Artificial intelligence-based encrypted communication traffic analysis system and method

Abstract

The application relates to the technical field of communication security management, and discloses an encrypted communication flow analysis system and method based on artificial intelligence, which realizes intelligent and scientific analysis of encrypted communication flow based on a communication transmission protocol by intelligently matching communication transmission protocol communication index characteristic information established by combining artificial intelligence algorithms and standard with target communication encrypted flow application scene communication index characteristic information; realizes accurate analysis of encrypted communication flow based on data integrity by accurately selecting a communication anti-tampering scheme of encrypted communication flow based on target communication encrypted flow application scene communication index characteristic information and scientifically established communication encrypted flow communication anti-tampering scheme communication index characteristic information; improves the intelligence and accuracy of encrypted communication flow monitoring; and improves the security and reliability of network communication.

Description

Technical Field

[0001] This invention relates to the technical field of communication security management, specifically to an artificial intelligence-based encrypted communication traffic analysis system and method. Background Technology

[0002] Encrypted traffic monitoring is a key technology in network security operations, aiming to identify threats and detect anomalies in network traffic carried by encryption protocols such as SSL / TLS. With encrypted traffic accounting for over 95% of internet traffic, more than 90% of malware utilizes HTTPS channels for command and control and data theft. Traditional deep packet inspection and port identification technologies are rendered ineffective due to data encryption, forcing monitoring methods to evolve in two main directions. The first is proactive decryption detection, which involves deploying an SSL decryption proxy on the firewall to decrypt encrypted traffic and perform intrusion prevention, antivirus scanning, and URL filtering, followed by re-encryption and forwarding. This method is highly accurate but consumes significant hardware resources and raises privacy compliance issues. The second is non-decryption detection, which constructs fingerprints based on the external behavioral characteristics of encrypted traffic. Machine learning and deep learning algorithms are used to model and analyze traffic statistics, data packet size distribution, connection patterns, plaintext information during the handshake phase, and JA3 fingerprints, identifying malicious encrypted traffic, hidden tunnels, and illegal proxy tools without cracking the encrypted content. Current encrypted traffic monitoring cannot intelligently match communication transmission protocols and anti-tampering schemes based on the communication indicator characteristics of the encrypted traffic application scenario, reducing the flexibility and intelligence of encrypted traffic monitoring.

[0003] Chinese invention patent application CN118487777A, published on August 13, 2024, discloses a method and system for monitoring and analyzing encrypted traffic in the field of information and communication. The method involves: acquiring raw traffic data; identifying encryption protocols based on the raw traffic data to obtain encrypted traffic and background traffic within the encrypted traffic; performing compliance checks on the encrypted traffic to obtain an abnormal encrypted traffic result set; extracting features from the encrypted traffic, calculating feature values, and combining these feature values ​​to obtain an encrypted traffic feature dataset; and obtaining encrypted traffic analysis results based on the encrypted traffic, background traffic, abnormal encrypted traffic result set, and encrypted traffic feature dataset. However, this technical solution fails to scientifically and autonomously select communication transmission protocols and anti-tampering schemes for the specific usage scenarios of encrypted communication traffic, thus reducing the intelligence of encrypted communication traffic monitoring. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] To address the shortcomings of existing encrypted traffic monitoring methods, which fail to intelligently match communication transmission protocols and anti-tampering schemes based on the communication indicator characteristics of encrypted traffic application scenarios, thus reducing the flexibility and intelligence of encrypted traffic monitoring, this new method aims to achieve the following objectives: accurately analyze encrypted traffic application scenarios, efficiently identify communication indicator characteristics of encrypted traffic application scenarios, intelligently match encrypted traffic communication transmission protocols, scientifically select encrypted traffic anti-tampering schemes, realize the flexibility and intelligence of encrypted traffic monitoring, and improve the security and reliability of network communication.

[0006] (II) Technical Solution

[0007] This invention is achieved through the following technical solution: an artificial intelligence-based encrypted communication traffic analysis method, the method comprising the following steps:

[0008] The system collects attribute feature information of encrypted communication traffic, analyzes and processes the application scenarios of encrypted communication traffic to obtain target encrypted communication traffic application scenario information; identifies and processes the communication indicator features of the encrypted communication traffic application scenarios to obtain target encrypted communication traffic application scenario communication indicator feature information; matches the communication transmission protocols of encrypted communication traffic to obtain target encrypted communication traffic communication transmission protocol information; selects communication anti-tampering schemes for encrypted communication traffic to generate target encrypted communication traffic communication anti-tampering scheme information; and acquires real-time security monitoring information of target encrypted communication traffic and executes real-time security monitoring feedback operations for encrypted communication traffic.

[0009] Preferably, the process of collecting attribute feature information of encrypted communication traffic, analyzing and processing the application scenarios of encrypted communication traffic to obtain target encrypted communication traffic application scenario information, and identifying and processing the communication indicator features of the encrypted communication traffic application scenario to obtain target encrypted communication traffic application scenario communication indicator feature information includes the following steps:

[0010] The network encrypted traffic monitoring platform collects textual descriptions of the usage scenario attributes of target encrypted communication traffic objects online and generates encrypted communication traffic attribute feature information. This information represents the characteristic keywords of the specific usage scenario of the target encrypted communication traffic object. The network encrypted traffic monitoring platform includes any one of the following: Shumo Technology's illegal VPN identification system, QiMingXingChen's illegal VPN identification system, or QiAnXin's illegal VPN identification system.

[0011] Based on the set of communication encrypted traffic attribute feature information and communication encrypted traffic application scenario attribute feature information, the application scenario analysis and processing of communication encrypted traffic is performed to obtain target communication encrypted traffic application scenario information.

[0012] Based on the target communication encrypted traffic application scenario information and the communication indicator feature information set of the communication encrypted traffic application scenario, the communication indicator feature identification processing of the communication encrypted traffic application scenario is performed to obtain the communication indicator feature information of the target communication encrypted traffic application scenario.

[0013] Preferably, the process of analyzing and processing the application scenario of the encrypted communication traffic based on the set of encrypted communication traffic attribute features and application scenario attribute features to obtain the target encrypted communication traffic application scenario information includes the following steps:

[0014] Establish a set of attribute feature information for application scenarios of encrypted communication traffic ,in Indicates the first The communication encrypted traffic application scenario attribute feature information corresponds to various communication encrypted traffic application scenario types, including web browsing application scenarios, online service application scenarios, remote office application scenarios, VPN access application scenarios, electronic payment application scenarios, medical data secure transmission application scenarios, and government and judicial confidential communication application scenarios; the communication encrypted traffic application scenario attribute feature information represents standard communication encrypted traffic usage scenario feature keywords set for different communication encrypted traffic application scenario types;

[0015] The set of attribute features of the encrypted communication traffic and the attribute features of the encrypted communication traffic application scenario. The communication encryption traffic application scenario attribute feature information described in the document The attribute feature information of the encrypted communication traffic is matched to find the application scenario attribute feature information of the encrypted communication traffic that matches the attribute feature information of the encrypted communication traffic. The corresponding text information of the communication encryption traffic application scenario type is used to construct the target communication encryption traffic application scenario information, which includes any one of the following: web browsing application scenario, online service application scenario, remote office application scenario, VPN access application scenario, electronic payment application scenario, medical data secure transmission application scenario, and government and judicial confidential communication application scenario.

[0016] Preferably, the process of identifying communication indicator features of the target encrypted communication traffic application scenario based on the target encrypted communication traffic application scenario information and the set of communication indicator feature information of the encrypted communication traffic application scenario, to obtain the target encrypted communication traffic application scenario communication indicator feature information, includes the following steps:

[0017] Establish a set of communication indicator feature information for application scenarios of encrypted communication traffic ,in Indicates the first This document defines communication indicator characteristics for different types of encrypted traffic application scenarios. These characteristics represent standard encrypted traffic communication indicator requirements set for each scenario. The communication indicator characteristics include requirements for communication latency, security level, bandwidth, throughput, real-time performance, compliance, power consumption, and connectivity.

[0018] The target communication encrypted traffic application scenario information and the communication indicator feature information set of the communication encrypted traffic application scenario are combined. Communication indicator feature information in the application scenarios of encrypted traffic communication described in the article Perform communication encryption traffic application scenario type matching to search for the communication indicator feature information of the target communication encryption traffic application scenario information. The target communication encrypted traffic application scenario communication indicator feature information is generated through data identification. The target communication encrypted traffic application scenario communication indicator feature information includes any one or more of the following: communication latency indicator requirements, communication security level indicator requirements, communication bandwidth indicator requirements, communication throughput indicator requirements, communication real-time indicator requirements, communication compliance indicator requirements, communication equipment power consumption indicator requirements, and communication equipment connectivity indicator requirements.

[0019] Preferably, the process of matching the communication transmission protocol of the encrypted communication traffic to obtain the communication transmission protocol information of the target encrypted communication traffic, and selecting the communication anti-tampering scheme of the encrypted communication traffic to generate the communication anti-tampering scheme information of the target encrypted communication traffic includes the following steps:

[0020] Based on the target communication encrypted traffic application scenario communication indicator feature information and the communication encrypted traffic communication transmission protocol communication indicator feature information set, the communication transmission protocol matching process of the communication encrypted traffic is performed to obtain the target communication encrypted traffic communication transmission protocol information;

[0021] Based on the target communication encrypted traffic application scenario communication indicator feature information and the communication indicator feature information set of the communication encrypted traffic anti-tampering scheme, the communication encrypted traffic anti-tampering scheme selection process is performed to generate target communication encrypted traffic anti-tampering scheme information.

[0022] Preferably, the process of matching the communication transmission protocol of the encrypted communication traffic with the communication indicator feature information set of the target encrypted communication traffic application scenario to obtain the target encrypted communication traffic communication transmission protocol information includes the following steps:

[0023] Establish a set of communication encryption traffic communication transmission protocol communication indicator feature information ,in Indicates the first The communication indicator feature information corresponds to various types of encrypted traffic transmission protocols, including HTTPS, MIME, PGP, IPsec, SSLVPN, TLSVPN, TLS+envelope encryption, and the Chinese national cryptographic algorithm SM. The communication indicator feature information represents the standard encrypted traffic transmission protocol requirements set for different types of encrypted traffic transmission protocols.

[0024] The target communication encrypted traffic application scenario communication indicator feature information is combined with the communication encrypted traffic communication transmission protocol communication indicator feature information set. The communication encryption traffic communication transmission protocol and communication indicator feature information described in the document The system performs communication indicator matching on encrypted traffic to search for communication indicator features of the communication transmission protocol that match the communication indicator features of the target encrypted traffic application scenario. The corresponding encrypted traffic transmission protocol type text information is used to generate target encrypted traffic transmission protocol information through data identification; the specific steps for generating the target encrypted traffic transmission protocol information are as follows:

[0025] Step 2121: Initialization, the communication transmission protocol search Cheetah update in spatial dimension is The set of communication encryption traffic communication transmission protocol communication indicator feature information The position in the search space, and the initial position update formula for the cheetah search using the communication transmission protocol are: In the formula Indicates the communication transmission protocol for searching individual cheetahs. In spatial dimension The set of communication encryption traffic communication transmission protocol communication indicator feature information The location in the search space, , They respectively represent spatial dimensions of The set of communication encryption traffic communication transmission protocol communication indicator feature information The upper and lower bounds of the search space, rand is a random number between 0 and 1, and T represents the maximum number of iterations;

[0026] Step 2122: Complete initialization and execute the search strategy to search for prey. The cheetah will perform a full-range scan or active search within its territory or surrounding area to find prey. The cheetah will use the communication transmission protocol to search for prey within the communication encryption traffic communication transmission protocol communication indicator feature information set. Search the search space for communication indicator feature information of the encrypted communication traffic that matches the communication indicator feature information of the target communication encrypted traffic application scenario. The mathematical description of the search strategy is as follows: In the formula Indicates the communication transmission protocol for searching individual cheetahs. After the (t+1)th iteration, the spatial dimension is The set of communication encryption traffic communication transmission protocol communication indicator feature information The location in the search space, Indicates the communication transmission protocol for searching individual cheetahs. After the t-th iteration, the spatial dimension is The set of communication encryption traffic communication transmission protocol communication indicator feature information The location in the search space, Indicates the communication transmission protocol for searching individual cheetahs. After the t-th iteration, the spatial dimension is... The set of communication encryption traffic communication transmission protocol communication indicator feature information Random numbers that are normally distributed in the search space. Indicates the communication transmission protocol for searching individual cheetahs. After the t-th iteration, the spatial dimension is The set of communication encryption traffic communication transmission protocol communication indicator feature information The search step size in the search space;

[0027] Step 2123: The prey search is performed using a passive strategy. In search mode, the prey is exposed to the cheetah's field of vision via the communication transmission protocol, and the communication indicator feature information set of the communication encryption traffic communication transmission protocol is used. Search the search space for communication indicator feature information of the encrypted communication traffic that matches the communication indicator feature information of the target communication encrypted traffic application scenario. The communication transmission protocol searches the cheetah's every move, which will cause the prey to escape. The cheetah adopts a wait-and-ambush strategy to approach its prey. The wait-and-ambush strategy includes lying on the ground or hiding in bushes. The mathematical description of the strategy is... ;

[0028] Step 2124: Execute the waiting strategy to approach the prey and attack according to the attack strategy. In the algorithm, each cheetah using the communication transmission protocol adjusts its position based on the location of the fleeing prey, the leader cheetah, or nearby cheetahs to obtain the optimal attack position. This is done within the communication encrypted traffic communication transmission protocol communication indicator feature information set. Search the search space to find the communication transmission protocol communication indicator feature information of the communication encrypted traffic that best matches the communication indicator feature information of the target communication encrypted traffic application scenario. The attack strategy is mathematically described as follows: In the formula This indicates that after the t-th iteration of the communication transmission protocol search, the cheetah individual has a spatial dimension of... The set of communication encryption traffic communication transmission protocol communication indicator feature information The best position in the search space; Searching for individual cheetahs using communication transmission protocols In spatial dimension The set of communication encryption traffic communication transmission protocol communication indicator feature information The turning factor in the search space; Indicates the communication transmission protocol for searching individual cheetahs. After the t-th iteration, the spatial dimension is The set of communication encryption traffic communication transmission protocol communication indicator feature information Interaction factors in the search space;

[0029] Step 2125: Repeat steps 2122, 2123, and 2124 until the maximum number of iterations is met. Output the communication indicator feature information of the communication transmission protocol of the encrypted traffic that best matches the communication indicator feature information of the target communication encrypted traffic application scenario. ;

[0030] Step 2126: Based on the communication indicator feature information of the communication transmission protocol of the encrypted traffic that best matches the communication indicator feature information of the target communication encrypted traffic application scenario output in step 2125. The corresponding encrypted traffic transmission protocol type text information is generated by data identification to form target encrypted traffic transmission protocol information. The target encrypted traffic transmission protocol information includes any one of HTTPS, MIME, PGP, IPsec, SSLVPN, TLSVPN, TLS+ envelope encryption, and the national cryptographic SM algorithm.

[0031] Preferably, the process of selecting a communication anti-tampering scheme for the communication encrypted traffic based on the communication indicator feature information of the target communication encrypted traffic application scenario and the communication indicator feature information set of the communication anti-tampering scheme for the communication encrypted traffic, and generating the target communication encrypted traffic communication anti-tampering scheme information, includes the following steps:

[0032] Establish a communication encryption traffic anti-tampering scheme and a set of communication indicator feature information. ,in Indicates the first This document describes the communication indicator characteristics of various communication encryption traffic anti-tampering schemes, including TLS record layer HMAC message verification codes, digital certificate chain authentication, AH authentication headers, IKE key exchange, strong digital signatures + two-factor authentication, FIPS 140-2 compliant MAC algorithms, end-to-end integrity verification, quantum key distribution, digital signatures + audit logs, and national cryptographic digital signatures. The communication indicator characteristics represent the standard communication indicator requirements set for different communication encryption traffic anti-tampering scheme types.

[0033] Similarly, based on the intelligent search algorithm in steps 2121 to 2126, the communication indicator feature information of the target communication encrypted traffic application scenario is compared with the communication indicator feature information set of the communication encrypted traffic anti-tampering scheme. The communication encryption traffic anti-tampering scheme described in the article provides communication indicator feature information. The communication indicator information of the encrypted traffic is matched to find the communication indicator feature information of the anti-tampering scheme for the encrypted traffic that matches the communication indicator feature information of the target encrypted traffic application scenario. The corresponding communication encryption traffic anti-tampering scheme type text information is generated by data identification to produce target communication encryption traffic anti-tampering scheme information; the target communication encryption traffic anti-tampering scheme information includes any one of the following: TLS record layer HMAC message verification code, digital certificate chain authentication, AH authentication header, IKE key exchange, strong digital signature + two-factor authentication, FIPS 140-2 compliant MAC algorithm, end-to-end integrity verification, quantum key distribution, digital signature + audit log, and national cryptographic digital signature.

[0034] Preferably, acquiring real-time security monitoring information of target encrypted communication traffic and performing real-time security monitoring feedback operations for encrypted communication traffic includes the following steps:

[0035] The target communication encrypted traffic application scenario information, the target communication encrypted traffic application scenario communication indicator feature information, the target communication encrypted traffic communication transmission protocol information, and the target communication encrypted traffic communication anti-tampering scheme information are combined and identified to generate real-time security monitoring information for target communication encrypted traffic;

[0036] The real-time security monitoring information of the target communication encrypted traffic is pushed online to the network encrypted traffic supervision platform. The display screen displays the application scenario information, application scenario communication indicator characteristic information, communication transmission protocol information, and communication anti-tampering scheme information of the target communication encrypted traffic object in an orderly manner from top to bottom, thus performing the real-time security monitoring and feedback operation of communication encrypted traffic.

[0037] An AI-based encrypted communication traffic analysis system is used to implement the AI-based encrypted communication traffic analysis method. The system includes a communication encrypted traffic feature localization module, a communication encrypted traffic security monitoring module, and a communication encrypted traffic security monitoring feedback module.

[0038] The communication encrypted traffic feature localization module includes a communication encrypted traffic attribute feature acquisition unit, a communication encrypted traffic application scenario attribute feature storage unit, a communication encrypted traffic application scenario analysis unit, a communication encrypted traffic application scenario communication indicator feature storage unit, and a communication encrypted traffic application scenario communication indicator feature identification unit.

[0039] The communication encrypted traffic attribute feature acquisition unit collects communication encrypted traffic attribute feature information through the network encrypted traffic monitoring platform; the communication encrypted traffic application scenario attribute feature storage unit stores communication encrypted traffic application scenario attribute feature information; the communication encrypted traffic application scenario analysis unit performs application scenario analysis processing on the communication encrypted traffic based on the communication encrypted traffic attribute feature information and the communication encrypted traffic application scenario attribute feature information to obtain target communication encrypted traffic application scenario information; the communication encrypted traffic application scenario communication indicator feature storage unit stores communication encrypted traffic application scenario communication indicator feature information; the communication encrypted traffic application scenario communication indicator feature identification unit performs communication indicator feature identification processing on the communication encrypted traffic application scenario based on the target communication encrypted traffic application scenario information and the communication encrypted traffic application scenario communication indicator feature information to obtain target communication encrypted traffic application scenario communication indicator feature information.

[0040] The communication encrypted traffic security monitoring module includes a communication encrypted traffic communication transmission protocol communication indicator feature storage unit, a communication encrypted traffic communication transmission protocol matching unit, a communication encrypted traffic communication anti-tampering scheme communication indicator feature storage unit, and a communication encrypted traffic communication anti-tampering scheme selection unit.

[0041] The communication encrypted traffic communication transmission protocol communication indicator feature storage unit is used to store communication encrypted traffic communication transmission protocol communication indicator feature information; the communication encrypted traffic communication transmission protocol matching unit performs communication transmission protocol matching processing on the communication encrypted traffic based on the target communication encrypted traffic application scenario communication indicator feature information and the communication encrypted traffic communication transmission protocol communication indicator feature information to obtain target communication encrypted traffic communication transmission protocol information; the communication encrypted traffic communication anti-tampering scheme communication indicator feature storage unit is used to store communication encrypted traffic communication anti-tampering scheme communication indicator feature information; the communication encrypted traffic communication anti-tampering scheme selection unit performs communication anti-tampering scheme selection processing on the target communication encrypted traffic application scenario communication indicator feature information and the communication encrypted traffic communication anti-tampering scheme communication indicator feature information to generate target communication encrypted traffic communication anti-tampering scheme information;

[0042] The communication encrypted traffic security monitoring and feedback module includes a communication encrypted traffic real-time security monitoring result acquisition unit and a communication encrypted traffic real-time security monitoring result feedback unit.

[0043] The real-time security monitoring result acquisition unit for encrypted communication traffic acquires real-time security monitoring information for encrypted communication traffic based on the target encrypted communication traffic application scenario information, the target encrypted communication traffic application scenario communication indicator characteristic information, the target encrypted communication traffic communication transmission protocol information, and the target encrypted communication traffic anti-tampering scheme information, and combines data processing. The real-time security monitoring result feedback unit for encrypted communication traffic performs real-time security monitoring feedback operations for encrypted communication traffic based on the target encrypted communication traffic real-time security monitoring information and in conjunction with the network encrypted traffic monitoring platform and the display screen.

[0044] (III) Beneficial Effects

[0045] This invention provides an encrypted communication traffic analysis system and method based on artificial intelligence. It has the following beneficial effects:

[0046] I. Real-time collection of encrypted communication traffic attribute and characteristic information through a network encrypted traffic monitoring platform provides scientific data support for refined analysis of encrypted communication traffic application scenarios; accurate analysis of encrypted communication traffic application scenarios is achieved based on encrypted communication traffic attribute and characteristic information combined with data analysis and standards-based encrypted communication traffic application scenario attribute and characteristic information, enabling in-depth analysis of encrypted communication traffic based on application scenarios; efficient and accurate analysis of encrypted communication traffic application scenario communication indicator characteristics is achieved based on target encrypted communication traffic application scenario information combined with data analysis and big data-based encrypted communication traffic application scenario communication indicator and characteristic information, thereby improving the quality of encrypted communication traffic monitoring.

[0047] Second, based on the communication indicator characteristics of the target encrypted traffic application scenario, combined with artificial intelligence algorithms and standards to establish communication transmission protocol characteristics, intelligent matching of communication encrypted traffic transmission protocols is performed to achieve intelligent and scientific analysis of encrypted traffic based on communication transmission protocols. Furthermore, based on the communication indicator characteristics of the target encrypted traffic application scenario, combined with artificial intelligence algorithms and scientifically established communication anti-tampering schemes, precise selection of communication anti-tampering schemes for encrypted traffic is achieved, enabling accurate analysis of encrypted traffic based on data integrity, improving the intelligence and accuracy of encrypted traffic monitoring, and enhancing the security and reliability of network communication.

[0048] Third, based on the target communication encrypted traffic application scenario information, target communication encrypted traffic application scenario communication indicator characteristic information, target communication encrypted traffic communication transmission protocol information, and target communication encrypted traffic anti-tampering scheme information, and combined with data processing, the real-time security monitoring information of the target communication encrypted traffic is obtained securely and efficiently. At the same time, based on the real-time security monitoring information of the target communication encrypted traffic, and combined with the network encrypted traffic supervision platform and display screen, the real-time security monitoring feedback operation of the communication encrypted traffic is performed, realizing the efficient collection and visualization output of the communication encrypted traffic monitoring results, and improving the intuitiveness of communication encrypted traffic monitoring. Attached Figure Description

[0049] Fig. 1 A schematic diagram of the modules of the AI-based encrypted communication traffic analysis system provided by the present invention;

[0050] Fig. 2 A flowchart of the AI-based encrypted communication traffic analysis method provided by the present invention. Detailed Implementation

[0051] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0052] An embodiment of the AI-based encrypted communication traffic analysis system and method is as follows:

[0053] Example 1:

[0054] Please see Figs. 1-2 An AI-based method for analyzing encrypted communication traffic, comprising the following steps:

[0055] The system collects attribute feature information of encrypted communication traffic, analyzes and processes the application scenarios of encrypted communication traffic to obtain target encrypted communication traffic application scenario information; identifies and processes the communication indicator features of the encrypted communication traffic application scenarios to obtain target encrypted communication traffic application scenario communication indicator feature information; matches the communication transmission protocols of encrypted communication traffic to obtain target encrypted communication traffic communication transmission protocol information; selects communication anti-tampering schemes for encrypted communication traffic to generate target encrypted communication traffic communication anti-tampering scheme information; and acquires real-time security monitoring information of target encrypted communication traffic and executes real-time security monitoring feedback operations for encrypted communication traffic.

[0056] For further details, please refer to Figs. 1-2 The process involves collecting attribute feature information of encrypted communication traffic, analyzing and processing the application scenarios of encrypted communication traffic to obtain target encrypted communication traffic application scenario information, and identifying and processing the communication indicator features of the encrypted communication traffic application scenario to obtain target encrypted communication traffic application scenario communication indicator feature information. This includes the following steps:

[0057] Step 11: Collect the usage scenario attribute feature description text information of the target encrypted communication traffic object online through the network encrypted traffic monitoring platform, and generate communication encrypted traffic attribute feature information. The communication encrypted traffic attribute feature information represents the characteristic keywords of the specific usage scenario of the target encrypted communication traffic object; the network encrypted traffic monitoring platform includes any one of the following: Shumo Technology's illegal VPN identification system, QiMingXingChen's illegal VPN identification system, and QiAnXin's illegal VPN identification system;

[0058] Step 12: Based on the set of attribute feature information of encrypted communication traffic and attribute feature information of application scenario of encrypted communication traffic, perform application scenario analysis and processing of encrypted communication traffic to obtain application scenario information of target encrypted communication traffic;

[0059] Step 13: Based on the target communication encrypted traffic application scenario information and the communication indicator feature information set of the communication encrypted traffic application scenario, perform communication indicator feature identification processing of the communication encrypted traffic application scenario to obtain the communication indicator feature information of the target communication encrypted traffic application scenario.

[0060] The application scenario analysis and processing of encrypted communication traffic based on the set of attribute feature information and application scenario feature information of encrypted communication traffic to obtain the target encrypted communication traffic application scenario information includes the following steps:

[0061] Step 121: Establish a set of attribute feature information for communication encryption traffic application scenarios. ,in Indicates the first The communication encrypted traffic application scenario attribute feature information corresponds to the various communication encrypted traffic application scenario types, which include web browsing application scenarios, online service application scenarios, remote office application scenarios, VPN access application scenarios, electronic payment application scenarios, medical data secure transmission application scenarios, and government and judicial confidential communication application scenarios; the communication encrypted traffic application scenario attribute feature information represents the standard communication encrypted traffic usage scenario feature keywords set for different communication encrypted traffic application scenario types;

[0062] Step 122: Combine the attribute feature information of encrypted communication traffic with the attribute feature information of encrypted communication traffic application scenarios. Application scenario attribute characteristics information of encrypted traffic in China Communications Perform attribute feature matching on encrypted communication traffic to search for application scenario attribute feature information of encrypted communication traffic that matches the attribute feature information of encrypted communication traffic. The corresponding text information of the application scenario type of encrypted communication traffic is used to construct the target encrypted communication traffic application scenario information. The target encrypted communication traffic application scenario information includes any one of the following: web browsing application scenario, online service application scenario, remote office application scenario, VPN access application scenario, electronic payment application scenario, medical data secure transmission application scenario, and government and judicial confidential communication application scenario.

[0063] Based on the target communication encrypted traffic application scenario information and the communication indicator feature information set of the communication encrypted traffic application scenario, the communication indicator feature identification processing of the communication encrypted traffic application scenario is performed to obtain the target communication encrypted traffic application scenario communication indicator feature information, including the following steps:

[0064] Step 131: Establish a set of communication indicator feature information for communication encryption traffic application scenarios. ,in Indicates the first This document describes the communication indicator characteristics of various encrypted traffic application scenarios. These characteristics represent the standard encrypted traffic communication indicator requirements set for different encrypted traffic application scenario types. The communication indicator characteristics include requirements for communication latency, security level, bandwidth, throughput, real-time performance, compliance, power consumption, and connectivity of the encrypted traffic application scenario.

[0065] Step 132: Combine the target communication encrypted traffic application scenario information with the communication indicator feature information set of the communication encrypted traffic application scenario. Communication metrics and characteristics information in the application scenarios of encrypted traffic in China. Perform matching of application scenario type information for encrypted communication traffic, and search for communication indicator feature information of the target encrypted communication traffic application scenario. The target communication encrypted traffic application scenario communication indicator feature information is generated through data identification. The target communication encrypted traffic application scenario communication indicator feature information includes any one or more of the following: communication latency indicator requirements, communication security level indicator requirements, communication bandwidth indicator requirements, communication throughput indicator requirements, communication real-time indicator requirements, communication compliance indicator requirements, communication equipment power consumption indicator requirements, and communication equipment connectivity indicator requirements.

[0066] The network encrypted traffic monitoring platform collects real-time attribute and characteristic information of encrypted communication traffic, providing scientific data support for the refined analysis of encrypted communication traffic application scenarios. Based on the attribute and characteristic information of encrypted communication traffic, combined with data analysis and standard-based application scenario attribute and characteristic information, accurate analysis of encrypted communication traffic application scenarios is achieved, enabling in-depth analysis of encrypted communication traffic based on application scenarios. Furthermore, based on the target encrypted communication traffic application scenario information, combined with data analysis and communication indicator characteristic information of encrypted communication traffic application scenarios established based on big data, the communication indicator characteristics of encrypted communication traffic application scenarios are efficiently and accurately analyzed, enabling refined analysis of encrypted communication traffic based on application scenario communication indicator characteristics and improving the quality of encrypted communication traffic monitoring.

[0067] For further details, please refer to Figs. 1-2 The process involves matching the communication transmission protocol of the encrypted communication traffic to obtain the communication transmission protocol information of the target encrypted communication traffic; and selecting a communication anti-tampering scheme for the encrypted communication traffic to generate the communication anti-tampering scheme information of the target encrypted communication traffic, including the following steps:

[0068] Step 21: Based on the target communication encrypted traffic application scenario communication indicator feature information and the communication encrypted traffic communication transmission protocol communication indicator feature information set, perform communication transmission protocol matching processing on the communication encrypted traffic to obtain the target communication encrypted traffic communication transmission protocol information.

[0069] Step 22: Based on the target communication encrypted traffic application scenario communication indicator feature information and the communication indicator feature information set of the communication encrypted traffic anti-tampering scheme, perform communication anti-tampering scheme selection processing for the communication encrypted traffic to generate target communication encrypted traffic anti-tampering scheme information.

[0070] The process of matching the communication transmission protocol of the encrypted traffic with the communication indicator feature information of the target encrypted traffic application scenario and the communication transmission protocol feature information of the encrypted traffic to obtain the communication transmission protocol information of the target encrypted traffic includes the following steps:

[0071] Step 211: Establish a set of communication encryption traffic transmission protocol communication indicator feature information. ,in Indicates the first This document describes the communication indicator characteristics of various encrypted traffic transmission protocol types, including HTTPS, MIME, PGP, IPsec, SSLVPN, TLSVPN, TLS+envelope encryption, and the Chinese national cryptographic algorithm SM. The communication indicator characteristics also represent the standard encrypted traffic communication indicator requirements set for different encrypted traffic transmission protocol types.

[0072] Step 212: Combine the target communication encrypted traffic application scenario communication indicator feature information with the communication encrypted traffic communication transmission protocol communication indicator feature information set. China Communications Encrypted Traffic Communication Transmission Protocol Communication Indicator Feature Information This involves matching encrypted traffic with communication metrics to find encrypted traffic communication transmission protocols that match the communication metrics characteristics of the target encrypted traffic application scenario. The corresponding encrypted traffic transmission protocol type text information is used to generate target encrypted traffic transmission protocol information after data identification. The specific steps for generating target encrypted traffic transmission protocol information are as follows:

[0073] Step 2121: Initialization, the communication transmission protocol search Cheetah update in spatial dimension is Communication encryption traffic communication transmission protocol communication indicator feature information set The position in the search space, and the initial position update formula for the cheetah search using the communication transmission protocol are: In the formula Indicates the communication transmission protocol for searching individual cheetahs. In spatial dimension Communication encryption traffic communication transmission protocol communication indicator feature information set The location in the search space, , They respectively represent spatial dimensions of Communication encryption traffic communication transmission protocol communication indicator feature information set The upper and lower bounds of the search space, rand is a random number between 0 and 1, and T represents the maximum number of iterations;

[0074] Step 2122: Complete initialization and execute the search strategy to search for prey. The cheetah will conduct a full-range scan or active search within its territory or surrounding area to find prey. The cheetah will also use the communication transmission protocol to search for encrypted traffic, communication transmission protocol, and communication indicator feature information sets. Search the search space for communication encrypted traffic, communication transmission protocols, and communication indicator characteristics that match the target communication encrypted traffic application scenario. The mathematical description of the search strategy is as follows: In the formula Indicates the communication transmission protocol for searching individual cheetahs. After the (t+1)th iteration, the spatial dimension is Communication encryption traffic communication transmission protocol communication indicator feature information set The location in the search space, Indicates the communication transmission protocol for searching individual cheetahs. After the t-th iteration, the spatial dimension is Communication encryption traffic communication transmission protocol communication indicator feature information set The location in the search space, Indicates the communication transmission protocol for searching individual cheetahs. After the t-th iteration, the spatial dimension is... Communication encryption traffic communication transmission protocol communication indicator feature information set Random numbers that are normally distributed in the search space. Indicates the communication transmission protocol for searching individual cheetahs. After the t-th iteration, the spatial dimension is Communication encryption traffic communication transmission protocol communication indicator feature information set The search step size in the search space;

[0075] Step 2123: The prey search is performed using a passive strategy. In search mode, the prey is exposed to the cheetah's field of vision via the communication transmission protocol, and the search is conducted using a set of communication indicators and feature information related to the encrypted traffic and communication transmission protocol. Search the search space for communication encrypted traffic, communication transmission protocols, and communication indicator characteristics that match the target communication encrypted traffic application scenario. The communication transmission protocol searches the cheetah's every move, which will cause the prey to escape. The cheetah adopts a wait-and-ambush strategy to approach its prey. The wait-and-ambush strategy includes lying on the ground or hiding in bushes. The mathematical description of the strategy is... ;

[0076] Step 2124: Execute the waiting strategy to approach the prey and attack according to the attack strategy. In the algorithm, each cheetah using the communication transmission protocol adjusts its position based on the location of the fleeing prey, the leader cheetah, or nearby cheetahs to obtain the optimal attack position. This is done within the communication encryption traffic, communication transmission protocol, and communication indicator feature information set. Search the search space to find the communication encrypted traffic, communication transmission protocol, and communication indicator feature information that best match the target communication encrypted traffic application scenario. The attack strategy is mathematically described as follows: In the formula This indicates that after the t-th iteration of the communication transmission protocol search, the cheetah individual has a spatial dimension of... Communication encryption traffic communication transmission protocol communication indicator feature information set The best position in the search space; Searching for individual cheetahs using communication transmission protocols In spatial dimension Communication encryption traffic communication transmission protocol communication indicator feature information set The turning factor in the search space; Indicates the communication transmission protocol for searching individual cheetahs. After the t-th iteration, the spatial dimension is Communication encryption traffic communication transmission protocol communication indicator feature information set Interaction factors in the search space;

[0077] Step 2125: Repeat steps 2122, 2123, and 2124 until the maximum number of iterations is met. Output the communication encrypted traffic communication transmission protocol communication indicator characteristic information that best matches the communication indicator characteristic information of the target communication encrypted traffic application scenario. ;

[0078] Step 2126: Based on the communication indicator feature information of the encrypted traffic output in step 2125 that best matches the target communication encrypted traffic application scenario, the communication transmission protocol communication indicator feature information is determined. The corresponding encrypted traffic transmission protocol type text information is generated by data identification to produce target encrypted traffic transmission protocol information. The target encrypted traffic transmission protocol information includes any one of HTTPS, MIME, PGP, IPsec, SSLVPN, TLSVPN, TLS+ envelope encryption, and the national cryptographic SM algorithm.

[0079] Based on the target communication encrypted traffic application scenario communication indicator feature information and the communication indicator feature information set of the communication encrypted traffic anti-tampering scheme, the communication encrypted traffic anti-tampering scheme selection process is performed to generate target communication encrypted traffic anti-tampering scheme information, including the following steps:

[0080] Step 221: Establish a set of communication indicator feature information for the communication encryption traffic anti-tampering scheme. ,in Indicates the first This document describes the communication indicator characteristics of various communication encryption traffic anti-tampering schemes, including TLS record layer HMAC message verification codes, digital certificate chain authentication, AH authentication headers, IKE key exchange, strong digital signatures + two-factor authentication, FIPS 140-2 compliant MAC algorithms, end-to-end integrity verification, quantum key distribution, digital signatures + audit logs, and national cryptographic digital signatures. The communication indicator characteristics also represent the standard communication indicator requirements set for different communication encryption traffic anti-tampering scheme types.

[0081] Step 222: Similarly, based on the intelligent search algorithm in steps 2121 to 2126, the target communication encrypted traffic application scenario communication indicator feature information and the communication encrypted traffic anti-tampering scheme communication indicator feature information set are combined. China Communications Encrypted Traffic Communication Anti-Tampering Solution Communication Indicator Feature Information The system performs communication indicator matching on encrypted traffic to search for communication indicator features that match the target encrypted traffic application scenario's communication indicator characteristics. The corresponding text information of the communication encryption traffic anti-tampering scheme type is generated by data identification to produce the target communication encryption traffic anti-tampering scheme information; the target communication encryption traffic anti-tampering scheme information includes any one of the following: TLS record layer HMAC message verification code, digital certificate chain authentication, AH authentication header, IKE key exchange, strong digital signature + two-factor authentication, FIPS 140-2 compliant MAC algorithm, end-to-end integrity verification, quantum key distribution, digital signature + audit log, and national cryptographic digital signature.

[0082] Based on the communication indicator characteristics of the target encrypted traffic application scenario, combined with artificial intelligence algorithms and standards to establish communication transmission protocol characteristics, intelligent matching of communication transmission protocols for encrypted traffic is achieved, enabling intelligent and scientific analysis of encrypted traffic based on communication transmission protocols. Furthermore, based on the communication indicator characteristics of the target encrypted traffic application scenario, combined with artificial intelligence algorithms and scientifically established communication anti-tampering schemes for encrypted traffic, precise selection of communication anti-tampering schemes for encrypted traffic is achieved, enabling accurate analysis of encrypted traffic based on data integrity, improving the intelligence and accuracy of encrypted traffic monitoring, and enhancing the security and reliability of network communication.

[0083] For further details, please refer to Figs. 1-2 The process of acquiring real-time security monitoring information of target encrypted communication traffic and executing real-time security monitoring feedback tasks for encrypted communication traffic includes the following steps:

[0084] Step 31: Combine and identify the target communication encrypted traffic application scenario information, target communication encrypted traffic application scenario communication indicator characteristic information, target communication encrypted traffic communication transmission protocol information, and target communication encrypted traffic communication anti-tampering scheme information to generate target communication encrypted traffic real-time security monitoring information.

[0085] Step 32: Push the real-time security monitoring information of the target communication encrypted traffic online to the network encrypted traffic monitoring platform, and display the application scenario information, application scenario communication indicator characteristic information, communication transmission protocol information and communication anti-tampering scheme information of the target communication encrypted traffic object in an orderly manner from top to bottom to perform the real-time security monitoring feedback operation of communication encrypted traffic.

[0086] Based on the target communication encrypted traffic application scenario information, target communication encrypted traffic application scenario communication indicator characteristic information, target communication encrypted traffic communication transmission protocol information, and target communication encrypted traffic anti-tampering scheme information, and combined with data processing, the real-time security monitoring information of the target communication encrypted traffic is obtained securely and efficiently. At the same time, based on the real-time security monitoring information of the target communication encrypted traffic, and combined with the network encrypted traffic monitoring platform and display screen, the real-time security monitoring feedback operation of the communication encrypted traffic is performed, realizing the efficient collection and visualization output of the communication encrypted traffic monitoring results, and improving the intuitiveness of communication encrypted traffic monitoring.

[0087] Example 2:

[0088] Please see Figs. 1-2 An AI-based encrypted communication traffic analysis system is used to implement an AI-based encrypted communication traffic analysis method. The system includes a communication encrypted traffic feature localization module, a communication encrypted traffic security monitoring module, and a communication encrypted traffic security monitoring feedback module.

[0089] The communication encrypted traffic feature localization module includes a communication encrypted traffic attribute feature acquisition unit, a communication encrypted traffic application scenario attribute feature storage unit, a communication encrypted traffic application scenario analysis unit, a communication encrypted traffic application scenario communication indicator feature storage unit, and a communication encrypted traffic application scenario communication indicator feature identification unit.

[0090] The system includes: a communication encrypted traffic attribute feature acquisition unit, which collects communication encrypted traffic attribute feature information through a network encrypted traffic monitoring platform; a communication encrypted traffic application scenario attribute feature storage unit, which stores communication encrypted traffic application scenario attribute feature information; a communication encrypted traffic application scenario analysis unit, which performs application scenario analysis processing on communication encrypted traffic based on the communication encrypted traffic attribute feature information and the communication encrypted traffic application scenario attribute feature information to obtain target communication encrypted traffic application scenario information; a communication encrypted traffic application scenario communication indicator feature storage unit, which stores communication encrypted traffic application scenario communication indicator feature information; and a communication encrypted traffic application scenario communication indicator feature identification unit, which performs communication indicator feature identification processing on the communication encrypted traffic application scenario based on the target communication encrypted traffic application scenario information and the communication encrypted traffic application scenario communication indicator feature information to obtain target communication encrypted traffic application scenario communication indicator feature information.

[0091] The communication encrypted traffic security monitoring module includes a communication encrypted traffic communication transmission protocol communication indicator feature storage unit, a communication encrypted traffic communication transmission protocol matching unit, a communication encrypted traffic communication anti-tampering scheme communication indicator feature storage unit, and a communication encrypted traffic communication anti-tampering scheme selection unit;

[0092] The system includes: a communication encrypted traffic communication transmission protocol communication indicator feature storage unit for storing communication encrypted traffic communication transmission protocol communication indicator feature information; a communication encrypted traffic communication transmission protocol matching unit for performing communication encrypted traffic communication transmission protocol matching processing based on the target communication encrypted traffic application scenario communication indicator feature information and the communication encrypted traffic communication transmission protocol communication indicator feature information to obtain target communication encrypted traffic communication transmission protocol information; a communication encrypted traffic communication anti-tampering scheme communication indicator feature storage unit for storing communication encrypted traffic communication anti-tampering scheme communication indicator feature information; and a communication encrypted traffic communication anti-tampering scheme selection unit for performing communication encrypted traffic communication anti-tampering scheme selection processing based on the target communication encrypted traffic application scenario communication indicator feature information and the communication encrypted traffic communication anti-tampering scheme communication indicator feature information to generate target communication encrypted traffic communication anti-tampering scheme information.

[0093] The communication encrypted traffic security monitoring and feedback module includes a communication encrypted traffic real-time security monitoring result acquisition unit and a communication encrypted traffic real-time security monitoring result feedback unit.

[0094] The real-time security monitoring result acquisition unit for encrypted communication traffic acquires real-time security monitoring information for encrypted communication traffic based on the target encrypted communication traffic application scenario information, the target encrypted communication traffic application scenario communication indicator characteristic information, the target encrypted communication traffic communication transmission protocol information, and the target encrypted communication traffic anti-tampering scheme information, and combines data processing. The real-time security monitoring result feedback unit for encrypted communication traffic performs real-time security monitoring feedback operations based on the target encrypted communication traffic real-time security monitoring information and in conjunction with the network encrypted traffic monitoring platform and display screen.

[0095] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for analyzing encrypted communication traffic based on artificial intelligence, characterized in that, The method includes the following steps: Collect attribute feature information of encrypted communication traffic, analyze and process the application scenarios of encrypted communication traffic to obtain target encrypted communication traffic application scenario information; identify and process the communication indicator features of the encrypted communication traffic application scenario to obtain target encrypted communication traffic application scenario communication indicator feature information. The communication transmission protocol of the encrypted communication traffic is matched to obtain the communication transmission protocol information of the target encrypted communication traffic; the communication anti-tampering scheme of the encrypted communication traffic is selected to generate the communication anti-tampering scheme information of the target encrypted communication traffic. Acquire real-time security monitoring information of target encrypted communication traffic and execute real-time security monitoring feedback tasks for encrypted communication traffic.

2. The method for analyzing encrypted communication traffic based on artificial intelligence according to claim 1, characterized in that: Collect attribute feature information of encrypted communication traffic, analyze and process the application scenarios of encrypted communication traffic, and obtain application scenario information of target encrypted communication traffic; The process of identifying and processing communication indicator characteristics in encrypted communication traffic application scenarios to obtain communication indicator characteristic information for the target encrypted communication traffic application scenario includes the following steps: The network encrypted traffic monitoring platform collects textual descriptions of the usage scenarios and attributes of target encrypted communication traffic objects online, and generates attribute feature information for encrypted communication traffic. Based on the set of communication encrypted traffic attribute feature information and communication encrypted traffic application scenario attribute feature information, the application scenario analysis and processing of communication encrypted traffic is performed to obtain target communication encrypted traffic application scenario information. Based on the target communication encrypted traffic application scenario information and the communication indicator feature information set of the communication encrypted traffic application scenario, the communication indicator feature identification processing of the communication encrypted traffic application scenario is performed to obtain the communication indicator feature information of the target communication encrypted traffic application scenario.

3. The method for analyzing encrypted communication traffic based on artificial intelligence according to claim 2, characterized in that: Based on the set of attribute features of encrypted communication traffic and attribute features of encrypted communication traffic, the application scenario analysis and processing of encrypted communication traffic is performed to obtain the target encrypted communication traffic application scenario information, including the following steps: Establish a set of attribute feature information for application scenarios of encrypted communication traffic The include ;in Indicates the first The attribute and characteristic information of the communication encryption traffic application scenario corresponding to the various communication encryption traffic application scenario types; The communication encrypted traffic attribute feature information and the The above Perform attribute feature matching on encrypted communication traffic to search for traffic that matches the attribute feature information of the encrypted communication traffic. The corresponding text information of the application scenario type of encrypted communication traffic is used to construct the target encrypted communication traffic application scenario information.

4. The method for analyzing encrypted communication traffic based on artificial intelligence according to claim 3, characterized in that: The process of identifying communication indicator features of the target encrypted communication traffic application scenario based on the target encrypted communication traffic application scenario application scenario information and the set of communication indicator feature information of the encrypted communication traffic application scenario includes the following steps: Establish a set of communication indicator feature information for application scenarios of encrypted communication traffic The include ;in Indicates the first Communication indicator feature information corresponding to various types of communication encrypted traffic application scenarios; The target communication encrypted traffic application scenario information and the The above Perform communication encryption traffic application scenario type matching to search for the target communication encryption traffic application scenario information corresponding to the specified application scenario. The target communication encrypted traffic application scenario communication indicator feature information is generated through data identification.

5. The method for analyzing encrypted communication traffic based on artificial intelligence according to claim 4, characterized in that: The process of matching the communication transmission protocol of encrypted communication traffic to obtain the communication transmission protocol information of the target encrypted communication traffic, and selecting the communication anti-tampering scheme of encrypted communication traffic to generate the communication anti-tampering scheme information of the target encrypted communication traffic includes the following steps: Based on the target communication encrypted traffic application scenario communication indicator feature information and the communication encrypted traffic communication transmission protocol communication indicator feature information set, the communication transmission protocol matching process of the communication encrypted traffic is performed to obtain the target communication encrypted traffic communication transmission protocol information; Based on the target communication encrypted traffic application scenario communication indicator feature information and the communication indicator feature information set of the communication encrypted traffic anti-tampering scheme, the communication encrypted traffic anti-tampering scheme selection process is performed to generate target communication encrypted traffic anti-tampering scheme information.

6. The method for analyzing encrypted communication traffic based on artificial intelligence according to claim 5, characterized in that: The process of matching the communication transmission protocol of the encrypted communication traffic with the communication indicator feature information of the target encrypted communication traffic application scenario and the communication indicator feature information of the encrypted communication traffic communication transmission protocol to obtain the target encrypted communication traffic communication transmission protocol information includes the following steps: Establish a set of communication encryption traffic communication transmission protocol communication indicator feature information The include ;in Indicates the first Communication indicator feature information corresponding to various types of encrypted traffic communication transmission protocols; The target communication encrypted traffic application scenario communication indicator feature information and the... The above The system performs communication indicator matching on encrypted traffic to search for communication indicator features that match the target encrypted traffic application scenario. The corresponding encrypted traffic transmission protocol type text information is used to generate target encrypted traffic transmission protocol information through data identification; the specific steps for generating the target encrypted traffic transmission protocol information are as follows: Step 2121: Initialization, the communication transmission protocol search Cheetah update in spatial dimension is The above The position in the search space; Step 2122: Complete initialization and execute the search strategy to search for prey. The cheetah will perform a full-range scan or active search within its territory or surrounding area to find prey. The cheetah will use the communication transmission protocol to search for prey. Search the search space to find the communication indicator feature information that matches the target communication encrypted traffic application scenario. ; Step 2123: The prey search is performed using a passive strategy. In search mode, the prey is exposed to the cheetah's field of vision via the communication transmission protocol. Search the search space to find the communication indicator feature information that matches the target communication encrypted traffic application scenario. The communication transmission protocol searches that every move of the cheetah will cause the prey to escape. The cheetah adopts a wait-and-ambush strategy to approach its prey. The wait-and-ambush strategy includes lying on the ground or hiding in the bushes. Step 2124: Execute the waiting strategy to approach the prey and attack according to the attack strategy. In the algorithm, each cheetah using the communication transmission protocol adjusts its position based on the location of the fleeing prey, the leader cheetah using the communication transmission protocol, or nearby cheetahs using the communication transmission protocol, to obtain the optimal attack position. Search the search space to find the communication indicator feature information that best matches the target communication encrypted traffic application scenario. ; Step 2125: Repeat steps 2122, 2123, and 2124 until the maximum number of iterations is met, and output the communication indicator feature information that best matches the target communication encryption traffic application scenario. ; Step 2126: Based on the communication indicator feature information that best matches the target communication encryption traffic application scenario output in step 2125... The corresponding encrypted traffic communication transmission protocol type text information is generated by data identification to produce target encrypted traffic communication transmission protocol information.

7. The method for analyzing encrypted communication traffic based on artificial intelligence according to claim 6, characterized in that: Based on the target communication encrypted traffic application scenario communication indicator feature information and the communication indicator feature information set of the communication encrypted traffic anti-tampering scheme, the communication encrypted traffic anti-tampering scheme selection process is performed to generate target communication encrypted traffic anti-tampering scheme information, including the following steps: Establish a communication encryption traffic anti-tampering scheme and a set of communication indicator feature information. The include ;in Indicates the first Communication indicator characteristic information of communication encryption traffic anti-tampering schemes corresponding to various communication encryption traffic anti-tampering scheme types; Similarly, based on the intelligent search algorithm in steps 2121 to 2126, the target communication encrypted traffic application scenario communication indicator feature information is compared with the... The above The system performs communication indicator matching on encrypted traffic to search for communication indicator features that match the target encrypted traffic application scenario. The corresponding communication encryption traffic anti-tampering scheme type text information is generated by data identification to produce target communication encryption traffic anti-tampering scheme information.

8. The method for analyzing encrypted communication traffic based on artificial intelligence according to claim 7, characterized in that: Obtaining real-time security monitoring information of target encrypted communication traffic and executing real-time security monitoring feedback tasks for encrypted communication traffic includes the following steps: The target communication encrypted traffic application scenario information, the target communication encrypted traffic application scenario communication indicator feature information, the target communication encrypted traffic communication transmission protocol information, and the target communication encrypted traffic communication anti-tampering scheme information are combined and identified to generate real-time security monitoring information for target communication encrypted traffic; The real-time security monitoring information of the target communication encrypted traffic is pushed online to the network encrypted traffic supervision platform. The display screen displays the application scenario information, application scenario communication indicator characteristic information, communication transmission protocol information, and communication anti-tampering scheme information of the target communication encrypted traffic object in an orderly manner from top to bottom, thus performing the real-time security monitoring and feedback operation of communication encrypted traffic.

9. An AI-based encrypted communication traffic analysis system, used to implement the AI-based encrypted communication traffic analysis method according to any one of claims 1-8, characterized in that: The system includes a communication encrypted traffic feature location module, a communication encrypted traffic security monitoring module, and a communication encrypted traffic security monitoring feedback module; The communication encrypted traffic feature localization module is used to collect communication encrypted traffic attribute feature information, analyze and process the application scenarios of communication encrypted traffic, and obtain target communication encrypted traffic application scenario information. The communication indicator characteristics of the target encrypted communication traffic application scenario are identified and processed to obtain the communication indicator characteristic information of the target encrypted communication traffic application scenario. The communication encryption traffic security monitoring module performs matching processing on the communication transmission protocol of the communication encryption traffic to obtain the communication transmission protocol information of the target communication encryption traffic; and performs selection processing on the communication anti-tampering scheme of the communication encryption traffic to generate communication anti-tampering scheme information of the target communication encryption traffic. The communication encrypted traffic security monitoring and feedback module acquires real-time security monitoring information of the target communication encrypted traffic and performs real-time security monitoring and feedback operations for communication encrypted traffic.

Images