A method and system for detecting and warning of cryptographic protocol anomalies

Abstract

This invention provides a method and system for detecting and warning of anomalies in encryption protocols, belonging to the field of network security technology. The method includes: extracting a multimodal feature set from the target encryption protocol communication stream; inputting it in parallel into an adaptive rule engine and an interpretable artificial intelligence model to obtain rule-triggered events and confidence weights, a first anomaly score, and an attribution explanation report, respectively; calculating a second anomaly score based on the above outputs using an improved scoring algorithm; fusing the first and second anomaly scores to obtain a comprehensive anomaly score and generating a warning decision; and uploading the warning information to a federated collaborative node to drive the collaborative evolution of the global rule base and the model. This invention, employing the aforementioned method and system for detecting and warning of anomalies in encryption protocols, solves the collaborative problems of poor interpretability, lagging knowledge updates, and data silos in encryption threat detection through deep collaboration between an interpretable artificial intelligence model and a rule engine, achieving accurate, reliable, and adaptive anomaly warnings.

Images