QUIC robot detection method based on ensemble learning and sequence modeling

Abstract

The application discloses a QUIC robot detection method based on integrated learning and sequence modeling, which comprises the following steps: extracting a QUIC packet level metadata feature set; constructing a QUIC ciphertext multi-scale metadata feature set; obtaining a sub-flow set; obtaining a QUIC ciphertext time sequence embedding vector sequence; inputting the QUIC ciphertext time sequence embedding vector sequence into a double-scale Mamba state space modeling module to obtain a QUIC connection level high-dimensional time sequence hidden state matrix; obtaining sub-domain discrimination results output by each micro-expert; and generating a judgment result data structure, which is output to a network security control system to execute a flow limiting, blocking or alarm strategy. The application makes it possible to perform real-time detection on a QUIC connection containing tens of thousands of UDP data messages on a gateway device, while maintaining long-range dependent modeling capability and significantly reducing the consumption of computing resources.

Description

Technical Field

[0001] This invention relates to the field of robotics, and in particular to a QUIC robot detection method based on ensemble learning and sequence modeling. Background Technology

[0002] As internet infrastructure evolves towards full encryption and high concurrency, the UDP-based QUIC protocol (RFC9000) has gradually become the mainstream transport protocol and is widely deployed in application layer protocols such as HTTP / 3. The QUIC protocol incorporates end-to-end encryption mechanisms in its design; except for a few necessary header fields, its handshake process and data transmission content are encrypted and protected. It also supports multiplexing and connection migration mechanisms. In this context, traditional deep packet inspection techniques based on plaintext payload analysis are no longer effective. The cybersecurity field urgently needs to achieve effective identification of abnormal behavior in encrypted traffic without relying on decryption capabilities.

[0003] In existing technologies, methods for detecting robot behavior in encrypted traffic mainly rely on statistical feature analysis and sequence modeling techniques. One type of method extracts observable packet-level fields such as packet length, direction, and arrival time interval to construct feature vectors, and then uses traditional machine learning models for classification. However, this method typically uses fixed-length windows or simple sliding statistical features, making it difficult to capture long-range temporal dependencies spanning thousands or even tens of thousands of packets. For persistent botnet heartbeat streams or low-frequency, slow crawler behavior, there is a problem of long-range feature loss.

[0004] Another approach introduces recurrent neural networks or long short-term memory networks to model the traffic sequence. However, when faced with ultra-long QUIC connections, the vanishing gradient and memory decay problems make it difficult for the model to maintain a long-term memory of the correlation between the handshake behavior in the initial stage of the connection and the subsequent cycle behavior, thus affecting the detection accuracy. At the same time, some existing methods attempt to use the Transformer structure to model the network flow with global attention. However, since the computational complexity of its attention mechanism is quadratic with the sequence length, it is easy to cause computational resource overload and memory overflow when dealing with long connections containing a large number of data packets, making it difficult to achieve line-speed real-time detection on the gateway side. Summary of the Invention

[0005] One objective of this invention is to propose a QUIC robot detection method based on ensemble learning and sequence modeling. This invention enables real-time detection of QUIC connections containing tens of thousands of UDP data packets on gateway devices, significantly reducing computational resource consumption while maintaining long-range dependency modeling capabilities.

[0006] A QUIC robot detection method based on ensemble learning and sequence modeling according to an embodiment of the present invention includes:

[0007] The QUIC encrypted communication stream is captured without key bypass and reassembled into a corresponding ordered data packet sequence, and the QUIC packet-level metadata feature set is extracted.

[0008] Encode the QUIC packet-level metadata feature set to generate a multi-scale time-frequency parallel feature channel, and then concatenate the multi-scale time-frequency parallel feature channel with the QUIC packet-level metadata feature set to construct a QUIC ciphertext multi-scale metadata feature set.

[0009] Unsupervised subspace clustering is performed in the high-dimensional feature space based on the QUIC ciphertext multi-scale metadata feature set, and logical sub-stream splitting is performed on the QUIC ciphertext multi-scale metadata feature set according to the spatial clustering results to obtain the sub-stream set;

[0010] For each sub-stream in the sub-stream set, generate a sub-stream relative position code and a corresponding global position code. Superimpose the sub-stream relative position code and the global position code onto the QUIC ciphertext multi-scale metadata feature set to obtain the QUIC ciphertext temporal embedding vector sequence.

[0011] Inputting the QUIC ciphertext temporal embedding vector sequence into the dual-scale Mamba state space modeling module yields the QUIC connection-level high-dimensional temporal hidden state matrix.

[0012] The high-dimensional temporal hidden state matrix of the QUIC connection level and the sub-stream set are input into the gated routing network to obtain the subdomain discrimination results output by each micro-expert.

[0013] The subdomain discrimination results are weighted and fused to output a connection-level comprehensive behavior judgment vector. The robot probability value of the target QUIC connection is calculated. When the robot probability value exceeds the preset threshold, the temporal segment backtracking and positioning is performed on the high-dimensional temporal hidden state matrix of the QUIC connection level to generate a judgment result data structure. The judgment result data structure is output to the network security control system to execute rate limiting, blocking or alarm strategies.

[0014] Optionally, the keyless bypass capture and session reassembly of the QUIC encrypted communication stream includes:

[0015] The system performs keyless bypass capture and session reassembly of QUIC encrypted communication streams in the target network environment. Based on the 5-tuple information, UDP datagrams are aggregated into a set of raw QUIC connection-level data streams. The UDP datagrams in each QUIC connection are sorted according to the timestamp to form a corresponding ordered data packet sequence. From the ordered data packet sequence, a set of QUIC packet-level metadata features that depend only on observable packet-level fields is extracted.

[0016] Optionally, the QUIC packet-level metadata feature set includes packet length, packet direction identifier, arrival time interval between adjacent packets, packet burst duration, packet burst strength, and QUIC long packet type identifier.

[0017] Optionally, the step of performing feature-level concatenation of the multi-scale time-domain-frequency-domain parallel feature channels with the QUIC packet-level metadata feature set includes:

[0018] Perform dimensionality-consistent processing on the ordered data packet length sequence, the adjacent data packet arrival time interval sequence, the ordered data packet burst duration sequence, and the ordered data packet burst intensity sequence to generate a basic normalized sequence;

[0019] Multi-scale inter-packet differential coding is performed on the ordered data packet length base normalized sequence and the adjacent data packet arrival time interval base normalized sequence. For any scale, when the index value of the i-th UDP data packet is less than or equal to the scale, the differential result at the corresponding position is defined as zero; otherwise, the differential result at the corresponding position is defined as the base normalized value at the corresponding position minus the index value minus the base normalized value at the scale position, resulting in a multi-scale ordered data packet length differential sequence and a multi-scale adjacent data packet arrival time interval differential sequence of length N.

[0020] Time window sliding statistical coding is performed on the ordered data packet length basic normalized sequence, the adjacent data packet arrival time interval basic normalized sequence, the ordered data packet burst duration basic normalized sequence, and the ordered data packet burst intensity basic normalized sequence to obtain a sliding statistical feature sequence of length N that is aligned packet by packet with the ordered data packet sequence.

[0021] Short time-frequency domain transform coding is performed on the ordered data packet length basic normalized sequence and the adjacent data packet arrival time interval basic normalized sequence to obtain the short time-frequency domain aggregated feature sequence;

[0022] The multi-scale ordered data packet length difference sequence, the multi-scale adjacent data packet arrival time interval difference sequence, the sliding statistical feature sequence, and the short time-frequency domain aggregated feature sequence are aligned and concatenated with the QUIC packet-level metadata feature set packet by packet to form the QUIC ciphertext multi-scale metadata feature set.

[0023] Optionally, the unsupervised subspace clustering in the high-dimensional feature space based on the QUIC ciphertext multi-scale metadata feature set includes:

[0024] The QUIC ciphertext multi-scale metadata feature set is represented as a packet-by-packet aligned feature sequence of length N;

[0025] The package-aligned feature sequences are stacked in package index order to form a feature matrix, and a sample self-expression coefficient matrix is ​​constructed on the feature matrix;

[0026] An affinity matrix is ​​constructed based on the sample self-expression coefficient matrix. Unsupervised clustering is performed on N UDP data packets based on the affinity matrix, and a behavior subspace cluster label is assigned to each UDP data packet.

[0027] Based on the behavior subspace cluster label, the QUIC ciphertext multi-scale metadata feature set is logically split into sub-streams. UDP datagram indices with the same behavior subspace cluster label are grouped into the same logical sub-stream to construct a sub-stream set.

[0028] Optionally, the step of superimposing the substream relative position encoding and the global position encoding onto the QUIC ciphertext multi-scale metadata feature set includes:

[0029] For each logical sub-stream, construct a sub-stream relative position encoding index, and uniformly map all sub-stream relative position encoding indices to a sub-stream relative position index vector of length N;

[0030] Construct a global positional encoding index vector;

[0031] A sub-stream relative position encoding matrix is ​​generated based on the sub-stream relative position index vector, and a global position encoding matrix is ​​generated based on the global position encoding index vector.

[0032] The sub-stream relative position encoding matrix and the global position encoding matrix are superimposed onto the feature matrix corresponding to the QUIC ciphertext multi-scale metadata feature set;

[0033] The original feature matrix, the masked substream relative position encoding matrix, and the global position encoding matrix are added element by element to form the superimposed feature matrix;

[0034] An embedding mapping is performed on the superimposed feature matrix to obtain a sequence of QUIC ciphertext temporal embedding vectors of length N.

[0035] Optionally, the construction of the sub-stream relative position index vector includes:

[0036] When the i-th UDP datagram belongs to any logical sub-stream, the sub-stream relative position index vector is taken as its relative position number within the corresponding logical sub-stream.

[0037] When the i-th UDP datagram does not belong to any logical sub-stream, the sub-stream relative position index vector is set to 0, and a sub-stream mask vector aligned with the packet-by-packet aligned feature sequence is generated.

[0038] The i-th element in the sub-stream mask vector is used to indicate whether the i-th UDP datagram belongs to any logical sub-stream;

[0039] The mask element is set to 1 when the i-th UDP datagram belongs to any logical sub-stream;

[0040] The mask element is 0 when the i-th UDP datagram does not belong to any logical substream.

[0041] Optionally, the step of inputting the QUIC ciphertext temporal embedding vector sequence into the dual-scale Mamba state-space modeling module includes:

[0042] Construct the microscale hidden state sequence of the microscale branch and the macroscale hidden state sequence of the macroscale branch;

[0043] In the microscale branch, the continuous-time state parameter matrix is ​​set as the continuous-time dynamic basis matrix of the microscale branch;

[0044] Based on the QUIC ciphertext timing embedding vector corresponding to the i-th UDP datagram and the arrival time interval of adjacent data packets, a time scale parameter and input mapping parameter that depend on the input step time are generated;

[0045] The zero-order preservation rule is used to calculate the discretized state transition matrix and the discretized input mapping matrix based on the step-time scale parameter, the continuous-time state parameter matrix, and the input mapping parameter.

[0046] Based on the discretized state transition matrix and the discretized input mapping matrix, the microscale hidden state vector is updated at the i-th UDP data packet according to the linear time-varying state update equation;

[0047] In the macro-scale branch, the continuous-time state parameter matrix is ​​set as the continuous-time dynamic basis matrix of the macro-scale branch. The macro-scale update step size is set as a preset positive integer in packets. When the index value of the i-th UDP data packet is divided by the macro-scale update step size, the macro-scale hidden state update is performed. Otherwise, the previous hidden state is kept unchanged, and the updated macro-scale hidden state vector is obtained.

[0048] Construct a gated fusion unit, and at the i-th UDP data packet, perform weighted fusion of the updated micro-scale hidden state vector and the updated macro-scale hidden state vector to obtain the fused hidden state vector of the i-th UDP data packet.

[0049] The fused hidden state vectors are stacked row by row according to the index order of the UDP datagrams to construct a high-dimensional temporal hidden state matrix at the QUIC connection level.

[0050] Optionally, the step of inputting the QUIC connection-level high-dimensional temporal hidden state matrix and the sub-stream set into the gated routing network includes:

[0051] Based on the matching score, the first-layer routing is performed to allocate the QUIC connection-level high-dimensional temporal hidden state matrix to the macro-expert set. Within the activated macro-experts, the second-layer routing is used to allocate the QUIC connection-level high-dimensional temporal hidden state matrix to the micro-expert set. A hierarchical sparse activation strategy is adopted to obtain the subdomain discrimination results output by each micro-expert.

[0052] Optionally, the weighted fusion of the subdomain discrimination results to output a connection-level comprehensive behavior determination vector includes:

[0053] Perform a weight fusion operation on the subdomain discrimination result set to obtain the connection-level comprehensive behavior judgment vector;

[0054] Based on the connection-level integrated behavior determination vector, calculate the robot probability value and behavior category label of the target QUIC connection;

[0055] Set a robot probability threshold. When the robot probability value is greater than the robot probability threshold, obtain the QUIC connection-level high-dimensional temporal hidden state matrix.

[0056] Based on the high-dimensional temporal hidden state matrix of the QUIC connection level, the packet-by-packet trigger score is calculated to obtain the trigger judgment index range;

[0057] Construct a judgment result data structure that includes robot probability value, behavior category label, and trigger judgment index range. Output the judgment result data structure to the network security control system, which then executes rate limiting, blocking, or alarm policies based on the judgment result data structure.

[0058] The beneficial effects of this invention are:

[0059] This invention overcomes the bottleneck of traditional sequence models in modeling ultra-long QUIC connections by constructing a dual-scale Mamba state space modeling module, combining continuous-time dynamics models with input-dependent discretized parameters. By introducing time-scale parameters in the micro-scale branch, the arrival time intervals of adjacent data packets in the real network environment are directly mapped to the discretized evolution of the continuous state space. This allows hidden state updates to not only rely on the embedding vector but also explicitly integrate physical time information, enabling accurate memorization and selective forgetting of irregular burst traffic and periodic heartbeat behavior. Simultaneously, by generating discretized state transition matrices and discretized input mapping matrices through zero-order preservation rules, state updates maintain strictly linear time complexity, reducing computational complexity from quadratic to linear. This avoids memory overflow issues in long-connection scenarios, making real-time detection of QUIC connections containing tens of thousands of UDP data packets on gateway devices possible, significantly reducing computational resource consumption while maintaining long-range dependency modeling capabilities.

[0060] This invention constructs a logical sub-stream splitting mechanism by performing self-expressive modeling and unsupervised subspace clustering on the multi-scale metadata feature set of QUIC ciphertext. This achieves a feature decoupling method that matches the QUIC multiplexing mechanism. By constructing a sample self-expressive coefficient matrix and constraining the diagonal elements to zero, the feature vector of each UDP datagram is linearly reconstructed only from other datagrams. In the high-dimensional feature space, a sample set with similar temporal rhythms, packet length distribution patterns, and burst structures is mined. Unsupervised clustering is then performed based on the affinity matrix to split different logical behaviors mixed in the same physical connection into independent sub-streams. This effectively suppresses feature aliasing between different business flows and reduces the probability of misjudging complex web page loading behavior as high-frequency automated requests. At the same time, sub-stream-level behavior partitioning is achieved without relying on the internal frame structure of the QUIC encrypted payload, ensuring the feasibility of the technical solution in a keyless bypass environment. Attached Figure Description

[0061] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0062] Figure 1 This is a flowchart of a QUIC robot detection method based on ensemble learning and sequence modeling proposed in this invention. Detailed Implementation

[0063] Example 1: Reference Figure 1 A QUIC robot detection method based on ensemble learning and sequence modeling includes:

[0064] The QUIC encrypted communication stream is captured without key bypass and reassembled into a corresponding ordered data packet sequence, and the QUIC packet-level metadata feature set is extracted.

[0065] Encode the QUIC packet-level metadata feature set to generate a multi-scale time-frequency parallel feature channel, and then concatenate the multi-scale time-frequency parallel feature channel with the QUIC packet-level metadata feature set to construct a QUIC ciphertext multi-scale metadata feature set.

[0066] Unsupervised subspace clustering is performed in the high-dimensional feature space based on the QUIC ciphertext multi-scale metadata feature set, and logical sub-stream splitting is performed on the QUIC ciphertext multi-scale metadata feature set according to the spatial clustering results to obtain the sub-stream set;

[0067] For each sub-stream in the sub-stream set, generate a sub-stream relative position code and a corresponding global position code. Superimpose the sub-stream relative position code and the global position code onto the QUIC ciphertext multi-scale metadata feature set to obtain the QUIC ciphertext temporal embedding vector sequence.

[0068] Inputting the QUIC ciphertext temporal embedding vector sequence into the dual-scale Mamba state space modeling module yields the QUIC connection-level high-dimensional temporal hidden state matrix.

[0069] The high-dimensional temporal hidden state matrix of the QUIC connection level and the sub-stream set are input into the gated routing network to obtain the subdomain discrimination results output by each micro-expert.

[0070] The subdomain discrimination results are weighted and fused to output a connection-level comprehensive behavior judgment vector. The robot probability value of the target QUIC connection is calculated. When the robot probability value exceeds the preset threshold, the temporal segment backtracking and positioning is performed on the high-dimensional temporal hidden state matrix of the QUIC connection level to generate a judgment result data structure. The judgment result data structure is output to the network security control system to execute rate limiting, blocking or alarm strategies.

[0071] In this embodiment, keyless bypass capture and session reassembly of the QUIC encrypted communication stream include:

[0072] The system performs keyless bypass capture and session reassembly of QUIC encrypted communication streams in the target network environment. Based on the 5-tuple information, UDP datagrams are aggregated into a set of raw QUIC connection-level data streams. The UDP datagrams in each QUIC connection are sorted according to the timestamp to form a corresponding ordered data packet sequence. From the ordered data packet sequence, a set of QUIC packet-level metadata features that depend only on observable packet-level fields is extracted.

[0073] In this embodiment, the QUIC packet-level metadata feature set includes packet length, packet direction identifier, arrival time interval between adjacent packets, packet burst duration, packet burst strength, and QUIC long packet type identifier.

[0074] The QUIC packet-level metadata feature set is represented as a packet-by-packet aligned sequence of length N, where N represents the total number of UDP datagrams within the same QUIC connection. The i-th element in the packet-by-packet aligned sequence represents the QUIC packet-level metadata feature vector corresponding to the i-th UDP datagram within the same QUIC connection and corresponds one-to-one with the ordered data packet sequence.

[0075] The ordered packet length sequence is a packet-by-packet aligned sequence of length N. The i-th element in the ordered packet length sequence represents the ordered packet length of the i-th UDP datagram in bytes. The ordered packet direction identifier sequence is a packet-by-packet aligned sequence of length N. The i-th element in the ordered packet direction identifier sequence takes a value of negative one or positive one, used to represent the direction identifier of the i-th UDP datagram. The adjacent packet arrival time interval sequence is a packet-by-packet aligned sequence of length N. When i equals 1, the first element is defined as zero. When i is greater than or equal to 2, the i-th element is defined as the timestamp of the i-th UDP datagram arriving at the collection point minus the timestamp of the i-th minus 1 UDP datagram arriving at the collection point, ensuring that the length of the adjacent packet arrival time interval sequence is N and is aligned packet-by-packet with the ordered packet sequence.

[0076] The ordered packet burst duration sequence is a packet-by-packet aligned sequence of length N. The i-th element in the ordered packet burst duration sequence represents the duration of the burst to which the i-th UDP datagram belongs, and the unit is seconds. The ordered packet burst intensity sequence is a packet-by-packet aligned sequence of length N. The i-th element in the ordered packet burst intensity sequence represents the number of packets per unit time within the burst to which the i-th UDP datagram belongs, and the unit is packets per second.

[0077] In this embodiment, the multi-scale time-domain-frequency-domain parallel feature channels are concatenated with the QUIC packet-level metadata feature set at the feature level, including:

[0078] Perform dimensionality-consistent processing on the ordered data packet length sequence, the adjacent data packet arrival time interval sequence, the ordered data packet burst duration sequence, and the ordered data packet burst intensity sequence to generate a basic normalized sequence;

[0079] In Example 1, the dimension uniformity processing is as follows: For any numerical sequence of length N, the mean and standard deviation of the corresponding numerical sequence within the QUIC connection are calculated. For each element in the numerical sequence, the mean is subtracted and the standard deviation is divided to obtain the basic normalized sequence. The basic normalized sequences are the ordered data packet length basic normalized sequence, the adjacent data packet arrival time interval basic normalized sequence, the ordered data packet burst duration basic normalized sequence, and the ordered data packet burst intensity basic normalized sequence. The ordered data packet direction identifier sequence and the QUIC long packet type identifier sequence are aligned with the basic normalized sequence packet by packet.

[0080] Multi-scale inter-packet differential coding is performed on the ordered data packet length base normalized sequence and the adjacent data packet arrival time interval base normalized sequence. For any scale, when the index value of the i-th UDP data packet is less than or equal to the scale, the differential result at the corresponding position is defined as zero; otherwise, the differential result at the corresponding position is defined as the base normalized value at the corresponding position minus the index value minus the base normalized value at the scale position, resulting in a multi-scale ordered data packet length differential sequence and a multi-scale adjacent data packet arrival time interval differential sequence of length N.

[0081] Time window sliding statistical coding is performed on the ordered data packet length basic normalized sequence, the adjacent data packet arrival time interval basic normalized sequence, the ordered data packet burst duration basic normalized sequence, and the ordered data packet burst intensity basic normalized sequence to obtain a sliding statistical feature sequence of length N that is aligned with the ordered data packet sequence packet by packet.

[0082] In Example 1, the sliding window length is set to a positive integer in packets. For the i-th UDP datagram, a window index set is constructed containing the UDP datagrams at that position and at most the number of sliding window lengths minus one. When the left boundary of the window is less than 1, it is automatically truncated to 1 to ensure that the window index set always falls within the range of 1 to N. Within each window index set, the sliding mean and sliding variance of the corresponding basic normalized sequence are calculated. The sliding mean is the sum of all elements in the window index set divided by the number of elements in the window. The sliding variance is the sum of the squares of the differences between each element in the window index set and the sliding mean divided by the number of elements in the window. This yields a sliding statistical feature sequence of length N that is aligned packet by packet with the ordered data packet sequence.

[0083] Short time-frequency domain transform coding is performed on the ordered data packet length basic normalized sequence and the adjacent data packet arrival time interval basic normalized sequence to obtain the short time-frequency domain aggregated feature sequence;

[0084] In Example 1, the short-time frequency domain transform window length is set to a positive integer in packets, and the step length is set to a positive integer in packets. Multiple window index sets are constructed by moving the window once every step length starting from the first UDP datagram. Each window index set contains a continuous number of UDP datagrams of the window length. When the right boundary of the window exceeds N, it is automatically truncated to N. For the basic normalized sequence fragments in each window index set, a preset number of frequency domain coefficients are calculated according to the discrete cosine transform rule. The number of frequency domain coefficients is a preset positive integer. For any UDP datagram index, all window index sets including the index are determined. The frequency domain coefficients of the index corresponding to the same frequency number in different windows are arithmetically averaged to obtain the frequency domain feature value of the UDP datagram under that frequency number. When there is no window index set containing the index, the frequency domain feature value of the UDP datagram under the frequency number is defined as zero, resulting in a short-time frequency domain aggregated feature sequence of length N that is aligned packet by packet with the ordered data packet sequence.

[0085] ;

[0086] ;

[0087] in, Indicates the first The first short-time frequency domain transform window corresponds to the first Each frequency domain coefficient The index number represents the short-time-frequency domain transform window and is used to distinguish different sliding windows. The number representing the frequency component. This indicates the number of frequency domain coefficients retained. This indicates the index of the sample position within the window. A number representing an integer used to iterate through each data position within the window. The short time-frequency domain transformation window length represents the number of UDP datagrams contained in each window. Indicates the first Within the short-time frequency domain transform window, the first... The sequence of values ​​at each position, Indicates the relationship with the first The UDP datagram is aligned packet by packet. Each frequency domain eigenvalue, This indicates the index number of the UDP datagram within the same QUIC connection. Indicates containing the first The set of all short-time frequency domain transform window numbers for each UDP datagram index. Represents the set of window numbers The number of elements, This indicates that for all cases containing the first... The window of the first UDP datagram Sum of the frequency domain coefficients This indicates that there exists at least one short time-frequency domain transform window covering the first... One UDP datagram, This indicates that there is no short-time frequency domain transform window covering the first... A UDP datagram.

[0088] The multi-scale ordered data packet length difference sequence, the multi-scale adjacent data packet arrival time interval difference sequence, the sliding statistical feature sequence, and the short time-frequency domain aggregated feature sequence are aligned and concatenated with the QUIC packet-level metadata feature set packet by packet to form the QUIC ciphertext multi-scale metadata feature set.

[0089] The i-th element in the QUIC ciphertext multi-scale metadata feature set corresponds one-to-one with the i-th UDP datagram and includes original QUIC packet-level metadata features, multi-scale inter-packet differential features, sliding statistical features, and short-time frequency domain aggregation features.

[0090] In this embodiment, unsupervised subspace clustering is performed in a high-dimensional feature space based on the QUIC ciphertext multi-scale metadata feature set, including:

[0091] The QUIC ciphertext multi-scale metadata feature set is represented as a packet-by-packet aligned feature sequence of length N;

[0092] In Example 1, the i-th feature vector in the packet-by-packet alignment feature sequence is a QUIC ciphertext multi-scale metadata feature vector corresponding one-to-one with the i-th UDP datagram. Each QUIC ciphertext multi-scale metadata feature vector is formed by concatenating the basic normalized sequence, the multi-scale ordered packet length difference sequence, the multi-scale adjacent packet arrival time difference sequence, the sliding statistical feature sequence, the short time-frequency domain aggregated feature sequence, and the QUIC packet-level metadata feature set according to the same packet index.

[0093] The package-aligned feature sequences are stacked in package index order to form a feature matrix, and a sample self-expression coefficient matrix is ​​constructed on the feature matrix;

[0094] In Example 1, each element in the sample self-expression coefficient matrix represents the reconstruction weight when the feature vector corresponding to the i-th UDP datagram is linearly reconstructed from the feature vectors of the other UDP datagrams. The optimal sample self-expression coefficient matrix is ​​obtained by minimizing the reconstruction error and simultaneously minimizing the sum of the absolute values ​​of all reconstruction weights in the sample self-expression coefficient matrix. All diagonal elements of the sample self-expression coefficient matrix are uniformly set to zero to ensure that no UDP datagram participates in the reconstruction of its own feature vector.

[0095] An affinity matrix is ​​constructed based on the sample self-expression coefficient matrix. Unsupervised clustering is performed on N UDP data packets based on the affinity matrix, and a behavior subspace cluster label is assigned to each UDP data packet.

[0096] In Example 1, each element in the affinity matrix is ​​used to characterize the similarity between any two UDP datagrams. The value of each element in the affinity matrix is ​​obtained by adding the absolute value of the corresponding element in the sample self-expression coefficient matrix to the absolute value of the transpose of the element in the same row and column of the sample self-expression coefficient matrix.

[0097] The behavior subspace cluster label is a preset positive integer number used to uniquely represent the clustering relationship of UDP data packets in the high-dimensional feature space.

[0098] Based on the behavior subspace cluster label, the QUIC ciphertext multi-scale metadata feature set is logically split into sub-streams. UDP datagram indices with the same behavior subspace cluster label are grouped into the same logical sub-stream to construct a sub-stream set.

[0099] In Example 1, the sub-stream set includes several logical sub-streams. Each logical sub-stream consists of UDP datagram indexes with the same cluster label for all behavior subspaces. Each logical sub-stream is constructed solely based on the multi-scale metadata feature vector of QUIC ciphertext aligned packet by packet, without relying on the frame structure inside the QUIC encrypted payload. This ensures that the logical sub-stream splitting process does not involve any protocol internal content that cannot be observed in the encrypted state.

[0100] In this embodiment, the substream relative position encoding and the global position encoding are superimposed on the QUIC ciphertext multi-scale metadata feature set, including:

[0101] For each logical sub-stream, construct a sub-stream relative position encoding index, and uniformly map all sub-stream relative position encoding indices to a sub-stream relative position index vector of length N;

[0102] In Example 1, each index value in the sub-stream relative position encoding index sequence represents the relative position number of the corresponding UDP datagram within its logical sub-stream. The relative position number monotonically increases in the same logical sub-stream according to the time order of the UDP datagrams and starts counting from 1.

[0103] Construct a global positional encoding index vector;

[0104] In Example 1, the i-th element in the global location coding index vector takes the value i, which represents the global location number of the i-th UDP datagram within the same QUIC connection. The global location coding index vector is aligned with the packet-by-packet alignment feature sequence.

[0105] A sub-stream relative position encoding matrix is ​​generated based on the sub-stream relative position index vector, and a global position encoding matrix is ​​generated based on the global position encoding index vector.

[0106] In Example 1, each row vector of the sub-stream relative position encoding matrix is ​​obtained by mapping the sub-stream relative position index of the corresponding UDP datagram through a preset sine and cosine function encoding rule. The sine and cosine function encoding rule uses a preset scale base to perform exponentially decreasing scaling, and the scale base is a preset constant.

[0107] Each row vector of the global position coding matrix is ​​obtained by mapping the global position index of the corresponding UDP datagram through the same sine and cosine function coding rules as the sub-stream relative position coding matrix. Both the sub-stream relative position coding matrix and the global position coding matrix are aligned with the packet-by-packet alignment feature sequence.

[0108] The sub-stream relative position encoding matrix and the global position encoding matrix are superimposed onto the feature matrix corresponding to the QUIC ciphertext multi-scale metadata feature set;

[0109] The original feature matrix, the masked substream relative position encoding matrix, and the global position encoding matrix are added element by element to form the superimposed feature matrix;

[0110] In Example 1, before performing the overlay operation, a first linear mapping operation is performed on the sub-stream relative position encoding matrix. The encoding dimension of the sub-stream relative position encoding matrix is ​​mapped to the same dimension as the feature dimension of the feature matrix through the first linear mapping matrix, thus obtaining the first position mapping matrix.

[0111] Multiply the i-th element of the sub-stream mask vector by all elements of the i-th row of the first position mapping matrix to obtain the sub-stream position matrix controlled by the mask. The sub-stream position matrix controlled by the mask is completely identical to the feature matrix in terms of the number of rows and columns.

[0112] The second position mapping matrix is ​​obtained by mapping the encoding dimension of the global position encoding matrix to the same dimension as the feature dimension of the feature matrix through the second linear mapping matrix.

[0113] After ensuring that the feature matrix, the masked sub-stream position matrix, and the second position mapping matrix are completely identical in terms of the number of rows and columns, the feature matrix, the masked sub-stream position matrix, and the second position mapping matrix are added one by one according to the corresponding row and corresponding column elements to obtain the superimposed feature matrix. The superimposed feature matrix has the number of rows equal to the number of UDP data packets N, and the number of columns equal to the feature dimension of the feature matrix.

[0114] ;

[0115] in, Indicates the substream relative position encoding superposition coefficients. Represents the global positional coding overlay coefficients. Denotes the first linear mapping matrix. Denotes the second linear mapping matrix. Represents the substream mask vector. This represents the element-wise multiplication operation in row-wise broadcasting, where F represents the characteristic matrix. This represents the substream relative position encoding matrix. This represents the global location encoding matrix.

[0116] An embedding mapping is performed on the superimposed feature matrix to obtain a sequence of QUIC ciphertext temporal embedding vectors of length N.

[0117] The i-th embedding vector in the QUIC ciphertext timing embedding vector sequence corresponds one-to-one with the i-th UDP datagram.

[0118] In this embodiment, the construction of the sub-stream relative position index vector includes:

[0119] When the i-th UDP datagram belongs to any logical sub-stream, the sub-stream relative position index vector is taken as its relative position number within the corresponding logical sub-stream.

[0120] When the i-th UDP datagram does not belong to any logical sub-stream, the sub-stream relative position index vector is set to 0, and a sub-stream mask vector aligned with the packet-by-packet aligned feature sequence is generated.

[0121] The i-th element in the sub-stream mask vector is used to indicate whether the i-th UDP datagram belongs to any logical sub-stream;

[0122] The mask element is set to 1 when the i-th UDP datagram belongs to any logical sub-stream;

[0123] The mask element is 0 when the i-th UDP datagram does not belong to any logical substream.

[0124] In this embodiment, the QUIC ciphertext temporal embedding vector sequence is input into the dual-scale Mamba state-space modeling module, including:

[0125] Construct the microscale hidden state sequence of the microscale branch and the macroscale hidden state sequence of the macroscale branch;

[0126] In the microscale branch, the continuous-time state parameter matrix is ​​set as the continuous-time dynamic basis matrix of the microscale branch;

[0127] The continuous-time state parameter matrix is ​​set as the continuous-time dynamic basis matrix of the microscale branch, and the continuous-time state parameter matrix is ​​strictly limited to a diagonal matrix or a structured state matrix, so as to reduce the dimensionality of the calculation of the discretized state transition matrix to element-wise scalar operations.

[0128] Based on the QUIC ciphertext timing embedding vector corresponding to the i-th UDP datagram and the arrival time interval of adjacent data packets, a time scale parameter and input mapping parameter that depend on the input step time are generated;

[0129] In Example 1, the first linear mapping operation is performed on the i-th QUIC ciphertext timing embedding vector to map it into a scalar, and then added to the first linear mapping bias term. The arrival time interval of adjacent data packets is multiplied by the time interval weight coefficient and added to the sum. The result is then subjected to an activation function operation with positive value constraints to obtain the step time scale parameter.

[0130] Perform a second linear mapping operation on the i-th embedding vector and add a second linear mapping bias term. The resulting vector is rearranged into a matrix with dimensions $d_h$ multiplied by d according to a preset rule, which constitutes the input mapping parameters of the i-th UDP datagram.

[0131] The zero-order preservation rule is used to calculate the discretized state transition matrix and the discretized input mapping matrix based on the step-time scale parameter, the continuous-time state parameter matrix, and the input mapping parameter.

[0132] In Example 1, the step-time scale parameter is multiplied by the continuous-time state parameter matrix and then used as the input for matrix exponentiation to calculate the discretized state transition matrix corresponding to the i-th UDP data packet.

[0133] Multiplying the step-time scale parameter by the continuous-time state parameter matrix as a linear operator, obtaining its inverse operator, multiplying the inverse operator by the result of subtracting the identity matrix from the discretized state transition matrix, and multiplying the result by the product of the step-time scale parameter and the input mapping parameter to obtain the discretized input mapping matrix corresponding to the i-th UDP datagram.

[0134] ;

[0135] in, Represents matrix exponentiation. Represents the identity matrix. This represents the discretized input mapping matrix, where s is the microscale branch. This represents the time scale parameter corresponding to the i-th UDP datagram. The continuous-time state parameter matrix, For input mapping parameters.

[0136] Based on the discretized state transition matrix and the discretized input mapping matrix, the microscale hidden state vector is updated at the i-th UDP data packet according to the linear time-varying state update equation;

[0137] In Example 1, the discretized state transition matrix of the i-th UDP datagram is multiplied by the microscale hidden state vector of the (i-1)-th UDP datagram, the discretized input mapping matrix is ​​multiplied by the i-th embedding vector, and the two results are added together to obtain the microscale hidden state vector corresponding to the i-th UDP datagram.

[0138] In the macro-scale branch, the continuous-time state parameter matrix is ​​set as the continuous-time dynamic basis matrix of the macro-scale branch. The macro-scale update step size is set as a preset positive integer in packets. When the index value of the i-th UDP data packet is divided by the macro-scale update step size, the macro-scale hidden state update is performed. Otherwise, the previous hidden state is kept unchanged, and the updated macro-scale hidden state vector is obtained.

[0139] In Example 1, the macroscale hidden state update method is as follows: when the update condition is met, the macroscale discretized state transition matrix and macroscale discretized input mapping matrix of the i-th UDP data packet are generated according to the zero-order preservation rule corresponding to step S54. The macroscale discretized state transition matrix is ​​multiplied by the i-1-th macroscale hidden state vector, and the macroscale discretized input mapping matrix is ​​multiplied by the i-th embedding vector. The two terms are added together as the i-th macroscale hidden state vector. When the update condition is not met, the i-1-th macroscale hidden state vector is directly used as the i-th macroscale hidden state vector.

[0140] Construct a gated fusion unit, and at the i-th UDP data packet, perform weighted fusion of the updated micro-scale hidden state vector and the updated macro-scale hidden state vector to obtain the fused hidden state vector of the i-th UDP data packet.

[0141] The fused hidden state vectors are stacked row by row according to the index order of the UDP datagrams to construct a high-dimensional temporal hidden state matrix at the QUIC connection level.

[0142] In this embodiment, the high-dimensional temporal hidden state matrix of the QUIC connection level and the sub-stream set are input into the gated routing network, including:

[0143] Based on the matching score, the first-level routing is performed to allocate the QUIC connection-level high-dimensional temporal hidden state matrix to the macro-expert set. Within the activated macro-experts, the second-level routing is used to allocate the QUIC connection-level high-dimensional temporal hidden state matrix to the micro-expert set. A hierarchical sparse activation strategy is adopted to obtain the subdomain discrimination results output by each micro-expert.

[0144] In Example 1, for the fused hidden state vector corresponding to each UDP datagram in the QUIC connection-level high-dimensional temporal hidden state matrix, the gated routing network calculates the matching score between the fused hidden state vector and each macro expert through the first-layer linear mapping and normalization operation. The matching score represents the similarity between the current UDP datagram features and the processing capabilities of each macro expert. Normalization is performed on the matching score, and several macro experts with the highest matching scores are selected as activated macro experts according to the preset number of macro expert activations. The activation weights of the remaining macro experts are reset to zero, thus realizing the first-layer hierarchical sparse activation.

[0145] For each activated macro-expert, the matching score between the current fused hidden state vector and each micro-expert within the macro-expert is calculated again through the second-layer linear mapping and normalization operation. The micro-expert matching score is normalized, and several micro-experts with the highest matching scores are selected as activated micro-experts according to the preset number of activated micro-experts. The activation weight of the remaining micro-experts is reset to zero, thus realizing the second-layer hierarchical sparse activation.

[0146] The current fused hidden state vector is input into the activated micro-expert networks for forward computation. Each micro-expert network outputs a subdomain discrimination vector, which represents the classification score of the current UDP datagram in the preset subdomain category space. The subdomain discrimination vectors of all activated micro-experts corresponding to the same UDP datagram are weighted and summed according to the corresponding macro-expert activation weights and micro-expert activation weights to obtain the comprehensive subdomain discrimination result of the UDP datagram.

[0147] In this embodiment, the subdomain discrimination results are weighted and fused to output a connection-level comprehensive behavior determination vector, including:

[0148] Perform a weight fusion operation on the subdomain discrimination result set to obtain the connection-level comprehensive behavior judgment vector;

[0149] In Example 1, the subdomain discrimination result vector of each activated micro-expert is multiplied by its corresponding fusion weight, and all weighted subdomain discrimination result vectors are summed element by element to obtain the connection-level comprehensive behavior determination vector of the target QUIC connection.

[0150] Each element in the connection-level comprehensive behavior judgment vector represents the comprehensive score of the target QUIC connection under the corresponding behavior category.

[0151] Based on the connection-level integrated behavior determination vector, calculate the robot probability value and behavior category label of the target QUIC connection;

[0152] In Example 1, the connection-level integrated behavior judgment vector and the robot probability mapping weight vector are multiplied element by element and summed. The summation result is added to the robot probability mapping bias term. The result is then processed by the Sigmoid function to obtain a robot probability value between zero and one. The robot probability mapping weight vector is used to measure the contribution of each category score in the connection-level integrated behavior judgment vector to the robot judgment. The robot probability mapping bias term is used to adjust the overall judgment threshold offset.

[0153] In the connection-level integrated behavior determination vector, the category number corresponding to the element with the largest value is selected as the behavior category label of the target QUIC connection. The behavior category label is a preset positive integer number used to uniquely represent the behavior type of the target QUIC connection.

[0154] Set a robot probability threshold. When the robot probability value is greater than the robot probability threshold, obtain the QUIC connection-level high-dimensional temporal hidden state matrix.

[0155] Based on the high-dimensional temporal hidden state matrix of the QUIC connection level, the packet-by-packet trigger score is calculated to obtain the trigger judgment index range;

[0156] In Example 1, for each fused hidden state vector in the high-dimensional temporal hidden state matrix of the QUIC connection level, the trigger score mapping weight vector is multiplied element by element and summed. The summation result is added to the trigger score mapping bias term, and the Sigmoid function is applied to the result to obtain the packet-by-packet trigger score value corresponding to each UDP datagram.

[0157] Set a trigger scoring threshold, and form a trigger index set by indexing UDP datagrams whose trigger score value per packet is greater than the trigger scoring threshold.

[0158] If the trigger index set is not empty, then the continuous index interval with the longest consecutive index value and the longest interval length is selected from the trigger index set as the trigger judgment index interval.

[0159] If the trigger index set is empty, the UDP datagram index with the largest per-packet trigger score value is selected as the starting and ending indexes of the trigger determination index range.

[0160] Construct a judgment result data structure that includes robot probability value, behavior category label, and trigger judgment index range. Output the judgment result data structure to the network security control system, which then executes rate limiting, blocking, or alarm policies based on the judgment result data structure.

[0161] Example 2: In a large Internet egress environment, the implementer continuously monitors a segment of continuously running QUIC encrypted traffic. The average duration of a QUIC connection in the network environment is 8 minutes, but some connections last for more than 2 hours. The number of UDP datagrams in a single connection fluctuates between 5,000 and 20,000. During a certain monitoring period, the system found that a host with a source address of "10.23.45.18" established a QUIC connection with multiple target servers. The connection lasted for 2 hours and 37 minutes, and the total number of UDP datagrams was 16,842.

[0162] The system performs keyless bypass capture and session reassembly operations, sorting the connected UDP datagrams by timestamp to form an ordered data packet sequence. QUIC packet-level metadata features are extracted from this ordered data packet sequence. The average data packet length is 214 bytes, with a standard deviation of 63 bytes. The average arrival time interval between adjacent data packets is 1.96 seconds, with a maximum interval of 7.84 seconds and a minimum interval of 0.003 seconds. The data packet direction indicator shows an uplink to downlink ratio of 1:1.12. Data packet burst duration statistics show that a burst interval lasting 0.12 seconds occurs approximately every 110 seconds, with each burst interval containing 4 to 6 UDP datagrams.

[0163] After performing dimensionality standardization, the system performs multi-scale inter-packet differential coding on the basic normalized sequence of packet length and the basic normalized sequence of arrival time intervals of adjacent packets, with scales set to 1, 8, and 32. In the differential results at scale 32, the differential amplitude of the index interval from 8192 to 8224 is significantly higher than the overall mean by 2.8 times, showing a periodic burst structure. Subsequently, the system performs sliding statistical coding, with the sliding window length set to 128 UDP datagrams. The sliding variance of the index interval from 12640 to 12768 reaches 3.1 times the overall mean.

[0164] In the short-time frequency domain transform coding stage, the window length is set to 256, the step size is 64, and the first 10 frequency domain coefficients are retained. The system calculates that the amplitudes of the frequency domain coefficients at frequency numbers k=3 and k=4 are 2.46 and 2.18, respectively, while the corresponding averages for normal webpage access links are only 0.74 and 0.69. The system performs arithmetic mean aggregation on all windows covering this index to obtain a packet-aligned short-time frequency domain aggregated feature sequence.

[0165] After completing the multi-scale feature concatenation, the system represents the multi-scale metadata feature set of the connected QUIC ciphertext as a packet-by-packet aligned feature sequence of length 16842, and constructs a sample self-expression coefficient matrix. By minimizing the reconstruction error and L1 norm, a sparse coefficient matrix is ​​obtained, with all diagonal elements being zero. After constructing an affinity matrix based on the sparse coefficient matrix, cluster analysis is performed, ultimately dividing the connection into three logical sub-streams. The first sub-stream contains 13504 UDP data packets, corresponding to the mainstream webpage loading behavior; the second sub-stream contains 2731 UDP data packets, corresponding to the background silent download behavior; the third sub-stream contains 607 UDP data packets, exhibiting highly regular temporal rhythm characteristics, with a burst period of 110 seconds, consistent with the statistical results.

[0166] The system generates a sub-stream relative position index vector for each logical sub-stream and a sub-stream mask vector for data packets not belonging to any logical sub-stream. The number of unassigned data packets in the connection is 9, accounting for 0.053%. Subsequently, a global position encoding index vector is constructed, and a sub-stream relative position encoding matrix and a global position encoding matrix are generated based on sine and cosine encoding rules. After linear mapping and mask control, the three are added element-wise to form a superimposed feature matrix, resulting in a QUIC ciphertext temporal embedding vector sequence with a dimension of 16842×128.

[0167] In the dual-scale Mamba state space modeling stage, the hidden state dimension was set to 256. The micro-scale branch generated the step-time scale parameter based on the embedding vector and the arrival time interval of adjacent data packets. Statistical results showed that the maximum value of the step-time scale parameter was 2.04 seconds, the minimum value was 0.002 seconds, and the average value was 1.88 seconds. The macro-scale update step size was set to 32. Macro-scale update was performed when the index value was divisible by 32. Through the hardware-aware parallel scanning mechanism, the connection complete state update took 0.041 seconds, and the peak memory usage was 2.7GB.

[0168] During the MoE gated routing phase, there are 4 macro experts and 6 micro experts. The connection triggers 2 macro experts and 2 micro experts. The subdomain discrimination result vector is weighted and fused to output the connection-level comprehensive behavior judgment vector. The calculated robot probability value is 0.917, which is higher than the preset threshold of 0.85.

[0169] The system calculates the packet-by-packet trigger scoring sequence and finds that the scoring values ​​in the index range of 8160 to 8768 are all greater than 0.93. The corresponding time range is from 2 hours 11 minutes to 2 hours 19 minutes after the connection is established. The system generates a judgment result data structure, which records the robot probability value, behavior category label, trigger index range, trigger time range, and hidden state weight distribution vector, and outputs it to the network security control system. Based on the judgment result, the network security control system implements a rate limiting policy on the connection with source address "10.23.45.18", limiting the transmission rate to 10% of the original rate.

[0170] Within the same monitoring period, the implementers conducted comparative tests on 50,000 manually labeled QUIC connections, including 6,200 robot connections and 43,800 normal connections. The traditional detection method based on a fixed-window LSTM model showed an accuracy of 83.1%, a recall of 78.4%, and a false positive rate of 8.7%. The detection results of the method of this invention on the same dataset showed an accuracy of 95.6%, a recall of 93.2%, and a false positive rate of 2.9%.

[0171] In the ultra-long connection test set, 4300 connections with more than 10,000 data packets were selected, including 1080 robot connections. The traditional Transformer model had an average inference time of 0.218 seconds and a peak memory usage of 21.4GB on connections with a length of 12000; the method of this invention had an average inference time of 0.036 seconds and a peak memory usage of 3.1GB.

[0172] In concurrent stress testing, when processing 100,000 QUIC connections simultaneously, the traditional model had a packet loss rate of 3.8% and a CPU utilization rate of 94%; the method of this invention had a packet loss rate of 0.6% and a CPU utilization rate of 61%.

[0173] During manual verification, the host corresponding to the source address was confirmed to be a web crawler controlled by an automated script, and its behavioral characteristics were completely consistent with the periodic burst intervals detected by this invention. Through timely rate limiting and alerts, network administrators prevented the target server resources from being continuously consumed.

[0174] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A QUIC robot detection method based on ensemble learning and sequence modeling, characterized in that, include: The QUIC encrypted communication stream is captured without key bypass and reassembled into a corresponding ordered data packet sequence, and the QUIC packet-level metadata feature set is extracted. Encode the QUIC packet-level metadata feature set to generate a multi-scale time-frequency parallel feature channel, and then concatenate the multi-scale time-frequency parallel feature channel with the QUIC packet-level metadata feature set to construct a QUIC ciphertext multi-scale metadata feature set. Unsupervised subspace clustering is performed in the high-dimensional feature space based on the QUIC ciphertext multi-scale metadata feature set, and logical sub-stream splitting is performed on the QUIC ciphertext multi-scale metadata feature set according to the spatial clustering results to obtain the sub-stream set; For each sub-stream in the sub-stream set, generate a sub-stream relative position code and a corresponding global position code. Superimpose the sub-stream relative position code and the global position code onto the QUIC ciphertext multi-scale metadata feature set to obtain the QUIC ciphertext temporal embedding vector sequence. Inputting the QUIC ciphertext temporal embedding vector sequence into the dual-scale Mamba state space modeling module yields the QUIC connection-level high-dimensional temporal hidden state matrix. The high-dimensional temporal hidden state matrix of the QUIC connection level and the sub-stream set are input into the gated routing network to obtain the subdomain discrimination results output by each micro-expert. The subdomain discrimination results are weighted and fused to output the connection-level comprehensive behavior judgment vector. The robot probability value of the target QUIC connection is calculated. When the robot probability value exceeds the preset threshold, the temporal segment backtracking and positioning is performed on the high-dimensional temporal hidden state matrix of the QUIC connection level to generate the judgment result data structure. The judgment result data structure is output to the network security control system to execute the rate limiting, blocking or alarm strategy. The step of performing feature-level concatenation of multi-scale time-domain-frequency-domain parallel feature channels with QUIC packet-level metadata feature sets includes: Perform dimensionality-consistent processing on the ordered data packet length sequence, the adjacent data packet arrival time interval sequence, the ordered data packet burst duration sequence, and the ordered data packet burst intensity sequence to generate a basic normalized sequence; Multi-scale inter-packet differential coding is performed on the ordered data packet length base normalized sequence and the adjacent data packet arrival time interval base normalized sequence. For any scale, when the index value of the i-th UDP data packet is less than or equal to the scale, the differential result at the corresponding position is defined as zero; otherwise, the differential result at the corresponding position is defined as the base normalized value at the corresponding position minus the index value minus the base normalized value at the scale position, resulting in a multi-scale ordered data packet length differential sequence and a multi-scale adjacent data packet arrival time interval differential sequence of length N. Time window sliding statistical coding is performed on the ordered data packet length basic normalized sequence, the adjacent data packet arrival time interval basic normalized sequence, the ordered data packet burst duration basic normalized sequence, and the ordered data packet burst intensity basic normalized sequence to obtain a sliding statistical feature sequence of length N that is aligned packet by packet with the ordered data packet sequence. Short time-frequency domain transform coding is performed on the ordered data packet length basic normalized sequence and the adjacent data packet arrival time interval basic normalized sequence to obtain the short time-frequency domain aggregated feature sequence; The multi-scale ordered data packet length difference sequence, the multi-scale adjacent data packet arrival time interval difference sequence, the sliding statistical feature sequence, and the short time-frequency domain aggregated feature sequence are aligned and concatenated with the QUIC packet-level metadata feature set packet by packet to form the QUIC ciphertext multi-scale metadata feature set.

2. The QUIC robot detection method based on ensemble learning and sequence modeling according to claim 1, characterized in that, The keyless bypass capture and session reassembly of the QUIC encrypted communication stream includes: The system performs keyless bypass capture and session reassembly of QUIC encrypted communication streams in the target network environment. Based on the 5-tuple information, UDP datagrams are aggregated into a set of raw QUIC connection-level data streams. The UDP datagrams in each QUIC connection are sorted according to the timestamp to form a corresponding ordered data packet sequence. From the ordered data packet sequence, a set of QUIC packet-level metadata features that depend only on observable packet-level fields is extracted.

3. The QUIC robot detection method based on ensemble learning and sequence modeling according to claim 2, characterized in that, The QUIC packet-level metadata feature set includes packet length, packet direction identifier, arrival time interval between adjacent packets, packet burst duration, packet burst strength, and QUIC long packet type identifier.

4. The QUIC robot detection method based on ensemble learning and sequence modeling according to claim 1, characterized in that, The QUIC-based multi-scale metadata feature set performs unsupervised subspace clustering in a high-dimensional feature space, including: The QUIC ciphertext multi-scale metadata feature set is represented as a packet-by-packet aligned feature sequence of length N; The package-aligned feature sequences are stacked in package index order to form a feature matrix, and a sample self-expression coefficient matrix is ​​constructed on the feature matrix; An affinity matrix is ​​constructed based on the sample self-expression coefficient matrix. Unsupervised clustering is performed on N UDP data packets based on the affinity matrix, and a behavior subspace cluster label is assigned to each UDP data packet. Based on the behavior subspace cluster label, the QUIC ciphertext multi-scale metadata feature set is logically split into sub-streams. UDP datagram indices with the same behavior subspace cluster label are grouped into the same logical sub-stream to construct a sub-stream set.

5. The QUIC robot detection method based on ensemble learning and sequence modeling according to claim 1, characterized in that, The process of superimposing the substream relative position encoding and the global position encoding onto the QUIC ciphertext multi-scale metadata feature set includes: For each logical sub-stream, construct a sub-stream relative position encoding index, and uniformly map all sub-stream relative position encoding indices to a sub-stream relative position index vector of length N; Construct a global positional encoding index vector; A sub-stream relative position encoding matrix is ​​generated based on the sub-stream relative position index vector, and a global position encoding matrix is ​​generated based on the global position encoding index vector. The sub-stream relative position encoding matrix and the global position encoding matrix are superimposed onto the feature matrix corresponding to the QUIC ciphertext multi-scale metadata feature set; The original feature matrix, the masked substream relative position encoding matrix, and the global position encoding matrix are added element by element to form the superimposed feature matrix; An embedding mapping is performed on the superimposed feature matrix to obtain a sequence of QUIC ciphertext temporal embedding vectors of length N.

6. The QUIC robot detection method based on ensemble learning and sequence modeling according to claim 1, characterized in that, The construction of the sub-stream relative position index vector includes: When the i-th UDP datagram belongs to any logical sub-stream, the sub-stream relative position index vector is taken as its relative position number within the corresponding logical sub-stream. When the i-th UDP datagram does not belong to any logical sub-stream, the sub-stream relative position index vector is set to 0, and a sub-stream mask vector aligned with the packet-by-packet aligned feature sequence is generated. The i-th element in the sub-stream mask vector is used to indicate whether the i-th UDP datagram belongs to any logical sub-stream; The mask element is set to 1 when the i-th UDP datagram belongs to any logical sub-stream; The mask element is 0 when the i-th UDP datagram does not belong to any logical substream.

7. The QUIC robot detection method based on ensemble learning and sequence modeling according to claim 1, characterized in that, The module for inputting the QUIC ciphertext temporal embedding vector sequence into the dual-scale Mamba state space modeling module includes: Construct the microscale hidden state sequence of the microscale branch and the macroscale hidden state sequence of the macroscale branch; In the microscale branch, the continuous-time state parameter matrix is ​​set as the continuous-time dynamic basis matrix of the microscale branch; Based on the QUIC ciphertext timing embedding vector corresponding to the i-th UDP datagram and the arrival time interval of adjacent data packets, a time scale parameter and input mapping parameter that depend on the input step time are generated; The zero-order preservation rule is used to calculate the discretized state transition matrix and the discretized input mapping matrix based on the step-time scale parameter, the continuous-time state parameter matrix, and the input mapping parameter. Based on the discretized state transition matrix and the discretized input mapping matrix, the microscale hidden state vector is updated at the i-th UDP data packet according to the linear time-varying state update equation; In the macro-scale branch, the continuous-time state parameter matrix is ​​set as the continuous-time dynamic basis matrix of the macro-scale branch. The macro-scale update step size is set as a preset positive integer in packets. When the index value of the i-th UDP data packet is divided by the macro-scale update step size, the macro-scale hidden state update is performed. Otherwise, the previous hidden state is kept unchanged, and the updated macro-scale hidden state vector is obtained. Construct a gated fusion unit, and at the i-th UDP data packet, perform weighted fusion of the updated micro-scale hidden state vector and the updated macro-scale hidden state vector to obtain the fused hidden state vector of the i-th UDP data packet. The fused hidden state vectors are stacked row by row according to the index order of the UDP datagrams to construct a high-dimensional temporal hidden state matrix at the QUIC connection level.

8. The QUIC robot detection method based on ensemble learning and sequence modeling according to claim 1, characterized in that, The process of inputting the high-dimensional temporal hidden state matrix of the QUIC connection level and the sub-stream set into the gated routing network includes: Based on the matching score, the first-layer routing is performed to allocate the QUIC connection-level high-dimensional temporal hidden state matrix to the macro-expert set. Within the activated macro-experts, the second-layer routing is used to allocate the QUIC connection-level high-dimensional temporal hidden state matrix to the micro-expert set. A hierarchical sparse activation strategy is adopted to obtain the subdomain discrimination results output by each micro-expert.

9. The QUIC robot detection method based on ensemble learning and sequence modeling according to claim 1, characterized in that, The weighted fusion of the subdomain discrimination results to output a connection-level comprehensive behavior determination vector includes: Perform a weight fusion operation on the subdomain discrimination result set to obtain the connection-level comprehensive behavior judgment vector; Based on the connection-level integrated behavior determination vector, calculate the robot probability value and behavior category label of the target QUIC connection; Set a robot probability threshold. When the robot probability value is greater than the robot probability threshold, obtain the QUIC connection-level high-dimensional temporal hidden state matrix. Based on the high-dimensional temporal hidden state matrix of the QUIC connection level, the packet-by-packet trigger score is calculated to obtain the trigger judgment index range; Construct a judgment result data structure that includes robot probability value, behavior category label, and trigger judgment index range. Output the judgment result data structure to the network security control system, which then executes rate limiting, blocking, or alarm policies based on the judgment result data structure.

Images