A High-Security Network Gateway Control Method and System Based on Message Parsing

Abstract

This application relates to the field of information technology, specifically to a high-security network gateway control method and system based on packet parsing. The method includes: parsing network data packets to obtain traffic behavior characteristics; binding the identified traffic behavior characteristics to generate a traffic identifier containing a source IP address, destination IP address, port, and traffic behavior characteristics; continuously parsing subsequent arriving data packets to obtain traffic behavior characteristics and matching them with stored traffic identifiers; updating the traffic behavior characteristics in the traffic identifier using newly identified traffic behavior characteristics to obtain an evolution sequence of the traffic identifier over time and associating it with a preset risk level; issuing a preliminary alarm when a new traffic behavior characteristic appears; obtaining the correlation degree between the new traffic behavior characteristic corresponding to the preliminary alarm and the evolution sequence, and further processing the preliminary alarm based on the correlation degree and the risk level.

Description

Technical Field

[0001] This application relates to the field of information technology, specifically to a high-security network gateway control method and system based on message parsing. Background Technology

[0002] With the continuous evolution of cyberattack methods, network perimeter security faces increasingly severe challenges. As a critical node for interaction between internal and external networks, the security of the network gateway's control methods directly affects the stability and reliability of the entire network system. Traditional gateway security control methods mainly rely on static access control lists (ACLs), deep packet inspection (DPI), and signature-based intrusion detection systems (IDS). These methods have good identification capabilities for known attack patterns, but they are difficult to effectively deal with new threats such as zero-day attacks, polymorphic attacks, and slow, stealthy attacks.

[0003] In recent years, detection methods based on traffic behavior analysis have gradually gained attention. These methods establish a baseline of normal traffic by extracting statistical features such as packet length, arrival interval, and connection frequency, and then identify anomalies accordingly. However, most existing solutions only analyze traffic characteristics independently within a single time window, ignoring the dynamic evolution of traffic behavior over time for the same communication pair (source IP, destination IP, port). This results in insufficient ability to identify gradual anomalies (such as slow scanning, low-rate DDoS, and slow deformation of tunnel traffic). Furthermore, using a uniform risk assessment strategy for traffic from different application types (such as web browsing, file transfer, and tunnel proxies) fails to dynamically adjust risk levels based on the vulnerability of the application itself and the importance of the business. Therefore, further research is needed on network gateway security control technologies. Summary of the Invention

[0004] This specification describes a highly secure network gateway control method and system based on message parsing through several embodiments.

[0005] Firstly, embodiments of this specification provide a high-security network gateway control method based on message parsing, including the following steps:

[0006] Parse network data packets to obtain traffic behavior characteristics, and extract source IP address, destination IP address and port;

[0007] The identified traffic behavior features are bound to the extracted source IP address, destination IP address, and port to generate a traffic identifier that includes the source IP address, destination IP address, port, and traffic behavior features.

[0008] The system continuously parses subsequent incoming data packets to obtain traffic behavior characteristics, and matches the extracted source IP address, destination IP address, and port with the stored traffic identifier.

[0009] The newly identified traffic behavior features are used to update the traffic behavior features in the traffic identifier to obtain the evolution sequence of the traffic identifier over time under the same source IP address, destination IP address and port, and a preset risk level is associated with the evolution sequence.

[0010] When new traffic behavior characteristics appear in the evolution sequence, an initial alarm is issued;

[0011] Obtain the correlation between the new traffic behavior characteristics and the evolution sequence corresponding to the initial alarm, and perform further processing on the initial alarm based on the correlation and the risk level. The further processing includes one or more of the following: alarming, ignoring the initial alarm, and updating the risk level.

[0012] Secondly, embodiments of this specification provide a high-security network gateway control system based on message parsing, including:

[0013] The parsing module parses network data packets to obtain traffic behavior characteristics and extracts source IP address, destination IP address, and port.

[0014] The identification module binds the identified traffic behavior characteristics with the extracted source IP address, destination IP address, and port to generate a traffic identifier that includes the source IP address, destination IP address, port, and traffic behavior characteristics.

[0015] The identification module continuously parses subsequent incoming data packets to obtain traffic behavior characteristics, and matches the extracted source IP address, destination IP address and port with the stored traffic identifier;

[0016] The judgment module updates the traffic behavior features in the traffic identifier using the newly identified traffic behavior features, obtains the evolution sequence of the traffic identifier over time under the same source IP address, destination IP address and port, and associates the preset risk level with the evolution sequence.

[0017] The alarm module issues a preliminary alarm when new traffic behavior characteristics appear in the evolution sequence;

[0018] The processing module obtains the correlation between the new traffic behavior characteristics and the evolution sequence corresponding to the initial alarm, and performs further processing on the initial alarm based on the correlation and the risk level. The further processing includes one or more of the following: alarming, ignoring the initial alarm, and updating the risk level.

[0019] Thirdly, embodiments of this specification provide an electronic device, including a processor and a memory;

[0020] The processor is connected to the memory;

[0021] The memory is used to store executable program code;

[0022] The processor runs a program corresponding to the executable program code stored in the memory to perform the method described in any of the above aspects.

[0023] Fourthly, embodiments of this specification provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the methods described in any of the above aspects.

[0024] Fifthly, embodiments of this specification provide a computer program product, including a computer program that, when executed by a processor, implements the methods described in any of the above aspects.

[0025] The beneficial effects of the technical solutions provided in some embodiments of this specification include at least the following:

[0026] In several embodiments of this specification, the high-security network gateway control method and system based on packet parsing provided bind traffic behavior characteristics with source IP, destination IP and port to form traffic identifiers, and continuously track the evolution sequence of behavior characteristics under the same identifier. This can characterize the long-term behavior profile of each network session, quickly discover hidden abnormal traffic that deviates from historical behavior patterns or newly emerging covert attacks, and improve the detection sensitivity to advanced persistent threats and unknown attacks.

[0027] By differentiating the handling of initial alerts—whether to trigger, ignore, or update risk levels—it is possible to effectively distinguish between normal business fluctuations and genuine attack behavior, reducing false alarm rates. Dynamically adjusting risk levels prevents the oversight of escalating attacks due to the continuous ignoring of low-risk anomalies.

[0028] By quantifying the degree of deviation between new behavioral characteristics and historical sequences, and combining it with risk benchmark levels based on application type differences, risk assessment becomes more in line with the actual network environment, overcoming the shortcomings of traditional static threshold alarms that lack context awareness.

[0029] Other features and advantages of various embodiments of this specification will be further revealed in the following detailed description and accompanying drawings. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this specification, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1This is a schematic diagram of the high-security network gateway control provided in this manual.

[0032] Figure 2 This is a flowchart illustrating the high-security network gateway control method provided in this manual.

[0033] Figure 3 This is a schematic diagram of the method for updating traffic behavior characteristics provided in this specification.

[0034] Figure 4 This is a schematic diagram of the high-security network gateway control system provided in this manual.

[0035] Figure 5 This is a schematic diagram of the electronic device provided in this manual. Detailed Implementation

[0036] The technical solutions of the embodiments of this specification will be explained and described below with reference to the accompanying drawings. However, the following embodiments are only preferred embodiments of this specification and not all of them. Other embodiments obtained by those skilled in the art based on the embodiments in the implementation methods without creative effort are all within the protection scope of this specification.

[0037] The terms "first," "second," "third," etc., in the description, claims, and accompanying drawings are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to such processes, methods, products, or apparatus.

[0038] In the following description, terms such as “inner,” “outer,” “upper,” “lower,” “left,” and “right” are used only to facilitate the description of the embodiments and to simplify the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this specification.

[0039] All data involved in this application are information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0040] Before introducing the technical solutions described in this manual, the application scenarios and related technologies of the technical solutions will be introduced.

[0041] As cyberattacks become increasingly sophisticated and covert, traditional network security gateways, relying primarily on signature matching or static threshold rules for threat detection, are struggling to effectively identify advanced persistent threats (APTs), internal data theft, slow scanning, and other hidden anomalies. These attacks often bypass defenses by altering traffic behavior patterns, incorporating new behavioral characteristics with subtle deviations from historical patterns into normal business traffic. Existing technologies lack the ability to create long-term behavioral profiles based on sessions. Most current traffic analysis methods perform isolated analysis of statistical characteristics within a single time window, failing to bind traffic behavior characteristics to specific source IPs, destination IPs, and ports for long-term tracking, and thus unable to construct an evolutionary sequence over time for each communication session. This results in an inability to characterize the baseline and evolutionary trend of normal behavior, making it prone to misjudgment when normal business changes slowly, and highly susceptible to missed detection when attacks penetrate in a gradual manner.

[0042] When a new traffic behavior feature 21 is detected, the existing solution usually triggers an alarm directly without considering the correlation between the new feature and the current session's historical behavior sequence, nor does it take into account the session's existing risk level 14 for comprehensive judgment. This results in a large number of new features caused by normal business fluctuations (such as new applications, changes in working hours, etc.) being falsely alarmed, leading to severe alarm fatigue.

[0043] Existing gateway control methods typically apply a uniform risk assessment standard to all traffic, failing to set differentiated risk benchmarks based on the actual application type carried by the traffic (such as web browsing, file transfer, video streaming, etc.) and also failing to provide a calculation method that can objectively quantify the correlation between emerging behavioral characteristics and evolutionary sequences. This results in risk assessment results being out of touch with the actual network environment, and insufficient accuracy and adaptability of security control.

[0044] This manual provides a high-security network gateway control method and system based on message parsing. Please refer to the appendix. Figure 1 By performing deep analysis of network packets, traffic behavior features 12 are extracted and bound to source IP, destination IP and port to form traffic identifiers 13. The evolution sequence of behavior features under the same identifier is continuously tracked. Combined with the risk level 14 associated with the evolution sequence, when a new behavior feature appears, a preliminary alarm 22 is issued first, then the correlation between the new feature and the evolution sequence is calculated. Finally, based on the correlation and risk level 14, a decision is made on whether to issue a formal alarm, ignore the preliminary alarm 22, or upgrade the current risk level 14.

[0045] Specifically, this manual first provides a high-security network gateway control method based on message parsing; please refer to the appendix. Figure 2 The steps include:

[0046] Step S1: Parse the network data packet 11 to obtain traffic behavior characteristics 12, and extract the source IP address, destination IP address and port.

[0047] The methods for parsing network data packets 11 to obtain traffic behavior characteristics 12 include:

[0048] Extract the 5-tuple information, message length, message arrival timestamp, TCP flags, or application layer protocol type from each data packet.

[0049] Aggregate and statistically analyze packets under the same source IP address, destination IP address, and port according to a fixed time window to obtain a preset number of statistical quantities; the statistical quantities are the average packet length and its variance, the average interval time of packet arrival and the coefficient of variation of the interval time, the number of packets and bytes per unit time, the number of retransmissions or the proportion of zero-window packets during the connection establishment phase, the application layer protocol identification result, or the hash value of key payload fields.

[0050] The multiple statistics are converted into feature vectors and normalized to a uniform numerical range, which serve as the traffic behavior feature 12.

[0051] For each data packet, extract its five-tuple information (source IP address, source port, destination IP address, destination port, and transport layer protocol), and also extract fields such as packet length, packet arrival timestamp, TCP flags, or application layer protocol type. For example, from a packet carrying an HTTPS request, we can extract the source IP address 192.168.1.50, destination IP address 203.0.113.20, source port 54321, destination port 443, protocol TCP, packet length 1460 bytes, arrival timestamp at a microsecond level, TCP flags ACK+PSH, and the application layer protocol identified as TLS.

[0052] Packets with the same source IP address, destination IP address, and port (e.g., all pointing to 192.168.1.50: any port -> 203.0.113.20:443) are aggregated and statistically analyzed within a fixed time window (e.g., 60 seconds). Several preset statistics are calculated to form a multi-dimensional description of traffic behavior within that time window. These statistics include, but are not limited to: average packet length and its variance (reflecting the distribution of payload size), average packet arrival interval and its coefficient of variation (reflecting the regularity of communication rhythm), number of packets and bytes per unit time (reflecting communication intensity), number of retransmissions or proportion of zero-window packets during connection establishment (reflecting transmission quality and congestion status), application layer protocol identification results (e.g., HTTP, TLS, DNS, SMTP, unknown protocols, etc.), and hash values ​​of key payload fields (used to detect changes in payload content).

[0053] Taking office document transmission traffic as an example, within a 60-second time window, a total of 80 TCP packets occurred between the source IP address 192.168.1.50 and the destination IP address 203.0.113.20 on port 443. Statistics show an average packet length of 850 bytes and a variance of 120; an average packet arrival interval of 0.03 seconds and a coefficient of variation of 0.15; 80 packets per unit time and a total of 68,000 bytes; no SYN retransmissions occurred during the TCP connection establishment phase, and the proportion of zero-window packets was 0; the application layer protocol identification result was TLS; and the hash values ​​of key payload fields remained stable. These statistics collectively depict the traffic within this window as characterized by moderate packet length, a relatively regular communication rhythm, and no abnormal transmission quality.

[0054] After obtaining the statistics, they are combined into a feature vector and uniformly normalized to the [0,1] value range. During normalization, the maximum and minimum values ​​can be scaled according to the preset typical value range of each statistic, such as dividing the average message length by 1500, the variance by 1000, the average interval time by 0.1, and the number of messages by 5000, etc. The normalized feature vector serves as the traffic behavior feature of this time window.12

[0055] Step S2: Bind the identified traffic behavior feature 12 with the extracted source IP address, destination IP address and port to generate a traffic identifier 13 containing the source IP address, destination IP address, port and traffic behavior feature 12.

[0056] The method for binding the identified traffic behavior feature 12 with the extracted source IP address, destination IP address, and port to generate a traffic identifier 13 containing the source IP address, destination IP address, port, and traffic behavior feature 12 includes:

[0057] The source IP address, destination IP address, and port are used as identifiers respectively;

[0058] Cluster analysis or rule matching is performed on multiple statistics in the traffic behavior feature 12 to identify the behavior type of the current traffic; the behavior type includes at least one of interactive service type, large file transfer type, tunnel proxy type, scanning and detection type, and heartbeat keep-alive type.

[0059] For each type of behavior, a set of key features is preset, and the statistics listed in the set of key features are used as the key features of that type of traffic;

[0060] When generating traffic identifier 13, for key features belonging to the set of key features, the original numerical values ​​or original feature vectors are fully stored.

[0061] For non-critical features that do not belong to the set of key features, a summary compression method is used to generate compressed codes for storage.

[0062] The behavior type, the key features stored in full, and the non-key features after compression and encoding are associated with an identifier and then encapsulated into a traffic identifier 13.

[0063] The source IP address, destination IP address, and port are used as identifiers to collectively define a unique network session or connection. By performing clustering analysis or rule matching on multiple statistics included in traffic behavior characteristics 12 (such as average packet length, packet arrival interval, and traffic per unit time), the behavior type of the current traffic can be identified.

[0064] Behavioral types such as:

[0065] Interactive service types, such as SSH remote login or online games, are typically characterized by frequent small packet interactions with short and stable message intervals.

[0066] Large file transfer types, such as FTP downloads, are characterized by consistently high throughput, large message lengths, and minimal variation.

[0067] Scanning probe types: such as port scanning, characterized by sending a small number of probe packets to a large number of different ports in a short period of time, with a high connection establishment failure rate.

[0068] For each of the predefined behavior types mentioned above, a set of key features is defined. These features include crucial statistics that best represent the nature of that type of traffic. For example, for "heartbeat keep-alive" traffic, the key features might be "average interval between packet arrivals" and "average packet length," because this type of traffic typically sends extremely small data packets at a fixed frequency.

[0069] A differentiated storage strategy was used to optimize efficiency when generating the final traffic identifier 13:

[0070] Key features: These are the statistics belonging to the "focused feature set," which are stored in their original numerical values ​​or original feature vectors. This ensures that the information used for core judgments is not distorted.

[0071] Non-critical features: These are other statistical quantities that are not the focus of this behavior type. They are then compressed and encoded using a summary compression method before being stored. This method sacrifices some accuracy but greatly saves storage space and is suitable for auxiliary information that has little impact on the current behavior type determination.

[0072] The identified "behavior type", the fully stored "key features" and the compressed and encoded "non-key features" are all associated with the original "identifier" (source IP, destination IP, port) and encapsulated into a complete "traffic identifier 13".

[0073] Traffic identifier 13 not only records "who is communicating with whom", but also describes "how they are communicating", providing a foundation for subsequent traffic monitoring, anomaly detection and security analysis.

[0074] Step S3: Continuously parse the subsequent data packets 11 to obtain traffic behavior characteristics 12, and match the extracted source IP address, destination IP address and port with the stored traffic identifier 13.

[0075] Whenever a new data packet 11 arrives, it is deeply analyzed to extract the latest "traffic behavior characteristics 12". At the same time, its "source IP address", "destination IP address", and "port" information are extracted from the packet. These three together constitute a precise query key.

[0076] This query key allows for efficient retrieval within an established database of traffic identifiers (13). The goal is to find a previously generated traffic identifier (13) that is an exact match. For example, suppose an HTTPS connection from 192.168.1.100:54321 to 203.0.113.5:443 was initially identified as an "interactive service type" and generated with a corresponding traffic identifier (13). Then, all subsequent new packets belonging to the same connection (or the same session flow) will be precisely matched back to this existing identifier using their five-tuple information.

[0077] Once a match is successful, the newly parsed traffic behavior feature 12 is no longer an isolated data point, but is given context, including which known communication entity the traffic belongs to, and what the entity's historical behavior patterns are.

[0078] Step S4: Update the traffic behavior feature 12 in the traffic identifier 13 using the newly identified traffic behavior feature 12, obtain the evolution sequence of the traffic identifier 13 over time under the same source IP address, destination IP address and port, and associate the preset risk level 14 according to the evolution sequence.

[0079] Please refer to the appendix for details. Figure 3 The method for updating the traffic behavior feature 12 in the traffic identifier 13 using the newly identified traffic behavior feature 12 to obtain the evolution sequence of the traffic identifier 13 over time under the same source IP address, destination IP address, and port includes:

[0080] Step S41: Maintain a time-ordered feature sequence container for each traffic identifier 13. The container has a preset maximum length L and maintains the maximum length in a first-in-first-out manner.

[0081] Each traffic identifier (13) uniquely identified by its source IP, destination IP, and port is assigned a dedicated feature sequence container. This feature sequence container functions like a fixed-length sliding window with a maximum capacity of L. It employs a First-In-First-Out (FIFO) strategy, ensuring that snapshots of behavioral characteristics from the most recent L time windows are always retained, while the oldest data is automatically removed, thus striking a balance between memory efficiency and historical traceability.

[0082] Step S42: When a newly identified traffic behavior feature 12 is obtained, the feature vector is appended to the end of the feature sequence container as the latest evolution state.

[0083] A brand-new feature vector is appended to the end of the corresponding container, becoming the latest "evolutionary state" of the traffic. For example, a connection that has long exhibited a "heartbeat keep-alive" behavior may have a stable feature vector for a long time; however, if a newly appended vector shows a surge in traffic and an increase in packet length per unit time, it indicates that its behavior pattern may be shifting.

[0084] Step S43: Perform difference calculation on adjacent feature vectors in the feature sequence container to obtain the feature change amount and direction between adjacent time windows, and form an evolution trajectory descriptor.

[0085] It performs difference calculations on adjacent feature vectors within the container. This is not just about calculating numerical differences, but more importantly, capturing the "amount of change" and the "direction of change". For example, from time [t-1] to time [t], the "average message interval" shortens from 10 seconds to 0.1 seconds, while the "per unit time flow rate" surges from 1KB / s to 10MB / s. This drastic and clearly directional change is recorded, forming a high-dimensional "evolutionary trajectory descriptor".

[0086] Step S44: Associate and store the evolution trajectory descriptor with the corresponding flow identifier 13 to form an evolution sequence.

[0087] The descriptor is strongly correlated with and stored in relation to the original traffic identifier 13. Each traffic identifier 13 is no longer an isolated point, but rather comes with a clear behavioral evolution trajectory. This behavioral evolution trajectory is a key basis for subsequent risk assessment. For example, if a trajectory shows that the communication of a certain IP pair smoothly transitions from normal "interactive services" to continuous "large file transfers," the risk level 14 may be low; however, if the trajectory shows that its behavior jumps directly from "inactivity" to high-frequency "scanning and probing" in a short period of time, a high-risk alarm will be triggered immediately because it highly matches the precursor characteristics of a network attack.

[0088] On the other hand, the method of associating a preset risk level 14 with the evolutionary sequence includes:

[0089] Based on the statistics in the traffic behavior feature 12, the application type corresponding to the traffic is identified; the application type includes web browsing, file transfer, email, remote login, video streaming, database access, P2P download, network proxy, tunnel communication or at least one of the following;

[0090] Each application type is pre-configured with a corresponding application risk baseline level, and the application risk baseline level for different application types is set differently based on the vulnerability of the application type in historical security incidents, common attack methods and business importance.

[0091] Obtain the flow behavior features 12 under multiple consecutive time windows in the evolution sequence, calculate the change amplitude and trend between adjacent flow behavior features 12, and obtain the behavior evolution deviation.

[0092] Based on the behavioral evolution deviation and the application risk benchmark level of the currently identified application type, a comprehensive risk level 14 for the current evolution sequence is generated. The risk offset is determined based on the behavioral evolution deviation and the duration of the deviation.

[0093] When the application type identified in the evolution sequence changes, the application risk baseline level of the new application type is re-acquired, and the comprehensive risk level 14 is updated to the larger value between the new application risk baseline level and the cumulative risk offset.

[0094] The comprehensive risk level 14 is used as the associated risk level 14 of the current evolutionary sequence.

[0095] Based on the statistics in traffic behavior characteristics 12 (such as port, protocol, message pattern, and traffic rate), the specific application type corresponding to the traffic can be identified. For example, traffic using TCP port 22 with short interactions and low throughput is usually identified as "remote login" (such as SSH); while traffic with continuous high throughput, large messages, and using TCP ports 80 / 443 may be classified as "file transfer" or "video streaming".

[0096] For each application type, a pre-defined application risk baseline level is established. This baseline is not arbitrary but rather a comprehensive assessment of the application's performance in historical security incidents: its inherent vulnerabilities, common attack methods (such as SSH brute-force attacks and SQL injection), and the importance of the business it supports. For example, the baseline risk level of 14 for "database access" is typically very high because the data is of great value and is a prime target for attacks; while the baseline risk for ordinary "web browsing" is relatively low.

[0097] However, static baseline levels alone are insufficient. Real risks often lie hidden within changes in behavior. Therefore, it is necessary to analyze the characteristics of multiple consecutive time windows within the "evolutionary sequence," calculate the magnitude and trend of changes between adjacent features, and thus derive a key indicator: "behavioral evolution deviation." For example, a previously stable "web browsing" connection that suddenly experiences an exponential increase in traffic rate, accompanied by a large number of small packets being sent out, would exhibit a very high degree of abnormal deviation.

[0098] The final overall risk level of 14 is determined by two parts: the current application risk baseline level, and the risk offset calculated from the degree of behavioral evolution deviation and the duration of that deviation. This ensures that even low-risk applications (such as web browsing) will have their overall risk significantly increased if sustained and drastic abnormal behavior occurs.

[0099] Of particular note is the scenario of application type switching. Suppose a connection is initially identified as low-risk "web browsing," but subsequent evolution shows its behavior has completely transformed into typical "P2P downloading" or "tunneling." In this case, the baseline application risk level corresponding to the new application type (such as P2P) is immediately re-acquired, typically higher. The overall risk level of 14 will be updated to the larger of the "new baseline level" and the "cumulative risk offset." For example, switching from "web browsing" to "network proxy," even if the behavior transition is smooth (with minimal deviation), will immediately cause the overall risk level of 14 to jump due to the extremely high baseline risk of "network proxy," thus accurately reflecting the potential threat.

[0100] In this way, each traffic identifier 13 is associated with a dynamic, contextual "comprehensive risk level 14", providing a more accurate and timely basis for security decisions.

[0101] Step S5: When a new traffic behavior feature 21 appears in the evolution sequence, a preliminary alarm 22 is issued.

[0102] A preliminary alarm 22 is triggered as soon as significant anomalies or unknown patterns in traffic behavior are observed, providing initial information for subsequent in-depth analysis and response. Here, "new" does not refer to the order of events, but rather to the novelty or deviation of the behavioral pattern, that is, the currently observed traffic behavior feature 12 is fundamentally different from the existing patterns in the historical evolution sequence of this connection.

[0103] For example, a connection long identified as a "remote login" (SSH) exhibits a stable evolutionary sequence characterized by interactive small packets and fixed heartbeat intervals. However, in a certain update, newly identified traffic behavior 12 shows consistently high throughput, large packets, and a destination port that becomes an uncommon port (such as 8080). Clustering or rule matching engines might reclassify it as "large file transfer type" or even "tunneling communication." This sudden switch from one predefined behavior type to another, especially to a high-risk type (such as tunneling communication), is considered a "new traffic behavior 21," immediately triggering an initial alert 22. This could mean that a legitimate SSH session has been abused to establish a covert data transfer channel.

[0104] Another example is that even if the application type remains the same, an extreme anomaly in specific statistics also constitutes a "new" feature. For instance, a normal "database access" connection typically has an average query response time between 10-50ms. If the new feature shows a sudden increase in response time to several seconds, accompanied by a large number of error codes, this may indicate that the database is suffering from a slow SQL injection attack or a denial-of-service (DoS) attack. Although it still belongs to the "database access" type, its position in the feature vector space has deviated far from the historical normal range, forming a clear anomaly and triggering an initial alert.22

[0105] Step S6: Obtain the correlation degree between the new traffic behavior feature 21 corresponding to the preliminary alarm 22 and the evolution sequence, and perform the next processing 23 on the preliminary alarm 22 according to the correlation degree and the risk level 14. The next processing 23 includes one or more of alarming, ignoring the preliminary alarm 22 and updating the risk level 14.

[0106] The method for obtaining the correlation between the new traffic behavior feature 21 corresponding to the initial alarm 22 and the evolution sequence includes:

[0107] Calculate the similarity between the new flow behavior feature 21 and each flow behavior feature 12 in the evolutionary sequence;

[0108] The calculated similarity values ​​are averaged using a weighted average, with higher weights assigned to historical feature vectors that are closer to the current time, to obtain the weighted average similarity S.

[0109] The weighted average similarity S is mapped to the correlation degree R. The mapping calculation formula is R=1 / (1+e^(-α(S-β))), where α is a preset sensitivity parameter that determines the sensitivity of the correlation degree R to changes in the similarity S, and β is a preset bias parameter that determines the center position of the sigmoid function, that is, the value of the similarity S when R=0.5.

[0110] Output the correlation degree R, where the closer the R value is to 1, the stronger the correlation between the new traffic behavior feature 21 and the evolution sequence.

[0111] Specifically, the similarity is first calculated between the new traffic behavior feature vector 21 and each historical feature vector in the evolution sequence. Common methods include normalized forms of cosine similarity or Euclidean distance. Since recent behavior better reflects the current state, historical features closer to the current time point are given higher weights in the subsequent weighted average. For example, the weight of the most recent window might be 0.5, the previous two 0.3, the next earlier 0.2, and so on, resulting in the final weighted average similarity S.

[0112] To transform S into a more interpretable probabilistic metric, the Sigmoid mapping function is used: R = 1 / (1 + e^(-α(S-β))). The larger α is, the more sensitive R is to small changes in S; β determines the "neutral point." For example, when S = β, R = 0.5, indicating "moderate correlation." By adjusting α and β, the needs of different business scenarios can be adapted. For instance, in environments with high security requirements, a lower β value can be set so that only highly similar behaviors are considered "strong correlation."

[0113] For example, a video streaming connection experiences a brief drop in bitrate within a single window due to network jitter, triggering initial alarm 22. However, calculations show that the new characteristic is highly similar to the characteristics of the previous 5 windows (S=0.92). Substituting this into the Sigmoid function (assuming α=10, β=0.7), we get R≈0.98. This high correlation indicates that this change falls within the normal fluctuation range. Considering the low to medium risk baseline of "video streaming," the final decision is to ignore initial alarm 22 to avoid false alarms.

[0114] For another example, a new feature of a "database access" connection shows that the query frequency has increased sharply by 100 times and contains a large number of unconventional SQL statements. Its similarity to historical features is extremely low (S = 0.35), and after mapping, R ≈ 0.12, indicating almost no association. At this time, although the preliminary alarm 22 has been issued, the low R value confirms the "novelty" and "disconnection" of the behavior. Combining the current increased comprehensive risk level 14 of this connection (such as rising from "medium" to "high"), the next step of processing 23 will include: officially issuing a high-level alarm and solidifying and updating the risk level 14 for subsequent policy linkage (such as automatic blocking or traffic mirroring).

[0115] The method for performing the next step of processing 23 on the preliminary alarm 22 according to the degree of association and the risk level 14 includes:

[0116] Preset a high threshold Th and a low threshold Tl for the degree of association, and 0 < Tl < Th < 1. The preset risk level 14 is divided into three levels: low risk, medium risk, and high risk, and is mapped to numerical values 1 to 3;

[0117] Obtain the numerical value L of the associated risk level 14 of the current evolution sequence and the calculated degree of association R;

[0118] If R ≥ Th, it means that the new traffic behavior feature 21 is highly associated with the historical evolution sequence, and it is determined as a normal behavior fluctuation. Execute to ignore the preliminary alarm 22 and keep the current risk level 14 unchanged;

[0119] If R ≤ Tl and L ≥ 2, execute an alarm, issue a final security alarm, and trigger a preset security control operation;

[0120] If R ≤ Tl and L = 1, execute an update of the risk level 14, raise the associated risk level 14 of the current evolution sequence to medium risk, and at the same time ignore the preliminary alarm 22, waiting for further confirmation by subsequent evolution sequences;

[0121] If Tl < R < Th and L ≥ 2, execute an alarm;

[0122] If Tl < R < Th and L = 1, execute to ignore the preliminary alarm 22, but record this abnormal event for subsequent statistical analysis;

[0123] When executing the alarm, encapsulate the new traffic behavior feature 21, the degree of association, the current risk level 14, and the evolution sequence identifier into an alarm event for reporting;

[0124] When executing the update of the risk level 14, write the updated risk level 14 into the traffic identifier 13 and continue subsequent packet monitoring.

[0125] Perform intelligent filtering and hierarchical decision-making on the preliminary alert 22 to avoid alert fatigue caused by transient noise or benign fluctuations, while ensuring that truly abnormal behaviors are not missed. Its implementation depends on the quantitative evaluation of the degree of correlation between the new traffic behavior characteristics 12 and the historical evolution sequence of this connection.

[0126] Preset two correlation thresholds: a high threshold Th (such as 0.85) and a low threshold Tl (such as 0.4), satisfying 0 < Tl < Th < 1. Numerically represent the risk level 14: low risk = 1, medium risk = 2, high risk = 3.

[0127] Set five typical scenarios, which are as follows:

[0128] Scenario 1, R ≥ Th: High correlation, then ignore the alert (normal fluctuation)

[0129] When the new feature is highly similar to the historical evolution (R ≥ Th), even if the preliminary alert 22 is triggered, it is regarded as a benign fluctuation.

[0130] For example, for a "web browsing" connection, the instantaneous request volume doubles due to the user refreshing the page, but the packet structure and protocol behavior are consistent with the history (R = 0.92 > Th = 0.85). At this time, it is determined as normal behavior, the preliminary alert 22 is ignored, and the risk level 14 remains 1.

[0131] Scenario 2, R ≤ Tl and L ≥ 2: Low correlation and medium / high risk, then immediately alert

[0132] The new behavior is seriously out of touch with the history (R ≤ Tl), and the current risk is already medium or high, indicating that the abnormality is very likely to actually exist.

[0133] Case: A database connection that has been marked as "medium risk" (L = 2) suddenly has a large number of SELECT * FROM users queries during non-business hours, and the characteristics have little relation to the history (R = 0.3 < Tl = 0.4). This behavior highly conforms to the characteristics of data theft, immediately issue a final security alert, and the firewall can be linked to block this IP.

[0134] Scenario 3, R ≤ Tl and L = 1: Low correlation and low risk, then raise the risk level 14 and do not alert temporarily

[0135] Although the behavior is abnormal, the initial risk is low, and it needs to be "determined after observation". At this time, raise the risk level 14 to medium risk (L = 2) to accumulate context for subsequent judgments.

[0136] Case: A long-term "low-risk" internal office terminal (L = 1) made the first attempt to initiate an SSH connection to an overseas IP (R = 0.25). Since there is no other evidence of maliciousness, first update its risk level from 14 to medium risk and ignore this preliminary alert 22. If similar behavior occurs again later, an alert will be triggered due to L ≥ 2.

[0137] Scenario 4, Tl < R < Th and L ≥ 2: Moderate correlation and medium / high risk, then issue an alert

[0138] Although the behavior is not completely out of line, there is already a certain deviation. Coupled with the existing risks, it is still necessary to be vigilant.

[0139] Exemplarily, for a "high-risk" (L = 3) external API interface, its traffic pattern changes from stable JSON interaction to a mixture of XML and binary data (R = 0.6, between Tl = 0.4 and Th = 0.85). This may indicate that an attacker is probing for interface parsing vulnerabilities, and an alert is issued for manual verification.

[0140] Scenario 5, Tl < R < Th and L = 1: Moderate correlation and low risk, then ignore but record

[0141] The behavior is slightly abnormal, but the risk basis is low, not sufficient to issue an alert, but it is worth leaving a record for statistical analysis.

[0142] For example, an ordinary employee's computer (L = 1) occasionally accesses an infrequently used CDN domain name, with a medium similarity of characteristics (R = 0.55). It may be caused by a new software update. At this time, the alert is ignored, but the event is recorded in the database. If the same type of behavior occurs on multiple hosts across the network within a short period of time, potential supply chain attacks can be discovered through aggregation analysis. An evolution sequence identifier consisting of a new traffic behavior feature 21 vector, correlation degree R, current risk level 14L, source / destination IP + port is ensured to be traceable and reproducible. Once "update risk level 14" is executed, the new L value will be written into the corresponding traffic identifier 13 metadata, affecting all subsequent judgments. For example, after rising from L = 1 to L = 2, if R ≤ Tl occurs again next time, it will directly enter the "alert" branch.

[0143] Through refined conditional branches, the detection rate and false alarm rate are effectively balanced. It not only avoids overreacting to daily fluctuations but also can respond in a timely manner when a real threat emerges, achieving the security effect of "dynamic trust and continuous assessment".

[0144] On the other hand, this specification provides a high-security network gateway control system based on packet parsing. Please refer to the appendix Figure 4 , including:

[0145] The parsing module 100 parses the network data packets 11 to obtain traffic behavior characteristics 12 and extracts the source IP address, destination IP address and port.

[0146] The identification module 200 binds the identified traffic behavior features 12 with the extracted source IP address, destination IP address and port to generate a traffic identifier 13 containing the source IP address, destination IP address, port and traffic behavior features 12.

[0147] The identification module 300 continuously parses the subsequent data packets 11 to obtain traffic behavior characteristics 12, and matches the extracted source IP address, destination IP address and port with the stored traffic identifier 13;

[0148] The judgment module 400 updates the traffic behavior feature 12 in the traffic identifier 13 using the newly identified traffic behavior feature 12, obtains the evolution sequence of the traffic identifier 13 over time under the same source IP address, destination IP address and port, and associates the preset risk level 14 according to the evolution sequence.

[0149] The alarm module 500 issues a preliminary alarm 22 when a new traffic behavior feature 21 appears in the evolution sequence;

[0150] The processing module 600 obtains the correlation degree between the new traffic behavior feature 21 corresponding to the preliminary alarm 22 and the evolution sequence, and performs further processing 23 on the preliminary alarm 22 according to the correlation degree and the risk level 14. The further processing 23 includes one or more of alarming, ignoring the preliminary alarm 22 and updating the risk level 14.

[0151] Please see Figure 5 The diagram shown is a structural schematic of an electronic device provided in an embodiment of this specification.

[0152] like Figure 5As shown, the electronic device 1100 may include: at least one processor 1101, at least one network interface 1104, a user interface 1103, a memory 1105, and at least one communication bus 1102. The communication bus 1102 can be used to connect and communicate with the various components mentioned above. The user interface 1103 may include buttons, and optionally may include standard wired or wireless interfaces. The network interface 1104 may include, but is not limited to, a Bluetooth module, an NFC module, or a Wi-Fi module. The processor 1101 may include one or more processing cores. The processor 1101 connects to various parts within the electronic device 1100 using various interfaces and lines, and performs various functions of the routing device and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 1105, and by calling data stored in the memory 1105. Optionally, the processor 1101 may be implemented using at least one hardware form of DSP, FPGA, or PLA. The processor 1101 may integrate one or more combinations of CPU, GPU, and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content that the display screen needs to show; and the modem is used for wireless communication.

[0153] It is understandable that the aforementioned modem may not be integrated into the processor 1101, but may be implemented using a separate chip.

[0154] The memory 1105 may include RAM or ROM. Optionally, the memory 1105 may include a non-transitory computer-readable medium. The memory 1105 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 1105 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 1105 may also be at least one storage device located remotely from the aforementioned processor 1101. As a computer storage medium, the memory 1105 may include an operating system, a network communication module, a user interface module, and application programs. The processor 1101 may be used to call the application programs stored in the memory 1105 and execute the methods in the above-described embodiments.

[0155] This specification also provides a computer-readable storage medium storing instructions that, when executed on a computer or processor, cause the computer or processor to perform multiple steps as described in the above embodiments. If the constituent modules of the above-described electronic device are implemented as software functional units and sold or used as independent products, they can be stored in the computer-readable storage medium.

[0156] This specification also provides a computer program product, including a computer program that, when executed by a processor, implements the multiple steps described in the above embodiments.

[0157] Where there is no conflict, the technical features in this embodiment and implementation scheme can be combined arbitrarily.

[0158] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes multiple computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this specification are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center integrating multiple available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital versatile discs (DVDs)), or semiconductor media (e.g., solid-state drives (SSDs)).

[0159] When implemented through hardware or firmware, the aforementioned method flow is programmed into the hardware circuit to obtain the corresponding hardware circuit structure and achieve the corresponding function. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit, whose logic function is determined by the user programming the device. Designers can program a digital system onto a PLD themselves, eliminating the need for chip manufacturers to design and fabricate dedicated integrated circuit chips. Furthermore, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly implemented using "logic compiler" software, similar to the software compiler used in program development. The original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There is not just one HDL, but many. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of the aforementioned hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logic method flow can be easily obtained.

[0160] The embodiments described above are merely preferred embodiments of this specification and are not intended to limit the scope of this specification. Any modifications and improvements made by those skilled in the art to the technical solutions of this specification without departing from the spirit of this specification should fall within the protection scope defined by the claims of this specification.

Claims

1. A high-security network gateway control method based on packet analysis, characterized by, Including the following steps: Parse network data packets to obtain traffic behavior characteristics, and extract source IP address, destination IP address and port; The identified traffic behavior features are bound to the extracted source IP address, destination IP address, and port to generate a traffic identifier that includes the source IP address, destination IP address, port, and traffic behavior features. The system continuously parses subsequent incoming data packets to obtain traffic behavior characteristics, and matches the extracted source IP address, destination IP address, and port with the stored traffic identifier. The newly identified traffic behavior features are used to update the traffic behavior features in the traffic identifier to obtain the evolution sequence of the traffic identifier over time under the same source IP address, destination IP address and port, and a preset risk level is associated with the evolution sequence. When new traffic behavior characteristics appear in the evolution sequence, an initial alarm is issued; Obtain the correlation between the new traffic behavior characteristics and the evolution sequence corresponding to the initial alarm, and perform further processing on the initial alarm based on the correlation and the risk level. The further processing includes one or more of the following: alarming, ignoring the initial alarm, and updating the risk level.

2. The high-security network gateway control method based on message parsing according to claim 1, characterized in that, Methods for parsing network data packets to obtain traffic behavior characteristics include: Extract the five-tuple information, message length, message arrival timestamp, TCP flags, or application layer protocol type from each data packet; Aggregate and statistically analyze packets under the same source IP address, destination IP address, and port according to a fixed time window to obtain a preset number of statistical quantities; the statistical quantities are the average packet length and its variance, the average interval time of packet arrival and the coefficient of variation of the interval time, the number of packets and bytes per unit time, the number of retransmissions or the proportion of zero-window packets during the connection establishment phase, the application layer protocol identification result, or the hash value of key payload fields. The multiple statistics are converted into feature vectors and normalized to a uniform numerical range, which serve as the traffic behavior features.

3. The high-security network gateway control method based on message parsing according to claim 2, characterized in that, Methods for binding identified traffic behavior characteristics with extracted source IP addresses, destination IP addresses, and ports to generate traffic identifiers containing source IP addresses, destination IP addresses, ports, and traffic behavior characteristics include: The source IP address, destination IP address, and port are used as identifiers respectively; Cluster analysis or rule matching is performed on multiple statistics in the traffic behavior characteristics to identify the behavior type of the current traffic; the behavior type includes at least one of interactive service type, large file transfer type, tunnel proxy type, scanning and probing type, and heartbeat keep-alive type. For each type of behavior, a set of key features is preset, and the statistics listed in the set of key features are used as the key features of that type of traffic; When generating traffic identifiers, key features belonging to the set of key features are stored in their original values ​​or original feature vectors. For non-critical features that do not belong to the set of key features, a summary compression method is used to generate compressed codes for storage. The behavior type, the key features stored in full, and the non-key features after compression and encoding are associated with an identifier and then encapsulated into a traffic identifier.

4. The high-security network gateway control method based on message parsing according to claim 2, characterized in that, The method for updating the traffic behavior features in the traffic identifier using newly identified traffic behavior features to obtain the evolution sequence of the traffic identifier over time for the same source IP address, destination IP address, and port includes: For each traffic identifier, maintain a time-ordered feature sequence container, which has a preset maximum length L and maintains the maximum length in a first-in-first-out manner; When a newly identified traffic behavior feature is obtained, the feature vector is appended to the end of the feature sequence container as the latest evolution state; The difference calculation is performed on adjacent feature vectors in the feature sequence container to obtain the feature change amount and direction between adjacent time windows, forming an evolution trajectory descriptor; The evolution trajectory descriptors are associated with and stored with the corresponding traffic identifiers to form an evolution sequence.

5. The high-security network gateway control method based on message parsing according to claim 1, characterized in that, The method for associating a preset risk level with the evolutionary sequence includes: Based on the statistics in the traffic behavior characteristics, the application type corresponding to the traffic is identified; the application type includes web browsing, file transfer, email, remote login, video streaming, database access, P2P download, network proxy, tunnel communication, or at least one of the following; Each application type is pre-configured with a corresponding application risk baseline level, and the application risk baseline level for different application types is set differently based on the vulnerability of the application type in historical security incidents, common attack methods and business importance. Obtain the flow behavior characteristics under multiple consecutive time windows in the evolution sequence, calculate the change amplitude and trend between adjacent flow behavior characteristics, and obtain the behavior evolution deviation. Based on the behavioral evolution deviation and the application risk benchmark level of the currently identified application type, a comprehensive risk level of the current evolution sequence is generated, and the risk offset is determined according to the behavioral evolution deviation and the duration of the deviation. When the application type identified in the evolution sequence changes, the application risk baseline level of the new application type is re-acquired, and the comprehensive risk level is updated to the larger value between the new application risk baseline level and the cumulative risk offset. The comprehensive risk level is used as the associated risk level of the current evolutionary sequence.

6. The high-security network gateway control method based on message parsing according to claim 1, characterized in that, The method for obtaining the correlation between the new traffic behavior features and the evolution sequence corresponding to the initial alarm includes: Calculate the similarity between the new flow behavior feature and each flow behavior feature in the evolution sequence; Perform weighted averaging on the calculated multiple similarity values, where the historical feature vectors closer to the current time are assigned higher weights to obtain the weighted average similarity S; Map the weighted average similarity S to the correlation degree R. The mapping calculation formula is R = 1 / (1 + e^(-α(S - β))), where α is a preset sensitivity parameter that determines the sensitivity of the correlation degree R to the change of the similarity S, and β is a preset bias parameter that determines the central position of the Sigmoid function, that is, the value of the similarity S corresponding to when R = 0.5; Output the correlation degree R, where the closer the R value is to 1, the closer the new traffic behavior feature is associated with the evolution sequence.

7. The method for controlling a highly secure network gateway based on packet parsing according to claim 1, characterized in that, The method for further processing the preliminary alarm according to the correlation degree and the risk level includes: Preset a high correlation degree threshold Th and a low correlation degree threshold Tl, and 0 < Tl < Th < 1. The preset risk levels are divided into three levels: low risk, medium risk, and high risk, which are mapped to numerical values 1 to 3; Obtain the numerical value L of the correlation risk level of the current evolution sequence and the calculated correlation degree R; If R ≥ Th, it means that the new traffic behavior feature is highly associated with the historical evolution sequence, and it is determined as a normal behavior fluctuation. Execute ignoring the preliminary alarm and keep the current risk level unchanged; If R ≤ Tl and L ≥ 2, execute an alarm, issue a final security alarm, and can trigger a preset security control operation; If R ≤ Tl and L = 1, execute an update of the risk level, raise the correlation risk level of the current evolution sequence to medium risk, and at the same time ignore the preliminary alarm, and wait for further confirmation by subsequent evolution sequences; If Tl < R < Th and L ≥ 2, execute an alarm; If Tl < R < Th and L = 1, execute ignoring the preliminary alarm, but record this abnormal event for subsequent statistical analysis; When executing the alarm, encapsulate the new traffic behavior feature, correlation degree, current risk level, and evolution sequence identifier together as an alarm event for reporting; When executing the update of the risk level, write the updated risk level into the traffic identifier and continue subsequent packet monitoring.

8. A high-security network gateway control system based on message parsing, characterized in that, Including: A parsing module that parses network data packets to obtain traffic behavior features, and extracts the source IP address, destination IP address, and port; An identification module that binds the identified traffic behavior features with the extracted source IP address, destination IP address, and port to generate a traffic identifier including the source IP address, destination IP address, port, and traffic behavior features; An identification module that continuously executes parsing on subsequent arriving data packets to obtain traffic behavior features, and matches the stored traffic identifiers according to the extracted source IP address, destination IP address, and port; A judgment module that updates the traffic behavior features in the traffic identifier using the newly identified traffic behavior features, obtains the evolution sequence of the traffic identifier over time under the same source IP address, destination IP address, and port, and associates a preset risk level according to the evolution sequence; An alarm module that issues a preliminary alarm when a new traffic behavior feature appears in the evolution sequence; The processing module obtains the correlation between the new traffic behavior characteristics and the evolution sequence corresponding to the initial alarm, and performs further processing on the initial alarm based on the correlation and the risk level. The further processing includes one or more of the following: alarming, ignoring the initial alarm, and updating the risk level.

9. An electronic device, characterized in that, Including the processor and memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code stored in the memory to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-7.

Images