristics are as follows:

[0129] Packet_length: Packet length, 4 bytes, with the most significant byte first;

[0130] Padding_length: Padding length, occupying one byte;

[0131] SSH_Payload: Data payload, with a length of payload_length = packet_length - padding_length - 1 byte;

[0132] Random_padding: Randomly padded data, occupying padding_length bytes;

[0133] Mac: Message Authentication Code. Its length is the length of the hash algorithm. The hash algorithm can only be determined after negotiation between the cryptographic algorithms, so it is empty in the early stages.

[0134] Clearly, assuming the TCP payload data values ​​are evenly distributed, the probability of correctly identifying an SSH packet using this method, but not actually being one, is less than:

[0135]

[0136] For application payload characteristics, the key exchange initialization packet format is as follows:

[0137] SSH_MSG_KEXINIT: 1 byte (value is 20);

[0138] Cookie: A 16-byte random number;

[0139] kex_algorithms_length: A 4-byte integer, with the most significant byte first;

[0140] kex_algorithms: A comma-separated string with a length of kex_algorithms_length;

[0141] server_host_key_algorithms_length: A 4-byte integer, with the most significant byte first;

[0142] server_host_key_algorithms: A comma-separated string with a length of server_host_key_algorithms_length;

[0143] encryption_algorithms_client_to_server_length: A 4-byte integer, with the most significant byte first;

[0144] encryption_algorithms_client_to_server: A comma-separated string with a length of encryption_algorithms_client_to_server_length;

[0145] encryption_algorithms_server_to_client_length: A 4-byte integer, with the most significant byte first;

[0146] encryption_algorithms_server_to_client: A comma-separated string with a length of encryption_algorithms_server_to_client_length;

[0147] mac_algorithms_client_to_server_length: A 4-byte integer, with the most significant byte first;

[0148] mac_algorithms_client_to_server: A comma-separated string with a length of mac_algorithms_client_to_server_length;

[0149] mac_algorithms_server_to_client_length: A 4-byte integer, with the most significant byte first;

[0150] mac_algorithms_server_to_client: A comma-separated string with a length of mac_algorithms_server_to_client_length;

[0151] compression_algorithms_client_to_server_length: A 4-byte integer, with the most significant byte first;

[0152] compression_algorithms_client_to_server: A comma-separated string with a length of compression_algorithms_client_to_server_length;

[0153] compression_algorithms_server_to_client_length: A 4-byte integer, with the most significant byte first;

[0154] compression_algorithms_server_to_client: A comma-separated string with a length of compression_algorithms_server_to_client_length;

[0155] languages_client_to_server_length: A 4-byte integer, with the most significant byte first;

[0156] languages_client_to_server: A comma-separated string with a length of languages_client_to_server_length;

[0157] languages_server_to_client_length: A 4-byte integer, with the most significant byte first;

[0158] languages_server_to_client: A comma-separated string with a length of languages_server_to_client_length;

[0159] first_kex_packet_follows: 1 byte, boolean data;

[0160] reserved_data: 4 bytes of reserved data.

[0161] For key exchange packets and key exchange response packets, the first byte of the key exchange packet is 1e (hexadecimal form, decimal 30), and the subsequent content varies depending on the algorithm used for key negotiation.

[0162] The first byte of the key exchange reply packet is 1f (hexadecimal form, decimal 31), and the subsequent content varies depending on the key negotiation algorithm.

[0163] The key exchange algorithms DH and ECDH differ in that DH requires an additional exchange. ECDH, on the other hand, specifies curve parameters and only requires a single exchange.

[0164] Using the new key data packet: the payload is only one byte, and the content is 21.

[0165] Encrypted communication packets: All content in an encrypted communication packet is encrypted and cannot be retrieved.

[0166] Detect ISAKMP packets to determine if it is an IPSec connection;

[0167] It should be noted that the key to identifying secure IPSec communication is the IKEv2 key exchange protocol. The negotiated communication data is encrypted, and no further connection information can be obtained. Therefore, identifying the characteristics of IPSec communication essentially involves parsing the characteristic attributes of both parties through IKEv2 data packets.

[0168] The IKEv2 protocol UPD payload characteristics use the UDP protocol and port 500.

[0169] The characteristics of a UDP packet are as follows:

[0170] InitiatorCookie: 8-byte random number from the initiator;

[0171] ResponderCookie: An 8-byte random number for the responder;

[0172] NextPayload: The next payload type, 1 byte;

[0173] Ver: Version, 1 byte;

[0174] ExchangeType: Exchange type, 1 byte;

[0175] Flags: Flags, 1 byte;

[0176] MessageID: Message ID, 4 bytes;

[0177] Length: Total length, including header and payload. 4 bytes;

[0178] Payload: Data load.

[0179] For the IKEv2 protocol application layer payload characteristics, the application layer characteristics are as follows:

[0180] NextPayload: The next payload type, 1 byte;

[0181] RESERVED: Data is retained, 1 byte;

[0182] PayloadLength: The length of this payload, 2 bytes.

[0183] The principle behind IPSec protocol feature identification is as follows:

[0184] Identifying the IPSec protocol mainly involves judging ISAKMP packets. The judgment method is as follows: it is a UPDATE packet, and the port is 500 or 4500; the length of the entire data is an integer consisting of 25-28 bytes; the probability of determining that it is an ISAKMP packet but not an ISAKMP packet using this method is less than 2.33 × 10^(-10).

[0185] By analyzing the IKE protocol, user attributes can be obtained: the identities of the communicating parties, and the Security Association (SA) (including encryption algorithm, hash algorithm, authentication method, PRF algorithm, compression algorithm, DH algorithm, time to live, etc.).

[0186] Furthermore, the attribute analysis includes further analysis of the identified protocols, collecting and extracting the cryptographic algorithms used in TCP encrypted communication, and the public keys or electronic identity information of both parties.

[0187] At the same time, the access methods, terminal types, MAC addresses, physical locations, electronic identities, or public key information used by both parties are extracted from the data frames;

[0188] Extract digital certificate, server random number, client random number, key exchange algorithm, and key parameters from TLCP handshake protocol data packets;

[0189] Extract encryption algorithms, data integrity algorithms, key exchange algorithms, and session keys from SSH key exchange protocol data packets;

[0190] Extract the identity certificate, security parameter index, Diffie-Hellman parameters, and authentication signature from IPSec IKE protocol messages;

[0191] Extract the source IP address, destination IP address, source MAC address, and destination MAC address from IP data packets.

[0192] Furthermore, the classification of user attributes includes

[0193] The collected information is categorized into physical attributes, communication attributes, and user attributes;

[0194] The physical attributes include Ethernet type, terminal type, access method, physical location, and MAC address;

[0195] The communication attributes include IP address, port, and traffic data;

[0196] The user attributes include the protocol used, identity information, algorithm used, and communication connection time.

[0197] S3: Generate a profile for each connection based on connectivity features;

[0198] Furthermore, generating a profile for each connection includes constructing a TCP connection dataset, storing the dataset on a big data platform, and performing data preprocessing to standardize the dataset.

[0199] The standardized dataset is analyzed using clustering algorithms, and the clustering results are integrated.

[0200] The clustering algorithms include K-Means clustering, DBSCAN clustering, HDBSCAN clustering, Whisper clustering, Chinese Whisper clustering, and AGNES clustering;

[0201] An ensemble learning model is used, and the results depend on the common clustering results of each model.

[0202]

[0203] Where b i En(x) records the clustering results of x using different models, En(x) records the total clustering results of x, and M is the number of models;

[0204] Perform Bayesian estimation and output the evaluation results.

[0205] It should be noted that when using classification or clustering, the distance between points in the dataset must be defined.

[0206] Assume there is a complete information asset table, with details on the model and manufacturer of all information assets.

[0207] The coordinates of the dataset points are defined as follows:

[0208] The null value for all items is 1, which is the maximum value after standardization;

[0209] Terminal type, access method, and Ethernet type point set coordinates are defined as the percentage in the information asset. For example, if the manufacturer of a record network card MAC address is Company A, and Company A's products account for q% of all network cards in the unit, then the coordinates corresponding to the MAC address of that record are q.

[0210] The coordinates corresponding to the IP address are the physical location, and this distance is the standardized physical distance; if the protocol is used, the default port is 0, otherwise it is 1; traffic data is the actual data standardized as the coordinate value;

[0211] The protocol, identity information, and algorithm used are 0 if they fall within a specified range, and 1 otherwise.

[0212] The start / end time of a communication connection is 0 if it falls within normal working hours; otherwise, it is calculated based on the off-peak time. For example, if the normal working hours are 9:00 to 18:00, the furthest distance is (24-7) / 2 = 8.5. If a connection occurs at 3:00 AM, the relative distance is (9-3) / 8.5 = 0.71, which corresponds to the coordinate component value.

[0213] The distance between data points is the Euclidean distance, which is the sum of the squares of the differences between the components.

[0214] S4: Determine the risk level based on the connection profile and issue warnings for high-risk connections.

[0215] Furthermore, the step of determining the risk level based on the connection profile and issuing an early warning for high-risk connections includes using a deep learning-based evaluation model to evaluate the profile of each generated connection and obtain a risk score for the connection.

[0216] The risk scores of the connections are mapped to points in the discrete cluster diagram. Based on the location, distribution, and density of the points, the discrete cluster diagram is generated and analyzed. Using risk assessment techniques based on multidimensional data analysis, the points in the discrete cluster diagram are compared with predefined risk characteristics and behavioral patterns to identify potential risks.

[0217] When the system detects abnormal IP addresses or illegal geographical locations in a TCP connection, it will record detailed connection logs, extract key features, compare them with known malicious features, and once a match is found, the system will generate a high-risk warning message and notify technical personnel via email and SMS. It will also use firewall isolation to block and drop the connection traffic.

[0218] When a TCP connection is initiated during non-business hours or via an unregistered terminal, the system will activate an emergency response procedure to immediately isolate the connection and analyze its data flow in detail to obtain possible malicious behavior patterns and characteristics, so as to facilitate subsequent security research and countermeasure formulation. The isolation method is to use VLAN isolation to cut off the connection communication.

[0219] When a TCP connection uses a known insecure encryption algorithm or an application layer protocol with security vulnerabilities, the system will automatically intercept the connection and store the associated source IP address, destination IP address, and protocol type information in the security event database for further analysis and processing by the security team. The interception method is to use a network gateway to isolate and perform security checks and filtering on the data.

[0220] When the system detects frequent connection requests or abnormally large data packets, it automatically triggers an advanced security scan. It uses deep packet inspection technology to parse and analyze the payload of the data packets, extracting the application layer features of the data packets. These application layer features include protocol type, data format, and content semantics. The system then compares these features with known malicious patterns. If a match is found, a high-risk warning is generated. The system then uses a one-way data transmission isolation method to transmit the data from the external network to the internal network to prevent data leakage and tampering.

[0221] When a new cybersecurity threat pattern is identified, the system updates the threat database in a timely manner and adjusts the parameters and rules of the risk assessment model to ensure that the system can accurately identify and respond to the new threat pattern.

[0222] For connections identified as high-risk, record all relevant network behaviors, communication content, and associated attributes in detail, and organize and analyze the data to form a complete risk report so that the security team can take specific security measures.

[0223] Example 2

[0224] The second embodiment of the present invention differs from the first embodiment in that:

[0225] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0226] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0227] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0228] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0229] Example 3

[0230] Reference Figure 10 This is the third embodiment of the present invention. This embodiment provides a TCP encrypted communication profiling and risk identification method system based on application layer feature recognition, including: a data acquisition module, a data preprocessing module, a protocol identification module, an attribute analysis module, a user classification module, a connection profiling module, a risk determination module, an early warning response module, a threat update module, and a risk reporting module;

[0231] The data acquisition module is used to capture data packets of encrypted TCP connections;

[0232] The data preprocessing module is used to aggregate and standardize datasets;

[0233] The protocol identification module is used to identify the security protocol used by the TCP connection;

[0234] The attribute analysis module is used to extract the cryptographic algorithm, public keys, or electronic identity information of both parties in TCP encrypted communication.

[0235] The user classification module is used to classify the collected information into physical attributes, communication attributes, and user attributes;

[0236] The connection profiling module is used to generate a profile for each connection using clustering algorithms and ensemble learning models;

[0237] The risk assessment module is used to evaluate the generated profile of each connection using a deep learning-based evaluation model, obtain the risk score of the connection, and identify potential risks.

[0238] The early warning response module is used to generate high-risk early warning information when the system detects a risk in a TCP connection, and to use isolation methods to intercept and discard the connection's traffic, isolate the connection in real time, and analyze its data flow in detail to obtain possible malicious behavior patterns and characteristics.

[0239] The threat update module is used to update the threat database in a timely manner and adjust the parameters and rules of the risk assessment model when new network security threat patterns are identified.

[0240] The risk reporting module is used to record in detail all relevant network behaviors, communication content and associated attributes of connections identified as high-risk, and to generate a complete risk report.

[0241] Example 4

[0242] The fourth embodiment of the present invention provides a TCP encrypted communication profiling and risk identification method based on application layer feature recognition. To verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculations and experiments.

[0243] In two similar enterprise network environments, existing technical solutions and this method were deployed, respectively. Both environments faced daily network threats and attack attempts. Performance data for the two solutions were collected and compared over a certain period, as shown below:

[0244]

[0245] As shown in the table above, this method achieves a 94% success rate in DDoS attack detection, a significant improvement over the existing 82% solution, while reducing the response time from 12 seconds to 5 seconds. In phishing attack scenarios, this method achieves a 92% success rate, higher than the existing 78%, with the response time reduced from 8 seconds to 3 seconds. This method demonstrates a 91% success rate in detecting Marvara propagation, compared to the existing 74%, with the processing time reduced to 7 seconds, a substantial improvement over the existing 18 seconds. In data breach detection, this method achieves an 89% success rate, surpassing the existing 70%, with the processing time reduced from 22 seconds to 9 seconds. Against zero-day attacks, this method achieves an 87% success rate, higher than the existing 68%, with the response time reduced to 12 seconds. In dealing with APT attacks, this method achieves an 85% success rate, significantly better than the existing 65%, with the response time reduced from 35 seconds to 15 seconds.

[0246]

[0247] As can be seen from the table above, this method significantly outperforms existing technical solutions in many aspects, including accuracy, response speed, resource efficiency, detection of novel attacks, system stability, and user satisfaction. These data fully demonstrate the beneficial effects of this method in improving network security, reducing false alarms, improving resource utilization efficiency, and enhancing user experience.

[0248] In summary, this method is a solution for profiling and identifying risks in encrypted TCP communication that has significant advantages in real-world network environments.

[0249] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for profiling and identifying risks in TCP encrypted communication based on application-layer feature recognition, characterized in that, include: Use a bypass to collect network egress traffic; Detect the protocol type, perform attribute analysis, and classify user attributes; Based on connection features, generate a profile for each connection; The risk level is determined based on the connection profile, and warnings are issued for high-risk connections.

2. The TCP encrypted communication profiling and risk identification method based on application layer feature recognition as described in claim 1, characterized in that: The method of using bypass to collect network egress traffic includes using a data packet capture tool, configuring filtering rules, and capturing data packets containing encrypted TCP connections within a time range of 1-5 seconds. Packets belonging to the same connection are grouped according to source IP, destination IP, source port, destination port, and protocol type.

3. The TCP encrypted communication profiling and risk identification method based on application layer feature recognition as described in claim 2, characterized in that: The protocol type detection includes rapid identification of protocol types through data characteristics, including TLS 1.0-1.3, TLCP, SSH, and IPSec-like encryption protocols; based on application layer characteristics, it identifies the security protocol used by the TCP connection, checks the ContentType, ProtocolVersion, and Length fields of the TCP datagram to determine if it is an HTTPS connection; examines the value of the ProtocolVersion field to determine if it is the Chinese national cryptographic standard TLCP and TLS 1.0-1.3; detects ISAKMP packets to determine if it is an IPSec connection; and detects the negotiation characteristics and packet format characteristics of the TCP packet payload to determine if it is an SSH connection. The logic for detecting HTTPS protocol packets includes that the protocol must be built on top of the TCP protocol, and the TCP payload must conform to the data format of the record layer protocol. The criteria for judging TCP layer payload data are as follows: The first byte is not a value other than 0, 20, 21, 22, or 23; The second and third bytes are not values ​​other than {1,1}, {3,2}, {3,3}, and {3,4}. If it is the Chinese national cryptographic TLCP protocol, it can only be {1,1}. The integer formed by the 4th and 5th bytes must be the same length as the data that follows, and all three conditions must be met simultaneously.

4. The TCP encrypted communication profiling and risk identification method based on application layer feature recognition as described in claim 3, characterized in that: The attribute analysis includes further analysis of the identified protocols, collecting and extracting the cryptographic algorithms used in TCP encrypted communication, the public keys of both parties, and electronic identity information; at the same time, extracting the access methods, terminal types, MAC addresses, physical locations, electronic identities, and public key information used by both parties from the data frames; Extract digital certificate, server random number, client random number, key exchange algorithm, and key parameters from TLCP handshake protocol data packets; Extract encryption algorithms, data integrity algorithms, key exchange algorithms, and session keys from SSH key exchange protocol data packets; Extract the identity certificate, security parameter index, Diffie-Hellman parameters, and authentication signature from IPSec IKE protocol messages; Extract the source IP address, destination IP address, source MAC address, and destination MAC address from IP data packets.

5. The TCP encrypted communication profiling and risk identification method based on application layer feature recognition as described in claim 4, characterized in that: The classification of user attributes includes dividing the collected information into physical attributes, communication attributes, and user attributes. The physical attributes include Ethernet type, terminal type, access method, physical location, and MAC address; The communication attributes include IP address, port, and traffic data; The user attributes include the protocol used, identity information, algorithm used, and communication connection time.

6. The TCP encrypted communication profiling and risk identification method based on application layer feature recognition as described in claim 5, characterized in that, The process of generating a profile for each connection includes constructing a TCP connection dataset, storing the dataset on a big data platform, and performing data preprocessing to standardize the dataset. The standardized dataset is analyzed using clustering algorithms, and the clustering results are integrated. The clustering algorithms include K-Means clustering, DBSCAN clustering, HDBSCAN clustering, Whisper clustering, ChineseWhisper clustering, and AGNES clustering; An ensemble learning model is used, and the result depends on the common clustering results of each model, as shown below: Where b i En(x) records the clustering results of x using different models, En(x) records the total clustering results of x, and M is the number of models; Perform Bayesian estimation and output the evaluation results.

7. The TCP encrypted communication profiling and risk identification method based on application layer feature recognition as described in claim 6, characterized in that: The step of determining the risk level based on the connection profile and issuing early warnings for high-risk connections includes using a deep learning-based evaluation model to evaluate the profile of each generated connection and obtain a risk score for the connection. The risk scores of the connections are mapped to points in the discrete cluster diagram, and the discrete cluster diagram is generated and analyzed based on the location, distribution and density of the points. Risk assessment techniques based on multidimensional data analysis are used to compare points in a discrete cluster diagram with predefined risk characteristics and behavioral patterns in order to identify potential risks. When the system detects abnormal IP addresses or illegal geographical locations in a TCP connection, it will record detailed connection logs, extract key features, compare them with known malicious features, and once a match is found, the system will generate a high-risk warning message and notify technical personnel via email and SMS. It will also use firewall isolation to block and drop the connection traffic. When a TCP connection is initiated during non-business hours or via an unregistered terminal, the system will activate an emergency response procedure to immediately isolate the connection, analyze its data flow in detail to obtain malicious behavior patterns and characteristics, and use VLAN isolation to cut off the connection communication. When a TCP connection uses a known insecure encryption algorithm, the system automatically intercepts the connection and stores the associated source IP address, destination IP address, and protocol type information in the security event database for further analysis and processing by the security team. The interception method involves using a network gateway to isolate and perform security checks and filtering on the data. When the system detects frequent connection requests or abnormally large data packets, it automatically triggers an advanced security scan, using deep packet inspection technology to parse and analyze the payload of the data packets, extracting the application layer features of the data packets. These application layer features include protocol type, data format, and content semantics. These features are then compared with known malicious patterns. If a match is found, a high-risk warning is generated, and the data is transmitted from the external network to the internal network using a one-way data transmission isolation method. When a new cybersecurity threat pattern is identified, the system updates the threat database and adjusts the parameters and rules of the risk assessment model to ensure that the system can accurately identify and respond to the new threat pattern. For connections identified as high-risk, all relevant network behaviors, communication content, and associated attributes are recorded in detail, and the data is organized and analyzed to generate a risk report.

8. A system employing the TCP encrypted communication profiling and risk identification method based on application layer feature recognition as described in any one of claims 1 to 7, characterized in that: It includes a data acquisition module, a data preprocessing module, a protocol identification module, an attribute analysis module, a user classification module, a connection profiling module, a risk assessment module, an early warning response module, a threat update module, and a risk reporting module; The data acquisition module is used to capture data packets of encrypted TCP connections; The data preprocessing module is used to aggregate and standardize datasets; The protocol identification module is used to identify the security protocol used by the TCP connection; The attribute analysis module is used to extract the cryptographic algorithm, public keys, or electronic identity information of both parties in TCP encrypted communication. The user classification module is used to classify the collected information into physical attributes, communication attributes, and user attributes; The connection profiling module is used to generate a profile for each connection using clustering algorithms and ensemble learning models; The risk assessment module is used to evaluate the generated profile of each connection using a deep learning-based evaluation model, obtain the risk score of the connection, and identify potential risks. The early warning response module is used to generate high-risk early warning information when the system detects a risk in a TCP connection, and to use isolation methods to intercept and discard the connection's traffic, isolate the connection in real time, and analyze its data flow in detail to obtain possible malicious behavior patterns and characteristics. The threat update module is used to update the threat database in a timely manner and adjust the parameters and rules of the risk assessment model when new network security threat patterns are identified. The risk reporting module is used to record in detail all relevant network behaviors, communication content and associated attributes of connections identified as high-risk, and to generate a complete risk report.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images