Communication data leakage detection and protection method combined with deep learning

Abstract

The invention discloses a communication data leakage detection and protection method combined with deep learning, and relates to the technical field of communication data security, and the method comprises the following steps: step 1) constructing a protocol semantic gene pool, step 2) constructing a semantic gene driven dynamic fingerprint self-verification model, and step 3) constructing an ambiguity self-resolution protection closed loop. According to the method, the problems that in the prior art, hidden data leakage caused by protocol semantic ambiguity cannot be recognized and utilized and protection and communication compatibility cannot be achieved at the same time are solved by utilizing a protocol semantic genetic analysis and semantic gene driven dynamic fingerprint self-verification model and ambiguity self-resolution protection closed loop cooperation technology; the high-efficiency protection effects of precise hidden leakage recognition, safety and compatibility cooperation and technical system self-evolution are achieved, and the safety operation and maintenance cost of an enterprise is reduced.

Description

Technical Field

[0001] This invention relates to the field of communication data security technology, specifically to a method for detecting and protecting against communication data leakage that combines deep learning. Background Technology

[0002] With the advancement of digital transformation, communication networks have become the core carrier of enterprise data transmission, leading to a continuous rise in data leakage risks. Consequently, communication data leakage detection and protection technologies combining deep learning have emerged. Existing technologies primarily focus on two detection dimensions: first, protocol syntax detection, which identifies transmission behaviors with syntax errors or abnormal configurations by extracting features such as the format, value range, and length of communication protocol fields; second, data content detection, which captures abnormal content such as privacy information and core business data in transmitted data through training sensitive information recognition models, enabling early warning of leakage behavior.

[0003] Current technology generally believes that semantic ambiguity in communication protocols is an inherent attribute of the protocol design phase to adapt to the needs of multiple scenarios. It is believed that transmission security can be guaranteed simply by interpreting the default semantics, without having to pay attention to its security risks. Therefore, existing deep learning models have not designed modules for extracting and analyzing semantic ambiguity features, and the protection system only builds blocking mechanisms for transmission behaviors with syntax errors and abnormal content.

[0004] However, in real-world communication scenarios, attackers can exploit the semantic ambiguity of protocols to encode leaked instructions as combinations of ambiguous field values ​​or temporal sequences, creating syntactically compliant but semantically ambiguous transmitted data. Because this type of data is completely identical in syntax and content structure to normal communication data, existing deep learning detection models cannot distinguish it, and protection systems cannot effectively block it, leading to frequent occurrences of such covert leaks and posing serious security risks to core enterprise data. Therefore, this paper proposes a deep learning-based method for communication data leakage detection and protection to overcome these problems. Summary of the Invention

[0005] The purpose of this invention is to provide a method for detecting and protecting communication data leakage that combines deep learning, so as to solve the problems mentioned in the background art.

[0006] To address the aforementioned technical problems, this invention provides a communication data leakage detection and protection method combining deep learning, used to detect and protect against covert data leakage behaviors that exploit protocol semantic ambiguity, comprising the following steps: Step 1) Construct a protocol semantic gene library, deconstruct the communication protocol fields into semantic gene fragments and encode them, construct a semantic gene network, and set up a dynamic evolution mechanism; Step 2) Construct a semantic gene-driven dynamic fingerprint self-verification model. This model is embedded in the protocol semantic interpretation process to generate dynamic semantic fingerprints in real time and verify leakage risks. Step 3) Construct a self-dissolving protection loop, locate leaked semantics, dynamically calibrate semantic priorities to complete self-dissolving of ambiguity, strengthen communication links and optimize protection strategies.

[0007] Furthermore, in step 1), the semantic gene fragment is a quadruple consisting of a basic semantic fragment, a semantic triggering factor, an ambiguous semantic branch, and a security threshold. This quadruple is then converted into a 64-bit binary gene sequence using a semantic gene encoding algorithm. The basic semantic fragment occupies 8 bits, the semantic triggering factor occupies 6 bits, the ambiguous semantic branch occupies 7 bits, and the security threshold occupies 4 bits.

[0008] Furthermore, in step 1), the semantic gene network uses semantic gene fragments as nodes and semantic trigger weights between fragments as edges. It is trained using a gene association learning algorithm with training parameters set to 3000 iterations and a learning rate of 0.0001. The dynamic evolution mechanism is triggered by an incremental learning algorithm with a learning rate of 0.001. Every 10,000 new communication logs generate a new semantic gene fragment and update the network weights.

[0009] Furthermore, in step 2), the dynamic fingerprint self-verification model consists of a semantic gene parser, a dynamic fingerprint generator, and an ambiguity verifier. The dynamic fingerprint generator generates a 128-bit binary one-time fingerprint using a context-aware fingerprint generation algorithm. The ambiguity verifier sets a risk level of 0-100 points and a preset risk threshold of 60 points. When the risk level is ≥60 points, it is judged as a suspicious disclosure behavior.

[0010] Furthermore, in step 2), the model is trained using the gene adversarial training method, with 5000 training rounds, each round containing 100 batches and each batch containing 1000 samples. The cross-entropy loss function and Adam optimizer are used, with an initial learning rate of 0.0001, which decays to 0.5 times the original rate every 1000 rounds.

[0011] Furthermore, in step 3), the leaked semantics are located by the semantic gene tracing algorithm, and the semantic priority dynamic calibration algorithm is used to set the normal communication semantic priority to level 1 and the ambiguous semantic branch used by the attacker to level 3. Device identity authentication is completed by hardware encryption lock and instruction authorization verification is completed by comparison of preset authorization code.

[0012] Furthermore, in step 3), semantic hardening of the communication link includes deploying semantic verification nodes in the core gateway, dynamically adjusting the transmission timing of high-risk fields, semantic-level desensitization is completed by replacing the semantic gene fragments corresponding to sensitive information with invalid gene sequences, and the self-optimization of the protection strategy triggers the update of the semantic gene library security threshold and trigger weight after each protection process is completed.

[0013] Furthermore, in step 2), the semantic gene parser outputs a semantic interpretation panorama containing various semantic triggering conditions and security states.

[0014] Compared with the prior art, the beneficial effects of the present invention are: 1. Zero Escape from Covert Leakage: Through protocol semantic gene analysis and dynamic fingerprint verification, it accurately identifies ambiguous leakage behaviors that are grammatically compliant but semantically abnormal, completely solving the problem of blind spots in existing technology detection and eliminating covert data leakage at the source.

[0015] 2. Security and compatibility are coordinated and unified: The system adopts a mechanism for self-dissolving ambiguous semantics and dynamic priority calibration. While locking down the ambiguous semantic branches exploited by attacks, it retains the original multi-scenario compatibility of the protocol, achieving both protection and compatibility.

[0016] 3. Self-evolution of the technical system: The semantic gene library achieves dynamic evolution through incremental learning. It automatically updates gene fragments and network weights every time 10,000 new communication logs are added or a new type of leak is detected. It can adapt to new scenarios and deal with new attacks without manual intervention, greatly reducing the security operation and maintenance costs of enterprises.

[0017] 4. Dynamic fingerprint anti-imitation: Based on context awareness, a 128-bit binary one-time dynamic semantic fingerprint is generated. The fingerprint is unique for each normal communication, and attackers cannot imitate it. This completely avoids the defects of existing static feature matching that are easily bypassed, forming a unique security barrier.

[0018] 5. More precise semantic-level desensitization protection: By replacing the semantic gene fragments corresponding to sensitive information with invalid sequences, sensitive data protection is achieved while preserving the normal communication semantic structure. The protection granularity is more refined, avoiding the risk of data leakage.

[0019] 6. High efficiency and low latency in detection response: Balancing detection accuracy with communication efficiency. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of a communication data leakage detection and protection method combining deep learning according to the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] Please see Figure 1 The present invention provides a technical solution: The core problem with existing technologies is not that they fail to address semantic ambiguity, but rather that their underlying logic suffers from three fundamental flaws that prevent them from handling the hidden leakage of semantic ambiguity, and existing technologies cannot remedy these flaws: The root cause lies in the separation of detection and protocol architecture, which leads to the inability to perceive semantic ambiguity. Existing technologies deploy the detection model as an independent module in the communication link, disconnected from the semantic parsing logic of the protocol itself. The detection model passively receives the result data after protocol parsing, rather than participating in the entire process of protocol semantic interpretation. This separated architecture prevents the detection model from obtaining core information such as the semantic interpretation context and triggering conditions of ambiguous fields. It can only rely on surface-level grammatical and content features for judgment, and is completely unable to detect leakage of grammatical compliance and semantic anomalies, thus logically creating a detection blind spot.

[0023] Technical Root Cause: The static feature matching detection paradigm cannot adapt to the dynamic nature of ambiguous semantics. Existing deep learning detection models all adopt a static feature extraction and matching paradigm. The extracted features, such as grammatical formats and content keywords, are fixed and static information. However, the core of protocol semantic ambiguity lies in the dynamic nature and multiple possibilities of semantic interpretation. The same ambiguous field can be interpreted with completely different semantics in different contexts and time sequences. Attackers can circumvent static feature matching by dynamically adjusting the combination of values ​​and the transmission sequence. This paradigm-level mismatch means that even with the addition of a semantic ambiguity feature extraction module, existing technologies cannot accurately identify dynamically changing ambiguous leakage behavior.

[0024] The root cause of the problem lies in the passive logic of blocking-based protection, which fails to balance security and compatibility. The core logic of existing protection systems is to block communication upon identifying anomalies. However, semantic ambiguity is the fundamental basis for protocols to achieve multi-scenario compatibility. Simply blocking communication involving ambiguous fields will severely impact the compatibility of normal business operations; conversely, not blocking prevents data leakage. This black-and-white, passive protection logic prevents existing technologies from achieving effective protection while ensuring compatibility, creating a deadlock where protection and compatibility are mutually exclusive.

[0025] See Figure 1 As shown, an embodiment of a communication data leakage detection and protection method combining deep learning is presented: Includes the following steps: Step 1: Construct the protocol semantic gene library: 1.1 Semantic Gene Deconstruction and Encoding: Breaking through the limitations of existing protocol semantic parsing, each field of the communication protocol, including ambiguous fields, is deconstructed into a four-tuple consisting of a basic semantic fragment, a semantic triggering factor, an ambiguous semantic branch, and a security threshold, defined as a semantic gene fragment. A semantic gene encoding algorithm is used to transform the four-tuple information into a binary gene sequence that can be recognized by a deep learning model. The basic semantic fragment corresponds to the core semantics of the field, the semantic triggering factor corresponds to the contextual temporal conditions for semantic interpretation, the ambiguous semantic branch corresponds to all possible semantics of the field, and the security threshold corresponds to the security boundary of semantic interpretation. The semantic gene encoding algorithm allocates 8 bits for the basic semantic fragment, 6 bits for the semantic triggering factor, 7 bits for the ambiguous semantic branch, and 4 bits for the security threshold, for a total length of 64 bits. During encoding, the four-tuple information is converted into a binary sequence according to the above bit allocation, forming the semantic gene sequence.

[0026] 1.2 Semantic Gene Network Construction: Based on the association relationships of semantic gene fragments, such as ambiguous semantic branches of field A triggering semantic interpretation of field B, a semantic gene network is constructed. Nodes are semantic gene fragments, and edges are semantic trigger weights between fragments; the larger the weight, the higher the trigger probability. A gene association learning algorithm, fusing graph neural networks and reinforcement learning, is used to train the semantic gene network to discover potential combination patterns of ambiguous semantic fragments. High-risk semantic gene combinations are labeled, representing ambiguous combination paths exploited by attackers. The training parameters of the gene association learning algorithm are set to 3000 iterations with a learning rate of 0.0001. Gradient descent is used to optimize the network weights, enabling the network to achieve a high level of accuracy in discovering high-risk semantic gene combinations.

[0027] 1.3 Semantic Gene Dynamic Evolution Mechanism: Gene evolution is triggered by conditions including the detection of novel ambiguity leaks and new communication scenarios. New semantic gene fragments are automatically generated using an incremental learning algorithm, updating the trigger weights of the semantic gene network. This enables the semantic gene library to adapt to multiple scenarios and respond to novel leaks, completely resolving the shortcomings of existing technologies in adapting to dynamic scenarios. The incremental learning algorithm uses a fixed learning rate of 0.001. Gene fragment generation and weight updates are triggered every 10,000 new communication log data entries. During the update process, existing semantic gene fragments and their relationships are retained; only semantic gene fragments adapted to new scenarios or novel leaks are added, and the trigger weights of the corresponding edges are adjusted.

[0028] Step 2: Construct a semantic gene-driven dynamic fingerprint self-verification model: 2.1 Model Architecture Design: A three-in-one deep learning model consisting of a semantic gene parser, a dynamic fingerprint generator, and an ambiguity verifier is constructed, embedded throughout the protocol semantic interpretation process, rather than being deployed independently. The semantic gene parser reads the protocol fields of the communication data in real time, calls the corresponding semantic gene fragments in the semantic gene library, parses all possible semantics of the fields, including default and ambiguous semantics, and outputs a semantic interpretation panorama including the triggering conditions and security status of each semantic. The dynamic fingerprint generator, based on the semantic interpretation panorama and the communication context, including transmission timing, device information, and scene parameters, generates a dynamic semantic fingerprint in real time using a context-aware fingerprint generation algorithm. This fingerprint is a one-time fingerprint; a unique fingerprint is generated for each normal communication. The fingerprint contains the semantic gene sequence, context features, and security threshold verification results, making it impossible for attackers to imitate and completely avoiding the defects of static feature matching. The context-aware fingerprint generation algorithm performs a hash operation on the semantic gene sequence, context features, and security threshold verification results using a hash function to generate a 128-bit binary dynamic semantic fingerprint, ensuring that the fingerprint generated for each communication is unique. The ambiguity verifier compares the dynamic semantic fingerprint with high-risk semantic gene combinations in the semantic gene library to verify whether the interpretation of ambiguous semantics exceeds the security threshold. The output leakage risk verification result includes risk level, suspicious semantic gene combination, and leakage intent analysis. The risk level is set from 0 to 100 points, with a preset risk threshold of 60 points. When the risk level is greater than or equal to 60 points, it is judged as a suspicious leakage behavior.

[0029] 2.2 Model Training Mechanism: A gene adversarial training method is adopted, constructing a semantic gene attack simulator and a semantic gene-driven dynamic fingerprint self-verification model for adversarial training. The semantic gene attack simulator aims to generate ambiguous semantic gene combinations that conform to security thresholds and carry leaking instructions, while the semantic gene-driven dynamic fingerprint self-verification model aims to accurately identify the disguised gene combinations and generate unimitable dynamic semantic fingerprints. Through multiple rounds of adversarial training, the semantic gene-driven dynamic fingerprint self-verification model acquires the ability to accurately identify various ambiguous leaking behaviors. The gene adversarial training method is set to 5000 training rounds, with each round containing 100 batches and each batch containing 1000 samples. During training, the cross-entropy loss function is used to calculate the model recognition error, and the model parameters are adjusted using the Adam optimizer. The learning rate is initially set to 0.0001, and every 1000 rounds of training, the learning rate decays to 0.5 times its original value.

[0030] 2.3 Real-time Detection Process: During communication data transmission, the semantic gene-driven dynamic fingerprint self-verification model participates in semantic interpretation throughout the entire process, generating dynamic semantic fingerprints in real time and completing verification. When a suspicious semantic gene combination is detected, i.e., the risk level is greater than or equal to the preset threshold of 60 points, the protection process is immediately triggered, and the characteristics of the semantic gene combination are recorded to provide data support for the evolution of the semantic gene library. The detection process time is controlled within 20 milliseconds to ensure that it does not affect the efficiency of normal communication transmission.

[0031] Step 3: Construct a self-dissolving protection loop: 3.1 Precise Location of Leaked Semantics: For suspicious semantic gene combinations detected by the semantic gene-driven dynamic fingerprint self-verification model, the semantic gene tracing algorithm precisely locates the ambiguous semantic branches, triggering conditions, and encoding methods of leaked instructions used by the attacker, and outputs a leaked semantic analysis report. The semantic gene tracing algorithm locates the ambiguous semantic branches and triggering conditions used by the attacker by reverse querying the association paths of suspicious semantic gene combinations in the semantic gene network, combined with the transmission timing and device information in the communication logs, and identifies the encoding methods of leaked instructions through semantic gene sequence comparison.

[0032] 3.2 Ambiguous Semantic Self-Resolution: Based on the leaked semantic analysis report, a dynamic semantic priority calibration algorithm is used to temporarily increase the interpretation priority of semantics required for normal communication without deleting ambiguous semantic branches to ensure compatibility across multiple scenarios. This sets the ambiguous semantic branches exploited by attackers to a secure locked state, allowing interpretation only when preset multiple security verifications, including device authentication and command authorization verification, are met. This renders the attacker's leaked commands ineffective because they cannot trigger semantic interpretation. The dynamic semantic priority calibration algorithm sets the interpretation priority of semantics required for normal communication to level 1 (highest), the priority of ambiguous semantic branches exploited by attackers to level 3 (lowest), and the intermediate priority level 2 to other ambiguous semantic branches. Multiple security verifications require device authentication to be implemented through a hardware encryption lock, and command authorization verification to be implemented through comparison of preset authorization codes; both must pass before the corresponding ambiguous semantics can be interpreted.

[0033] 3.3 Semantic Hardening of Communication Links: For transmission links corresponding to high-risk semantic gene combinations, semantic hardening rules are automatically generated, including adding semantic verification nodes and dynamically adjusting field transmission timing. These rules are encoded into temporary semantic gene fragments using a deep learning model and embedded into the semantic gene network to achieve dynamic link hardening. Simultaneously, sensitive information in the transmitted data undergoes semantic-level desensitization, preserving the semantic structure while replacing the gene encoding of sensitive information, ensuring that even with interpretation vulnerabilities, core data cannot be obtained. Semantic verification nodes are deployed at the core gateway of the communication link to perform real-time verification of the semantic priority of transmitted data, allowing only data streams corresponding to priority levels 1 and 2 semantic interpretations to pass. Dynamic adjustment of field transmission timing, based on the trigger weights of the semantic gene network, adjusts the transmission timing of fields involved in high-risk semantic gene combinations to a non-trigger timing sequence. Semantic-level desensitization replaces the semantic gene fragments corresponding to sensitive information with preset invalid gene sequences; the replaced gene sequences cannot be interpreted as valid information.

[0034] 3.4 Self-Optimization of Protection Strategy: Data from the protection process, including leakage semantic analysis results, protection effectiveness, and compatibility feedback, is input into the semantic gene library. Through a gene evolution mechanism, the security thresholds and trigger weights of semantic gene fragments are optimized, allowing the protection strategy to evolve synchronously with the semantic gene library, achieving a long-term protection effect of lifelong immunity after a single protection step. The self-optimization of the protection strategy sets an update to the security thresholds and trigger weights of the semantic gene library for each completed protection process. During the update, the security threshold values ​​are adjusted based on protection effectiveness feedback, and the trigger weights of the corresponding semantic gene fragments are adjusted based on leakage semantic analysis results.

[0035] It should be noted that: Zero escape from covert data leakage: Achieve comprehensive and accurate identification of leakage behaviors with semantic ambiguity in the protocol, completely solve the pain point that existing technologies cannot distinguish between grammatically compliant and semantically abnormal data, and eliminate covert data leakage from the root. Security and compatibility are coordinated and unified: through the self-dissolution of ambiguous semantics and dynamic priority calibration, while effectively preventing leakage, the protocol's multi-scenario compatibility is fully preserved, solving the deadlock of existing technologies that cannot achieve both protection and compatibility, and realizing comprehensive protection of communication compatibility. Self-evolution of the technology system: The semantic gene library and protection strategies achieve dynamic evolution through incremental learning, which can cope with new ambiguous leakage attacks and new communication scenarios without manual intervention, achieving one-time deployment and lifelong adaptation, and significantly reducing the enterprise's security operation and maintenance costs. Dynamic fingerprint anti-imitation: One-time dynamic semantic fingerprints completely avoid imitation attacks by attackers. Existing technologies cannot generate such fingerprints, nor can they crack this verification mechanism, forming a unique security barrier. Semantic-level desensitization protection: For the first time, desensitization protection based on semantic gene encoding is achieved, ensuring that sensitive data cannot be illegally extracted without affecting the semantic interpretation of normal communication. The protection is more granular and more thorough.

[0036] Implementation process: 5.1 Setting up the implementation environment: This embodiment is deployed on a large enterprise hybrid communication network, including intranet, extranet, and IoT terminals. The protocols involved include TCP / IP, HTTP, MQTT, and CoAP. The core devices include a communication gateway, edge computing nodes, and security protection nodes. The hardware environment consists of an Intel Xeon Platinum 8480C CPU, 128GB of memory, and a 2TB SSD. The software environment uses Python 3.10, TensorFlow 2.10, and PyTorch 2.0. The semantic gene encoding tool is independently developed. This tool is based on Python and integrates a protocol reverse engineering module and a natural language processing module, which can automatically complete the deconstruction of protocol fields and semantic gene encoding.

[0037] 5.2 Construction and Implementation of Protocol Semantic Gene Library: 5.2.1 Semantic Gene Deconstruction and Encoding: 150,000 multi-scenario communication logs covering office, IoT, and external interaction scenarios were collected. Using a semantic gene deconstruction tool, 23 core protocol fields containing 16 ambiguous fields were deconstructed into quadruplets. The semantic gene encoding algorithm was used to convert the quadruplets into 64-bit binary gene sequences. For example, the gene sequence of the ambiguous field of the MQTT protocol Topic field is 0110100110010100111011100. The first 8 bits 01101001 are the basic semantic fragments, the middle 6 bits 100101 are the semantic triggering factors, the following 7 bits 0011101 are the ambiguous semantic branches, and the last 4 bits 1100 are the security thresholds.

[0038] 5.2.2 Semantic Gene Network Construction: Based on semantic gene fragments with 23 fields, a semantic gene network with 23 nodes and 127 edges was constructed. The network was trained using a gene association learning algorithm for 3000 iterations with a learning rate of 0.0001, identifying 11 high-risk semantic gene combinations, such as combinations of ambiguous branches in the Topic field, ambiguous branches in the Cookie field, and abnormal transmission timing. After training, the network achieved a high level of accuracy in identifying high-risk semantic gene combinations.

[0039] 5.2.3 Gene Evolution Verification: Simulating a new IoT device communication scenario, the gene evolution mechanism is triggered, automatically generating three new semantic gene fragments and updating the trigger weights of 15 edges. The network adapts to the new scenario in 5 minutes without manual intervention. After adaptation, the network achieves an extremely high level of semantic parsing accuracy for communication data in the new scenario.

[0040] 5.3 Implementation of Dynamic Fingerprint Self-Verification Model Training and Detection: 5.3.1 Sample Preparation: 100,000 normal communication data samples were collected, and 100,000 disguised ambiguous leakage samples were generated using a semantic gene attack simulator, covering 11 high-risk semantic gene combinations. These samples were divided into training and testing sets at an 8:2 ratio. The training set contained 160,000 samples, and the testing set contained 40,000 samples.

[0041] 5.3.2 Model Training: A gene adversarial training method was employed, with 5000 training iterations. Each iteration contained 100 batches, with 1000 samples per batch. After training, the model achieved extremely high accuracy in identifying leaks on the test set, a 100% success rate in generating dynamic fingerprints, and a 0.7% success rate in spoofing attacker-simulated samples. The final value of the cross-entropy loss function during model training was 0.02, indicating good model convergence.

[0042] 5.3.3 Real-time Detection and Verification: A model is deployed on the communication gateway to monitor transmitted data in real time. When an attacker encodes leaked instructions through ambiguous branches of the Topic and Cookie fields, the model completes semantic parsing, dynamic fingerprint generation, and verification within 15 milliseconds, accurately identifying a risk level of 89 for the leaked behavior, triggering the protection process, with no false positives or false negatives. During the detection process, the transmission latency of normal communication was not affected, with the average latency controlled within 2 milliseconds.

[0043] 5.4 Implementation of a closed-loop protection mechanism for self-resolution of ambiguity: 5.4.1 Leakage Semantic Location: The leakage semantic analysis report output by the model shows that the attacker exploited the ambiguous branch of the broadcast topic in the Topic field, triggered by a specific device ID timing parameter, and used the Cookie field to encode sensitive data extraction instructions, intending to steal enterprise customer information. The location process took 3 milliseconds, with a location accuracy of 100%.

[0044] 5.4.2 Ambiguity Self-Resolution: Through a dynamic semantic priority calibration algorithm, the priority required for normal communication of device group topic semantics in the Topic field is raised to the highest level 1, and the ambiguous branch of the broadcast topic is set to a security lockout state of level 3. Since the attacker's leaked commands cannot meet the multiple security verifications, they cannot trigger the interpretation of the ambiguous semantics, and the leaking behavior directly fails. After priority calibration, the semantic interpretation efficiency of normal communication is not affected, and the interpretation latency remains within 1 millisecond.

[0045] 5.4.3. Link Semantic Hardening: Semantic hardening rules are automatically generated, adding a semantic verification node to the transmission link and dynamically adjusting the transmission sequence of the Topic and Cookie fields. Simultaneously, semantic-level desensitization is performed on customer information in the transmitted data, replacing the genetic code of sensitive information to ensure data security. The verification latency of the semantic verification node is 2 milliseconds, and the desensitization processing latency is 1 millisecond, neither of which affects normal communication.

[0046] 5.4.4 Strategy Self-Optimization: The protection data is input into the semantic gene library, and the gene network automatically updates the security thresholds of relevant semantic gene fragments, improving the subsequent identification accuracy of this type of leakage behavior and reducing the protection latency to 12 milliseconds. After optimization, the model's response speed for identifying this type of leakage behavior is improved.

[0047] Summarize: This invention breaks through the existing framework of detection and protocol separation, static feature matching, and blocking-style protection. It proposes a novel technical approach of dynamic protection against ambiguity self-dissolution through protocol semantic gene-based detection fingerprints. The semantic rules of communication protocols, including default and ambiguous semantics, are encoded into semantic genes with genetic and evolutionary characteristics. A dynamic fingerprint self-verification model driven by semantic genes is constructed through deep learning, enabling real-time perception and accurate identification of ambiguous leakage behavior. At the same time, an ambiguity self-dissolution protection closed loop is constructed, which automatically dissolves the ambiguous semantics used by attackers without affecting multi-scenario compatibility, thereby eliminating covert data leakage at its source. This forms a new full-link new technology system of semantic gene-encoded dynamic fingerprint verification ambiguity self-dissolution protection gene evolution.

Claims

1. A method for detecting and protecting communication data leakage by combining deep learning, used to detect and protect against covert data leakage behaviors that exploit semantic ambiguity of protocols, characterized in that, Includes the following steps: Step 1) Construct a protocol semantic gene library, deconstruct the communication protocol fields into semantic gene fragments and encode them, construct a semantic gene network, and set up a dynamic evolution mechanism; Step 2) Construct a semantic gene-driven dynamic fingerprint self-verification model. This model is embedded in the protocol semantic interpretation process to generate dynamic semantic fingerprints in real time and verify leakage risks. Step 3) Construct a self-dissolving protection loop, locate leaked semantics, dynamically calibrate semantic priorities to complete self-dissolving of ambiguity, strengthen communication links and optimize protection strategies.

2. The communication data leakage detection and protection method combining deep learning as described in claim 1, characterized in that: In step 1), the semantic gene fragment is a quadruple consisting of a basic semantic fragment, a semantic triggering factor, an ambiguous semantic branch, and a security threshold. It is then converted into a 64-bit binary gene sequence using a semantic gene encoding algorithm, where the basic semantic fragment occupies 8 bits, the semantic triggering factor occupies 6 bits, the ambiguous semantic branch occupies 7 bits, and the security threshold occupies 4 bits.

3. The communication data leakage detection and protection method combining deep learning as described in claim 1, characterized in that: In step 1), the semantic gene network uses semantic gene fragments as nodes and semantic trigger weights between fragments as edges. It is trained using a gene association learning algorithm with training parameters set to 3000 iterations and a learning rate of 0.0001. The dynamic evolution mechanism is triggered by an incremental learning algorithm with a learning rate of 0.

001. Every 10,000 new communication logs generate a new semantic gene fragment and update the network weights.

4. The communication data leakage detection and protection method combining deep learning as described in claim 1, characterized in that: In step 2), the dynamic fingerprint self-verification model consists of a semantic gene parser, a dynamic fingerprint generator, and an ambiguity verifier. The dynamic fingerprint generator generates a 128-bit binary one-time fingerprint using a context-aware fingerprint generation algorithm. The ambiguity verifier sets a risk level of 0-100 points and a preset risk threshold of 60 points. When the risk level is ≥60 points, it is judged as a suspicious disclosure behavior.

5. The communication data leakage detection and protection method combining deep learning as described in claim 1, characterized in that: In step 2), the model is trained using the gene adversarial training method, with 5000 training rounds, each round containing 100 batches and each batch containing 1000 samples. The cross-entropy loss function and Adam optimizer are used, with an initial learning rate of 0.0001, which decays to 0.5 times the original rate every 1000 rounds.

6. The communication data leakage detection and protection method combining deep learning as described in claim 1, characterized in that: In step 3), the leaked semantics are located by semantic gene tracing algorithm, and the semantic priority dynamic calibration algorithm is used to set the normal communication semantic priority to level 1 and the ambiguous semantic branch used by the attacker to level 3. Device identity authentication is completed by hardware encryption lock and instruction authorization verification is completed by comparison of preset authorization code.

7. The communication data leakage detection and protection method combining deep learning as described in claim 1, characterized in that: Step 3) involves semantic hardening of the communication link, which includes deploying semantic verification nodes in the core gateway, dynamically adjusting the transmission timing of high-risk fields, and semantic-level desensitization by replacing the semantic gene fragments corresponding to sensitive information with invalid gene sequences. The self-optimization of the protection strategy triggers the update of the semantic gene library security threshold and trigger weight after each protection process is completed.

8. The communication data leakage detection and protection method combining deep learning as described in claim 1, characterized in that: In step 2), the semantic gene parser outputs a semantic interpretation panorama containing various semantic triggering conditions and security states.

Images