A method, device and equipment for monitoring cross-border transmission of encrypted data and a storage medium

Abstract

The application provides a method and device for monitoring cross-border transmission of encrypted data, equipment and a storage medium, wherein original network traffic mirror data is obtained; the original network traffic mirror data is reorganized by sessions to obtain session flows; multi-dimensional encryption behavior features are extracted from the session flows; the multi-dimensional encryption behavior features are input into an encryption behavior recognition model based on a graph-time sequence hybrid architecture to output risk scores corresponding to uploading file behaviors; and cross-border uploading file behaviors of encrypted data are identified according to the risk scores. The above method can improve the accuracy and pertinence of monitoring cross-border transmission of encrypted data.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to a method, apparatus, device, and storage medium for monitoring cross-border transmission of encrypted data. Background Technology

[0002] With the increasing frequency of cross-border network communication, encrypted data has become the main form of cross-border data transmission. Security monitoring of encrypted data transmission across borders is of great significance for preventing illegal data leakage and ensuring data security, and is a basic requirement in the field of network traffic security.

[0003] Currently, the industry's monitoring of cross-border encrypted data transmission only involves monitoring the port number and simple encryption protocol type of network traffic. That is, a few commonly used overseas communication ports and basic encryption protocols are pre-set. When network traffic is detected passing through the preset port and using the preset encryption protocol, it is directly judged as suspected cross-border encrypted data transmission behavior, without any complicated data processing and behavior analysis steps.

[0004] The aforementioned outdated monitoring technology for cross-border encrypted data transmission has a core flaw: it can only identify ports and basic encryption protocols, but cannot distinguish the transmission type of encrypted data, cannot determine whether encrypted traffic is legitimate communication such as normal chatting or browsing, or cross-border file uploads of encrypted data, and cannot identify cross-border uploads using non-preset ports or new, simple encryption protocols. False positives and false negatives are extremely common, and the monitoring accuracy is extremely low, making it fundamentally unable to meet the basic needs for monitoring cross-border encrypted data transmission. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide a method, apparatus, device and storage medium for monitoring cross-border transmission of encrypted data, which can improve the accuracy and targeting of monitoring cross-border transmission of encrypted data.

[0006] In a first aspect, embodiments of this application provide a method for monitoring cross-border transmission of encrypted data, the method comprising: Obtain raw network traffic mirror data; The original network traffic mirror data is reassembled into a session stream. Extract multidimensional encryption behavior features from the session stream; The multidimensional encryption behavior features are input into an encryption behavior recognition model based on a graph-temporal hybrid architecture, and a risk score corresponding to the file upload behavior is output. Based on the risk score, the act of uploading encrypted data across borders was identified.

[0007] Optionally, obtaining the original network traffic mirror data includes: Establish a cross-border encrypted tunnel using OpenVPN to simulate a cross-border network environment; In the cross-border network environment, multiple applications are triggered to upload files. Use Wireshark to perform full traffic mirroring at the gateway and save the raw data packets in PCAP format; The original data packets are tagged with timestamps and session IDs, and irrelevant traffic is removed by filtering rules to obtain the original network traffic mirror data for subsequent session reassembly.

[0008] Optionally, the step of reassembling the original network traffic mirroring data to obtain a session stream includes: Session segmentation is performed on the original data packets based on the five-tuple, and data packets belonging to the same communication process are aggregated into the same session unit. The five-tuple includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol type. A unique session identifier is established for each session unit through hash mapping; A dynamic timeout threshold is set. When the interval between adjacent data packets in the same session unit is greater than the dynamic timeout threshold, the current session is determined to be terminated and the session unit is closed. When a new data packet is detected that matches the five-tuple characteristics of a terminated session, a new session unit is opened for recording. Each session unit that has completed session segmentation and identification is treated as a session flow.

[0009] Optionally, the multidimensional encryption behavior feature includes at least one of the following: Uploaded file size, uploaded file type, uploaded file duration, abnormal time, peak traffic, port number, communication protocol, DNS domain name, high-risk IP, TCP handshake count, packet length sequence entropy, cipher suite type, TLS handshake characteristics, forward security identifier, uplink / downlink data volume ratio, and packet length distribution characteristics.

[0010] Optionally, the step of inputting the multidimensional encryption behavior features into an encryption behavior recognition model based on a graph-temporal hybrid architecture, and outputting a risk score corresponding to the file upload behavior, includes: Construct a graph attention network branch to abstract the network session into a graph structure, where nodes represent IP addresses and edges represent communication flows. Aggregate neighbor node information through a multi-head attention mechanism to generate a graph structure embedding representation. A hybrid expert-temporal encoder branch is constructed, and the time series features of the same communication stream are input into an expert pool composed of multiple feedforward neural network experts. Experts are dynamically selected and features are synthesized through a gating network. Then, the temporal dependencies are captured by the Transformer encoder to generate a temporal embedding representation. The graph structure embedding representation and the temporal embedding representation are concatenated and fused. The risk probability of the file upload behavior is output through a fully connected layer and a Softmax function, which serves as the risk score corresponding to the file upload behavior.

[0011] Optionally, identifying the cross-border file upload behavior of encrypted data based on the risk score includes: The risk score is compared with a preset threshold. If the risk score is greater than or equal to the preset threshold, it is determined that there is encrypted data cross-border file upload behavior in the current session stream; If the risk score is less than the preset threshold, the current session stream is determined to be normal communication behavior, thus completing the identification of encrypted data cross-border file upload behavior.

[0012] Optionally, the method further includes: Based on the risk score, a tiered response strategy is implemented, which includes: When the risk score is greater than or equal to the first threshold, the firewall or NDR system will automatically block the IP or interrupt the session. When the risk score is between the first threshold and the second threshold, an alarm will be pushed to the human-machine collaborative assessment platform for review by security analysts. When the risk score is less than the second threshold, behavioral data is recorded for continuous monitoring and trend analysis, wherein the first threshold is greater than the second threshold. The system collects feedback information generated during the execution of the tiered response strategy and updates the encrypted behavior recognition model through an online distillation mechanism or incremental learning mechanism to optimize subsequent risk scoring output. Secondly, embodiments of this application provide an encrypted data cross-border transmission monitoring device, the device comprising: The mirror data acquisition module is used to acquire raw network traffic mirror data; The session reassembly module is used to reassemble the original network traffic mirroring data to obtain a session stream; A behavior feature extraction module is used to extract multi-dimensional encrypted behavior features from the session stream; The risk score output module is used to input the multi-dimensional encryption behavior features into the encryption behavior recognition model based on graph-temporal hybrid architecture, and output the risk score corresponding to the file upload behavior. The file upload behavior recognition module is used to identify cross-border file upload behavior of encrypted data based on the risk score.

[0013] Optionally, obtaining the original network traffic mirror data includes: Establish a cross-border encrypted tunnel using OpenVPN to simulate a cross-border network environment; In the cross-border network environment, multiple applications are triggered to upload files. Use Wireshark to perform full traffic mirroring at the gateway and save the raw data packets in PCAP format; The original data packets are tagged with timestamps and session IDs, and irrelevant traffic is removed by filtering rules to obtain the original network traffic mirror data for subsequent session reassembly.

[0014] Optionally, the step of reassembling the original network traffic mirroring data to obtain a session stream includes: Session segmentation is performed on the original data packets based on the five-tuple, and data packets belonging to the same communication process are aggregated into the same session unit. The five-tuple includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol type. A unique session identifier is established for each session unit through hash mapping; A dynamic timeout threshold is set. When the interval between adjacent data packets in the same session unit is greater than the dynamic timeout threshold, the current session is determined to be terminated and the session unit is closed. When a new data packet is detected that matches the five-tuple characteristics of a terminated session, a new session unit is opened for recording. Each session unit that has completed session segmentation and identification is treated as a session flow.

[0015] Optionally, the multidimensional encryption behavior feature includes at least one of the following: Uploaded file size, uploaded file type, uploaded file duration, abnormal time, peak traffic, port number, communication protocol, DNS domain name, high-risk IP, TCP handshake count, packet length sequence entropy, cipher suite type, TLS handshake characteristics, forward security identifier, uplink / downlink data volume ratio, and packet length distribution characteristics.

[0016] Optionally, the step of inputting the multidimensional encryption behavior features into an encryption behavior recognition model based on a graph-temporal hybrid architecture, and outputting a risk score corresponding to the file upload behavior, includes: Construct a graph attention network branch to abstract the network session into a graph structure, where nodes represent IP addresses and edges represent communication flows. Aggregate neighbor node information through a multi-head attention mechanism to generate a graph structure embedding representation. A hybrid expert-temporal encoder branch is constructed, and the time series features of the same communication stream are input into an expert pool composed of multiple feedforward neural network experts. Experts are dynamically selected and features are synthesized through a gating network. Then, the temporal dependencies are captured by the Transformer encoder to generate a temporal embedding representation. The graph structure embedding representation and the temporal embedding representation are concatenated and fused. The risk probability of the file upload behavior is output through a fully connected layer and a Softmax function, which serves as the risk score corresponding to the file upload behavior.

[0017] Optionally, identifying the cross-border file upload behavior of encrypted data based on the risk score includes: The risk score is compared with a preset threshold. If the risk score is greater than or equal to the preset threshold, it is determined that there is encrypted data cross-border file upload behavior in the current session stream; If the risk score is less than the preset threshold, the current session stream is determined to be normal communication behavior, thus completing the identification of encrypted data cross-border file upload behavior.

[0018] Optionally, the device further includes: The tiered handling strategy execution module is used to execute tiered handling strategies based on the risk score. The tiered handling strategies include: when the risk score is greater than or equal to a first threshold, automatically blocking IPs or interrupting sessions by linking the firewall or NDR system; when the risk score is between the first threshold and a second threshold, pushing alarms to a human-machine collaborative analysis platform for review by security analysts; and when the risk score is less than the second threshold, recording behavioral data for continuous monitoring and trend analysis, wherein the first threshold is greater than the second threshold. The identification model update module is used to collect the disposal feedback information generated during the execution of the graded disposal strategy, and update the encrypted behavior identification model through an online distillation mechanism or incremental learning mechanism to optimize the subsequent risk score output.

[0019] Thirdly, embodiments of this application provide a computer device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the encrypted data cross-border transmission monitoring method described in any of the optional embodiments of the first aspect are performed.

[0020] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the encrypted data cross-border transmission monitoring method described in any of the optional embodiments of the first aspect.

[0021] The technical solution provided in this application includes, but is not limited to, the following beneficial effects: The step of obtaining raw network traffic mirror data provides a complete and original basic data source for the entire process of monitoring cross-border transmission of encrypted data. This ensures that all subsequent monitoring steps have reliable data support, avoids monitoring deviations caused by missing or fragmented raw data, and solves the problem of non-standard and incomplete data sources in existing outdated monitoring technologies. This lays a solid foundation for the orderly conduct of subsequent monitoring work.

[0022] Session reassembly of raw network traffic mirror data yields session streams, which can aggregate scattered raw data packets into structured session units according to the communication process. This clearly defines the complete process of each network communication, avoids the mixing of data packets from different communication processes, and solves the shortcomings of existing technologies that cannot effectively organize traffic and are difficult to clarify communication logic. This enables subsequent feature extraction and behavior analysis to be carried out on a specific communication process, improving the targeting of monitoring.

[0023] Extracting multidimensional encrypted behavioral features from session streams can overcome the limitations of existing outdated monitoring technologies that can only monitor ports and simple encryption protocols. It can comprehensively capture various behavioral features during the cross-border transmission of encrypted data, fully characterize the specific patterns of encrypted transmission behavior, and provide sufficient and comprehensive feature basis for subsequent behavior identification. This solves the problem that existing technologies have single features and cannot accurately characterize encrypted transmission behavior.

[0024] By inputting multidimensional encrypted behavior features into an encrypted behavior recognition model based on a graph-temporal hybrid architecture, and outputting a risk score corresponding to the file upload behavior, it is possible to achieve quantitative analysis of encrypted data cross-border transmission behavior. This replaces the simple and crude qualitative judgment method in existing technologies, and provides clear quantitative basis for the recognition of encrypted data cross-border file upload behavior, improving the scientificity and accuracy of the recognition results and avoiding the drawbacks of blindly judging based on simple features in existing technologies.

[0025] Based on risk scoring, the system identifies cross-border file uploads of encrypted data. It can accurately distinguish between legitimate encrypted communication and cross-border file uploads of encrypted data based on quantified risk scores, effectively reducing the misjudgments and omissions that are common in existing technologies. It clearly identifies cross-border file uploads of encrypted data that require attention, and solves the core defects of existing technologies that cannot effectively distinguish between types of encrypted transmission behavior and have extremely low monitoring accuracy.

[0026] In summary, the five steps of this invention work in a progressive and synergistic manner, successively solving the problems of incomplete raw data, lack of standardized traffic processing, single feature extraction, crude judgment methods, and low identification accuracy in existing basic and outdated monitoring technologies. Through standardized monitoring processes and precise identification logic, the accuracy and targeting of monitoring encrypted data cross-border transmission are significantly improved, effectively realizing the accurate identification of encrypted data cross-border file upload behavior, meeting the basic needs of encrypted data cross-border transmission monitoring, and making up for the shortcomings of existing technologies.

[0027] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 A flowchart of a method for monitoring encrypted cross-border data transmission provided in Embodiment 1 of this application is shown; Figure 2 A flowchart of a method for obtaining raw network traffic mirror data provided in Embodiment 1 of this application is shown; Figure 3 A flowchart of a session stream generation method provided in Embodiment 1 of this application is shown; Figure 4 This diagram illustrates a temporal distribution of multidimensional encryption behavior features provided in Embodiment 1 of this application; Figure 5 A flowchart of a risk scoring output method provided in Embodiment 1 of this application is shown; Figure 6 The flowchart of a method for recognizing cross-border file upload behavior of encrypted data provided in Embodiment 1 of this application is shown; Figure 7 The flowchart of an encryption behavior recognition model update method provided in Embodiment 1 of this application is shown; Figure 8 This paper presents an overall process architecture diagram of an encrypted data cross-border transmission monitoring system provided in Embodiment 1 of this application; Figure 9 This diagram illustrates the output of a performance evaluation result provided in Embodiment 1 of this application. Figure 10This illustration shows a structural schematic diagram of an encrypted data cross-border transmission monitoring device provided in Embodiment 2 of this application; Figure 11 A schematic diagram of the structure of a computer device provided in Embodiment 3 of this application is shown. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0031] Example 1 To facilitate understanding of this application, the following is combined with... Figure 1 The flowchart illustrating the encrypted data cross-border transmission monitoring method provided in Embodiment 1 of this application will be described in detail for Embodiment 1 of this application.

[0032] See Figure 1 As shown, Figure 1 A flowchart of a method for monitoring cross-border transmission of encrypted data provided in Embodiment 1 of this application is shown, wherein the method includes steps S101 to S105: S101: Obtain raw network traffic mirror data.

[0033] Specifically, this step is the basic data collection stage for cross-border monitoring of encrypted data. It requires building a sample library of encrypted data cross-border transmission behavior according to a standardized process. First, cross-border encrypted tunnels with fixed nodes in the US West Coast and Singapore are built and configured through OpenVPN (Open Virtual Private Network) to simulate a real cross-border network environment. Then, popular applications covering scenarios such as social media, email, and cloud storage are selected to trigger upload operations. At the same time, full traffic mirroring is performed at the gateway using Wireshark. The captured data also needs to be processed to ensure its effectiveness, such as noise reduction, labeling, and data balancing. Finally, complete original traffic mirroring data of popular domestic and foreign tools before and after VPN cross-border transmission is obtained, providing a representative and effective data source for subsequent analysis.

[0034] S102: Perform session reassembly on the original network traffic mirror data to obtain a session stream.

[0035] Specifically, this step employs an improved TCP (Transmission Control Protocol) session reassembly algorithm for the entire process. First, it segments the original data packets into sessions based on a five-tuple consisting of the source IP (Internet Protocol) address, destination IP address, source port number, destination port number, and transport layer protocol type, aggregating data packets belonging to the same communication process into the same session unit. Then, it calculates the hash using the MD5 (Message-Digest Algorithm 5) hash algorithm. A unique hash mapping session identifier is established for each session unit, where A unique hash identifier for the session. The source IP address The destination IP address The source port number. The destination port number, This refers to the transport layer protocol type.

[0036] Simultaneously, a dynamic timeout threshold of 60 seconds is set. When the interval between adjacent data packets in the same session unit exceeds this threshold, the session is determined to be terminated and the unit is closed. If a new data packet is subsequently detected that matches the five-tuple feature of the terminated session, a new session unit record is opened. Furthermore, a three-level filtering mechanism of protocol / IP / port is combined to prioritize TCP protocol sessions, identify TLS (Transport Layer Security) / SSL (Secure Sockets Layer) handshake features, and eliminate irrelevant data from UDP (User Datagram Protocol) and other unreliable transport protocols. Finally, each session unit that has been divided, identified, and filtered is treated as a structured session stream.

[0037] S103: Extract multidimensional encryption behavior features from the session stream.

[0038] Specifically, this step extracts more than 20 core encryption behavior features from multiple levels, including transmission content, timing behavior, network protocols, traffic statistics, security risks, and graph networks. These features cover basic characteristics such as uploaded file size, type, duration, abnormal time, peak traffic, port number, communication protocol, DNS (Domain Name System) domain name, high-risk IP, and TCP handshake count, as well as encryption protocol-specific features and statistical analysis features.

[0039] The encryption protocol handshake features require intercepting and parsing the cipher suite list in the ClientHello and ServerHello messages during the TLS / SSL handshake phase. The encryption algorithm, key exchange algorithm, and message authentication code algorithm should be identified according to the IANA (Internet Assigned Numbers Authority) standard, and the scheme should be compatible with the TLS 1.3 protocol, so that its cipher suite list, encryption extensions, certificate and other information can be extracted normally. The traffic statistics features require calculating the information entropy of the data packet length to analyze the packet length distribution, and at the same time, analyzing the jitter and burstiness of the data packet arrival time interval to extract the temporal behavior pattern.

[0040] It also confirms the forward security identifier by judging whether the key exchange algorithm is a temporary Diffie-Hellman or an elliptic curve variant, and associates the encrypted session with the DNS query domain name and certificate authority information in context. Combined with statistical indicators such as the ratio of uplink to downlink data volume, the variance of the packet length sequence, and the distribution range of packet length, a complete multi-dimensional encryption behavior feature system is formed to provide comprehensive feature support for model input.

[0041] S104: Input the multidimensional encryption behavior features into the encryption behavior recognition model based on graph-temporal hybrid architecture, and output the risk score corresponding to the file upload behavior.

[0042] Specifically, this graph-temporal hybrid architecture consists of a parallel processing GAT (Graph Attention Network) branch and a MOE (Mixture of Experts)-Transformer temporal encoder branch. Ultimately, decision-making is completed through a feature fusion layer. Model training requires a multi-stage continuous optimization loop, including contrastive learning self-supervised pre-training, end-to-end fine training, online distillation, and incremental learning. It can also return a risk score in the range of 0-1 within 200ms through a real-time API (Application Programming Interface), enabling real-time analysis and response. The GAT branch abstracts network sessions as a graph structure. ,in Let be the set of nodes in the graph. Let be the set of edges and nodes of a graph. Represents the source IP and destination IP addresses, side The edges represent communication flows between IPs, and their attributes are feature vectors extracted from the communication flows. A multi-head graph attention mechanism is used via formula By aggregating neighbor node information and learning the embedded representations of nodes, we can obtain a model containing the behavioral patterns of the IP network topology. In this formula, For nodes Embedded representations aggregated through multi-head attention mechanisms This is a vector concatenation operation. For the index of attention head, For the total number of attention heads, For activation function, For nodes The neighbor node index, For nodes The set of all neighboring nodes, For the first Nodes in each attention head For nodes Attention coefficient For the first A trainable weight matrix for each attention head. For nodes The original embedding representation; for the problem of large-scale network IPs with many dynamic changes, traffic is first grouped by individual users, and then a local subgraph model is built for each user to reduce computational costs.

[0043] The MOE-Transformer branch incorporates the time-series characteristics of the same communication stream. As input, it is first sent to... An expert pool consists of several FFNs (Feed-Forward Networks), with experts designing tasks according to network protocols or specific apps / applications, and optimized under human guidance; then, a gating network is used. calculate Output the expert weight distribution and dynamically select the most relevant one. One expert, among whom Input time series features , For the trainable weight matrix of the gated network, The number of experts to be selected. Before taking weights Value operations, It is a soft maximization function; then through Complete expert synthesis, among which To select the expert's index, For the first The weight value of each selected expert. For the first Selected experts input The output of the MOE layer is then fed into a standard Transformer encoder to capture long-term dependencies within the sequence and generate a temporal embedding representation. .

[0044] Feature fusion layer will and Concatenate using the Concat (feature concatenation operation) method. Then input to the fully connected layer and through (Soft maximization function) function calculation The formula outputs the probability value of cross-border file upload behavior, which is the risk score corresponding to the file upload behavior; in this formula, This is the trainable weight matrix for the fully connected layer. This is a matrix multiplication operation. This is the bias term for the fully connected layer; during the model pre-training phase, positive and negative sample pairs are constructed through data augmentation such as random masking and cropping. Learn a general representation of traffic data, among which For the sample Embedded representation, For the sample Positive sample embedding representation, For the sample The negative sample embedding representation, This is the cosine similarity calculation function. For temperature hyperparameters, For sample index, The total number of samples; the labeled dataset is used during the fine training phase, with the cross-entropy loss function. Complete end-to-end training, among which For the number of categories, For category index, For the corresponding category of the sample The true label, For the corresponding category of the sample The predicted probability ensures the model's recognition accuracy.

[0045] S105: Based on the risk score, identify the cross-border file upload behavior of encrypted data.

[0046] Specifically, this step uses risk scoring as the core criterion for judgment, combined with preset thresholds to complete behavior recognition. The preset thresholds are not fixed values, but are derived by domain experts' experience and historical sample communication statistical analysis. They will also be dynamically adjusted according to the actual application scenario and software type / version. The threshold setting takes into account both the model's precision and recall rate to avoid false negatives or false positives.

[0047] Simultaneously, it can combine multi-dimensional behavioral characteristics with abnormal time period correlation analysis results to assist in identification. An analysis plane is constructed with a 24-hour time axis as the horizontal axis and 20+ key features as the vertical axis. By observing the distribution density, frequency and clustering interval of feature markers, suspicious time periods can be located, related features can be identified, and behavioral sequences can be traced. This forms a dual judgment basis with risk scoring, accurately distinguishing between normal communication behavior and encrypted data cross-border file upload behavior.

[0048] In an optional implementation, see Figure 2 As shown, Figure 2 The flowchart illustrates a method for obtaining raw network traffic mirror data according to Embodiment 1 of this application, wherein obtaining raw network traffic mirror data includes steps S201 to S204: S201: Establish a cross-border encrypted tunnel using OpenVPN to simulate a cross-border network environment.

[0049] Specifically, during setup, commonly used overseas fixed nodes are configured to recreate a real cross-border network transmission scenario. The OpenVPN control channel uses the TLSv1.2 protocol, the cipher suite is ECDHE-RSA-AES256-GCM-SHA384, and the certificate authority is Easy-RSA CA. During setup, key information of the TLS handshake will be recorded, including the remote server IP address, port, encryption protocol configuration, etc.

[0050] Traffic mirroring needs to be performed before and after the VPN connection. By comparing the changes in traffic characteristics before and after cross-border transmission, the unique behavioral characteristics of encrypted data cross-border transmission can be discovered. At the same time, the logs will capture warning messages such as "cipher" is present in local config but missing in remote config, providing protocol-level basis for the extraction of encrypted features in subsequent traffic analysis.

[0051] S202: Trigger file upload operations of multiple applications in the cross-border network environment.

[0052] Specifically, popular applications with cross-border transmission characteristics were selected, including Gmail based on SMTP (Simple Mail Transfer Protocol) / IMAP (Internet Message Access Protocol) over TLS, WhatsApp based on a proprietary protocol, WeChat based on HTTPS (Hypertext Transfer Protocol Secure) / a proprietary protocol, and AWS S3 (Amazon Web Services Simple Storage Service) cloud storage tools, covering typical cross-border data transmission scenarios such as social networking, email, and cloud storage.

[0053] By using scripts, different types of files, such as text, images, compressed files, and videos, are uploaded in batches through the aforementioned applications. Each file type contains at least 100 samples to balance the distribution of the dataset. At the same time, metadata for each upload is recorded synchronously, including file size, transmission duration, protocol type, and upload time, providing basic data for subsequent feature annotation and positive / negative sample classification.

[0054] S203: Use Wireshark to perform full traffic mirroring packet capture at the gateway and save the raw packets in PCAP (PacketCapture) format.

[0055] Specifically, a full-traffic mirroring packet capture operation is performed at the gateway to achieve lossless capture of cross-border encrypted data streams. The raw PCAP format data packets contain accurate timestamps, source / destination IP addresses, source / destination ports, protocol types, packet lengths, partial payload information, and complete protocol headers and encrypted payloads.

[0056] The captured traffic covers multiple protocols such as TCP, UDP, and TLSv1.2, and can clearly show the communication endpoints and data transmission process between the local host and the overseas server, providing the most original traffic data for subsequent packet filtering, session reassembly, and feature extraction.

[0057] S204: Add timestamps and session ID tags to the original data packets, and remove irrelevant traffic through filtering rules to obtain the original network traffic mirror data for subsequent session reassembly.

[0058] Specifically, firstly, filtering rules are set according to target IP, port, and protocol to remove traffic unrelated to the upload action, such as system updates and advertising requests, and only retain data streams related to the application's file upload behavior, and only retain valid data packets related to the application's file upload behavior; then, timestamps corrected by the NTP (Network Time Protocol) time synchronization protocol are added to the valid data packets, and standardized raw network traffic mirror data is obtained after data cleaning.

[0059] A rigorous validity assurance mechanism is implemented, including sample labeling, data balancing, and noise control. The above transmission is used as a positive sample, and ordinary chat text transmission is used as a negative sample. Security experts manually review the labels of 10% of the samples to ensure labeling consistency. The ratio of positive to negative samples is adjusted by combining SMOTE (Synthetic Minority Oversampling Technique) with undersampling to avoid model bias. Abnormal sessions with TCP retransmission rates ≥5% and handshake success rates ≤95% are removed through protocol compliance verification to improve data quality. At the same time, duplicate data packets are eliminated based on packet fingerprint characteristics (MD5 hash value). After data cleaning, standardized raw network traffic mirror data is obtained.

[0060] In an optional implementation, see Figure 3 As shown, Figure 3 The flowchart of a session stream generation method provided in Embodiment 1 of this application is shown, wherein the step of reassembling the original network traffic mirror data to obtain a session stream includes steps S301 to S304: S301: Based on the five-tuple, the original data packets are divided into sessions, and data packets belonging to the same communication process are aggregated into the same session unit. The five-tuple includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol type.

[0061] Specifically, the quintuple is the core identifier for dividing network sessions. It can accurately distinguish different network communication processes, ensuring that data packets of the same communication process are aggregated into the same session unit, and that data packets of different communication processes are not mixed up. This lays a structured foundation for subsequent session reassembly and feature extraction. During the division process, a three-level filtering mechanism of protocol / IP / port is combined to prioritize the retention of TCP protocol sessions and filter data packets of UDP and other unreliable transmission protocols.

[0062] S302: Establish a unique session identifier for each session unit through hash mapping.

[0063] Specifically, the MD5 hash algorithm is used to construct a hash mapping table, which is based on the concatenation of five-tuples. As input, calculate to get As a unique session identifier for each session unit, A unique hash identifier for the session. The source IP address The destination IP address The source port number. The destination port number, This identifier represents the transport layer protocol type. It enables precise differentiation, management, and tracing of different session units, avoiding confusion between session units, and providing an identification basis for subsequent session timeout control and abnormal session identification.

[0064] S303: Set a dynamic timeout threshold. When the interval between adjacent data packets in the same session unit is greater than the dynamic timeout threshold, determine that the current session is terminated and close the session unit. When a new data packet is detected that matches the five-tuple characteristics of the terminated session, open a new session unit for recording.

[0065] Specifically, this step preferably uses 60 seconds as the dynamic timeout threshold. This threshold was obtained through testing and statistical analysis in actual network communication scenarios and can accurately determine the termination status of the session. When the session interval exceeds 60 seconds, the communication process is immediately terminated and the corresponding session unit is closed to avoid invalid sessions occupying computing resources.

[0066] If a new data packet is subsequently detected that completely matches the five-tuple characteristics of a terminated session, it indicates that a new communication process has been initiated. At this time, a new session unit will be opened for independent recording to ensure that each session unit corresponds to only one complete communication process, thus guaranteeing the accuracy and independence of the session flow. At the same time, this mechanism adapts to dynamically changing network communication scenarios and is compatible with the IP many-to-one problem in NAT (Network Address Translation) environments.

[0067] S304: Treat each session unit that has completed session segmentation and identification as a session flow.

[0068] Specifically, a session unit that has completed the five-tuple partitioning, hash identifier construction, dynamic timeout determination, and protocol filtering contains a complete data packet sequence of the same network communication process. It has undergone preprocessing such as noise reduction, deduplication, and time synchronization, and has the characteristics of being structured, standardized, and normalized. This type of session unit is defined as a session stream.

[0069] Each session stream is an independent analysis unit, containing all traffic features and metadata of the communication process, which can be directly used for subsequent multi-dimensional encrypted behavior feature extraction. At the same time, the structured design of the session streams significantly reduces the computational cost of subsequent model training and improves the efficiency of feature extraction and behavior recognition.

[0070] In an optional implementation, the multidimensional encryption behavior features include at least one of the following: uploaded file size, uploaded file type, uploaded file duration, abnormal time, peak traffic, port number, communication protocol, DNS domain name, high-risk IP, TCP handshake count, packet length sequence entropy, cipher suite type, TLS handshake features, forward security identifier, uplink / downlink data volume ratio, and packet length distribution features.

[0071] Specifically, these features are systematically divided into six categories: transmission content features, temporal behavior features, network protocol features, traffic statistics features, security risk features, and graph network features. This is a core achievement that has been expanded from the two basic dimensions of "traffic size" and "data transmission frequency" in version 1.0 to more than 20 dimensions through feature engineering. It covers all dimensions of the behavioral features of cross-border transmission of encrypted data and greatly improves the model's ability to perceive and distinguish complex and hidden threats.

[0072] The transmission content characteristics include the size, type, and extension of the uploaded file, which are the basic characteristics for determining file upload behavior; the timing behavior characteristics include upload duration, abnormal times, peak traffic, and number of frequent logins, which can capture the time patterns and abnormal time periods of cross-border transmission; the network protocol characteristics include port number, communication protocol, number of TCP handshakes, cipher suite type, and TLS handshake characteristics, among which the TLS handshake characteristics cover TLS version, handshake process, certificate information, etc., and the cipher suite type is compatible with the parsing requirements of the TLS 1.3 protocol.

[0073] Traffic statistics features include packet length sequence entropy, uplink / downlink data volume ratio, and packet length distribution characteristics. Packet length sequence entropy is obtained by calculating the information entropy of packet length. The packet length entropy of encrypted data streams is significantly higher than that of unencrypted traffic. The uplink / downlink data volume ratio R≥3:1 is the core threshold for determining file upload behavior. A packet length sequence variance greater than 1000 is a positive sample feature, and a length ≤500 bytes is a negative sample feature. Security risk features include DNS domain names, high-risk IPs, and password verification. The matching of DNS domain names and encrypted sessions is based on the Server Name and takes into account time constraints. High-risk IPs are important security indicators for cross-border transmission monitoring.

[0074] The forward security identifier is confirmed by determining whether the key exchange algorithm is a temporary Diffie-Hellman or elliptic curve variant. At the same time, the forward security identifier is contextually associated with DNS query domain name and certificate information to construct a complete profile of encryption behavior. The graph network features are based on IP association degree, communication node centrality and other features extracted by GAT, which can reflect the behavior pattern of IP in the network topology and provide more comprehensive feature input for the model.

[0075] See Figure 4As shown, Figure 4 This diagram illustrates a time-series distribution of multidimensional encrypted behavioral features provided in Embodiment 1 of this application. The diagram uses a 24-hour linear time axis as the horizontal axis, with the time scale evenly distributed to fully cover a natural day monitoring cycle. The vertical axis is arranged with 20+ key behavioral feature fields in a vertical direction, which together form a two-dimensional analysis plane, achieving a clear decoupling and correlation between the time dimension and the feature dimension.

[0076] The vertical axis feature fields shown in the figure are systematically designed, covering multiple categories such as transmission content features, temporal behavior features, network protocol features, and security risk features. Among them, transmission content features include uploaded file size, uploaded file type, uploaded file duration, and uploaded file extension, used to characterize the basic attributes of uploaded files; temporal behavior features include traffic volume, peak traffic volume, number of frequent logins, abnormal times, action recognition results, and data packet length, used to capture the temporal patterns and behavioral patterns of traffic transmission; network protocol features include communication protocol, port number, and number of handshakes, used to reflect the protocol layer characteristics of network communication; and security risk features include DNS domain name, high-risk IP address, and password verification, used to identify potential security risk-related information. Each feature field in the diagram is marked with a solid circle at its corresponding time point. Analysts can make judgments by observing the distribution density, frequency of occurrence, and clustering intervals of the circles on the time axis. This allows them to quickly locate highly suspicious time periods when multiple features such as "uploaded file size," "high-risk IP," and "abnormal time" are densely clustered in the same time period (e.g., 2:00-5:00 AM). They can also analyze the feature fields with abnormal markings in a specific suspicious time period in the vertical direction to determine the combination of key risk features. For example, the simultaneous occurrence of "large file upload," "uncommon port," and "frequent handshake failures" in a certain time period strongly suggests the existence of data leakage attempts. Furthermore, they can track the changes of a specific feature (such as "action recognition result") over time in the horizontal direction to analyze the complete cycle of the start, duration, and end of risky behavior.

[0077] In an optional implementation, see Figure 5 As shown, Figure 5 The flowchart of a risk scoring output method provided in Embodiment 1 of this application is shown. The step of inputting the multidimensional encryption behavior features into an encryption behavior recognition model based on a graph-temporal hybrid architecture and outputting a risk score corresponding to the file upload behavior includes steps S501-S503: S501: Construct a graph attention network branch, abstract the network session into a graph structure, where nodes represent IP addresses and edges represent communication flows. The neighbor node information is aggregated through a multi-head attention mechanism to generate a graph structure embedding representation.

[0078] Specifically, this branch treats both the source and destination IPs involved in network communication as nodes in the graph structure. The actual communication flow between IPs serves as the edge connecting the nodes. Assign a feature vector extracted from the corresponding communication stream to each edge. To construct a graph structure that fits the actual network topology. ,in Let be the set of nodes in the graph. Given the set of edges of a graph, this structure can accurately reflect the communication relationships and behavioral characteristics between IPs.

[0079] The embedding representation of nodes is learned using a multi-head graph attention mechanism, through the formula... By aggregating neighbor node information and learning the embedded representations of nodes, we can obtain a model containing the behavioral patterns of the IP network topology. In this formula, For nodes Embedded representations aggregated through multi-head attention mechanisms This is a vector concatenation operation. For the index of attention head, For the total number of attention heads, For activation function, For nodes The neighbor node index, For nodes The set of all neighboring nodes, For the first Nodes in each attention head For nodes Attention coefficient For the first A trainable weight matrix for each attention head. For nodes The original embedding representation; the multi-head attention mechanism can capture the correlation information between nodes from multiple dimensions, improving the accuracy of the embedding representation.

[0080] To address the high computational cost of the entire graph due to the large number of IP addresses and dynamic changes in large-scale networks, a local subgraph modeling approach based on individual users is adopted. First, network traffic is grouped by individual user, and then a separate local subgraph is constructed for each user. The default daily network usage time for an individual user is assumed to be over ten hours. This approach significantly reduces computational costs without affecting the effectiveness of node embedding representations, ultimately yielding… That is, a graph-structured embedded representation that contains the topological behavior patterns of IP networks.

[0081] S502: Construct a hybrid expert-temporal encoder branch, input the time series features of the same communication stream into an expert pool composed of multiple feedforward neural network experts, dynamically select experts and synthesize features through a gating network, and then capture temporal dependencies through a Transformer encoder to generate a temporal embedding representation.

[0082] Specifically, the expert pool consists of... The system consists of several FFNs (Front-End Networks), with expert roles designed and guided manually. These roles are primarily based on network protocols, but can also be assigned based on specific apps / applications. Each expert optimizes for a specific traffic pattern, accurately capturing the timing characteristics of that pattern. The total number of experts... and dynamic selection quantity The optimal value is set based on the number of network protocols, adapting to the actual needs of scenarios with a fixed number of protocols (a few or a dozen).

[0083] Gated networks This is the core scheduling module of this branch, receiving time-series characteristics of the same communication stream. As input, through the formula Calculate the weight distribution for each expert, and then dynamically select the most relevant experts from highest to lowest weight. Several experts participated in feature extraction, among whom Input time series features , For the trainable weight matrix of the gated network, The number of experts to be selected. Before taking weights Value operations, It is a soft maximization function, which ensures the relevance and effectiveness of feature extraction.

[0084] The expert synthesis phase uses formulas Calculate, select The outputs of each expert are summed in weights, where... To select the expert's index, For the first The weight value of each selected expert. For the first Selected experts input The output results in an intermediate result that integrates the features of multiple experts, which combines the advantages of multiple experts and can cover more traffic patterns.

[0085] The intermediate results from the MOE layer are fed into a standard Transformer encoder, which utilizes its self-attention mechanism to capture long-term dependencies within time-series features, uncovering temporal patterns in the cross-border transmission of encrypted data, and ultimately generating a dataset that reflects the temporal characteristics of the traffic. , i.e., sequential embedding representation.

[0086] S503: The graph structure embedding representation and the temporal embedding representation are concatenated and fused, and the risk probability of the file upload behavior is output through a fully connected layer and a Softmax function as a risk score corresponding to the file upload behavior.

[0087] Specifically, the Concat method is used to concatenate the outputs of the graph attention network branches. and the output of the hybrid expert-time encoder branch The fusion process yields a result that combines graph network features and temporal features. This fusion feature encompasses both the network topology behavior patterns of IP and the temporal behavior patterns of communication flows, providing a more comprehensive feature basis for behavior recognition.

[0088] Will The input is fed into a trainable fully connected layer, where a linear transformation is used to extract the core information from the fused features before it is fed back into the system. Functions through formulas Calculate and output the probability value in the interval 0-1, where This is the trainable weight matrix for the fully connected layer. This is a matrix multiplication operation. This is a bias term for the fully connected layer. This probability value represents the likelihood that the current communication flow is a cross-border file upload behavior, which is the risk score corresponding to the file upload behavior.

[0089] During model training, the fully connected layers are optimized through contrastive learning, self-supervised pre-training, and end-to-end fine training. The function parameters are pre-trained using the InfoNCE loss function. Learn a general representation of traffic data, in which For the sample Embedded representation, For the sample Positive sample embedding representation, For the sample The negative sample embedding representation, This is the cosine similarity calculation function. For temperature hyperparameters, For sample index, The total number of samples; fine training uses the cross-entropy loss function. Optimize classification boundaries, among which For the number of categories, For category index, For the corresponding category of the sample The true label, For the corresponding category of the sample The model predicts probabilities to ensure the accuracy and discriminative power of risk scores. It also supports online distillation and incremental learning to continuously optimize parameters and improve the output accuracy of risk scores.

[0090] In an optional implementation, see Figure 6 As shown, Figure 6 The flowchart of a method for identifying encrypted data cross-border file upload behavior provided in Embodiment 1 of this application is shown, wherein the step of identifying encrypted data cross-border file upload behavior based on the risk score includes steps S601~S603: S601: Compare the risk score with a preset threshold.

[0091] Specifically, the preset threshold is not a single fixed value. It is derived from the practical experience of cybersecurity experts and the communication statistical analysis of historical cross-border transmission samples, taking into full account the differences in traffic characteristics of different application scenarios and different software types.

[0092] The threshold will be dynamically adjusted according to the actual application scenario and software type / version. For example, different threshold standards will be set for social applications such as WhatsApp and WeChat and cloud storage applications such as AWS S3. At the same time, the threshold setting takes into account the precision and recall of the model, so as to avoid missing cross-border upload behavior and reduce false alarms of normal communication behavior, thus ensuring the accuracy of behavior recognition.

[0093] The comparison process also incorporates visualization results of multi-dimensional behavioral characteristics and correlation analysis of abnormal time periods. With risk scoring as the core and feature distribution as an auxiliary, a dual judgment is achieved, improving the reliability of the comparison results.

[0094] S602: If the risk score is greater than or equal to the preset threshold, it is determined that there is encrypted data cross-border file upload behavior in the current session stream.

[0095] Specifically, when the risk score reaches or exceeds the preset threshold, it indicates that the multidimensional encrypted behavior characteristics of the current session flow and the feature matching degree of encrypted data cross-border file upload behavior reach the preset standard, and the model has a high degree of confidence in the judgment of this behavior. At the same time, combined with the feature analysis results, there will be a dense clustering of features such as large file upload, high-risk IP communication, abnormal time transmission, and frequent handshakes, forming double evidence for behavior recognition.

[0096] Once a cross-border file upload is identified, a corresponding tiered handling strategy will be immediately matched based on the specific value of the risk score. At the same time, all characteristic data, risk scores, and judgment results of the session stream will be recorded, generating a detailed security event log to provide data support for subsequent auditing, tracing, and model optimization.

[0097] S603: If the risk score is less than the preset threshold, the current session stream is determined to be normal communication behavior, thus completing the identification of the cross-border file upload behavior of encrypted data.

[0098] Specifically, when the risk score is lower than the preset threshold, it indicates that the traffic characteristics of the current session flow are highly consistent with normal communication behavior (such as text chat and ordinary message transmission), which meets the judgment rules for negative samples. That is, the data packet length is concentrated in the range of ≤500 bytes, the ratio of uplink to downlink data volume is close to 1:1 (tolerance ±20%), the packet interval time conforms to the exponential distribution characteristics, and there are no obvious abnormal characteristics of cross-border file upload behavior.

[0099] Once determined to be normal communication behavior, if the risk score is in the low-risk range, the session's metadata and risk score will be recorded in a long-term database for subsequent trend analysis, model retraining, and continuous monitoring. If the risk score is in the medium-risk range, it will be pushed to a human-machine collaborative assessment platform for review by security analysts to avoid misjudgments caused by new threats or complex legitimate business, thus completing the identification of encrypted data cross-border file upload behavior throughout the entire process.

[0100] In an optional implementation, see Figure 7 As shown, Figure 7 The flowchart of an encryption behavior recognition model update method provided in Embodiment 1 of this application is shown, wherein the method further includes steps S701-S702: S701: Based on the risk score, implement a tiered handling strategy, which includes: when the risk score is greater than or equal to a first threshold, automatically block the IP or interrupt the session in conjunction with the firewall or NDR system; when the risk score is between the first threshold and a second threshold, push the alarm to the human-machine collaborative analysis platform for review by security analysts; when the risk score is less than the second threshold, record behavioral data for continuous monitoring and trend analysis, wherein the first threshold is greater than the second threshold.

[0101] Specifically, this solution preferably sets the first threshold to 0.9 and the second threshold to 0.6. These thresholds are set based on the model's performance evaluation results on the WhatsApp upload action test set. The model's accuracy reaches 0.9815 and recall reaches 1.0000, which can ensure the accuracy of graded handling. Among them, a risk score ≥0.9 is a high-confidence alarm, and the judgment criteria are that the model confidence exceeds 99% and the typical behavioral feature matching degree >95%, corresponding to clear malicious or illegal characteristics, such as large-scale encrypted file transmission to high-risk overseas IPs.

[0102] The system achieves second-level response for handling highly reliable alarms. Within 3 seconds, the system automatically links with the firewall or NDR (Network Detection and Response) system through a predefined API interface to perform IP blocking or session interruption operations. At the same time, all automatic blocking operations generate detailed security event logs, including risk scores, trigger characteristics, timestamps of handling actions, communication flow metadata, etc., to achieve full-process auditing and traceability.

[0103] A risk score of 0.6 or less and less than 0.9 indicates a medium-risk behavior. The criteria for this behavior are the presence of suspicious characteristics but moderate model confidence. It may be a new type of threat or a complex legitimate business, such as encrypted uploads to a well-known cloud service provider's IP outside of working hours. Such alerts will be automatically pushed to the "human-machine collaborative analysis queue". The security analyst console will simultaneously present the main basis for the model's judgment, a feature contribution heatmap, historical IP behavior, and other contextual information.

[0104] Analysts, drawing on their professional experience, make the final judgment on medium-risk behaviors, choosing to "confirm the threat and block," "add to the whitelist," or "mark as requiring continuous monitoring." The judgment feedback serves as a sample for incremental learning, providing labeled data for model optimization. Behaviors with a risk score <0.6 are considered low-risk behaviors, judged by their high similarity to normal business traffic characteristics and low risk. The system will not issue an immediate alert, but will only record the session's metadata and risk score in a long-term database for trend analysis, model retraining, and continuous monitoring, enabling early detection of potential risks.

[0105] The tiered handling strategy forms a complete closed loop from automatic response to manual assessment and continuous monitoring. It adapts to cross-border transmission of encrypted data at different risk levels, balances handling efficiency and assessment accuracy, avoids misjudgments caused by single automatic handling, and can also quickly block high-risk behaviors, reducing the risk of data leakage.

[0106] S702: Collect the handling feedback information generated during the execution of the graded handling strategy, and update the encrypted behavior recognition model through an online distillation mechanism or incremental learning mechanism to optimize the subsequent risk score output.

[0107] Specifically, the feedback information includes binary classification labels for medium-risk behaviors by security analysts (whether it is cross-border file upload behavior), ban results for high-risk behaviors, and long-term monitoring data for low-risk behaviors. The classification labels are based on specific traffic behaviors, such as whether it is file transfer via WeChat, to provide accurate labeled samples for model updates.

[0108] The online distillation mechanism uses the currently deployed best-performing model as the teacher model. This model typically has a more complex structure and stronger representational capabilities. The teacher model infers from real-time traffic data and generates "soft labels." These soft labels are then used to... Introducing temperature parameters into the function According to the formula Obtain, among which For category The probability value of the soft label. For the teacher model, the categories The output value, For temperature hyperparameters, An index for all classification categories. For the teacher model, the categories The output value is higher. This generates a probability distribution that contains more information about the relationships between categories; the student model is the actual deployed inference model, which uses a joint loss function. Optimization was carried out, including To balance the hyperparameters of the two losses, It is the task loss between the student model's prediction results and the true labels. (Kullback-Leibler divergence, relative entropy / Kullback-Leibler divergence) is the KL divergence distillation loss for soft labels between the student and teacher models. For temperature hyperparameters, The output probability distribution of the student model. Online distillation was used to transfer knowledge from the teacher model to the student model by using the soft-label probability distribution of the teacher model, thereby improving the representation ability of the student model.

[0109] The incremental learning mechanism enables the model's capabilities to be "updated daily." The system automatically collects new traffic data and analyst feedback tags every day, and regularly starts the incremental learning process to fine-tune the model using new data. It adopts targeted optimization strategies to avoid catastrophic forgetting of the model and ensures that the model can continuously adapt to new network environments, new application features, and new cross-border transmission methods.

[0110] After the model is updated, its performance will be evaluated using an independent test set. The core evaluation metrics include accuracy, precision, recall, F1-Score, and AUC (Area Under the Curve) score. Detailed classification reports and confusion matrices will be generated to verify the model optimization effect. If the evaluation results do not meet the standards, the parameters will be readjusted and retrained. Only after the standards are met will the model be deployed online to ensure the accuracy and reliability of subsequent risk scoring output.

[0111] Model updates are the core of the system's closed-loop optimization. By combining online distillation and incremental learning mechanisms, the system achieves continuous evolution of model capabilities. The system also plans an intelligent evolution roadmap, which will introduce LLM (Large Language Model) to generate alarm summaries and bilingual security reports. It will also connect with mainstream threat intelligence platforms such as VirusTotal and AlienVault OTX (Open Threat Exchange). Furthermore, it plans to open-source the anonymized detection dataset and benchmark model to promote the improvement of industry technology and further optimize risk scoring output and cross-border behavior monitoring capabilities.

[0112] To better illustrate and understand the encrypted data cross-border transmission monitoring method provided in this application, this application describes the overall process of the encrypted data cross-border transmission monitoring system. See [link to relevant documentation]. Figure 8 As shown, Figure 8 This document illustrates the overall process architecture of an encrypted data cross-border transmission monitoring system provided in Embodiment 1 of this application. It fully demonstrates the entire technical process from data acquisition to closed-loop optimization, covering five core modules: data acquisition source, feature engineering, model training and verification, precise handling, and evaluation feedback. The core features of the system are also highlighted. The data acquisition source module collects traffic from popular domestic and international tools, VPN cross-border traffic before and after, and complete raw data packet captures through the raw traffic acquisition stage. This is then used to obtain raw network traffic mirror data through traffic mirroring. The feature engineering module extracts multi-dimensional encrypted behavioral features through uplink and downlink field analysis, and then constructs feature vectors as model input. The system possesses four core features: real-time response capability, adaptive graph-time series hybrid architecture, continuous model capability evolution, and a closed-loop optimization system, providing support for efficient monitoring and continuous iteration. The model training and verification module uses GAT+... Based on the MOE-Transformer temporal encoder, the AI ​​model is trained after self-supervised pre-training through comparative learning. Online distillation technology and incremental learning mechanisms are used to update the AI ​​model, ultimately outputting a risk score for uploaded file behavior through the AI ​​risk analysis engine. The precise handling module obtains the risk score through a real-time API interface that returns the risk score within 200ms. After risk level assessment, tiered handling is implemented: high-risk scenarios trigger firewall / NDR for second-level blocking; medium-risk scenarios are pushed to human-machine collaborative assessment; and low-risk scenarios undergo continuous monitoring. The evaluation feedback loop module obtains performance indicators through model performance evaluation (including accuracy and precision evaluation), and completes system closed-loop optimization through feedback parameter adjustments, continuously improving monitoring and identification accuracy and handling efficiency.

[0113] To better illustrate and understand the encrypted data cross-border transmission monitoring method provided in this application, this application explains the performance evaluation results of the encrypted data cross-border transmission monitoring method. See [link to relevant documentation]. Figure 9 As shown, Figure 9 This diagram illustrates the output of a performance evaluation result provided in Embodiment 1 of this application. The diagram shows the performance evaluation result of the trained encrypted data cross-border transmission behavior recognition model on an independent test set constructed based on WhatsApp upload action application traffic. The diagram presents the entire process of model prediction and evaluation in text form. The top first indicates "Performing Prediction...", followed by the "New Data Test Results" module, which clearly lists five core performance indicators: Accuracy is 0.9815, indicating that the model's overall classification accuracy for all samples is as high as 98.15%, demonstrating excellent comprehensive performance; Precision is 0.9231, specifically for the model... Of the samples classified as "cross-border upload behavior" (positive class), 92.31% were actually positive, demonstrating the reliability of the model's alerts. The recall rate was 1.0000, indicating that 100% of the genuine "cross-border upload behavior" samples in the test set were successfully identified by the model, achieving zero false negatives. The F1 score was 0.9600, which, as the harmonic mean of precision and recall, comprehensively reflects the model's balanced performance on positive samples. The AUC score was 1.0000, and the area under the receiver operating characteristic curve reached the ideal value, indicating that the model has perfect ranking ability and can completely distinguish between positive samples (cross-border behavior) and negative samples (normal chat).

[0114] The "Detailed Classification Report" module in the diagram further breaks down the model performance, presenting four sub-indicators in tabular form: precision, recall, F1-score, and support. For label 0 (representing "normal chat," the negative class), the precision is 1.00, recall is 0.98, and F1 score is 0.99, corresponding to 42 samples (support). This indicates that the model's judgment of normal behavior is very accurate, with only a very small number of false positives. For label 1 (representing "cross-border upload behavior," the positive class), the precision is 0.92, recall is 1.00, and F1 score is 0.96, corresponding to 12 samples. This confirms the model's "full detection" characteristic of cross-border behavior, while also showing a small number of instances where normal behavior was misclassified as cross-border behavior. Additionally, the accuracy (0.98, total samples 54) and macro scores are also listed. The three aggregate metrics, avg (precision 0.96, recall 0.99, F1 score 0.97, total sample size 54) and weightedavg (precision 0.98, recall 0.98, F1 score 0.98, total sample size 54), comprehensively reflect the overall performance of the model.

[0115] The "Confusion Matrix" module in the diagram visually displays the relationship between the model's prediction results and the true labels in the form of a matrix of [[41, 1], [0, 12]]. The 41 in the upper left corner represents the number of samples that were actually negative and predicted as negative (true negatives), the 1 in the upper right corner represents the number of samples that were actually negative but predicted as positive (false positives), the 0 in the lower left corner represents the number of samples that were actually positive but predicted as negative (false negatives), and the 0 in this item further verifies the model's 100% recall rate. The 12 in the lower right corner represents the number of samples that were actually positive and predicted as positive (true positives). The bottom of the diagram indicates that "prediction results have been saved to: models\test_predictions.csv", indicating that the system not only outputs various evaluation indicators but also completely saves the detailed prediction results for each test sample, ensuring that the evaluation process is auditable and reproducible, and providing direct data support for subsequent error analysis and model iteration optimization.

[0116] Example 2 See Figure 10 As shown, Figure 10 This illustration shows a structural schematic diagram of an encrypted data cross-border transmission monitoring device provided in Embodiment 2 of this application, wherein the device includes: The mirror data acquisition module 1001 is used to acquire raw network traffic mirror data. Session reassembly module 1002 is used to reassemble the original network traffic mirror data to obtain a session stream; The behavior feature extraction module 1003 is used to extract multi-dimensional encrypted behavior features from the session stream; The risk score output module 1004 is used to input the multi-dimensional encryption behavior features into the encryption behavior recognition model based on graph-temporal hybrid architecture, and output the risk score corresponding to the file upload behavior. The file upload behavior recognition module 1005 is used to identify the cross-border file upload behavior of encrypted data based on the risk score.

[0117] In an optional implementation, obtaining the raw network traffic mirroring data includes: Establish a cross-border encrypted tunnel using OpenVPN to simulate a cross-border network environment; In the cross-border network environment, multiple applications are triggered to upload files. Use Wireshark to perform full traffic mirroring at the gateway and save the raw data packets in PCAP format; The original data packets are tagged with timestamps and session IDs, and irrelevant traffic is removed by filtering rules to obtain the original network traffic mirror data for subsequent session reassembly.

[0118] In an optional implementation, the step of reassembling the original network traffic mirroring data to obtain a session stream includes: Session segmentation is performed on the original data packets based on the five-tuple, and data packets belonging to the same communication process are aggregated into the same session unit. The five-tuple includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol type. A unique session identifier is established for each session unit through hash mapping; A dynamic timeout threshold is set. When the interval between adjacent data packets in the same session unit is greater than the dynamic timeout threshold, the current session is determined to be terminated and the session unit is closed. When a new data packet is detected that matches the five-tuple characteristics of a terminated session, a new session unit is opened for recording. Each session unit that has completed session segmentation and identification is treated as a session flow.

[0119] In an optional implementation, the multidimensional cryptographic behavior feature includes at least one of the following: Uploaded file size, uploaded file type, uploaded file duration, abnormal time, peak traffic, port number, communication protocol, DNS domain name, high-risk IP, TCP handshake count, packet length sequence entropy, cipher suite type, TLS handshake characteristics, forward security identifier, uplink / downlink data volume ratio, and packet length distribution characteristics.

[0120] In an optional implementation, the step of inputting the multidimensional encryption behavior features into an encryption behavior recognition model based on a graph-temporal hybrid architecture, and outputting a risk score corresponding to the file upload behavior, includes: Construct a graph attention network branch to abstract the network session into a graph structure, where nodes represent IP addresses and edges represent communication flows. Aggregate neighbor node information through a multi-head attention mechanism to generate a graph structure embedding representation. A hybrid expert-temporal encoder branch is constructed, and the time series features of the same communication stream are input into an expert pool composed of multiple feedforward neural network experts. Experts are dynamically selected and features are synthesized through a gating network. Then, the temporal dependencies are captured by the Transformer encoder to generate a temporal embedding representation. The graph structure embedding representation and the temporal embedding representation are concatenated and fused. The risk probability of the file upload behavior is output through a fully connected layer and a Softmax function, which serves as the risk score corresponding to the file upload behavior.

[0121] In an optional implementation, identifying the act of uploading encrypted data across borders based on the risk score includes: The risk score is compared with a preset threshold. If the risk score is greater than or equal to the preset threshold, it is determined that there is encrypted data cross-border file upload behavior in the current session stream; If the risk score is less than the preset threshold, the current session stream is determined to be normal communication behavior, thus completing the identification of encrypted data cross-border file upload behavior.

[0122] In an optional embodiment, the device further includes: The tiered handling strategy execution module is used to execute tiered handling strategies based on the risk score. The tiered handling strategies include: when the risk score is greater than or equal to a first threshold, automatically blocking IPs or interrupting sessions by linking the firewall or NDR system; when the risk score is between the first threshold and a second threshold, pushing alarms to a human-machine collaborative analysis platform for review by security analysts; and when the risk score is less than the second threshold, recording behavioral data for continuous monitoring and trend analysis, wherein the first threshold is greater than the second threshold. The identification model update module is used to collect the disposal feedback information generated during the execution of the graded disposal strategy, and update the encrypted behavior identification model through an online distillation mechanism or incremental learning mechanism to optimize the subsequent risk score output.

[0123] Example 3 Based on the same application concept, see [link / reference] Figure 11 As shown, Figure 11This illustration shows a structural schematic diagram of a computer device provided in Embodiment 3 of this application, wherein, as shown... Figure 11 As shown, the computer device 1100 provided in Embodiment 3 of this application includes: The computer device 1100 includes a processor 1101, a memory 1102, and a bus 1103. The memory 1102 stores machine-readable instructions that can be executed by the processor 1101. When the computer device 1100 is running, the processor 1101 and the memory 1102 communicate through the bus 1103. When the machine-readable instructions are executed by the processor 1101, they perform the steps of the encrypted data cross-border transmission monitoring method shown in Embodiment 1 above.

[0124] Example 4 Based on the same concept, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the encrypted data cross-border transmission monitoring method described in any of the above embodiments.

[0125] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0126] The computer program product for monitoring cross-border transmission of encrypted data provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments. For specific implementation details, please refer to the method embodiments, which will not be repeated here.

[0127] The encrypted data cross-border transmission monitoring device provided in this application embodiment can be specific hardware on a device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in this application embodiment are the same as those in the foregoing method embodiments. For the sake of brevity, any parts not mentioned in the device embodiment can be referred to the corresponding content in the foregoing method embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can all be referred to the corresponding processes in the above method embodiments, and will not be repeated here.

[0128] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0129] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0130] In addition, the functional units in the embodiments provided in this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0131] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0132] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0133] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The protection scope of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application. All should be covered within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A method for monitoring cross-border transmission of encrypted data, characterized in that, The method includes: Obtain raw network traffic mirror data; The original network traffic mirror data is reassembled into a session stream. Extract multidimensional encryption behavior features from the session stream; The multidimensional encryption behavior features are input into an encryption behavior recognition model based on a graph-temporal hybrid architecture, and a risk score corresponding to the file upload behavior is output. Based on the risk score, the act of uploading encrypted data across borders was identified.

2. The method according to claim 1, characterized in that, The acquisition of raw network traffic mirror data includes: Establish a cross-border encrypted tunnel using OpenVPN to simulate a cross-border network environment; In the cross-border network environment, multiple applications are triggered to upload files. Use Wireshark to perform full traffic mirroring at the gateway and save the raw data packets in PCAP format; The original data packets are tagged with timestamps and session IDs, and irrelevant traffic is removed by filtering rules to obtain the original network traffic mirror data for subsequent session reassembly.

3. The method according to claim 1, characterized in that, The step of reassembling the original network traffic mirror data to obtain a session stream includes: Session segmentation is performed on the original data packets based on the five-tuple, and data packets belonging to the same communication process are aggregated into the same session unit. The five-tuple includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol type. A unique session identifier is established for each session unit through hash mapping; A dynamic timeout threshold is set. When the interval between adjacent data packets in the same session unit is greater than the dynamic timeout threshold, the current session is determined to be terminated and the session unit is closed. When a new data packet is detected that matches the five-tuple characteristics of a terminated session, a new session unit is opened for recording. Each session unit that has completed session segmentation and identification is treated as a session flow.

4. The method according to claim 1, characterized in that, The multidimensional encryption behavior features include at least one of the following: Uploaded file size, uploaded file type, uploaded file duration, abnormal time, peak traffic, port number, communication protocol, DNS domain name, high-risk IP, TCP handshake count, packet length sequence entropy, cipher suite type, TLS handshake characteristics, forward security identifier, uplink / downlink data volume ratio, and packet length distribution characteristics.

5. The method according to claim 1, characterized in that, The process of inputting the multidimensional encryption behavior features into an encryption behavior recognition model based on a graph-temporal hybrid architecture, and outputting a risk score corresponding to the file upload behavior, includes: Construct a graph attention network branch to abstract the network session into a graph structure, where nodes represent IP addresses and edges represent communication flows. Aggregate neighbor node information through a multi-head attention mechanism to generate a graph structure embedding representation. A hybrid expert-temporal encoder branch is constructed, and the time series features of the same communication stream are input into an expert pool composed of multiple feedforward neural network experts. Experts are dynamically selected and features are synthesized through a gating network. Then, the temporal dependencies are captured by the Transformer encoder to generate a temporal embedding representation. The graph structure embedding representation and the temporal embedding representation are concatenated and fused. The risk probability of the file upload behavior is output through a fully connected layer and a Softmax function, which serves as the risk score corresponding to the file upload behavior.

6. The method according to claim 1, characterized in that, The process of identifying cross-border file uploads of encrypted data based on the risk score includes: The risk score is compared with a preset threshold. If the risk score is greater than or equal to the preset threshold, it is determined that there is encrypted data cross-border file upload behavior in the current session stream; If the risk score is less than the preset threshold, the current session stream is determined to be normal communication behavior, thus completing the identification of encrypted data cross-border file upload behavior.

7. The method according to claim 1, characterized in that, The method further includes: Based on the risk score, a tiered response strategy is implemented, which includes: When the risk score is greater than or equal to the first threshold, the firewall or NDR system will automatically block the IP or interrupt the session. When the risk score is between the first threshold and the second threshold, an alarm will be pushed to the human-machine collaborative assessment platform for review by security analysts. When the risk score is less than the second threshold, behavioral data is recorded for continuous monitoring and trend analysis, wherein the first threshold is greater than the second threshold. Collect the handling feedback information generated during the execution of the tiered handling strategy, and update the encrypted behavior recognition model through an online distillation mechanism or incremental learning mechanism to optimize the subsequent risk score output.

8. A device for monitoring cross-border transmission of encrypted data, characterized in that, The device includes: The mirror data acquisition module is used to acquire raw network traffic mirror data; The session reassembly module is used to reassemble the original network traffic mirroring data to obtain a session stream; A behavior feature extraction module is used to extract multi-dimensional encrypted behavior features from the session stream; The risk score output module is used to input the multi-dimensional encryption behavior features into the encryption behavior recognition model based on graph-temporal hybrid architecture, and output the risk score corresponding to the file upload behavior. The file upload behavior recognition module is used to identify cross-border file upload behavior of encrypted data based on the risk score.

9. A computer device, characterized in that, include: The system includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the computer device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, they perform the steps of the encrypted data cross-border transmission monitoring method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the encrypted data cross-border transmission monitoring method as described in any one of claims 1 to 7.

Images