Intrusion detection and security enhancement method for quantum key distribution system

Abstract

The invention relates to an intrusion detection and security enhancement method for a quantum key distribution (QKD) system, which belongs to the technical field of quantum communication, and comprises the following steps: in the operation process of the QKD system, acquiring operation parameters of a plurality of physical nodes in real time, and constructing a multi-dimensional feature data set; inputting the multi-dimensional feature data set into a pre-trained hybrid neural network model for intrusion detection, wherein the hybrid neural network model comprises a convolutional neural network layer and a long-short-term memory network layer; when an intrusion behavior is detected, generating intrusion alarm information and positioning an intrusion type and a node position; in response to the intrusion alarm information, a security enhancement strategy is triggered, and the security enhancement strategy comprises dynamically adjusting quantum state coding parameters, switching to a local oscillation optical protocol mode and selecting a privacy amplification algorithm after starting. According to the method, intelligent intrusion detection and a self-adaptive security enhancement mechanism are combined, so that the security, robustness and self-adaptive defense capability of the quantum key distribution system in an actual deployment environment are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of quantum communication technology, and in particular to an intrusion detection and security enhancement method for a quantum key distribution system. Background Technology

[0002] Quantum Key Distribution (QKD), based on the fundamental principles of quantum mechanics, theoretically provides unconditionally secure key distribution. However, in practical physical implementation, due to imperfections in devices (such as light sources, detectors, and modulators), QKD systems face various side-channel attacks. Existing attack methods include strong light blinding attacks, wavelength attacks, dead-time attacks, and Trojan horse light attacks. These attacks exploit vulnerabilities in actual devices to steal key information without causing a significant change in the bit error rate, seriously threatening the practical security of QKD systems.

[0003] In existing technologies, the security protection of QKD systems mainly relies on passive monitoring of the quantum bit error rate (QBER), determining eavesdropping when the QBER exceeds a threshold. However, this method suffers from latency and struggles to identify complex, covert attacks that do not induce high QBERs. Furthermore, existing systems lack adaptive security enhancement capabilities; once an anomaly is detected, communication is often simply interrupted, leading to reduced system availability. Therefore, there is an urgent need for a security enhancement method capable of real-time and accurate detection of various intrusion behaviors and dynamically adjusting system configuration to defend against attacks. Summary of the Invention

[0004] This invention provides an intrusion detection and security enhancement method for a quantum key distribution system, which solves the problems mentioned in the background technology. By combining intelligent intrusion detection with an adaptive security enhancement mechanism, it significantly improves the security, robustness and adaptive defense capabilities of the quantum key distribution system in a real deployment environment.

[0005] The solution to the above-mentioned technical problems of the present invention is as follows: A method for intrusion detection and security enhancement of a quantum key distribution system, comprising the following steps: Step S1, during the operation of the quantum key distribution system, real-time acquisition of operating parameters of multiple physical nodes to construct a multi-dimensional feature dataset;

[0006] Step S2: Input the multidimensional feature dataset into a pre-trained hybrid neural network model for intrusion detection. The hybrid neural network model includes a convolutional neural network layer and a long short-term memory network layer.

[0007] As an feasible approach, the convolutional neural network layer comprises two convolutional layers and one pooling layer, with convolutional kernel sizes of 3×3 and 5×5, respectively, used to extract spatial correlation features between operating parameters at different scales; the long short-term memory network layer comprises two LSTM units, each containing 128 hidden units, used to learn the long-range dependencies of multidimensional feature data in the time dimension; the time window length of the model input is 10 consecutive sampling points, and the output layer uses the Softmax function to classify normal states and various attack types;

[0008] Step S3: When an intrusion is detected, generate an intrusion alarm and locate the intrusion type and node location;

[0009] Step S4: In response to the intrusion alarm information, a security enhancement strategy is triggered. The security enhancement strategy includes dynamically adjusting the quantum state encoding parameters, switching to the local oscillator optical protocol mode, and selecting the privacy amplification algorithm after startup.

[0010] Specifically, the system has a pre-set intrusion type-encoding parameter mapping table. When the intrusion detection module outputs an attack type label, the control unit reads the corresponding parameter configuration according to the mapping table. For example, when a strong light blinding attack is detected, the average number of photons in the signal state is adjusted from 0.5 to 0.3, and the proportion of decoy states is increased. When a Trojan horse light attack is detected, the basis selection probability is adjusted from a uniform distribution to an asymmetric distribution of Z basis: X basis = 0.7: 0.3 to disrupt the attacker's accurate estimation of quantum state preparation information.

[0011] Based on the above technical solution, the present invention can be further improved as follows.

[0012] Furthermore, the operating parameters of the multiple physical nodes include at least: transmitting light intensity, receiving light intensity, qubit bit error rate, detector count rate, phase drift, ambient temperature, and vibration frequency. By collecting operating parameters from multiple dimensions, including the transmitting end, receiving end, and environment, a multi-source feature system covering the light source, modulator, detector, channel, and external environment is constructed. This provides rich input information for subsequent intrusion detection models. Single-dimensional parameters are insufficient to capture the comprehensive characteristics of complex attack behaviors, while the fusion of multi-dimensional parameters enables the model to simultaneously perceive abnormal patterns such as abnormal light intensity, abnormal detector response, abnormal phase drift, and environmental disturbances. This significantly improves the ability to identify various attacks, such as strong light blinding attacks, wavelength attacks, dead-time attacks, and Trojan light attacks. In particular, it has stronger detection sensitivity for covert attacks that do not cause significant changes in the bit error rate.

[0013] Furthermore, the training process of the hybrid neural network model includes: constructing a training dataset containing multiple attack types, including at least: strong light blinding attack, wavelength attack, dead time attack, and Trojan light attack. Each sample in the training dataset contains a multi-dimensional feature vector of 10 consecutive time sampling points and its corresponding attack type label; using the training dataset to perform supervised training on the hybrid neural network model, aiming to minimize the cross-entropy loss function and optimize the network weights; by collecting running data under various typical attack scenarios in a laboratory environment, constructing a labeled training set covering multiple attack types, and performing supervised learning on the CNN-LSTM hybrid neural network, enabling the model to learn the feature patterns of various attack behaviors in the spatiotemporal dimension. This training method allows the model to not only identify the known attack types contained in the training set, but also to have a certain generalization recognition ability for unknown attack types by extracting the general feature patterns of attack behaviors; at the same time, the CNN-LSTM hybrid architecture can extract spatial and temporal features simultaneously, resulting in higher detection accuracy and lower false positive rate compared to a single network structure.

[0014] Furthermore, the dynamic adjustment of quantum state encoding parameters specifically includes: adaptively adjusting the intensity of the optical pulse, the basis vector selection probability of polarization state or phase encoding according to the detected intrusion type, to increase the difficulty for attackers to obtain effective information. When an intrusion is detected, the system can automatically change the encoding parameter configuration at the transmitting end, preventing attackers from continuing to carry out effective attacks using previous system characteristics. This strategy is an active defense method. By dynamically changing encoding parameters such as signal state strength, decoy state strength, and basis vector selection probability, it forces attackers to be unable to continuously obtain stable and reliable eavesdropping information, significantly increasing the attack cost. At the same time, this adjustment process does not interrupt the key distribution process, only changes the parameter configuration, and maintains the continuous availability of the system while improving security, overcoming the defect of interrupting communication upon detecting anomalies in the prior art.

[0015] Furthermore, the switching to the local oscillator light protocol mode specifically includes: controlling the receiver to activate the built-in local oscillator light source to replace the local oscillator light transmitted from the channel, thereby eliminating attack vectors targeting the local oscillator light. A fast switching between channel-transmitted local oscillator light and local oscillator light is achieved through an optical switch. When an attack threat targeting the local oscillator light is detected, the system can immediately cut off the external local oscillator light input from the channel and switch to using the stable local oscillator light built into the receiver for detection. This strategy fundamentally eliminates the possibility of attackers using various attack methods such as strong light blinding attacks, local oscillator light wavelength attacks, and local oscillator light phase modulation attacks by manipulating the channel local oscillator light, making it a "radical" defense solution. Simultaneously, the local oscillator light source uses a narrow-linewidth laser and an automatic power control loop, which can provide more stable optical power and frequency than the channel-transmitted local oscillator light, and to a certain extent, can also improve the system's detection stability and signal-to-noise ratio.

[0016] Furthermore, the selection of the privacy amplification algorithm after startup specifically includes: after intrusion detection is triggered, dynamically selecting the hash function length of the privacy amplification algorithm based on the real-time estimated qubit error rate, in order to maximize the compression of eavesdropper information while ensuring the security key rate. As an implementable method, the system has a preset correspondence between QBER ranges and compression ratios (the ratio of hash function length to the original key length): when QBER ≤ 1%, the compression ratio is set to 0.8; when 1% < QBER ≤ 3%, the compression ratio is set to 0.6; when QBER > 1%, the compression ratio is set to 0.6. When an intrusion alarm is detected (3%), the compression ratio is dynamically reduced to below 0.4. The specific value is calculated using linear interpolation based on the real-time QBER, ensuring a balance between security and key generation efficiency. In the key post-processing stage, the compression strength of privacy amplification is dynamically adjusted based on the current channel state and intrusion detection results, compressing the amount of information that might be leaked to eavesdroppers in the final generated key to a negligible level. This strategy achieves a dynamic balance between security and key generation efficiency: under normal conditions, a moderate compression ratio is used to maintain a high key generation rate, and the compression strength is automatically increased after an attack is detected to maximize key security. At the same time, this strategy is not dependent on specific attack types and is a universal security enhancement method that can provide a last line of defense against all types of intrusion behavior, forming a multi-layered defense-in-depth system.

[0017] The present invention also provides an intrusion detection and security enhancement device for a quantum key distribution system, including a data acquisition module, an intrusion detection module, and a security enhancement module;

[0018] The data acquisition module is used to collect the operating parameters of multiple physical nodes in real time and construct a multidimensional feature dataset;

[0019] The intrusion detection module is used to input a multidimensional feature dataset into a pre-trained hybrid neural network model for intrusion detection and to generate intrusion alarm information;

[0020] The security enhancement module is used to respond to the intrusion alarm information and trigger a security enhancement strategy. The security enhancement strategy includes dynamically adjusting quantum state encoding parameters, switching to the local oscillator optical protocol mode, and selecting a privacy amplification algorithm after startup.

[0021] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described method.

[0022] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-described method.

[0023] The beneficial effects of this invention are as follows: This invention provides an intrusion detection and security enhancement method for a quantum key distribution system, which has the following advantages:

[0024] 1. By introducing a hybrid neural network model (CNN-LSTM) to perform real-time analysis of the multi-source physical parameters of the QKD system, the spatial and temporal features of attack behavior can be effectively extracted, enabling high-precision and low-latency detection of various known and unknown intrusion behaviors.

[0025] 2. Based on the detection results, a graded and adaptive security enhancement strategy is triggered, including the adjustment of encoding parameters, the switching of protocol modes, and the dynamic configuration of privacy amplification strength. This enables the QKD system to proactively make defensive adjustments after detecting a threat, rather than simply interrupting communication, thereby significantly improving the availability and robustness of the system while ensuring security.

[0026] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it according to the contents of the specification, the preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings. Specific embodiments of the present invention are given in detail below with reference to the accompanying drawings. Attached Figure Description

[0027] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0028] Figure 1 This is a flowchart of an intrusion detection and security enhancement method for a quantum key distribution system according to an embodiment of the present invention;

[0029] Figure 2 This is a system architecture diagram of an intrusion detection and security enhancement method for a quantum key distribution system provided in an embodiment of the present invention. Detailed Implementation

[0030] The following is in conjunction with the appendix Figure 1-2 The principles and features of the present invention are described below. The examples given are for illustrative purposes only and are not intended to limit the scope of the invention. The invention is described more specifically in the following paragraphs by way of example with reference to the accompanying drawings. The advantages and features of the invention will become clearer from the following description. It should be noted that the drawings are in a very simplified form and use non-precise proportions, and are only used to facilitate and clarify the illustration of the embodiments of the invention.

[0031] It should be noted that when a component is described as "fixed to" another component, it can be directly on the other component or may have a component in between. When a component is considered "connected to" another component, it can be directly connected to the other component or may have a component in between. When a component is considered "set on" another component, it can be directly set on the other component or may have a component in between. The terms "vertical," "horizontal," "left," "right," and similar expressions used in this document are for illustrative purposes only.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0033] Example 1, please refer to Figure 1-2 This embodiment provides an intrusion detection and security enhancement method for a quantum key distribution system. The method aims to solve the problems of delayed detection and lack of adaptive defense capabilities when existing quantum key distribution (QKD) systems face side-channel attacks in actual deployment. The method includes the following steps S1 to S4.

[0034] Step S1: Real-time acquisition and construction of multidimensional feature datasets in a QKD system (such as...) Figure 2 As shown, during operation (including Alice the transmitter, Bob the receiver, and the channel), the system collects operating parameters in real time through sensors and monitoring modules deployed on multiple physical nodes. These physical nodes include at least the transmitter, the receiver, and environmental monitoring nodes.

[0035] Specifically, the collected operating parameters include, but are not limited to: transmitting light intensity, receiving light intensity, quantum bit error rate (QBER), detector count rate, phase drift, ambient temperature, and vibration frequency. For example, the intensity of the light pulse can be monitored in real time by integrating a photodiode at the transmitting end; at the receiving end, the count rate is obtained through the counting output of a single-photon detector, and the photon arrival time is obtained through a time-to-digital converter to calculate the QBER; the phase drift is monitored through a phase compensation system; and simultaneously, temperature and vibration sensors deployed inside the chassis collect ambient temperature and vibration frequency, respectively.

[0036] These time-series parameters, collected from different dimensions and nodes, are aggregated and standardized to construct a multidimensional feature dataset. The data vector within each time window in this dataset contains multi-source information characterizing the current operating state of the system, providing an input basis for subsequent intelligent analysis. For example, the feature vector of a time point (or time window) can be represented as [transmitter light intensity, receiver light intensity, QBER, detector count rate, phase drift, ambient temperature, vibration frequency].

[0037] Step S2: Intrusion detection based on a hybrid neural network model. The multidimensional feature dataset constructed in step S1 is input into a pre-trained hybrid neural network model in real time. The core architecture of this model includes convolutional neural network (CNN) layers and long short-term memory network (LSTM) layers.

[0038] In this embodiment, the CNN layer is used to extract spatial features between different parameters in the input data, such as the abnormal correlation between the light intensity at the transmitting end and the light intensity at the receiving end, which may indicate the presence of an attacker (such as a Trojan light attack). The LSTM layer is used to capture the long-range dependencies of the data in the time dimension, such as the periodic abnormal fluctuations in QBER or detector count rate over time, which may indicate the periodic implementation of dead-time attacks or strong light blinding attacks.

[0039] During the training phase, the model undergoes supervised learning using a training set containing a large amount of labeled data. This training set covers system operation data under various attack types, including but not limited to strong light blinding attacks, wavelength attacks, dead-time attacks, and Trojan light attacks. Each sample in the training dataset contains a multi-dimensional feature vector with 10 consecutive time sampling points and its corresponding attack type label. During training, the network weights are optimized with the goal of minimizing the cross-entropy loss function, so that the model can accurately distinguish between normal states and various attack states. For example, for a strong light blinding attack, its label is [0,0, 1, 0, 0] (assuming there are 5 attack types, where the third position represents a strong light blinding attack).

[0040] Step S3: Generate intrusion alarm and location. After the hybrid neural network model analyzes the current input feature data, if the output result determines that there is an intrusion behavior (for example, the model's output probability exceeds a preset threshold), an intrusion alarm is immediately generated. This alarm not only includes the time of occurrence of the intrusion event, but also identifies the specific intrusion type through the classification results output by the model (such as the output of the Softmax layer). At the same time, combined with the node source of the data collection in Step S1 (such as which parameters in the feature vector are abnormal), the location of the attacked node can be located (for example, the attack occurred on Bob's detector at the receiving end, or it occurred on the channel). This provides a decision basis for the subsequent execution of precise security enhancement strategies.

[0041] Step S4: Respond to the alarm and trigger the security enhancement strategy. In response to the intrusion alarm information generated in step S3, the system automatically triggers one or more security enhancement strategies to achieve proactive defense. The security enhancement strategies in this embodiment include the following three types, which can be used in combination or selectively triggered according to the attack type and severity.

[0042] Strategy 1: Dynamically adjust quantum state encoding parameters. Based on the detected intrusion type (e.g., detecting a detection attack against weak light pulses), the system dynamically adjusts the quantum state encoding parameters of the transmitter (Alice). Specifically, it adaptively adjusts the intensity of the light pulse (e.g., increasing the proportion of decoy states or adjusting the average number of photons in the signal state), the basis selection probability of polarization state or phase encoding. For example, if the original basis selection probability is 50% (Z basis): 50% (X basis), after detecting an attack, it can be dynamically adjusted to an asymmetric probability distribution, making it impossible for the attacker to accurately know the preparation information of the quantum state, thereby increasing the difficulty for them to obtain effective information. This adjustment does not interrupt the key distribution process, but only changes the parameter configuration, thus improving security while maintaining the continuous availability of the system.

[0043] Strategy 2: Switch to local oscillator light protocol mode. When the detected intrusion type clearly points to or may involve an attack targeting the local oscillator light (such as a strong light blinding attack or a local oscillator light wavelength attack), the system executes this strategy. Specifically, the system controls the optical switch built into the receiver (Bob) to quickly cut off the external local oscillator light input from the channel and simultaneously activates the built-in, highly stable local oscillator light source. This local oscillator light source uses a narrow linewidth laser and an automatic power control loop, which can provide stable local oscillation light. By switching the local oscillator light source required for detection from channel transmission to local generation, the possibility of attackers launching attacks by manipulating the channel local oscillator light is fundamentally eliminated.

[0044] Strategy 3: Select Privacy Amplification Algorithm After Startup. Upon intrusion detection, regardless of the specific attack type, the system can select the Privacy Amplification Algorithm during the key post-processing stage. This algorithm dynamically selects the hash function length (i.e., compression ratio) based on the real-time estimated quantum bit error rate (QBER) and the confidence level of the intrusion detection. For example, under normal conditions, if the QBER is 1%, the system selects a shorter hash function to maintain a higher secure key rate. After an attack is detected, even if the QBER does not increase significantly, the system will automatically select a longer hash function to maximize the compression of information that may be obtained by attackers, ensuring the absolute security of the final generated key. This strategy provides a universal, final line of defense.

[0045] Through the above steps S1-S4, the method provided in this embodiment closely integrates intelligent detection with proactive defense, significantly improving the security, robustness, and availability of the QKD system when facing complex physical layer attacks.

[0046] Example 2: This example provides an intrusion detection and security enhancement device for a quantum key distribution system. This device is used to implement the method in Example 1 above. Please refer to [link / reference]. Figure 2 The device includes a data acquisition module, an intrusion detection module, and a security enhancement module;

[0047] Data acquisition module: This module connects to multiple physical nodes in the QKD system (such as Alice at the transmitter, Bob at the receiver, and environmental sensors) to collect operating parameters in real time, such as light intensity at the transmitter, light intensity at the receiver, QBER, detector count rate, phase drift, ambient temperature and vibration frequency, and integrates these data to construct a multidimensional feature dataset.

[0048] Intrusion Detection Module: This module receives a multi-dimensional feature dataset from the data acquisition module. It integrates a pre-trained hybrid neural network model (CNN-LSTM). This module is responsible for analyzing the data stream in real time. When an intrusion is detected, it generates an intrusion alarm message containing the intrusion type and node location, and sends it to the security enhancement module.

[0049] As an feasible approach, the hybrid neural network model adopts a cascaded structure. The input layer receives a multidimensional feature matrix with dimensions (10, 7), where 10 is the time window length (unit: sampling interval) and 7 is the number of running parameters. This input matrix is ​​first fed into a convolutional neural network layer, which includes two convolutional layers with kernel sizes of 3×3 and 5×5, and a 2×2 max pooling layer, used to extract spatial correlation features between running parameters at different scales. The output of the convolutional neural network layer is flattened into a one-dimensional feature vector by a Flatten layer and then fed into a long short-term memory network layer. The long short-term memory network layer contains two LSTM units, each containing 128 hidden units, used to learn long-range dependencies in the time dimension. The output of the last time step of the LSTM layer is mapped by a fully connected layer and then output by a Softmax classifier, which outputs the probability distribution of normal state and various attack types.

[0050] Security Enhancement Module: This module receives alarm information from the intrusion detection module and triggers corresponding security enhancement strategies based on the alarm content. Specifically, this module can send instructions to the transmitter of the QKD system to dynamically adjust the quantum state encoding parameters; it can send instructions to the optical switch at the receiver to control it to switch to the local oscillator optical protocol mode; and it can control the key post-processing unit to dynamically select and start the privacy amplification algorithm.

[0051] Example 3: This example provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements all or part of the steps of the intrusion detection and security enhancement method for a quantum key distribution system as described in Example 1.

[0052] Example 4: This example provides a computer-readable storage medium storing a computer program thereon. When the program is executed by a processor, it implements all or part of the steps of the intrusion detection and security enhancement method for a quantum key distribution system as described in Example 1. The computer-readable storage medium can be any tangible medium that contains or stores a program, such as a USB flash drive, a portable hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0053] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Content not described in detail in this specification is prior art known to those skilled in the art.

[0054] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Those skilled in the art can readily implement the present invention based on the accompanying drawings and the above description. However, any modifications, alterations, or variations made by those skilled in the art without departing from the scope of the present invention, utilizing the disclosed technical content, are equivalent embodiments of the present invention. Furthermore, any modifications, alterations, or variations made to the above embodiments based on the essential technology of the present invention are still within the protection scope of the present invention.

Claims

1. A method for intrusion detection and security enhancement in a quantum key distribution system, characterized in that, Includes the following steps: Step S1: During the operation of the quantum key distribution system, the operating parameters of multiple physical nodes are collected in real time to construct a multi-dimensional feature dataset; Step S2: Input the multidimensional feature dataset into a pre-trained hybrid neural network model for intrusion detection. The hybrid neural network model includes a convolutional neural network layer and a long short-term memory network layer. Step S3: When an intrusion is detected, generate an intrusion alarm and locate the intrusion type and node location; Step S4: In response to the intrusion alarm information, a security enhancement strategy is triggered. The security enhancement strategy includes dynamically adjusting quantum state encoding parameters, switching to the local oscillator optical protocol mode, and selecting a privacy amplification algorithm after startup.

2. The intrusion detection and security enhancement method for a quantum key distribution system according to claim 1, characterized in that, The operating parameters of the multiple physical nodes include at least: transmitting light intensity, receiving light intensity, qubit error rate, detector count rate, phase drift, ambient temperature, and vibration frequency.

3. The intrusion detection and security enhancement method for a quantum key distribution system according to claim 1, characterized in that, The training process of the hybrid neural network model includes: Construct a training dataset containing multiple attack types, including at least: strong light blinding attack, wavelength attack, dead time attack, and Trojan light attack. Each sample in the training dataset contains a multidimensional feature vector of multiple consecutive time sampling points within a preset time window and its corresponding attack type label. The hybrid neural network model is trained in a supervised manner using the training dataset to optimize the network weights by minimizing the cross-entropy loss function.

4. The intrusion detection and security enhancement method for a quantum key distribution system according to claim 1, characterized in that, The dynamic adjustment of quantum state encoding parameters specifically includes: adaptively adjusting the intensity of the light pulse, the basis vector selection probability of the polarization state or phase encoding according to the detected intrusion type, so as to increase the difficulty for attackers to obtain effective information.

5. The intrusion detection and security enhancement method for a quantum key distribution system according to claim 1, characterized in that, The switching to the local oscillator light protocol mode specifically includes: controlling the receiver to start the built-in local oscillator light source to replace the local oscillator light transmitted from the channel, thereby eliminating attack vectors targeting the local oscillator light.

6. The intrusion detection and security enhancement method for a quantum key distribution system according to claim 1, characterized in that, The selection of the privacy amplification algorithm after startup specifically includes: after intrusion detection is triggered, dynamically selecting the hash function length of the privacy amplification algorithm based on the real-time estimated qubit error rate, so as to maximize the compression of eavesdropper information while ensuring the security key rate.

7. An intrusion detection and security enhancement device for a quantum key distribution system, characterized in that, Includes a data acquisition module, an intrusion detection module, and a security enhancement module; The data acquisition module is used to collect the operating parameters of multiple physical nodes in real time and construct a multidimensional feature dataset; The intrusion detection module is used to input a multidimensional feature dataset into a pre-trained hybrid neural network model for intrusion detection and to generate intrusion alarm information; The security enhancement module is used to respond to the intrusion alarm information and trigger a security enhancement strategy. The security enhancement strategy includes dynamically adjusting quantum state encoding parameters, switching to the local oscillator optical protocol mode, and selecting a privacy amplification algorithm after startup.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.

Images