Network security data transmission control method based on abnormal traffic identification

Abstract

The application relates to the field of computer network security and data transmission control technology, in particular to a network security data transmission control method based on abnormal traffic identification, which comprises the following steps: collecting original data flow in a network transmission channel to generate a flow statistical feature vector; constructing a micro-disturbance injector model to generate a modulated feedback flow with active timing features; constructing a source end response behavior trajectory of the active timing features according to dynamic response data to form a behavior difference feature representation; constructing a protocol stack behavior discriminator model to calculate the fitting deviation degree between the source end behavior and a standard protocol stack; generating a transmission control instruction set based on the fitting deviation degree; performing physical layer intervention on the transmission channel of the original data flow according to the transmission control instruction set, and updating the flow statistical feature vector according to the channel state after the intervention to complete the closed-loop control of data transmission; and the application eliminates the lag in timeliness of the traditional passive monitoring scheme and the excessive dependence on static features.

Description

Technical Field

[0001] This invention relates to the field of computer network security and data transmission control technology, specifically a network security data transmission control method based on abnormal traffic identification. Background Technology

[0002] With the rapid development of modern network communication technology, advanced encryption protocols such as TLS 1.3 and QUIC have become the mainstream for data transmission. While this trend of encryption ensures the privacy of information, it also makes network security defense face more complex challenges.

[0003] Currently, the monitoring of encrypted traffic mainly relies on passive detection schemes. Security systems capture raw flow data in the network and use traffic statistics or signature matching to identify malicious behavior. However, traditional passive monitoring methods have significant lag, and the identification accuracy drops sharply in environments where the data payload is fully encrypted. Since the payload content cannot be directly obtained, existing identification technologies struggle to distinguish between normal users following standard congestion control protocols and automated attack scripts lacking complete protocol stack logic. For gray-scale traffic that exhibits statistical anomalies but does not meet blocking criteria, there is a lack of effective means for secondary identification, leading defense systems to often face the dilemma of mistakenly blocking normal services or missing potential threats when dealing with highly covert attacks. Therefore, how to proactively and in real-time identify the true response behavior of the source protocol stack and achieve closed-loop control while ensuring the integrity of encrypted data has become an urgent problem to be solved in this field. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a network security data transmission control method based on abnormal traffic identification. Specifically, the technical solution of this invention includes:

[0005] S1. Collect the raw data stream in the network transmission channel, perform stream session reassembly and side channel feature extraction on the raw data stream, and generate a stream statistical feature vector; calculate the traffic anomaly confidence based on the stream statistical feature vector, and mark the data stream with the traffic anomaly confidence exceeding the preset grayscale threshold as a grayscale pending test stream;

[0006] S2. Construct a micro-perturbation injector model, including a timing delay generation module and a feedback signal modulation module. The control parameters of the micro-perturbation injector model include the basic delay step size, jitter mode sequence and injection strength coefficient. Input the downlink feedback data packet of the grayscale test stream into the micro-perturbation injector model to generate a modulated feedback stream with active timing characteristics.

[0007] S3. Extract the dynamic response data of the source protocol stack from the uplink data after the modulation feedback stream is sent, and construct the response behavior trajectory of the source to the active timing features based on the dynamic response data to form a behavioral differential feature representation.

[0008] S4. Construct a protocol stack behavior discriminator model, pre-set the theoretical response reference surface of the standard protocol stack in different network environments, map the behavior differential feature representation to the theoretical response reference surface, and calculate the fitting deviation between the source behavior and the standard protocol stack.

[0009] S5. Generate a transmission control instruction set based on the fitting deviation.

[0010] S6. Perform physical layer intervention on the transmission channel of the original data stream according to the transmission control instruction set, and update the stream statistical feature vector according to the channel status after intervention to complete the closed-loop control of data transmission.

[0011] Preferably, S1 specifically includes:

[0012] S11. Collect the raw data stream in the network transmission channel, wherein the raw data stream is undecrypted encrypted transmission traffic;

[0013] S12. Perform flow table association based on 5-tuples on the original data stream, extract the data packet arrival time interval, payload length sequence and transmission window size, and form a side channel physical feature set;

[0014] S13. Calculate the entropy and perform distribution statistics on the side channel physical feature set to generate a flow statistical feature vector;

[0015] S14. Calculate the Mahalanobis distance between the flow statistical feature vector and the preset historical baseline model, and use the Mahalanobis distance as the confidence level of flow anomalies.

[0016] S15. A preset blocking threshold and a grayscale threshold are set, and the blocking threshold is greater than the grayscale threshold. The traffic anomaly confidence level is compared with the grayscale threshold and the blocking threshold. If the traffic anomaly confidence level is greater than or equal to the grayscale threshold and less than the blocking threshold, the corresponding data stream is marked as a grayscale pending flow.

[0017] Preferably, S2 specifically includes:

[0018] S21. Initialize the micro-perturbation injector model and set the jitter pattern sequence in the control parameters to a non-random deterministic mathematical sequence;

[0019] S22. Intercept the acknowledgment data packets or control messages generated at the transport layer by the grayscale pending verification stream;

[0020] S23. Using the timing delay generation module, calculate the additional dwell time of each acknowledgment response data packet based on the basic delay step size and jitter pattern sequence.

[0021] S24. Using the feedback signal modulation module, without modifying the payload content of the acknowledgment response data packet, perform physical layer transmission delay processing on the acknowledgment response data packet according to the additional dwell time;

[0022] S25. Reassemble the delayed confirmation response data packet into a modulation feedback stream and send it to the source of the grayscale pending verification stream.

[0023] Preferably, S3 specifically includes:

[0024] S31. After sending the modulation feedback stream, open a time observation window of a preset length;

[0025] S32. Within the time observation window, capture subsequent data packets sent by the source end in real time, and extract the sending rate, congestion window adjustment value and retransmission count of subsequent data packets.

[0026] S33. Arrange the transmission rate change rate, congestion window adjustment value and retransmission count according to the timestamp sequence to construct the source end's response behavior trajectory to the modulation feedback stream;

[0027] S34. Calculate the cross-correlation coefficient of the response behavior trajectory relative to the jitter mode sequence injected in the modulation feedback stream, as a representation of the behavior difference feature.

[0028] Preferably, S4 specifically includes:

[0029] S41. Load the pre-set standard protocol stack congestion control algorithm model, wherein the congestion control algorithm model defines the theoretical transmission window adjustment curve under a specific round-trip time jitter input;

[0030] S42. Input the jitter pattern sequence generated by the micro-perturbation injector model into the standard protocol stack congestion control algorithm model to generate a theoretical response reference surface;

[0031] S43. Calculate the Euclidean distance and shape similarity between the behavioral difference feature representation and the theoretical response reference surface, and normalize the Euclidean distance and the shape similarity.

[0032] S44. Using preset weight coefficients, perform a weighted summation calculation on the normalized Euclidean distance and shape similarity to generate a fitting deviation that represents the probability of authenticity of the source protocol stack.

[0033] Preferably, S5 specifically includes:

[0034] S51. Set the allow threshold and the block threshold for the fitting deviation, wherein the block threshold is greater than the allow threshold;

[0035] S52. If the fitting deviation is less than the release threshold, it indicates that the source has complete standard protocol stack behavior, and a release instruction is generated to remove disturbance and forward at full speed.

[0036] S53. If the fitting deviation is greater than the blocking threshold, it indicates that the source end ignores network jitter or response logic abnormalities and generates a blocking instruction to discard data packets or send a reset message.

[0037] S54. If the fitting deviation is between the release threshold and the blocking threshold, generate an instruction to enhance the injection strength coefficient and trigger the micro-perturbation injector model to perform the next round of iterative testing.

[0038] Preferably, S6 specifically includes:

[0039] S61. Parse the transmission control instruction set and extract the bandwidth limitation parameters and connection status flags for the current network quintuple;

[0040] S62. Send the bandwidth limiting parameters to the traffic shaping queue of the gateway device and send the connection status flag to the session management table;

[0041] S63. While performing physical layer intervention, continuously collect the flow statistics feature vector after the intervention. If the flow statistics feature vector shows that the source actively terminates the connection or the flow characteristics tend to be silent, release the computing resources occupied by the micro-perturbation injector model.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] 1. This method extracts side-channel physical characteristics such as data packet arrival interval, payload length, and transmission window, and combines them with active timing micro-perturbation technology to accurately identify traffic attributes without decrypting the data payload. This effectively solves the problem of detection failure caused by the inability to obtain message content when facing advanced encryption protocols, and significantly improves the ability to detect high-strength encryption malicious behavior while ensuring data privacy and communication integrity.

[0044] 2. This method introduces an active protocol stack behavior identification mechanism. By injecting deterministic mathematical sequence interference into the feedback stream and observing the dynamic response trajectory of the source end, it can quantify the deviation of the source end behavior from the standard protocol stack in real time. This mechanism utilizes the essential differences between the real protocol stack and the automated script in congestion control logic to effectively identify attack tools disguised as normal business operations, eliminating the time lag and excessive reliance on static features in traditional passive monitoring solutions.

[0045] 3. This method constructs a scientific gray-scale traffic processing system. Through layered filtering and iterative enhancement of testing logic, it avoids false positives caused by directly blocking suspected risky traffic. For ambiguous traffic in a critical state, the system can adaptively adjust the detection intensity, forcing abnormal protocol stacks to expose their non-standard response characteristics under stress testing. This progressive verification method ensures the accuracy of judgment while greatly improving the system's robustness to complex network environments.

[0046] 4. This method achieves closed-loop control from anomaly identification to physical layer intervention and introduces a dynamic resource reclamation mechanism for defense. By continuously monitoring the channel status after intervention, the system can release the occupied memory and computing resources in real time according to the source response. This ensures that when facing large-scale concurrent connection attacks, the defense facilities will not exhaust resources due to maintaining a large number of connection states, significantly enhancing the anti-paralysis capability of the network boundary in high-load scenarios. Attached Figure Description

[0047] The present invention will be further explained below with reference to the accompanying drawings and embodiments:

[0048] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to specific embodiments.

[0050] Example 1:

[0051] Please see Figure 1 A network security data transmission control method based on abnormal traffic identification includes the following steps:

[0052] S1. Collect the raw data stream in the network transmission channel, perform stream session reassembly and side channel feature extraction on the raw data stream, and generate a stream statistical feature vector; calculate the traffic anomaly confidence based on the stream statistical feature vector, and mark the data stream with the traffic anomaly confidence exceeding the preset grayscale threshold as a grayscale pending test stream;

[0053] S2. Construct a micro-perturbation injector model, including a timing delay generation module and a feedback signal modulation module. The control parameters of the micro-perturbation injector model include the basic delay step size, jitter mode sequence and injection strength coefficient. Input the downlink feedback data packet of the grayscale test stream into the micro-perturbation injector model to generate a modulated feedback stream with active timing characteristics.

[0054] S3. Extract the dynamic response data of the source protocol stack from the uplink data after the modulation feedback stream is sent, and construct the response behavior trajectory of the source to the active timing features based on the dynamic response data to form a behavioral differential feature representation.

[0055] S4. Construct a protocol stack behavior discriminator model, pre-set the theoretical response reference surface of the standard protocol stack in different network environments, map the behavior differential feature representation to the theoretical response reference surface, and calculate the fitting deviation between the source behavior and the standard protocol stack.

[0056] S5. Generate a transmission control instruction set based on the fitting deviation.

[0057] S6. Perform physical layer intervention on the transmission channel of the original data stream according to the transmission control instruction set, and update the stream statistical feature vector according to the channel status after intervention to complete the closed-loop control of data transmission.

[0058] This embodiment details the overall architecture and core logic of a network security data transmission control method based on abnormal traffic identification. Addressing the limitations of existing technologies in effectively identifying malicious behavior in encrypted traffic such as TLS 1.3 and QUIC, and the lag in passive detection, this solution proposes an active Turing test mechanism. The system collects raw data streams from the network transmission channel, restores fragmented data packets to logical sessions using stream session reassembly technology, and extracts side-channel features. Side-channel feature extraction refers to the process of extracting information from the physical attributes of the data stream without decrypting the data payload. These physical attributes originate from metadata captured by the network interface card (NIC) driver layer, specifically including data packet arrival time intervals, payload length sequences, and transmission window sizes.

[0059] Based on this, the system calculates the confidence level of traffic anomalies and marks data streams exhibiting statistical anomalies, such as high-frequency small packets and data streams with strong periodicity but not reaching the direct blocking standard, as gray-scale pending verification streams. This introduces an intermediate state to avoid mistakenly blocking normal services. The system uses a micro-perturbation injector model deployed on the gateway or SDN controller as an active sonar. The timing delay generation module generates a non-random delay sequence, and the feedback signal modulation module performs physical layer delay operations to generate an ACK stream modulated with microsecond / millisecond level delays. This modulation changes the physical characteristics RTT of the transmission channel without modifying the data payload, sending implicit environmental change signals to the source end.

[0060] The system extracts dynamic response data of the source protocol stack from the uplink data and constructs a behavioral differential feature representation, which reflects the rate of change of the source's behavior before and after being disturbed. For example, the standard TCP protocol stack will reduce the sending window according to the algorithm, while botnet scripts usually do not have this logic. The protocol stack behavior discriminator model maps the extracted features to the theoretical response benchmark surface based on RFC standards and mainstream operating system behavior training, and calculates the fitting deviation to quantify the difference. The system generates a transmission control instruction set based on this deviation, performs intervention on the physical layer, and continuously updates the flow statistical feature vector to achieve closed-loop control.

[0061] Example 2:

[0062] This method specifically includes:

[0063] S11. Collect the raw data stream in the network transmission channel, wherein the raw data stream is undecrypted encrypted transmission traffic;

[0064] S12. Perform flow table association based on 5-tuples on the original data stream, extract the data packet arrival time interval, payload length sequence and transmission window size, and form a side channel physical feature set;

[0065] S13. Calculate the entropy and perform distribution statistics on the side channel physical feature set to generate a flow statistical feature vector;

[0066] S14. Calculate the Mahalanobis distance between the flow statistical feature vector and the preset historical baseline model, and use the Mahalanobis distance as the confidence level of flow anomalies.

[0067] S15. A preset blocking threshold and a grayscale threshold are set, and the blocking threshold is greater than the grayscale threshold. The traffic anomaly confidence level is compared with the grayscale threshold and the blocking threshold. If the traffic anomaly confidence level is greater than or equal to the grayscale threshold and less than the blocking threshold, the corresponding data stream is marked as a grayscale pending flow.

[0068] This embodiment further refines the process of side-channel feature extraction and preliminary screening; the system explicitly identifies the collection target as undecrypted encrypted transmission traffic such as HTTPS, TLS 1.3, and QUIC; based on the five-tuple consisting of source IP, source port, destination IP, destination port, and transport layer protocol, flow table association is performed to extract the side-channel physical feature set. The feature set is defined as follows: ,

[0069] in, The source is the network card driver layer timestamp, and its physical meaning is the timestamp of the network card driver layer. The time interval between the arrival of a data packet and its preceding packet is expressed in microseconds.

[0070] The source is the data packet header information, and its physical meaning is the first... The length of the encrypted payload of each data packet, in bytes;

[0071] The source is the TCP / QUIC header parsing, and its physical meaning is the first... The transmission window size carried by each data packet is in bytes;

[0072] The system performs statistical transformations on the above sequences to construct a unified vector space; to ensure the flow statistical feature vectors In the calculation of Mahalanobis distance, the determination of dimensionality and physical interpretability will be addressed in this step. Construct a 6-dimensional feature vector:

[0073]

[0074] in, Represent the matrix transpose operator to ensure for Column vectors; The variance of the sequence is used to characterize the degree of dispersion. Shannon entropy, used to characterize information uncertainty, is calculated using the following formula:

[0075]

[0076] in, The preset number of buckets for the histogram, for example Furthermore, to ensure the normalization and feasibility of probability calculations, the range of values ​​for bucketing is... Set to the dynamic extreme value range based on the data within the current analysis window or the physical limit specified by the protocol, such as the MTU size, to ensure that all sample points fall within the valid range; For the characteristic value to fall into the first The statistical probability of each interval;

[0077] Based on this, Mahalanobis distance is introduced to calculate the confidence level of flow anomalies. The calculation formula is as follows:

[0078]

[0079] in, The currently calculated 6-dimensional feature vector, This is the vector of historical baseline means. Let be the inverse of the historical covariance matrix; where the historical baseline model is derived from the mean vector of the normal flow sample set. The inverse of the covariance matrix To adapt to the dynamic evolution of the network environment, the system extracts a 6-dimensional feature vector from high-reputation business flows that are determined to be allowed and whose fitting deviation is less than 50% of the allowance threshold. This feature vector is then updated according to a preset weight, such as 0.05, relative to the historical baseline mean vector. With covariance matrix Online incremental updates are performed to achieve adaptive compensation of the baseline model for network background noise drift;

[0080] To prevent insufficient sample size or highly linearly correlated features from causing issues with the covariance matrix... Singularity occurs in the calculation At that time, Tikhonov regularization was introduced, that is, using Replace the original matrix, where For minor perturbation factors, for The identity matrix, to ensure the inverse matrix Existence and numerical stability; for the currently extracted flow statistical feature vector Its Mahalanobis distance The calculation formula is: This distance value is directly mapped to the traffic anomaly confidence level; in response to the calculated confidence level, the system performs a double threshold comparison: if Then directly block; if If the grayscale stream is detected, it is marked as a grayscale stream awaiting inspection and enters active detection; otherwise, it is allowed to pass directly. The preset grayscale threshold, The preset blocking threshold;

[0081] This embodiment utilizes Mahalanobis distance to process the strong correlation of multidimensional features and constructs a hierarchical filtering funnel. By mapping entropy value and variance feature in a clearly defined manner, it solves the feature alignment problem caused by the inconsistent length of the original side channel data, effectively resolving the contradiction between false alarms and false negatives. Through statistical methods, ambiguous suspected traffic is isolated to the gray area for secondary verification.

[0082] Example 3:

[0083] S2 specifically includes:

[0084] S21. Initialize the micro-perturbation injector model and set the jitter pattern sequence in the control parameters to a non-random deterministic mathematical sequence;

[0085] S22. Intercept the acknowledgment data packets or control messages generated at the transport layer by the grayscale pending verification stream;

[0086] S23. Using the timing delay generation module, calculate the additional dwell time of each acknowledgment response data packet based on the basic delay step size and jitter pattern sequence.

[0087] S24. Using the feedback signal modulation module, without modifying the payload content of the acknowledgment response data packet, perform physical layer transmission delay processing on the acknowledgment response data packet according to the additional dwell time;

[0088] S25. Reassemble the delayed confirmation response data packet into a modulation feedback stream and send it to the source of the grayscale pending verification stream.

[0089] This embodiment details the core working mechanism of the micro-perturbation injector model; the system initializes model parameters and sets the jitter mode sequence. Non-random deterministic mathematical sequences, such as variants of the Fibonacci sequence or sine wave sequences. Note: The sequence elements here are dimensionless scaling factors; deterministic sequences are used to watermark the channel for subsequent differentiation between background noise and active signals; the system intercepts ACK acknowledgment data packets or control messages of the grayscale pending stream at the transport layer; the specific calculation logic is as follows: let the sequence number of the currently processed ACK acknowledgment data packet be... The basic delay step size is , length is The jitter pattern sequence is Then the first Additional dwell time for each data packet Satisfying the formula:

[0090]

[0091] in, The source is the injection intensity coefficient setting, and its physical meaning is the base delay step size, measured in milliseconds; base delay step size. The value can be dynamically set according to the average round-trip time smoothing value of the current network link. For example, the value can be set to 5% to 10% of the average round-trip time smoothing value, or set to a preset fixed empirical value, such as between 10 milliseconds and 50 milliseconds.

[0092] : A dimensionless jitter mode factor sequence used to represent the relative amplitude of the modulation delay;

[0093] The source is the preset sequence length, and its physical meaning is the cycle period of the jitter mode;

[0094] This formula ensures the accuracy of the calculation results. The unit is milliseconds (milliseconds) This satisfies the dimensional requirements of physical layer timing control; based on this, the feedback signal modulation module sets a high-precision timer in the gateway device's egress queue to suspend data packets until... At any given time, physical layer transmission delay processing is performed; the delayed data packets are reassembled into a modulation feedback stream and sent to the source end;

[0095] This embodiment transforms uncontrollable public network connections into a controlled experimental environment by modulating deterministic timing characteristics on the feedback path. This scheme does not require decryption of traffic or modification of application layer payload, is fully compatible with TLS / SSL protocols and maintains data verification integrity, enabling the defense system to perform stress tests on suspicious connections with extremely high stealth, making it difficult for attackers to detect that they are being actively probed.

[0096] Example 4:

[0097] S3 specifically includes:

[0098] S31. After sending the modulation feedback stream, open a time observation window of a preset length;

[0099] S32. Within the time observation window, capture subsequent data packets sent by the source end in real time, and extract the sending rate, congestion window adjustment value and retransmission count of subsequent data packets.

[0100] S33. Arrange the transmission rate change rate, congestion window adjustment value and retransmission count according to the timestamp sequence to construct the source end's response behavior trajectory to the modulation feedback stream;

[0101] S34. Calculate the cross-correlation coefficient of the response behavior trajectory relative to the jitter mode sequence injected in the modulation feedback stream, as a representation of the behavior difference feature.

[0102] This embodiment details the observation and extraction process of the source-end response characteristics. After sending the modulation feedback stream, the system immediately opens a time observation window, typically 2-5 RTTs in length, to cover the complete congestion control adjustment cycle. The system captures subsequent data packets sent by the source end in real time, extracting the rate of change of the transmission rate of subsequent data packets, the first derivative of the number of bytes received per unit time, the congestion window adjustment value, and estimating the amount of data transmitted during flight, as well as retransmission counts and duplicate sequence number statistics. These parameters are arranged in a timestamp sequence to construct the source end's response behavior trajectory to the modulation feedback stream. ;

[0103] Based on this, the system calculates the cross-correlation coefficient between the response behavior trajectory and the injected jitter pattern sequence. As a behavioral differential feature representation; preprocessing of multidimensional data in the response behavior trajectory, including the rate of change of transmission rate. Congestion window adjustment value With retransmission count Perform normalization based on Min-Max mapping, mapping to The interval; where, Normalized reference maximum value Set as the current bandwidth-delay product (BDP) of the gateway device. Normalized reference maximum value Set to the total number of packets sent within the current analysis window. Alternatively, a preset retransmission upper limit threshold is used; a linear weighted summation is performed, fusing the results into a one-dimensional response feature sequence. The specific fusion calculation formula is as follows:

[0104]

[0105] in, The preset response sensitivity weights are, in this embodiment, taken as follows: And satisfy Physical dimension normalization constraints; calculation With the injected jitter pattern sequence Discrete cross-correlation coefficient The calculation formula is: The coefficient vector is then used as the behavioral difference feature representation. To ensure that the subsequent step S4 can perform vector-based geometric comparison, the behavioral difference feature representation is constructed in this embodiment as a structure containing multidimensional data. ,in The response behavior trajectory vector generated in step S33, i.e. discrete sequences, The cross-correlation coefficient; although the embodiments emphasize the description of the cross-correlation coefficient. The correlation is quantified, but the data actually transmitted to the discriminator model contains the complete trajectory vector. The calculation formula is:

[0106]

[0107] in, : Indicates the total number of sampling points within the time observation window;

[0108] The source is the micro-perturbation injector model, and the physical meaning is the first... The jitter value injected at any given time;

[0109] The source is the response behavior trajectory constructed in step S33, and its physical meaning is the comprehensive response characteristic value of the source end at time i.

[0110] : Represents the arithmetic mean of the injected jitter pattern sequences within the time observation window;

[0111] : Represents the arithmetic mean of the source response behavior trajectories within the time observation window;

[0112] This coefficient aims to quantify the causal correlation between the source response and the injected disturbance. This embodiment uses cross-correlation analysis technology to accurately extract the source response fingerprint to a specific disturbance from noisy network background noise. By quantifying the correlation between the injected signal and the response signal, the system can effectively distinguish between normal users who follow standard congestion control logic and brute-force packet sending tools that are indifferent to network jitter, thus providing a high-confidence feature basis for subsequent identification.

[0113] Example 5:

[0114] S4 specifically includes:

[0115] S41. Load the pre-set standard protocol stack congestion control algorithm model, wherein the congestion control algorithm model defines the theoretical transmission window adjustment curve under a specific round-trip time jitter input;

[0116] S42. Input the jitter pattern sequence generated by the micro-perturbation injector model into the standard protocol stack congestion control algorithm model to generate a theoretical response reference surface;

[0117] S43. Calculate the Euclidean distance and shape similarity between the behavioral difference feature representation and the theoretical response reference surface, and normalize the Euclidean distance and the shape similarity.

[0118] S44. Using preset weight coefficients, perform a weighted summation calculation on the normalized Euclidean distance and shape similarity to generate a fitting deviation that represents the probability of authenticity of the source protocol stack.

[0119] This embodiment further refines the identification logic of protocol stack behavior; the system loads a pre-built standard protocol stack congestion control algorithm model, which covers the theoretical behavior curves of mainstream algorithms such as TCPReno, CUBIC, and BBR when facing RTT jitter; to achieve code-level reproducibility, the standard protocol stack congestion control algorithm model is constructed as a discrete-time state machine equation: setting the base round-trip time. For the input jitter pattern sequence The first in One delay sample, the model is based on the throughput physical constraint formula of the congestion avoidance phase. Calculate the theoretical rate; where the discrete index Corresponding to the first time observation window The observed uplink data packets are synchronized with the sequence index when the feedback stream is injected.

[0120] in, The base delay step size defined in step S2, in milliseconds. The jitter factor is a dimensionless factor; their product constitutes an additional delay, thereby ensuring that the physical dimensions of the denominator time and the numerator bytes remain consistent when calculating throughput. The evolution of the unit of bytes follows the standard additive logic. Taking TCPReno as an example, where, The maximum segment length is preset, such as 1460 bytes; at the same time, in order to ensure that the initial conditions for recursive calculation are complete, the initial congestion window CWND[0] is set to the initial window value defined by the standard protocol, IW, which is usually 10×MSS, and the base round-trip time is set. The smooth round-trip time SRTT is measured in step S1 or S2; through this deterministic algebraic mapping, the abstract algorithm model is transformed into a concrete discrete numerical sequence generator, and the consistency of physical dimensions is ensured.

[0121] The actual jitter pattern sequence is input into the model to simulate and generate the theoretical response reference surface. System computational behavior differential feature representation The Euclidean distance and shape similarity between the theoretical response reference surface and the behavioral difference feature representation generated in step S3; Since the values ​​are already normalized and dimensionless, this step requires first adjusting the theoretical response reference surface. Perform the same normalization mapping to map it to the [0,1] interval to match. Dimensions; Define the normalized mapping function:

[0122]

[0123] in, The physical bandwidth limit set for the current network link, such as 1Gbps, needs to be uniformly converted to bytes per second for matching during calculation. The dimensions of the property; when calculating Euclidean distance, use directly. With normalization Perform calculations, that is This ensures that the calculated Euclidean distance is strictly constrained within the effective range; before subsequent weighted calculation of the fit deviation, this Euclidean distance needs to be divided by the number of sampling points. To map it to space;

[0124] Meanwhile, the shape similarity based on the DTW algorithm is calculated using the dynamic time warping algorithm. The DTW algorithm introduces a constraint window when constructing the cumulative cost matrix, and the constraint width is set to the number of sampling points. The window, representing 10%, limits the search path to the range near the diagonal of the cost matrix. This is designed to filter out anomalous temporal stretching caused by network jitter and ensure shape similarity. It can accurately reflect the inherent adjustment slope characteristics of the protocol stack congestion control algorithm;

[0125] In the DTW algorithm, the local cost function is defined as the squared Euclidean distance between points when constructing the cumulative cost matrix, and the cumulative cost matrix... The recursive calculation formula is:

[0126]

[0127] The formula for calculating the local cost function is as follows:

[0128]

[0129] Finally, the deviation from the fit The weighted calculation formula is defined as follows:

[0130]

[0131] in, Indicates the degree of deviation from the fit; and These are the Euclidean distance weight coefficient and the shape similarity weight coefficient, respectively, and satisfy the following conditions: ; This is the behavioral difference feature representation vector; This is the normalized theoretical response reference surface vector; This indicates the calculation of the Euclidean distance between vectors; This represents the total number of sampling points; The shape similarity is calculated based on the dynamic time warping algorithm; The preset normalization scaling factor, for example, a value of Transform it into The similarity score between intervals;

[0132] This embodiment uses a weighted combination of Euclidean distance and shape similarity to construct a multi-dimensional identification standard; through strict physical boundary normalization, it ensures that amplitude differences and trend differences are compared under the same dimension, so that the system can not only identify simple attack tools that do not respond at all, but also effectively detect advanced mimicry attacks that attempt to simulate normal behavior but do not match details such as adjusting the slope.

[0133] Example 6:

[0134] S5 specifically includes:

[0135] S51. Set the allow threshold and the block threshold for the fitting deviation, wherein the block threshold is greater than the allow threshold;

[0136] S52. If the fitting deviation is less than the release threshold, it indicates that the source has complete standard protocol stack behavior, and a release instruction is generated to remove disturbance and forward at full speed.

[0137] S53. If the fitting deviation is greater than the blocking threshold, it indicates that the source end ignores network jitter or response logic abnormalities and generates a blocking instruction to discard data packets or send a reset message.

[0138] S54. If the fitting deviation is between the release threshold and the blocking threshold, generate an instruction to enhance the injection strength coefficient and trigger the micro-perturbation injector model to perform the next round of iterative testing.

[0139] This embodiment illustrates the three-state judgment and control logic based on fitting deviation. The system sets a pass threshold and a block threshold for fitting deviation to construct a decision interval. In response to a fitting deviation less than the pass threshold, the system determines that the source has complete standard protocol stack behavior, such as a browser or APP, and then generates a pass instruction, immediately stops micro-perturbation injection, and restores the original state of the physical channel to ensure user experience. In response to a fitting deviation greater than the block threshold, the system determines that the source ignores network jitter or has abnormal response logic, confirms it as attack traffic, and generates a block instruction to discard data packets or send a reset message (RST).

[0140] In response to the fit deviation falling between the two extremes, the system generates an instruction to enhance the injection strength coefficient, triggering the micro-perturbation injector model to undergo the next round of iterative testing. During the iteration process, the system compares the rate of change of fit deviation between two adjacent tests. To evaluate the effectiveness of the test; if after two consecutive iterations If the value approaches zero, such as less than 0.01, it indicates that the current injection strength has reached the source response limit. In this case, the system will directly force the output of the judgment result. To prevent the algorithm from entering an infinite loop, the system presets a maximum number of iterations. ,like With upper limit of injection intensity If the iteration count reaches Or the injection intensity reaches If the post-fit deviation still does not enter the allowable range, the source behavior is determined to be abnormal, a blocking instruction is generated, and the iteration is terminated; increasing the injection strength means increasing the base delay step size. The specific step-by-step iteration equation is defined as follows:

[0141]

[0142] in, The preset intensity gain coefficient has a value range of [value range missing]. By rapidly forcing abnormal protocol stacks to expose their non-standard response characteristics through multiplicative growth, or by replacing them with more complex jitter pattern sequences, stronger stress tests are applied to the source end.

[0143] This embodiment introduces a three-state decision logic of allowing, blocking, and enhanced testing to construct an adaptive feedback control loop. This mechanism avoids the risk of misjudgment caused by the one-size-fits-all approach in traditional defense. For ambiguous traffic in a critical state, it forces it to expose its true attributes by dynamically enhancing the testing intensity, which significantly improves the robustness of the system and the accuracy of the decision in complex and ever-changing network attack and defense scenarios.

[0144] Example 7:

[0145] S6 specifically includes:

[0146] S61. Parse the transmission control instruction set and extract the bandwidth limitation parameters and connection status flags for the current network quintuple;

[0147] S62. Send the bandwidth limiting parameters to the traffic shaping queue of the gateway device and send the connection status flag to the session management table;

[0148] S63. While performing physical layer intervention, continuously collect the flow statistics feature vector after the intervention. If the flow statistics feature vector shows that the source actively terminates the connection or the flow characteristics tend to be silent, release the computing resources occupied by the micro-perturbation injector model.

[0149] This embodiment further illustrates the specific execution steps of physical layer intervention and resource management; the system parses the generated transmission control instruction set, extracts the bandwidth limitation parameters and connection status flags for the current network five-tuple; using LinuxTCTrafficControl or hardware QoS queue mechanism, the bandwidth limitation parameters are sent to the traffic shaping queue of the gateway device, and the session status is updated to the management table; during the execution of physical layer intervention, the system continuously collects the flow statistical feature vector after intervention; in response to the flow statistical feature vector indicating that the source actively terminates the connection, if an RST is received or the flow feature becomes silent and timeout with no data, the system immediately releases the memory and CPU computing resources occupied by the micro-perturbation injector model;

[0150] This embodiment implements a dynamic resource recycling mechanism for defense. In the face of DDoS attacks with large-scale concurrent connections, this mechanism ensures that system resources are not exhausted due to maintaining the state of a large number of zombie connections, effectively preventing the defense system from crashing and ensuring continuous availability under high load.

[0151] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention.

Claims

1. A network security data transmission control method based on abnormal traffic identification, characterized in that, Includes the following steps: S1. Collect the raw data stream in the network transmission channel, perform stream session reassembly and side channel feature extraction on the raw data stream, and generate a stream statistical feature vector; Based on the flow statistical feature vector, the confidence level of traffic anomalies is calculated, and data flows with a traffic anomaly confidence level exceeding a preset grayscale threshold are marked as grayscale pending verification flows; S1 specifically includes: S11. Collect the raw data stream in the network transmission channel, wherein the raw data stream is undecrypted encrypted transmission traffic; S12. Perform flow table association based on 5-tuples on the original data stream, extract the data packet arrival time interval, payload length sequence and transmission window size, and form a side channel physical feature set; S13. Calculate the entropy value and perform distribution statistics on the side channel physical feature set to generate a flow statistical feature vector; S14. Calculate the Mahalanobis distance between the flow statistical feature vector and the preset historical baseline model, and use the Mahalanobis distance as the confidence level of flow anomalies. S15. A preset blocking threshold and a grayscale threshold are set, and the blocking threshold is greater than the grayscale threshold; the traffic anomaly confidence level is compared with the grayscale threshold and the blocking threshold. If the traffic anomaly confidence level is greater than or equal to the grayscale threshold and less than the blocking threshold, the corresponding data stream is marked as a grayscale pending test stream. S2. Construct a micro-perturbation injector model, including a timing delay generation module and a feedback signal modulation module. The control parameters of the micro-perturbation injector model include the basic delay step size, jitter mode sequence and injection strength coefficient. Input the downlink feedback data packet of the grayscale test stream into the micro-perturbation injector model to generate a modulated feedback stream with active timing characteristics. S3. Extract the dynamic response data of the source protocol stack from the uplink data after the modulation feedback stream is sent, and construct the response behavior trajectory of the source to the active timing features based on the dynamic response data to form a behavioral differential feature representation. S4. Construct a protocol stack behavior discriminator model, pre-set the theoretical response reference surface of the standard protocol stack under different network environments, map the behavior differential feature representation to the theoretical response reference surface, and calculate the fitting deviation between the source behavior and the standard protocol stack; S4 specifically includes: S41. Load the pre-set standard protocol stack congestion control algorithm model, wherein the congestion control algorithm model defines the theoretical transmission window adjustment curve under a specific round-trip time jitter input; S42. Input the jitter pattern sequence generated by the micro-perturbation injector model into the standard protocol stack congestion control algorithm model to generate a theoretical response reference surface; S43. Calculate the Euclidean distance and shape similarity between the behavioral difference feature representation and the theoretical response reference surface, and normalize the Euclidean distance and the shape similarity. S44. Using preset weight coefficients, perform a weighted summation calculation on the normalized Euclidean distance and shape similarity to generate a fitting deviation that represents the probability of the authenticity of the source protocol stack. S5. Generate a transmission control instruction set based on the fitting deviation. S6. Perform physical layer intervention on the transmission channel of the original data stream according to the transmission control instruction set, and update the stream statistical feature vector according to the channel status after intervention to complete the closed-loop control of data transmission.

2. The network security data transmission control method based on abnormal traffic identification according to claim 1, characterized in that, S2 specifically includes: S21. Initialize the micro-perturbation injector model and set the jitter pattern sequence in the control parameters to a non-random deterministic mathematical sequence; S22. Intercept the acknowledgment data packets or control messages generated at the transport layer by the grayscale pending verification stream; S23. Using the timing delay generation module, calculate the additional dwell time of each acknowledgment response data packet based on the basic delay step size and jitter pattern sequence. S24. Using the feedback signal modulation module, without modifying the payload content of the acknowledgment response data packet, perform physical layer transmission delay processing on the acknowledgment response data packet according to the additional dwell time; S25. Reassemble the delayed confirmation response data packet into a modulation feedback stream and send it to the source of the grayscale pending verification stream.

3. The network security data transmission control method based on abnormal traffic identification according to claim 2, characterized in that, S3 specifically includes: S31. After sending the modulation feedback stream, open a time observation window of a preset length; S32. Within the time observation window, capture subsequent data packets sent by the source end in real time, and extract the sending rate, congestion window adjustment value and retransmission count of subsequent data packets. S33. Arrange the transmission rate change rate, congestion window adjustment value and retransmission count according to the timestamp sequence to construct the source end's response behavior trajectory to the modulation feedback stream; S34. Calculate the cross-correlation coefficient of the response behavior trajectory relative to the jitter mode sequence injected in the modulation feedback stream, as a representation of the behavior difference feature.

4. The network security data transmission control method based on abnormal traffic identification according to claim 3, characterized in that, S5 specifically includes: S51. Set the allow threshold and the block threshold for the fitting deviation, wherein the block threshold is greater than the allow threshold; S52. If the fitting deviation is less than the release threshold, it indicates that the source has complete standard protocol stack behavior, and a release instruction is generated to remove disturbance and forward at full speed. S53. If the fitting deviation is greater than the blocking threshold, it indicates that the source end ignores network jitter or response logic abnormalities and generates a blocking instruction to discard data packets or send a reset message. S54. If the fitting deviation is between the release threshold and the blocking threshold, generate an instruction to enhance the injection strength coefficient and trigger the micro-perturbation injector model to perform the next round of iterative testing.

5. The network security data transmission control method based on abnormal traffic identification according to claim 4, characterized in that, S6 specifically includes: S61. Parse the transmission control instruction set and extract the bandwidth limitation parameters and connection status flags for the current network quintuple; S62. Send the bandwidth limiting parameters to the traffic shaping queue of the gateway device and send the connection status flag to the session management table; S63. While performing physical layer intervention, continuously collect the flow statistics feature vector after the intervention. If the flow statistics feature vector shows that the source actively terminates the connection or the flow characteristics tend to be silent, release the computing resources occupied by the micro-perturbation injector model.

Images