A method and system for high-speed shunting and content-level security collaborative identification of encrypted traffic based on a heterogeneous core particle architecture

Abstract

The application discloses a kind of encrypted traffic high-speed shunting and content level security collaborative identification method and system based on heterogeneous core particle architecture, belong to network security and intelligent computing technical field.The method includes step 1: system initialization and core particle architecture configuration;Step 2: execute flow perception scheduling, realize load balancing and task migration;Step 3: execute multistage cache and main backup switching;Step 4: carry out intelligent fingerprint recovery and encrypted content identification;Step 5: generate dual-mode watermark and establish dynamic fuse contract mechanism;Step 6: execute federal collaborative learning and security recommendation.The method of the application can significantly improve the security collaboration and trusted defense capability in distributed network environment while ensuring user privacy and data encryption integrity, realize the intelligent security identification of high throughput and low delay.

Description

Technical Field

[0001] This invention belongs to the field of network security and intelligent computing technology, specifically relating to a method and system for high-speed diversion of encrypted traffic and collaborative identification of content-level security based on heterogeneous chip-core architecture. Background Technology

[0002] With the widespread application of network communication and encryption protocols, over 90% of internet traffic is now encrypted. While encrypted communication enhances data privacy and security, it also presents significant challenges to network monitoring and security analysis. Traditional methods for traffic identification, intrusion detection, and content classification, which rely on plaintext content, become almost ineffective when faced with encrypted traffic, as they cannot directly access payload data for feature extraction and content assessment.

[0003] In encrypted communication scenarios, existing traffic detection methods largely rely on shallow features such as statistical characteristics and behavioral patterns for analysis, for example, using information such as packet length distribution, time intervals, and direction sequences to build traffic classification models. However, these methods have limited feature representation capabilities and struggle to identify highly covert attack behaviors and complex semantic content in deeply encrypted streams.

[0004] Meanwhile, with the widespread adoption of the Internet of Things (IoT), connected vehicles, and smart terminal devices, the number of network edge devices has increased dramatically. Their computing power and storage resources are generally limited, making it difficult to support highly complex encrypted traffic processing algorithms. Existing centralized traffic analysis frameworks rely on cloud servers to process massive amounts of encrypted data, often resulting in high communication latency, high bandwidth consumption, and insufficient real-time performance. Furthermore, distributed learning frameworks also face security risks such as model contamination, data forgery, and privacy leaks in practical deployments, lacking effective trusted protection and traceability mechanisms.

[0005] The existing technology has the following main shortcomings:

[0006] The traditional traffic analysis relies mainly on centralized computing using CPU or GPU, which cannot achieve high-speed concurrency and low-latency processing in high-bandwidth scenarios.

[0007] The scheduling and caching mechanisms are crude: the existing scheduling strategies do not take into account the dynamic characteristics of traffic and changes in core load, which can easily cause processing bottlenecks.

[0008] Insufficient content-level recognition capability for encrypted traffic: lack of ability to model and reconstruct the potential semantic features in encrypted packet sequences;

[0009] Collaborative learning has weak security: the federated aggregation process lacks traceability and anti-counterfeiting mechanisms, making it susceptible to model injection or poisoning attacks;

[0010] Privacy protection and performance are difficult to balance: complex privacy protection mechanisms increase the computational burden on the device and affect processing throughput. Summary of the Invention

[0011] To address the problems of high processing latency, low identification accuracy, insecure collaboration mechanisms, and limited device resources in existing encrypted traffic identification and secure collaborative processing technologies, this invention proposes a method and system for high-speed encrypted traffic offloading and content-level secure collaborative identification based on a heterogeneous core-granular architecture. This method achieves high throughput and low latency intelligent security identification while ensuring user privacy and data encryption integrity, and can significantly improve the security collaboration and trusted defense capabilities in a distributed network environment.

[0012] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0013] A method for high-speed offloading of encrypted traffic and collaborative identification of content-level security based on heterogeneous chip-core architecture includes the following steps:

[0014] Step 1: System Initialization and Chip Architecture Configuration: Initialize and configure the three types of chip modules: CPU, FPGA, and ASIC. Clarify the division of labor of each module in terms of flow control, preprocessing, and deep learning inference. Interconnect them through a high-speed bus to build a high-parallel hardware processing foundation.

[0015] Step 2: Perform flow-aware scheduling to achieve load balancing and task migration: Map flow identifiers to virtual slots, monitor core load in real time, calculate the optimal core allocation, and automatically migrate tasks when the load exceeds the threshold to achieve load balancing across cores;

[0016] Step 3: Perform multi-level caching and master-slave failover: Manage three-level cache, decide cache replacement based on access frequency and priority, enable backup when cache exceeds threshold, merge after load fallback, and ensure low latency and low packet loss for high-priority data packets;

[0017] Step 4: Perform intelligent fingerprint restoration and encrypted content recognition;

[0018] A smart fingerprint reconstruction network is used to fuse and model the temporal and contextual features of encrypted traffic, achieving content-level feature recognition. The training steps of the fingerprint reconstruction network are as follows:

[0019] Step 4.1: Identify the characteristics of the encrypted traffic sequence Input to the GRU layer;

[0020] Step 4.2: Output the hidden state ;

[0021] Step 4.3: Construct an adjacency matrix A based on flow similarity;

[0022] Step 4.4: Using graph convolution functions Obtain potential fingerprint vectors to achieve semantic reconstruction;

[0023] Step 4.5: Input the fingerprint vector into the lightweight classifier and output the encrypted content category;

[0024] in, Indicates time The input features of the flow sequence; Indicates flow statistics characteristics; Indicates the time interval between packet arrivals; Indicates the direction of the data packet; Indicates time The hidden layer state; Indicates a gated loop unit; This represents the hidden layer state at the previous time step; Represents the graph convolution function; This represents the graph convolution operation function; Represents the node feature matrix; Represents the adjacency matrix based on flow similarity;

[0025] Step 5: Generate a bimodal watermark and establish a dynamic circuit breaker contract mechanism: Generate a behavioral and semantic bimodal watermark, establish a dynamic contract containing watermark, time, and authorization strategy, and automatically circuit breaker and isolate suspicious flows when verification fails;

[0026] Step 6: Perform federated collaborative learning and secure recommendation: The terminal independently trains the local model, securely aggregates to generate the global model, introduces differential privacy protection, and fine-tunes the terminal after distribution to achieve traffic classification and secure recommendation.

[0027] Preferably, in step 1, the specific implementation details are as follows:

[0028] The system hardware integrates three types of chip modules: central processing unit, programmable logic array, and application-specific integrated circuit;

[0029] The CPU is responsible for traffic access control, scheduling policy generation, and cache allocation management;

[0030] The FPGA is responsible for packet parsing, feature extraction, and preprocessing of packet splitting.

[0031] ASIC is responsible for performing deep learning inference and identifying features of encrypted content;

[0032] The heterogeneous chip modules are interconnected via a high-speed AXI bus and share a multi-level cache controller.

[0033] Preferably, in step 2, the specific implementation details are as follows:

[0034] Step 2.1: Map the stream identifier to a virtual slot using a hash function;

[0035] Step 2.2: The control module calculates the optimal allocation scheme based on the real-time load vector of each CPU core;

[0036] Step 2.3: Calculate the optimal core based on the load vector ;

[0037] in, Indicates core The current length of the task queue; Indicates core Real-time comprehensive load value; This represents the weighted balance coefficient between load and queue length; This represents the value of the variable that minimizes the objective function within the parentheses. This represents the calculated optimal target core index number;

[0038] Step 2.4: When the core load exceeds the threshold, the system automatically performs virtual slot remapping to achieve task migration and flow balancing.

[0039] Preferably, in step 3, the specific implementation details are as follows:

[0040] A three-level caching system is set up in the data plane: core cache L1, module shared cache L2, and global cache L3;

[0041] Cache replacement is managed based on a comprehensive scoring strategy that considers access frequency and priority; when the core cache exceeds the threshold, the backup cache is automatically started and merged back after the load decreases, ensuring low latency and low packet loss rate for high-priority data packets;

[0042] Cache replacement uses a frequency- and priority-weighted algorithm, calculated as follows:

[0043] ;

[0044] in, Indicates data packet The overall score for cache replacement; β1 and β2 represent weighting coefficients; Indicates the stream identifier Historical access frequency per unit of time; Indicates the stream identifier; Indicates data packet Priority; Indicates data packet priority Priority quantization value based on protocol type.

[0045] Preferably, in step 5, the specific implementation details are as follows:

[0046] The behavioral characteristics and semantic fingerprints of each encrypted stream are fused using a hash function to generate a bimodal watermark identifier. Simultaneously, a dynamic circuit breaker contract is established to record watermark identifiers, generation times, expiration times, and authorization policies. When verification fails or conflicts occur, the circuit breaker is automatically triggered to isolate suspicious flows; dual-modal watermarking. The generation method is as follows:

[0047] Step 5.1: Calculate the behavior watermark ;

[0048] Step 5.2: Calculate the semantic watermark ;

[0049] Step 5.3: Combine to obtain the final watermark ;

[0050] Step 5.4: Establish a dynamic circuit breaker contract When contract verification fails, a circuit breaker signal is automatically triggered and the corresponding flow is isolated.

[0051] in, This indicates the generated behavioral feature watermark; Represents a cryptographic hash function; This represents the extracted flow statistical feature vector; This indicates the generated semantic feature watermark; This represents the semantic feature vector output by the fingerprint reconstruction network; This represents the final synthesized dual-modal watermark; This represents a vector concatenation operation; This represents the generated dynamic circuit breaker contract data packet; Indicates the timestamp of watermark generation; Indicates the watermark's expiration timestamp; This indicates the authorization policy encoding.

[0052] Preferably, in step 6, the specific implementation details are as follows:

[0053] Step 6.1: Train local model parameters independently for each terminal device. ;

[0054] Step 6.2: The aggregation node updates the global model parameters using a weighted average algorithm;

[0055] Step 6.3: Introduce a differential privacy noise protection mechanism before uploading parameters.

[0056] As a preferred embodiment, in step 6.2, the specific implementation of updating the global model parameters using the weighted average algorithm at the aggregation node is as follows:

[0057] ;

[0058] in, This represents the global model parameters for round t+1; K represents the total number of terminal nodes participating in the aggregation. This represents the number of local samples for the i-th terminal; N represents the total number of samples from all participating terminals. This represents the local model parameters of the i-th terminal after the t-th round of training.

[0059] A high-speed encrypted traffic offloading and content-level security collaborative identification system based on heterogeneous core-granular architecture is provided to realize the high-speed encrypted traffic offloading and content-level security collaborative identification method based on heterogeneous core-granular architecture described in any of the above items. The system includes a heterogeneous core-granular architecture configuration module, a flow-aware scheduling and load balancing module, a multi-level caching and master-slave switching module, an intelligent fingerprint restoration and encrypted content identification module, a dual-modal watermarking and dynamic circuit breaker contract module, and a federated collaborative learning and security recommendation module.

[0060] Heterogeneous chip architecture configuration module: Initialize and configure three types of chip modules: CPU, FPGA, and ASIC, clarify the division of labor of each module in flow control, preprocessing, and deep learning inference, and build a high-parallel hardware processing foundation through high-speed bus interconnection;

[0061] The flow-aware scheduling and load balancing module maps flow identifiers to virtual slots, monitors core load in real time, calculates the optimal core allocation, and automatically migrates tasks when the load exceeds the threshold, thereby achieving load balancing across cores.

[0062] Multi-level caching and master-slave failover module: Manages three-level cache, determines cache replacement based on access frequency and priority, activates backup when cache exceeds threshold, merges subsequent caches when load is reduced, and ensures low latency and low packet loss for high-priority data packets;

[0063] Intelligent fingerprint restoration and encrypted content recognition module: Extracts encrypted traffic sequence features, generates fingerprint vectors through GRU layer and graph convolution function, inputs them into classifier, and realizes encrypted content category recognition without decryption;

[0064] The dual-modal watermarking and dynamic circuit breaker contract module generates behavioral and semantic dual-modal watermarks, establishes dynamic contracts containing watermarks, time, and authorization policies, and automatically circuit breaks and isolates suspicious flows when verification fails.

[0065] Federated Collaborative Learning and Secure Recommendation Module: Terminals independently train local models, securely aggregate to generate global models, introduce differential privacy protection, and fine-tune the models on the terminal after distribution to achieve traffic classification and secure recommendations.

[0066] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0067] (1) The method of the present invention utilizes a chip-level hardware parallel architecture, a flow-aware scheduling strategy and a multi-level caching mechanism to achieve efficient diversion and real-time processing of large-scale encrypted traffic; combined with intelligent fingerprint restoration and dual-modal watermarking technology, it improves the identifiability and traceability of encrypted content; and by introducing federated collaborative learning and dynamic circuit breaker contracts, it achieves secure collaboration and trusted interaction across terminals.

[0068] (2) The core objective of this invention is to provide a method for processing encrypted traffic with high throughput and low latency in a resource-constrained environment; to achieve accurate content-level identification and semantic restoration without decryption; to achieve data traceability and security isolation through multimodal watermarking and contract mechanism; and to achieve distributed intelligent optimization and trusted model aggregation by combining federated collaborative learning. Attached Figure Description

[0069] Figure 1 This is a flowchart of the method for high-speed diversion of encrypted traffic and collaborative identification of content-level security based on heterogeneous chip architecture of the present invention. Detailed Implementation

[0070] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0071] Example 1

[0072] This embodiment provides a method for high-speed encrypted traffic offloading and content-level security collaborative identification based on a heterogeneous chip-granular architecture. This method is applicable to large-scale encrypted traffic analysis and secure collaborative processing in resource-constrained scenarios such as the Industrial Internet, consumer electronics, and smart terminals. Its basic idea is to combine a heterogeneous chip-granular collaborative architecture, flow-aware scheduling, hierarchical caching control, intelligent fingerprint recognition, bimodal watermarking, and a federated collaborative mechanism to achieve high-concurrency processing, content-level identification, and secure and reliable collaborative defense of encrypted traffic. This method solves the problems of difficulty in real-time parsing of encrypted traffic under high bandwidth conditions, low identification accuracy, and insufficient security protection efficiency by implementing collaborative processing of multiple types of computing units at the chip level. The method mainly includes steps 1 to 6.

[0073] Step 1: System initialization and chip architecture configuration;

[0074] The purpose of this step is to establish a heterogeneous chip processing architecture that supports highly parallel data stream processing. The system consists of three types of chip modules: a central processing unit (CPU), a programmable logic array (FPGA), and an application-specific integrated circuit (ASIC). The CPU is mainly responsible for traffic access control, scheduling policy generation, and cache allocation management; the FPGA is responsible for packet parsing, feature extraction, and traffic splitting preprocessing tasks; and the ASIC module is responsible for performing deep learning inference and encrypted content feature recognition, that is, performing deep fingerprint inference and feature mapping.

[0075] Each core module is interconnected via the AXI high-speed interconnect bus and DMA (Direct Memory Access) mechanism, forming a dual-channel structure for the data plane and control plane. Memory read and write operations are uniformly managed by the cache controller, achieving zero-copy transmission. Employing a heterogeneous parallel architecture, it can operate stably under 20Gbps high-bandwidth encrypted traffic, with average latency controlled within 2ms.

[0076] During the startup phase, the system reads the configuration file, automatically loads the stream scheduling table and cache mapping table, and completes the initialization and synchronization of each module. At this point, the system enters a high-parallel stream processing standby state.

[0077] Step 2: Perform flow-aware scheduling to achieve load balancing and task migration;

[0078] For incoming encrypted network traffic, a flow-core binding mechanism based on an indirect mapping table is established. The flow identifier is mapped to a virtual slot through a hash function, and the virtual slot is dynamically allocated to available CPU cores according to the real-time load vector to achieve load balancing and task migration.

[0079] Upon receiving encrypted traffic input, the system enters the flow scheduling phase. This step employs a multi-core load balancing algorithm based on indirect mapping tables, a flow-aware dynamic scheduling algorithm, and a multi-level cache switching mechanism to perform real-time traffic distribution, load balancing, and cache optimization for encrypted traffic. The specific process is as follows:

[0080] Step 2.1: Map each FlowID to a virtual slot number using a hash function;

[0081] A consistent hashing algorithm is used to construct a hash table. A hash ring composed of virtual nodes calculates the hash value of the flow identifier (such as 5-tuple information: source IP, destination IP, source port, destination port, protocol number) using a hash function and maps it clockwise to the nearest virtual slot.

[0082] Step 2.2: The control module calculates the optimal allocation scheme based on the real-time load vector of each CPU core;

[0083] Maintain core load vector ;

[0084] Where m is the total number of CPU cores. Let m be the real-time load rate of the m-th core. Indicates core The real-time comprehensive load value is obtained by weighting the CPU utilization and memory usage of this core within the most recent time window T. The specific calculation formula is as follows:

[0085] ;

[0086] in, This represents the average CPU utilization of core k within the most recent time window T; This represents the average memory usage of core k within the most recent time window T.

[0087] Step 2.3: Calculate the optimal core based on the load vector ;

[0088] in, Indicates core The current length of the task queue; Indicates core Real-time comprehensive load value; This represents the weighted balancing coefficient between load and queue length, with a value range of [value missing]. ; This represents the value of the variable that minimizes the objective function within the parentheses. This represents the calculated optimal target core index number.

[0089] Step 2.4: When the core load exceeds the set threshold (e.g., 85%), the system triggers the slot migration strategy to dynamically migrate some traffic to idle cores;

[0090] The migration process is completed in the DMA channel with a delay of less than 50μs, and does not affect the continuous processing of the current stream.

[0091] This mechanism keeps the load on each core between 0.8 and 0.9, achieving balanced distribution and increasing system throughput by approximately 1.6 times.

[0092] Step 3: Multi-level cache management and primary / standby failover;

[0093] To cope with sudden surges in bandwidth traffic, this invention employs a three-tiered caching system in the data plane: L1 (core cache), L2 (module shared cache), and L3 (global cache). Cache replacement is managed based on a comprehensive scoring strategy that considers access frequency and priority. When the core cache exceeds a threshold, a backup cache is automatically activated and merged back into the backup cache after the load decreases, ensuring low latency and low packet loss for high-priority data packets.

[0094] Cache replacement uses a frequency- and priority-weighted algorithm, and the calculation formula for the cache replacement scoring function is as follows:

[0095] ;

[0096] in, Indicates data packet The overall score for cache replacement; β1 and β2 represent weighting coefficients; Indicates the stream identifier Historical access frequency per unit of time; Indicates the stream identifier; Indicates data packet Priority; Indicates data packet priority Priority quantization value based on protocol type.

[0097] When cache usage exceeds Automatically enable the backup cache. (Among them, The threshold coefficient for initiation is set to 0.85. (This is the maximum physical capacity of the L1 cache), and the system automatically starts the L2 shared cache as a backup area.

[0098] When the L1 cache utilization exceeds 80%, the system automatically enables L2 as a backup cache; when the L2 utilization drops below 50%, the primary and backup caches are merged.

[0099] If a high-priority service (such as a security alarm flow) occurs, the system directly places it in the high-priority queue of the L1 cache for processing, ensuring low-latency forwarding. Through this mechanism, the system can achieve a cache hit rate of 96% under a 20Gbps load, and the average packet loss rate is reduced by more than 30%.

[0100] Step 4: Perform intelligent fingerprint restoration and encrypted content recognition. Utilize the intelligent fingerprint restoration network to fuse and model the temporal and contextual features of encrypted traffic to achieve content-level feature recognition.

[0101] After completing traffic allocation and buffer scheduling, the FPGA module passes the packet sequence of each stream to the ASIC module for content feature analysis. The ASIC internally deploys a smart fingerprint recovery network (FR-Net), the structure of which includes:

[0102] 1) Time-dependent feature extraction layer: A two-layer gated recurrent unit (GRU) with 128 hidden units is used to extract the time, direction and length changes of the compartment;

[0103] 2) Context Graph Association Layer: Constructs the flow and related context into an adjacency graph, and uses a two-layer graph convolutional network (GCN) to extract structural relationships;

[0104] 3) Latent semantic mapping layer: integrates temporal features and structural features to generate a fixed-dimensional cryptographic fingerprint vector.

[0105] The fingerprint reconstruction network is trained using a joint loss function:

[0106] L = Lrecon + λLgraph;

[0107] Where Lrecon represents the reconstruction error, Lgraph represents the relation preservation constraint, L represents the loss function, and λ represents the balancing factor (weighting coefficient), which is used to adjust the weight ratio of the reconstruction error and the relation preservation constraint in the total loss function, so as to balance the fingerprint restoration accuracy and the consistency of structural features.

[0108] The fingerprint vector output by the model is input into a lightweight classifier to achieve behavior-level recognition of encrypted traffic. Experiments show that under TLS and QUIC protocols, the recognition accuracy can reach 92.4%, which is significantly better than traditional convolutional models.

[0109] Step 4.1: Identify the characteristics of the encrypted traffic sequence Input to the GRU layer;

[0110] in, This represents the input features of the flow sequence at time t; Indicates flow statistics characteristics; Indicates the time interval between packet arrivals; Indicates the direction of the data packet.

[0111] Step 4.2: Output the hidden state ;

[0112] in, This represents the hidden layer state at time t; Indicates a gated loop unit; This represents the hidden layer state at the previous time step.

[0113] Step 4.3: Construct an adjacency matrix A based on flow similarity;

[0114] Specifically, by calculating Euclidean distance or cosine similarity, when the similarity exceeds a preset threshold... hour, It is 1 if it is true, otherwise it is 0.

[0115] Step 4.4: Using graph convolution functions Obtain potential fingerprint vectors to achieve semantic reconstruction;

[0116] in, Represents the graph convolution function; H represents the graph convolution operation function; H represents the node feature matrix; A represents the adjacency matrix based on flow similarity.

[0117] Step 4.5: Input the fingerprint vector into the lightweight classifier and output the encrypted content category;

[0118] Step 5: Generate a bimodal watermark and establish a dynamic circuit breaker contract mechanism. By introducing a bimodal watermark and a dynamic circuit breaker contract mechanism, the traceability and anti-tampering verification of stream-level data can be realized.

[0119] The behavioral characteristics and semantic fingerprints of each encrypted stream are fused using a hash function to generate a bimodal watermark identifier. Simultaneously, a dynamic circuit breaker contract is established to record watermark identifiers, generation time, expiration time, and authorization policies. When verification fails or a conflict occurs, the circuit breaker is automatically triggered to isolate suspicious flows.

[0120] In step 5, dual-modal watermarking The generation method is as follows:

[0121] Step 5.1: Calculate the behavior watermark ;

[0122] in, This indicates the generated behavioral feature watermark; This represents a cryptographic hash function (such as SHA-256). This represents the extracted flow statistics feature vector.

[0123] Step 5.2: Calculate the semantic watermark ;

[0124] in, This indicates the generated semantic feature watermark; Represents a cryptographic hash function; This represents the semantic feature vector output by the fingerprint reconstruction network.

[0125] Step 5.3: Combine to obtain the final watermark ;

[0126] in, This represents the final synthesized dual-modal watermark; This indicates a vector concatenation operation. This indicates the generated behavioral feature watermark; This indicates the generated semantic feature watermark.

[0127] Step 5.4: Establish a dynamic circuit breaker contract When contract verification fails, a circuit breaker signal is automatically triggered and the corresponding flow is isolated.

[0128] in, This represents the generated dynamic circuit breaker contract data packet; This represents the final synthesized dual-modal watermark; Indicates the timestamp of watermark generation; Indicates the watermark's expiration timestamp; This indicates the authorization policy encoding.

[0129] To achieve traceability and security protection, this embodiment sets up a dual-modal watermarking mechanism and a dynamic circuit breaker contract.

[0130] Behavioral watermarking Generated from flow statistical features (such as time series of rooms, changes in flow direction); semantic watermarking Generated from latent semantic vectors of FR-Net.

[0131] Each watermark number is associated with a data holder in an index table. During model training or updates, the system dynamically verifies watermark consistency via smart contracts. When an abnormal watermark or duplicate number is detected, a circuit breaker mechanism is automatically triggered, isolating the relevant stream from the training set and recording the event hash.

[0132] In typical disturbance simulation experiments, the imitation detection success rate was 96.7%, and the false alarm rate was less than 3%.

[0133] Step 6: Perform federated collaborative learning and safe recommendation. Using the federated collaborative learning framework, achieve safe model aggregation and adaptive recommendation among terminal devices.

[0134] In a cross-terminal environment, each node independently trains its local model parameters. The encrypted gradient information is then uploaded to the central aggregation node. The aggregation node performs a weighted average: Gaussian noise is injected to satisfy the differential privacy constraint (ε=1.0).

[0135] In step 6, federated collaborative learning includes the following processes:

[0136] Step 6.1: Train local model parameters independently for each terminal device. ;

[0137] Step 6.2: The aggregation node updates the global model parameters using a weighted average algorithm. The specific calculation formula is as follows:

[0138] ;

[0139] in, This represents the global model parameters for round t+1; K represents the total number of terminal nodes participating in the aggregation. This represents the number of local samples for the i-th terminal; N represents the total number of samples from all participating terminals. This represents the local model parameters of the i-th terminal after the t-th round of training.

[0140] Step 6.3: Introduce a differential privacy noise protection mechanism before uploading parameters;

[0141] Specifically, in local parameters Add Gaussian noise ,Right now:

[0142] ;

[0143] in, Indicates local parameters Add Gaussian noise ; This represents the local model parameters of the i-th terminal after the t-th round of training; This indicates that the mean is 0 and the variance is 0. The noise is Gaussian distributed, and C represents the gradient clipping threshold. Indicates privacy budget, This represents a slack variable.

[0144] To reduce communication load, a gradient sparsity and quantization compression strategy is adopted, reducing the amount of uploaded data by 35%. After each round of aggregation, the central model is sent to the terminal for personalized fine-tuning to adapt to the different network environments and encryption protocols of each node.

[0145] To verify the effectiveness of the present invention, a simulation platform was built to compare the performance differences between the method of the present invention and traditional software solutions (CPU) and GPU acceleration solutions.

[0146] Test subjects: the prototype system of this invention (heterogeneous architecture of ARM CPU+FPGA+ASIC NPU); comparison group 1 (general server, Intel Xeon 20 cores); comparison group 2 (general server + NVIDIA T4 GPU).

[0147] Dataset: The dataset uses the publicly available ISCX-VPN-2016 and CIC-Darknet-2020 datasets, containing 5 million encrypted stream samples including HTTPS, Tor, and VPN.

[0148] Table 1 shows the comparison of processing throughput and latency for each scheme under the pressure of 40Gbps high concurrency traffic.

[0149] Table 1 Comparison of system processing performance under high load

[0150]

[0151] Results Analysis: Thanks to the hardware-level flow-aware scheduling of heterogeneous cores (step 2), this invention achieves physical separation between the data plane and the control plane. As shown in Table 1, the throughput of this system is 2.7 times that of the pure CPU solution, and the processing latency is controlled within 2.1ms, solving the latency bottleneck of traditional architectures under high bandwidth.

[0152] For highly concealed encrypted streams (Tor / VPN), the recognition performance of the fingerprint restoration network (FR-Net) of this invention is compared with that of the standard 1D-CNN model; at the same time, the convergence efficiency of federated learning is tested.

[0153] Table 2 Comparison of Encrypted Content Recognition and Collaborative Training Efficiency

[0154]

[0155] Experiments show that this invention, through heterogeneous hardware parallelism and intelligent algorithm collaboration, significantly outperforms existing technologies in three dimensions: real-time processing (low latency of 2.1ms), recognition accuracy (92.4% precision), and system security, thus meeting the high-speed protection requirements of large-scale encrypted traffic.

[0156] Example 2

[0157] This embodiment also proposes a high-speed encrypted traffic offloading and content-level security collaborative identification system based on a heterogeneous core-granular architecture. The system includes a heterogeneous core-granular architecture configuration module, a flow-aware scheduling and load balancing module, a multi-level caching and master-slave switching module, an intelligent fingerprint restoration and encrypted content identification module, a dual-modal watermarking and dynamic circuit breaker contract module, and a federated collaborative learning and security recommendation module.

[0158] Heterogeneous chip architecture configuration module: Initializes and configures three types of chip modules: CPU, FPGA, and ASIC, clarifies the division of labor of each module in flow control, preprocessing, and deep learning inference, and builds a high-parallel hardware processing foundation through high-speed bus interconnection.

[0159] The Flow-Aware Scheduling and Load Balancing module maps flow identifiers to virtual slots, monitors core load in real time, calculates the optimal core allocation, and automatically migrates tasks when the load exceeds the threshold, thereby achieving load balancing across cores.

[0160] Multi-level caching and master-slave failover module: Manages three-level cache, determines cache replacement based on access frequency and priority, activates backup when cache exceeds threshold, merges subsequent caches when load drops, and ensures low latency and low packet loss for high-priority data packets.

[0161] Intelligent fingerprint restoration and encrypted content recognition module: Extracts encrypted traffic sequence features, generates fingerprint vectors through GRU layers and graph convolution functions, inputs them into a classifier, and realizes encrypted content category recognition without decryption.

[0162] The dual-modal watermarking and dynamic circuit breaker contract module generates behavioral and semantic dual-modal watermarks, establishes dynamic contracts containing watermarks, time, and authorization policies, and automatically circuit breaks and isolates suspicious flows when verification fails.

[0163] Federated Collaborative Learning and Secure Recommendation Module: Terminals independently train local models, securely aggregate to generate global models, introduce differential privacy protection, and fine-tune the models on the terminal after distribution to achieve traffic classification and secure recommendations.

[0164] This embodiment applies the system based on heterogeneous chip-core architecture proposed in this invention to an industrial internet edge security gateway to verify its performance in resource-constrained and high real-time requirements scenarios.

[0165] Scenario Description: A smart manufacturing workshop is equipped with 500 CNC machine tools and high-frequency vibration sensors. These terminals send production control data to an edge gateway via an encrypted protocol (MQTT-over-TLS), requiring approximately 20Gbps of network bandwidth. The system needs to identify and block malicious disturbances disguised as normal commands with low latency.

[0166] Preprocessing chip (FPGA): Using Xilinx Kintex-7 series, responsible for TLS handshake parsing, flow table lookup and line-speed hash mapping.

[0167] Control and scheduling core (CPU): It adopts the ARM Cortex-A72 multi-core architecture and runs the flow-aware scheduling algorithm and federated aggregation process.

[0168] Deep detection chip (ASIC): It adopts a custom NPU module and embeds a smart fingerprint reconstruction network (FR-Net) to be responsible for semantic reasoning of encrypted content.

[0169] The specific processing procedure is as follows:

[0170] Step 1 (Flow-Aware Scheduling): Encrypted traffic from the sensors enters the FPGA and is mapped to virtual slots via consistent hashing. The scheduler monitors the load on CPU core 1 in real time. (Overload threshold), based on the formula (in, Indicates core The current length of the task queue; Indicates core Real-time comprehensive load value; This represents the weighted balance coefficient between load and queue length. The optimal path is calculated to seamlessly migrate newly connected video surveillance streams to idle CPU core 3 within 50μs.

[0171] Step 2 (Multi-level Cache Protection): The system identifies the emergency stop signaling as having the highest priority and locks it directly in the high-priority queue of the L1 core cache, ensuring that the processing latency of this type of signaling is always less than 1ms.

[0172] Step 3 (Encrypted Content Recognition): The ASIC chip analyzes an encrypted stream disguised as a regular log upload. Using a graph convolutional network to reconstruct its contextual semantic fingerprint, the system finds that this fingerprint highly matches known fuzzing perturbation features of industrial control protocols.

[0173] Step 4 (Fuse and Isolation): The system generates a bimodal watermark for this flow. And query the dynamic circuit breaker contract. Because the stream does not contain a valid authorization policy code. If contract verification fails, the circuit breaker mechanism at the FPGA physical layer is immediately triggered, and subsequent data packets of the stream are discarded directly.

[0174] Step 5 (Security Collaboration): The gateway extracts the disturbance features identified this time, uploads them to the factory cloud after differential privacy encryption, participates in federated model aggregation, and realizes synchronous upgrade of the security capabilities of the entire factory gateway.

[0175] To verify performance, a simulation test platform was built, and the performance of the system of this invention, traditional x86 soft gateway (based on Snort engine), general server, and GPU acceleration solution were compared under 40Gbps stress.

[0176] (1) Comparison of throughput and latency performance;

[0177] As shown in Table 3 below, this invention utilizes heterogeneous hardware offloading and flow-aware scheduling, which has significant advantages in both throughput and latency, and solves the performance bottleneck of traditional architectures under high concurrency.

[0178] Table 3 Comparison of system processing performance under 40Gbps load

[0179]

[0180] (2) Accuracy of identifying encrypted covert streams;

[0181] The comparison results for concealed disruptive traffic such as Tor anonymous access and VPN tunnels mixed in with normal traffic are shown in Table 4 below. This invention utilizes FR-Net to extract deep semantics, significantly improving recognition accuracy.

[0182] Table 4 Comparison of the accuracy of encrypted covert stream identification

[0183]

[0184] (3) Federal collaborative convergence efficiency;

[0185] Table 5 Comparison of Convergence Efficiency of Federated Collaborative Learning Models

[0186]

[0187] As shown in Table 5, this invention effectively eliminates low-quality or malicious nodes through dual-modal watermarking and a circuit breaker mechanism, significantly improving the convergence speed of federated learning. While ensuring user privacy and data encryption integrity, the method of this invention achieves high-throughput, low-latency intelligent security identification, significantly enhancing security collaboration and trusted defense capabilities in distributed network environments.

[0188] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for high-speed traffic offloading and content-level security collaborative identification based on heterogeneous core-chip architecture, characterized in that, Includes the following steps: Step 1: System Initialization and Chip Architecture Configuration: Initialize and configure the three types of chip modules: CPU, FPGA, and ASIC. Clarify the division of labor of each module in terms of flow control, preprocessing, and deep learning inference. Interconnect them through a high-speed bus to build a high-parallel hardware processing foundation. Step 2: Perform flow-aware scheduling to achieve load balancing and task migration: Map flow identifiers to virtual slots, monitor core load in real time, calculate the optimal core allocation, and automatically migrate tasks when the load exceeds the threshold to achieve load balancing across cores; Step 3: Perform multi-level caching and master-slave failover: Manage three-level cache, decide cache replacement based on access frequency and priority, enable backup when cache exceeds threshold, merge after load fallback, and ensure low latency and low packet loss for high-priority data packets; Step 4: Perform intelligent fingerprint restoration and encrypted content recognition; A smart fingerprint reconstruction network is used to fuse and model the temporal and contextual features of encrypted traffic, achieving content-level feature recognition. The training steps of the fingerprint reconstruction network are as follows: Step 4.1: Encrypt traffic sequence characteristics Input to the GRU layer; Step 4.2: Output the hidden state ; Step 4.3: Construct an adjacency matrix A based on flow similarity; Step 4.4: Using graph convolution functions Obtain potential fingerprint vectors to achieve semantic reconstruction; Step 4.5: Input the fingerprint vector into the lightweight classifier and output the encrypted content category; in, Indicates time The input features of the flow sequence; Indicates flow statistics characteristics; Indicates the time interval between packet arrivals; Indicates the direction of the data packet; Indicates time The hidden layer state; Indicates a gated loop unit; This represents the hidden layer state at the previous time step; Represents the graph convolution function; This represents the graph convolution operation function; Represents the node feature matrix; Represents the adjacency matrix based on flow similarity; Step 5: Generate a bimodal watermark and establish a dynamic circuit breaker contract mechanism: Generate a behavioral and semantic bimodal watermark, establish a dynamic contract containing watermark, time, and authorization strategy, and automatically circuit breaker and isolate suspicious flows when verification fails; Step 6: Perform federated collaborative learning and secure recommendation: The terminal independently trains the local model, securely aggregates to generate the global model, introduces differential privacy protection, and fine-tunes the terminal after distribution to achieve traffic classification and secure recommendation.

2. The method for high-speed traffic offloading and content-level security collaborative identification based on heterogeneous chip-core architecture according to claim 1, characterized in that: In step 1, the specific implementation details are as follows: The system hardware integrates three types of chip modules: central processing unit, programmable logic array, and application-specific integrated circuit; The CPU is responsible for traffic access control, scheduling policy generation, and cache allocation management; The FPGA is responsible for packet parsing, feature extraction, and preprocessing of packet splitting. ASIC is responsible for performing deep learning inference and identifying features of encrypted content; The heterogeneous chip modules are interconnected via a high-speed AXI bus and share a multi-level cache controller.

3. The method for high-speed traffic offloading and content-level security collaborative identification based on heterogeneous chip-core architecture according to claim 1, characterized in that: In step 2, the specific implementation details are as follows: Step 2.1: Map the stream identifier to a virtual slot using a hash function; Step 2.2: The control module calculates the optimal allocation scheme based on the real-time load vector of each CPU core; Step 2.3: Calculate the optimal core based on the load vector ; in, Indicates core The current length of the task queue; Indicates core Real-time comprehensive load value; This represents the weighted balance coefficient between load and queue length; This represents the value of the variable that minimizes the objective function within the parentheses. This represents the calculated optimal target core index number; Step 2.4: When the core load exceeds the threshold, the system automatically performs virtual slot remapping to achieve task migration and flow balancing.

4. The method for high-speed traffic offloading and content-level security collaborative identification based on heterogeneous chip-core architecture according to claim 1, characterized in that: In step 3, the specific implementation details are as follows: A three-level caching system is set up in the data plane: core cache L1, module shared cache L2, and global cache L3; Cache replacement is managed based on a comprehensive scoring strategy that considers access frequency and priority; when the core cache exceeds the threshold, the backup cache is automatically started and merged back after the load decreases, ensuring low latency and low packet loss rate for high-priority data packets; Cache replacement uses a frequency- and priority-weighted algorithm, calculated as follows: ； in, Indicates data packet The overall score for cache replacement; β1 and β2 represent weighting coefficients; Indicates the stream identifier Historical access frequency per unit time; Indicates the stream identifier; Indicates data packet Priority; Indicates data packet priority Priority quantization value based on protocol type.

5. The method for high-speed traffic offloading and content-level security collaborative identification based on heterogeneous chip-core architecture according to claim 1, characterized in that: In step 5, the specific implementation details are as follows: The behavioral characteristics and semantic fingerprints of each encrypted stream are fused using a hash function to generate a bimodal watermark identifier. Simultaneously, a dynamic circuit breaker contract is established to record watermark identifiers, generation times, expiration times, and authorization policies. When verification fails or conflicts occur, the circuit breaker is automatically triggered to isolate suspicious flows; dual-modal watermarking. The generation method is as follows: Step 5.1: Calculate the behavior watermark ; Step 5.2: Calculate the semantic watermark ; Step 5.3: Combine to obtain the final watermark ; Step 5.4: Establish a dynamic circuit breaker contract When contract verification fails, a circuit breaker signal is automatically triggered and the corresponding flow is isolated. in, This indicates the generated behavioral feature watermark; Represents a cryptographic hash function; This represents the extracted flow statistical feature vector; This indicates the generated semantic feature watermark; This represents the semantic feature vector output by the fingerprint reconstruction network; This represents the final synthesized dual-modal watermark; This represents a vector concatenation operation; This represents the generated dynamic circuit breaker contract data packet; Indicates the timestamp of watermark generation; Indicates the watermark's expiration timestamp; This indicates the authorization policy encoding.

6. The method for high-speed traffic offloading and content-level security collaborative identification based on heterogeneous chip-core architecture according to claim 1, characterized in that: In step 6, the specific implementation details are as follows: Step 6.1: Train local model parameters independently for each terminal device. ; Step 6.2: The aggregation node updates the global model parameters using a weighted average algorithm; Step 6.3: Introduce a differential privacy noise protection mechanism before uploading parameters.

7. The method for high-speed traffic offloading and content-level security collaborative identification based on heterogeneous chip-core architecture according to claim 6, characterized in that: In step 6.2, the specific implementation details of updating the global model parameters using the weighted average algorithm at the aggregation node are as follows: ； in, This represents the global model parameters for round t+1; K represents the total number of terminal nodes participating in the aggregation. This represents the number of local samples for the i-th terminal; N represents the total number of samples from all participating terminals. This represents the local model parameters of the i-th terminal after the t-th round of training.

8. A high-speed encrypted traffic offloading and content-level security collaborative identification system based on heterogeneous chip-and-granular architecture, realizing the high-speed encrypted traffic offloading and content-level security collaborative identification method based on heterogeneous chip-and-granular architecture as described in any one of claims 1 to 7, characterized in that: The system includes a heterogeneous core-granular architecture configuration module, a flow-aware scheduling and load balancing module, a multi-level caching and master-slave switching module, an intelligent fingerprint restoration and encrypted content recognition module, a dual-modal watermarking and dynamic circuit breaker contract module, and a federated collaborative learning and secure recommendation module. Heterogeneous chip architecture configuration module: Initialize and configure three types of chip modules: CPU, FPGA, and ASIC, clarify the division of labor of each module in flow control, preprocessing, and deep learning inference, and build a high-parallel hardware processing foundation through high-speed bus interconnection; The flow-aware scheduling and load balancing module maps flow identifiers to virtual slots, monitors core load in real time, calculates the optimal core allocation, and automatically migrates tasks when the load exceeds the threshold, thereby achieving load balancing across cores. Multi-level caching and master-slave failover module: Manages three-level cache, determines cache replacement based on access frequency and priority, activates backup when cache exceeds threshold, merges subsequent caches when load is reduced, and ensures low latency and low packet loss for high-priority data packets; Intelligent fingerprint restoration and encrypted content recognition module: Extracts encrypted traffic sequence features, generates fingerprint vectors through GRU layer and graph convolution function, inputs them into classifier, and realizes encrypted content category recognition without decryption; The dual-modal watermarking and dynamic circuit breaker contract module generates behavioral and semantic dual-modal watermarks, establishes dynamic contracts containing watermarks, time, and authorization policies, and automatically circuit breaks and isolates suspicious flows when verification fails. Federated Collaborative Learning and Secure Recommendation Module: Terminals independently train local models, securely aggregate to generate global models, introduce differential privacy protection, and fine-tune the models on the terminal after distribution to achieve traffic classification and secure recommendations.

Images