A password security situation awareness method and system based on federated learning

Abstract

The application discloses a password security situation awareness method and system based on federated learning, and relates to the technical field of network security, comprising the following steps: S1, a plurality of network devices respectively acquire password communication session data associated with the corresponding network devices; S2, a session sequence is generated; S3, a sample pool is generated based on a steady-state segment, a change segment and a review segment; S4, offset spectrum is corrected in sequence, and a cause item and a consequence item are generated; S5, local situation parameters are generated; S6, the improved FedProx algorithm is used for federated proximal update and federated collaborative aggregation, and a situation awareness result is generated. The application can realize cross-network device password security situation collaborative awareness under the condition that the original password communication session data is not centrally shared, and improve the accuracy, stability and risk source positioning ability of the situation awareness result.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a cryptographic security situation awareness method and system based on federated learning. Background Technology

[0002] With the continuous advancement of network security protection systems and commercial cryptography applications, cryptographic security situational awareness technologies for secure communication processes between network devices have received widespread attention. Existing network security systems typically monitor and analyze protocol usage, certificate verification, key negotiation, and session return status by collecting communication logs, handshake records, cryptographic service call records, and security device alarm information. However, in practical applications, the following problems commonly exist: Cryptographic communication session data across different network devices is stored in a dispersed manner, involving sensitive information such as communication sources, communication purposes, service links, certificate verification results, key negotiation results, and cryptographic service call results. Existing centralized collection methods easily expose network topology, service access paths, and cryptographic service call relationships, making it difficult to meet the dual requirements of cross-device collaborative analysis and local data protection. Existing methods often rely on single handshake failures, certificate verification failures, or abnormal interface returns as judgment criteria, lacking analysis of continuous changes in cryptographic communication states within adjacent time slices, making it difficult to distinguish between short-term state fluctuations, normal configuration changes, and persistent cryptographic risks. Different network devices have significant differences in protocol versions, cipher suites, certificate chain structures, service link types, and session sizes. Ordinary federated aggregation is easily affected by local data distribution offsets, leading to global situational awareness results being interfered with by local anomalies or single link characteristics, affecting the accuracy, stability, and interpretability of cryptographic security situational awareness.

[0003] Therefore, how to provide a cryptographic security situation awareness method and system based on federated learning is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] One objective of this invention is to propose a cryptographic security situation awareness method and system based on federated learning. This invention acquires cryptographic communication session data from multiple network devices, performs field normalization and local irreversible mapping to generate session elements and local situation parameters. An improved FedProx algorithm is used for federated near-end updates and federated collaborative aggregation to generate global situation parameters. This addresses the problems in existing technologies where centralized aggregation of cryptographic communication session data easily exposes network topology and cryptographic service call relationships, single anomaly detection struggles to distinguish between short-term state fluctuations and persistent cryptographic risks, and ordinary federated aggregation is susceptible to local data distribution offsets. This invention achieves cryptographic security situation awareness with continuous state analysis capabilities, risk source location capabilities, and federated aggregation stability even when the original cryptographic communication session data is not centrally shared.

[0005] A cryptographic security situation awareness method based on federated learning according to an embodiment of the present invention includes the following steps: S1. Multiple network devices respectively obtain the cryptographic communication session data associated with their respective network devices, perform field normalization and local irreversible mapping, and generate session elements; S2. Determine the session identifier based on the session element, sort the session elements under the same session identifier according to the time slice, and generate a session sequence; S3. Based on the state differences between session elements in adjacent time slices in the session sequence, the session sequence is segmented to generate steady-state segments and change segments; session elements located after the change segment and belonging to the same session identifier are reviewed. If the same state differences are retained in the reviewed session elements, the corresponding session sequence is marked as a review segment, and a sample pool is generated based on the steady-state segment, change segment, and review segment. S4. Generate an offset spectrum based on the session sequence and sample pool, and perform ordinal correction on the offset spectrum to generate primacy and consequence terms; S5. Generate link groups based on session elements, generate session families within the same link group based on the ordered combination of cryptographic communication states, and generate local situational parameters based on link groups, session families, primary factors, secondary factors, and sample pools. S6. The improved FedProx algorithm is used to perform federated near-end updates on the local situation parameters to generate a local update summary. The local update summaries generated by multiple network devices are federated and aggregated to generate global situation parameters. Situation awareness results are generated based on the global situation parameters.

[0006] Optionally, S1 specifically includes: Multiple network devices read the secure communication handshake record, cryptographic service call record, and session return record of their respective network devices. Extract session time, communication source identifier, communication destination identifier, business link identifier, protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason and session return status from secure communication handshake record, cryptographic service call record and session return record to form cryptographic communication session data; The cryptographic communication session data is standardized according to unified field names, unified time granularity, and unified status coding. Perform local irreversible mapping on the communication source identifier, communication destination identifier, and service link identifier to generate source-end mapping value, destination-end mapping value, and link mapping value; The session element consists of the normalized session time, source mapping value, destination mapping value, link mapping value, protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status.

[0007] Optionally, S2 specifically includes: The session identifier is obtained by combining the source mapping value, destination mapping value, link mapping value, protocol version, and cipher suite from the session element; Convert the session time in the session element into time slices according to a uniform time granularity; Arrange session elements with the same session identifier in ascending order of time slice to generate a session sequence; If multiple session elements exist within the same time slice under the same session identifier, they are arranged in the order of the fields: session return status, handshake failure reason, certificate chain verification result, key negotiation result, signature verification result, and encryption / decryption call result, to generate a session sequence.

[0008] Optionally, the step of segmenting the session sequence based on the state differences between session elements in adjacent time slices to generate steady-state segments and change segments specifically involves: Select the preceding and following session elements corresponding to adjacent time slices from the session sequence in sequence; The protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status in the previous and next session units are compared field by field to obtain the status differences; If the field-by-field comparison results of the previous session element and the next session element are consistent, then the previous session element and the next session element are classified into the steady state segment. If there are inconsistent fields in the field-by-field comparison results between the previous session element and the next session element, then the previous session element and the next session element will be classified into the change segment. In the session sequence, session cells that are consecutively assigned to the steady-state segment are merged in ascending order of time slices to generate a steady-state segment; in the session sequence, session cells that are consecutively assigned to the change segment are merged in ascending order of time slices to generate a change segment.

[0009] Optionally, the step of reviewing session elements located after the change segment and belonging to the same session identifier, and if the reviewed session elements retain the same state differences, marks the corresponding session sequence as a review segment, and generates a sample pool based on the steady-state segment, the change segment, and the review segment, specifically: Under the same session identifier, select session cells located after the change segment in ascending order of time slices to generate review session cells; The review session element is compared field by field with the last session element in the change segment to obtain the review status difference. If the lookback state difference contains the same state difference as the change segment, then the session sequence corresponding to the lookback session element is marked as a lookback segment. Session elements in the steady-state segment are written to the steady-state pool, session elements in the change segment are written to the change pool, and session elements in the lookback segment are written to the lookback pool. These are then combined to generate the sample pool.

[0010] Optionally, S4 specifically includes: Generate protocol offset, package offset, certificate offset, negotiation offset, signature verification offset, call offset, failure offset, and return offset based on the fields to which the state differences belong; Arrange the protocol offsets, package offsets, certificate offsets, negotiation offsets, signature verification offsets, call offsets, failure offsets, and return offsets in ascending order according to session identifier and time slice to generate an offset spectrum; The offset items in the offset spectrum are corrected according to the field order of protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason and session return status. The offset items that are ranked first after ordinal correction and are associated with the risk category are marked as primacy items; Offset items that are sorted after the primary item after the ordinal correction and are associated with the session return status, handshake failure reason, or encryption / decryption call result are marked as consequence items.

[0011] Optionally, the step of generating link groups based on session elements, and generating session families within the same link group based on ordered combinations of cryptographic communication states, specifically involves: The source mapping value, destination mapping value, link mapping value, protocol version, and cipher suite are combined to generate a link group; session elements with the same link group are grouped into the same link group. Within the same link group, extract the certificate chain verification results, key negotiation results, signature verification results, encryption / decryption call results, handshake failure reasons, and session return status in ascending order of time slices to generate an ordered combination of cryptographic communication states; group session elements with the same ordered combination into the same session family.

[0012] Optionally, the generation of local situational parameters based on link groups, session families, primacy items, consequence items, and sample pools specifically includes: The distribution values ​​of link groups, session families, primary causes, and secondary causes in the sample pool are statistically analyzed. The corresponding values ​​of primary causes and secondary causes under the same session identifier are also statistically analyzed to generate local situational parameters.

[0013] Optionally, S6 specifically includes: The link group near-end weight is generated based on the link group distribution value in the local situation parameters; the session family near-end weight is generated based on the session family distribution value in the local situation parameters; the primary cause near-end weight is generated based on the primary cause and consequence distribution values ​​in the local situation parameters; and the pool near-end weight is generated based on the number of session elements in the steady-state pool, change pool, and lookback pool in the sample pool. The link group near-end item is generated based on the link group near-end weight and the link group distribution value in the local situation parameters. The session family near term is generated based on the session family near term weight and the session family distribution value in the local situation parameters; The primary factor proximal term is generated based on the primary factor proximal weight, the distribution values ​​of the primary factor term and the distribution values ​​of the consequence term in the local situation parameters; Pooled near-end items are generated based on the pooled near-end weights and the number of session elements in the steady-state pool, change pool, and lookback pool in the sample pool; The risk assessment loss, source attribution loss, co-occurrence offset loss, link group near-end item, session family near-end item, primary cause near-end item, and pooling near-end item are combined into the local training objective of the improved FedProx algorithm. The local situation parameters are then federated near-end updated to generate a local update summary. Federated collaborative aggregation of local update summaries generated by multiple network devices is performed to generate global situational parameters. Situational calculations are then performed on the cryptographic communication session data to be identified to generate situational awareness results.

[0014] Optionally, a federated learning-based cryptographic security situational awareness system includes the following modules: The session generation module is used by multiple network devices to obtain the password communication session data associated with their respective network devices, perform field normalization and local irreversible mapping, and generate session elements. The sequence generation module is used to determine the session identifier based on the session element, sort the session elements under the same session identifier according to the time slice, and generate a session sequence. The segmented review module is used to segment the session sequence based on the state differences between session elements in adjacent time slices, generating steady-state segments and changed segments; it reviews session elements located after the changed segment that belong to the same session identifier, and if the same state differences are retained in the reviewed session elements, the corresponding session sequence is marked as a review segment, and a sample pool is generated based on the steady-state segment, changed segment, and review segment; The offset correction module is used to generate an offset spectrum based on the session sequence and sample pool, and to perform ordinal correction on the offset spectrum to generate primacy and consequence terms. The situation generation module is used to generate link groups based on session elements, generate session families within the same link group based on the ordered combination of cryptographic communication states, and generate local situation parameters based on link groups, session families, primary factors, consequences, and sample pools. The federated update module is used to perform federated near-end updates of local situation parameters using an improved FedProx algorithm, generate local update summaries, perform federated collaborative aggregation of local update summaries generated by multiple network devices, generate global situation parameters, and generate situation awareness results based on global situation parameters.

[0015] The beneficial effects of this invention are: (1) Based on the state differences between session elements in adjacent time slices in the session sequence, the present invention segments the session sequence to generate steady-state segments and change segments, and reviews the session elements located after the change segment that belong to the same session identifier to generate review segments and sample pools, so that short-term state fluctuations, normal change processes and persistent password risks can be distinguished at the sample level, reducing the probability of misjudgment caused by single handshake failure, certificate chain verification failure or abnormal session return; (2) Based on the session sequence and sample pool, an offset spectrum is generated, and the offset spectrum is corrected in order to generate primacy and consequence items, so that changes in the state of cryptographic communication can be corrected in the order of fields, thereby improving the ability to distinguish between the source of risk and the abnormal consequences. (3) The improved FedProx algorithm is used to perform federated near-end updates on local situation parameters, generate local update summaries, and perform federated collaborative aggregation on local update summaries generated by multiple network devices to generate global situation parameters. This enables the federated update process to combine link group near-end items, session family near-end items, primary cause near-end items and pooling near-end items, reducing the federated aggregation offset caused by inconsistent distribution of cryptographic communication sessions between different network devices and improving the stability of global situation parameters. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a cryptographic security situation awareness method based on federated learning proposed in this invention; Figure 2 This is a data flow diagram of a cryptographic security situation awareness method based on federated learning proposed in this invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figures 1-2 A cryptographic security situation awareness method based on federated learning includes the following steps: S1. Multiple network devices respectively obtain the cryptographic communication session data associated with their respective network devices, perform field normalization and local irreversible mapping, and generate session elements; S2. Determine the session identifier based on the session element, sort the session elements under the same session identifier according to the time slice, and generate a session sequence; S3. Based on the state differences between session elements in adjacent time slices in the session sequence, the session sequence is segmented to generate steady-state segments and change segments; session elements located after the change segment and belonging to the same session identifier are reviewed. If the same state differences are retained in the reviewed session elements, the corresponding session sequence is marked as a review segment, and a sample pool is generated based on the steady-state segment, change segment, and review segment. S4. Generate an offset spectrum based on the session sequence and sample pool, and perform ordinal correction on the offset spectrum to generate primacy and consequence terms; S5. Generate link groups based on session elements, generate session families within the same link group based on the ordered combination of cryptographic communication states, and generate local situational parameters based on link groups, session families, primary factors, secondary factors, and sample pools. S6. The improved FedProx algorithm is used to perform federated near-end updates on local situational parameters, generate local update summaries, and perform federated collaborative aggregation of local update summaries generated by multiple network devices to generate global situational parameters. Situational awareness results are generated based on global situational parameters.

[0019] In this embodiment, S1 specifically refers to: Multiple network devices read the secure communication handshake record, cryptographic service call record, and session return record of their respective network devices. The secure communication handshake record includes the session time, communication source identifier, communication destination identifier, service link identifier, protocol version, cipher suite, certificate chain verification result, key negotiation result, and handshake failure reason. The cryptographic service call record includes the session time, communication source identifier, communication destination identifier, service link identifier, signature verification result, encryption / decryption call result, and service return status. The session return record includes the session time, communication source identifier, communication destination identifier, service link identifier, and session return status. The secure communication handshake records, cryptographic service call records, and session return records are recorded and merged according to session time, communication source identifier, communication destination identifier, and service link identifier to form cryptographic communication session data. Write the protocol version, cipher suite, certificate chain verification result, key negotiation result, and handshake failure reason from the secure communication handshake record into the cryptographic communication session data; Write the signature verification result, encryption / decryption call result, and service return status from the cryptographic service call record into the cryptographic communication session data; write the session return status from the session return record into the cryptographic communication session data; The session time is converted into a time value corresponding to a uniform time granularity. The uniform time granularity is determined by the smallest common granularity of the timestamp precision in the secure communication handshake record, cryptographic service call record, and session return record. The communication source identifier is uniformly written into the communication source identifier field, the communication destination identifier is uniformly written into the communication destination identifier field, the service link identifier is uniformly written into the service link identifier field, the protocol version is uniformly written into the protocol version field, and the cipher suite is uniformly written into the cipher suite field. The certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result and session return status are converted into a unified status code, where a success status is written as 0, a failure status as 1, an abnormal status as 2, and a missing status as 9. The handshake failure reason is converted into a unified reason code, where 0 is written for no failure reason, 1 is written for certificate chain failure, 2 is written for key negotiation failure, 3 is written for cipher suite mismatch, 4 is written for protocol version mismatch, and 5 is written for service return exception. When performing local irreversible mapping on the communication source identifier, the communication source identifier, the local salt value of the network device, and the source field identifier are concatenated in sequence, and the source mapping value is obtained by using SM3 hash operation; When performing local irreversible mapping on the communication destination identifier, the communication destination identifier, the local salt value of the network device, and the destination field identifier are concatenated in sequence, and the destination mapping value is obtained by using SM3 hash operation; When performing local irreversible mapping of the service link identifier, the service link identifier, the network device local salt value, and the link field identifier are concatenated in sequence, and the link mapping value is obtained by SM3 hash operation; the network device local salt value is generated and saved locally by the corresponding network device and is not uploaded to other network devices; The session element consists of the normalized session time, source mapping value, destination mapping value, link mapping value, protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status.

[0020] In this embodiment, S2 specifically refers to: Read the source mapping value, destination mapping value, link mapping value, protocol version, and cipher suite from the session element; concatenate the fields in the order of source mapping value, destination mapping value, link mapping value, protocol version, and cipher suite, and add separators between adjacent fields to obtain the session identifier; The session time is converted into milliseconds starting from midnight of the day. The milliseconds are then divided by an integer quotient of the milliseconds corresponding to the unified time granularity to obtain the time slice. Session elements with the same session identifier are grouped into the same session set. Within the same session set, session elements are arranged in ascending order of time slice. If multiple session elements exist within the same time slice under the same session identifier, then the session return status, handshake failure reason, certificate chain verification result, key negotiation result, signature verification result, and encryption / decryption call result in the multiple session elements are read sequentially. The fields of session return status, handshake failure reason, certificate chain verification result, key negotiation result, signature verification result, and encryption / decryption call result are compared in the same time slice. When comparing fields, the successful status is arranged before the failed status, the failed status is arranged before the abnormal status, and the abnormal status is arranged before the missing status. If the session return statuses are the same, compare the handshake failure reasons; if the handshake failure reasons are the same, compare the certificate chain verification results; if the certificate chain verification results are the same, compare the key negotiation results; if the key negotiation results are the same, compare the signature verification results; if the signature verification results are the same, compare the encryption / decryption call results; arrange the results according to time slices and compare the fields within the same time slice to generate a session sequence.

[0021] In this embodiment, the session sequence is segmented based on the state differences between session elements in adjacent time slices to generate steady-state segments and change segments, specifically as follows: Read session cells with the same session identifier from the session sequence, and form the previous session cell and the next session cell in ascending order of time slice; The protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status are used as comparison fields. The field values ​​of the previous session element and the next session element in each comparison field are compared for consistency. If the field values ​​are consistent, it is recorded as no state difference, and if the field values ​​are inconsistent, it is recorded as a state difference. The state difference consists of the session identifier, the time slice of the previous session element, the time slice of the next session element, the inconsistent field name, the inconsistent field value of the previous session element, and the inconsistent field value of the next session element. If the field values ​​of the previous session element and the next session element are consistent in all the comparison fields, then the previous session element and the next session element are classified into the steady state segment. If the field values ​​of the previous session element and the next session element are inconsistent in any comparison field, the previous session element and the next session element will be included in the change segment, and the state difference will be written into the change segment. The session sequence is scanned in ascending order of time slices. Session cells that are consecutively assigned to the steady-state segment and have the same session identifier are merged into the same steady-state segment. The session sequence is also scanned in ascending order of time slices. Session cells that are consecutively assigned to the change segment and have the same session identifier are merged into the same change segment. The steady-state segment includes the session identifier, start time slice, end time slice, and session cells assigned to the steady-state segment. The change segment includes the session identifier, start time slice, end time slice, session cells assigned to the change segment, and state differences. If the same session element forms a change segment with the previous session element and a steady-state segment with the next session element, then the same session element is retained at the end of the change segment and used as the beginning of the steady-state segment. If the same session element forms a steady-state segment with the previous session element and a change segment with the next session element, then the same session element is retained at the end of the steady-state segment and used as the starting position of the change segment.

[0022] In this embodiment, session elements located after the change segment and belonging to the same session identifier are reviewed. If the reviewed session elements retain the same state differences, the corresponding session sequence is marked as a review segment, and a sample pool is generated based on the steady-state segment, the change segment, and the review segment. Specifically: Read the session identifier, end time slice, last session element, and state difference from the changed segment; in the session sequence with the same session identifier, select the session element whose time slice is greater than the end time slice to generate candidate session elements; If there is a next change segment before the candidate session element, then the candidate session element after the end time slice and before the start time slice of the next change segment is selected as the review session element; if there is no next change segment before the candidate session element, then the candidate session elements between the end time slice and the end of the session sequence are selected as the review session elements; the review session elements are arranged in ascending order of time slices. The protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status in the last session element and each lookback session element are compared field by field to obtain the lookback status difference. The lookback status difference consists of the session identifier, the time slice of the last session element, the time slice of the lookback session element, the inconsistency field name, the inconsistency field value of the last session element, and the inconsistency field value of the lookback session element. The status differences in the review segment are compared with those in the change segment. If the status differences in the review segment and the status differences in the change segment are consistent in terms of inconsistent field names, field values ​​before the change, and field values ​​after the change, it is determined that the same status differences are retained in the review session element. Review session elements that retain the same status differences are merged into a review segment in ascending order of time slices. The review segment includes the session identifier, start time slice, end time slice, session elements to be included in the review segment, and review status differences. Write session elements from the steady-state segment to the steady-state pool; write session elements from the change segment to the change pool; write session elements from the lookback segment to the lookback pool; arrange the steady-state pool, change pool, and lookback pool in ascending order according to session identifier and time slice, and combine them to generate a sample pool.

[0023] In this embodiment, S4 specifically refers to: Read state differences from the session sequence and sample pool. State differences include session identifier, previous time slice, next time slice, inconsistent field name, field value before change, and field value after change. If the inconsistent field name is "Protocol Version," a protocol offset is generated based on the session identifier, the previous time slice, the next time slice, the protocol version before the change, and the protocol version after the change. If the inconsistent field name is "Cryptographic Suite," a suite offset is generated based on the session identifier, the previous time slice, the next time slice, the cipher suite before the change, and the cipher suite after the change. If the inconsistent field name is "Certificate Chain Verification Result," a certificate offset is generated based on the session identifier, the previous time slice, the next time slice, the certificate chain verification result before the change, and the certificate chain verification result after the change. If the inconsistent field name is "Key Negotiation Result," a negotiation offset is generated based on the session identifier, the previous time slice, the next time slice, the key negotiation result before the change, and the key negotiation result after the change. If the inconsistent field name is... If the field name is "Signature Verification Result", then a verification offset item is generated based on the session identifier, the previous time slice, the next time slice, the signature verification result before the change, and the signature verification result after the change. If the inconsistent field name is "Encryption / Decryption Call Result", then a call offset item is generated based on the session identifier, the previous time slice, the next time slice, the encryption / decryption call result before the change, and the encryption / decryption call result after the change. If the inconsistent field name is "Handshake Failure Reason", then a failure offset item is generated based on the session identifier, the previous time slice, the next time slice, the handshake failure reason before the change, and the handshake failure reason after the change. If the inconsistent field name is "Session Return Status", then a return offset item is generated based on the session identifier, the previous time slice, the next time slice, the session return status before the change, and the session return status after the change. Protocol offsets, package offsets, certificate offsets, negotiation offsets, signature verification offsets, call offsets, failure offsets, and return offsets are grouped according to session identifiers; Under the same session identifier, the protocol offset, package offset, certificate offset, negotiation offset, signature verification offset, call offset, failure offset, and return offset are arranged in ascending order of the previous time slice and the next time slice. Under the same previous time slice and the same subsequent time slice, each offset item is arranged in the following order: protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status. The arranged offset items are written into the offset spectrum in the order of session identifier and time slice. The offset spectrum includes session identifier, previous time slice, next time slice, offset item type, field value before change, field value after change, and source pool. The source pool is written into the steady-state pool, change pool, or lookback pool according to the source of the offset item. When performing ordinal correction on the offset spectrum, the offset items within the same session identifier and the same time slice range are rearranged according to the field order of protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status. If an offset item in the offset spectrum is later in the time slice order but earlier in the field order, then the offset item's position in the offset spectrum is adjusted according to the field order; if an offset item in the offset spectrum is earlier in the time slice order but later in the field order, then the offset item's position in the offset spectrum is adjusted according to the field order; the protocol offset item, suite offset item, certificate offset item, negotiation offset item, and signature verification offset item that are ranked earlier after sequence correction are taken as candidate offset items for risk category association. If a candidate offset is associated with a certificate chain verification failure, key negotiation failure, signature verification failure, cipher suite change, or protocol version change, the candidate offset is marked as the primary offset. The call offset, failure offset, and return offset, which are ordered after the primary offset, are marked as consequences. The primary offset includes the session identifier, time slice, primary field name, field value before change, and field value after change. The consequences include the session identifier, time slice, consequences field name, field value before change, and field value after change.

[0024] In this embodiment, a link group is generated based on the session element, and a session family is generated within the same link group based on the ordered combination of cryptographic communication states, specifically as follows: Read the source mapping value, destination mapping value, link mapping value, protocol version, cipher suite, session time, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason and session return status from the session metadata; Arrange the data in the following order: source mapping value, destination mapping value, link mapping value, protocol version, and cipher suite, and add separators between adjacent fields to generate link groups; group session cells with the same link group into the same link group; within the same link group, arrange the session cells in ascending order according to the time slice corresponding to the session time. Read the certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason and session return status sequentially from the sorted session data. Arrange the fields in the following order: certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status. Generate the cryptographic communication status corresponding to a single session element. Arrange the cryptographic communication status corresponding to multiple session elements in the same link group in ascending order of time slice to generate an ordered combination of cryptographic communication statuses. Group session elements with the same ordered combination into the same session family. If there are multiple ordered combinations within the same link group, they are assigned to different session families according to their ordered combinations. If multiple session elements within the same link group have identical field values ​​in the certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status, then these multiple session elements will be grouped into the same session family. If multiple session elements within the same link group have inconsistent values ​​in any field of certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status, they are respectively assigned to the corresponding session family according to the ordered combination formed by the field values. The session family includes the link group, time slice range, session elements assigned to the session family, certificate chain verification result sequence, key negotiation result sequence, signature verification result sequence, encryption / decryption call result sequence, handshake failure reason sequence, and session return status sequence.

[0025] In this implementation, local situational parameters are generated based on link groups, session families, primacy items, consequence items, and sample pools, specifically as follows: Read session elements from the steady-state pool, change pool, and lookback pool in the sample pool; count the total number of session elements in the sample pool; For each link group, count the number of session cells in the steady-state pool, change pool, and lookback pool respectively. Divide the number of session cells in the steady-state pool, change pool, and lookback pool of the link group by the total number of session cells in the sample pool to obtain the link group distribution value. For each session family, count the number of session elements in the steady-state pool, change pool, and lookback pool respectively. Divide the number of session elements in the steady-state pool, change pool, and lookback pool by the total number of session elements in the sample pool to obtain the session family distribution value. For each primary factor, count the number of times the primary factor appears in the steady-state pool, the change pool, and the review pool respectively. Divide the number of times the primary factor appears in the steady-state pool, the change pool, and the review pool by the total number of primary factors in the sample pool to obtain the primary factor distribution value. For each consequence item, count the number of times the consequence item appears in the steady-state pool, the change pool, and the review pool respectively. Divide the number of times the consequence item appears in the steady-state pool, the change pool, and the review pool by the total number of consequence items in the sample pool to obtain the consequence item distribution value. Under the same session identifier, the primary cause and the consequence of the same or adjacent time slices are paired, and the number of pairings between each primary cause and each consequence is counted. The number of pairings between each primary cause and each consequence is divided by the total number of pairings in the sample pool to obtain the corresponding value. The local situation parameters are generated by arranging the distribution values ​​of link groups, session families, primary causes, consequences, and corresponding values ​​in the order of link group, session family, primary cause, consequence, and corresponding values. The local situation parameters include the distribution values ​​of link groups, session families, primary causes, consequences, and corresponding values.

[0026] In this embodiment, S6 specifically refers to: Multiple network devices read local situational parameters, which include link group distribution values, session family distribution values, primary cause distribution values, consequence distribution values, and corresponding values. Before the first round of federated near-end updates, multiple network devices upload summaries of the distribution values ​​in their local situational parameters, and the average of the summaries uploaded by multiple network devices forms the initial global situational parameters. Multiple network devices receive global situational parameters generated by the previous round of federated collaborative aggregation during non-first round of federated near-end updates; For each link group, the absolute value of the difference between the link group distribution value in the local situation parameters and the link group distribution value in the global situation parameters is calculated, and the reciprocal of the absolute value of the difference plus one is used as the near-end weight of the link group. For each session family, the absolute value of the difference between the session family distribution value in the local situation parameters and the session family distribution value in the global situation parameters is calculated, and the reciprocal of the absolute value of the difference plus one is used as the near weight of the session family. For each primary factor, the absolute value of the difference between the primary factor distribution value in the local situation parameters and the primary factor distribution value in the global situation parameters is calculated to obtain the primary factor difference value. For each consequence item, the absolute value of the difference between the consequence item distribution value in the local situation parameters and the consequence item distribution value in the global situation parameters is calculated to obtain the consequence difference value; the primary cause difference value and the consequence difference value are added together and then 1 is added, and the reciprocal of the sum is used as the primary cause proximal weight. The number of session cells in the steady-state pool, change pool, and lookback pool in the sample pool are counted separately. The number of session cells in the steady-state pool, change pool, and lookback pool are divided by the total number of session cells in the sample pool to obtain the percentage of steady-state pool, change pool, and lookback pool, respectively. The proportion of the steady-state pool is used as the near-end weight of the steady-state pool, the proportion of the change pool is used as the near-end weight of the change pool, and the proportion of the lookback pool is used as the near-end weight of the lookback pool to obtain the near-end weight of the pool. The link group near-end term is obtained by multiplying the square of the difference between the link group distribution value in the local situation parameters and the link group distribution value in the global situation parameters by the link group near-end weight. The conversation family near-end term is obtained by multiplying the square of the difference between the conversation family distribution value in the local situation parameters and the conversation family distribution value in the global situation parameters by the conversation family near-end weight. The squared differences between the primary factor distribution values ​​in the local situation parameters and the primary factor distribution values ​​in the global situation parameters, and the squared differences between the consequence factor distribution values ​​in the local situation parameters and the consequence factor distribution values ​​in the global situation parameters are added together, and the sum is multiplied by the primary factor proximal weight to obtain the primary factor proximal term. Multiply the proportions of the steady-state pool, the change pool, and the review pool by the squares of the differences in the situational parameters in their respective pools, and then add the products together to obtain the near-end terms of each pool. Risk assessment loss is obtained based on the difference between local situation parameters and local risk markers; The source attribution loss is obtained based on the differences between the primacy item, the consequence item, and the local risk source markers; The co-occurrence offset loss is obtained based on the difference between the offset terms in the offset spectrum and the ordered combination of cryptographic communication states in the session family; The local training objective of the improved FedProx algorithm is obtained by adding the risk assessment loss, source attribution loss, co-occurrence offset loss, link group near term, session family near term, primary cause near term, and pooling near term. The local situation parameters are iteratively updated multiple times according to the local training objective. In each iteration, the value corresponding to the local training objective is reduced to obtain the updated local situation parameters. A local update summary is generated based on the updated local situation parameters. The local update summary includes link group summary, session family summary, primary cause summary, consequence summary, sample pool summary, and training offset summary. The link group summary consists of the updated link group distribution value, the session family summary consists of the updated session family distribution value, the primacy summary consists of the updated primacy item distribution value, the consequence summary consists of the updated consequence item distribution value, the sample pool summary consists of the proportion of the steady-state pool, the proportion of the change pool, and the proportion of the lookback pool, and the training offset summary consists of the absolute value of the difference between the local situation parameters before and after the update. Multiple network devices upload local update summaries, but do not upload password communication session data, session elements, session sequences, source mapping values, destination mapping values, and link mapping values; The local update summaries uploaded by multiple network devices are merged according to link group summary, session family summary, primary cause summary, consequence summary and sample pool summary, and the average of the merged results is calculated to generate global situational parameters. Global situational parameters are distributed to multiple network devices; local situational parameters to be identified are generated based on the cryptographic communication session data to be identified; the local situational parameters to be identified are compared with the global situational parameters to obtain the situational difference results; situational awareness results are generated based on the situational difference results, primary causes, consequences, and link groups. The situational awareness results include risk categories, risk sources, affected links, and action directions.

[0027] In this embodiment, the improved FedProx algorithm inherits the local training, near-end constraint, and federated aggregation processes of the FedProx algorithm. Each network device retains the constraints of the global situation parameters during the local situation parameter update process, ensuring that the local situation parameters do not deviate excessively from the global situation parameters due to differences in the distribution of cryptographic communication sessions within a single network device. Based on this, the improved FedProx algorithm transforms the original single near-end constraint into a multi-layered near-end constraint related to the state of the cryptographic communication session. Specifically, the link group distribution value, session family distribution value, primacy term distribution value, consequence term distribution value in the local situation parameters, as well as the steady-state pool, change pool, and lookback pool in the sample pool, are respectively incorporated into the near-end constraint calculation, generating link group near-end items, session family near-end items, primacy term near-end items, and pool-specific near-end items. Among these, the link group near-end item is used to constrain different communication link types. The improved FedProx algorithm, under the current situation parameter shift model, uses several improvements. The session family near-end term constrains the situation parameter shift of ordered combinations of different cryptographic communication states within the same link group. The primacy near-end term retains primacy terms related to risk sources and reduces the interference of consequence terms on risk attribution. The pooling near-end term distinguishes the impact of samples corresponding to steady-state segments, changed segments, and lookback segments on local updates. Through these improvements, the FedProx algorithm retains its ability to suppress local parameter drift while enabling the federated near-end update process to adapt to link differences, state combination differences, primacy / cause / effect differences, and sample pool differences within cryptographic communication sessions. This reduces the federated aggregation shift caused by inconsistent distribution of cryptographic communication sessions between different network devices, minimizes the interference of short-term change data on global situation parameters, and improves the retention of low-frequency combinatorial cryptographic risks in situation awareness results.

[0028] In this embodiment, a cryptographic security situation awareness system based on federated learning includes the following modules: The session generation module is used by multiple network devices to obtain the password communication session data associated with their respective network devices, perform field normalization and local irreversible mapping, and generate session elements. The sequence generation module is used to determine the session identifier based on the session element, sort the session elements under the same session identifier according to the time slice, and generate a session sequence. The segmented review module is used to segment the session sequence based on the state differences between session elements in adjacent time slices, generating steady-state segments and changed segments; it reviews session elements located after the changed segment that belong to the same session identifier, and if the same state differences are retained in the reviewed session elements, the corresponding session sequence is marked as a review segment, and a sample pool is generated based on the steady-state segment, changed segment, and review segment; The offset correction module is used to generate an offset spectrum based on the session sequence and sample pool, and to perform ordinal correction on the offset spectrum to generate primacy and consequence terms. The situation generation module is used to generate link groups based on session elements, generate session families within the same link group based on the ordered combination of cryptographic communication states, and generate local situation parameters based on link groups, session families, primary factors, consequences, and sample pools. The federated update module is used to perform federated near-end updates of local situation parameters using an improved FedProx algorithm, generate local update summaries, perform federated collaborative aggregation of local update summaries generated by multiple network devices, generate global situation parameters, and generate situation awareness results based on global situation parameters.

[0029] Example 1: To verify the feasibility of this invention in practice, it was applied to a cryptographic security situation awareness scenario in a financial business network. This network includes 24 devices across six categories: business servers, authentication servers, encryption gateways, key management devices, certificate service devices, and cryptographic service devices. The business system generates approximately 1.8 million secure communication handshake records, cryptographic service call records, and session return records daily, involving TLS secure communication, certificate chain verification, key negotiation, signature verification, encryption / decryption calls, and session return status. Since communication source identifiers, communication destination identifiers, and business link identifiers reflect business access paths and cryptographic service call relationships, the original cryptographic communication session data cannot be centrally uploaded, making traditional centralized situation analysis insufficient to meet local data protection requirements.

[0030] When applying this invention, multiple network devices read the cryptographic communication session data associated with their respective network devices. The system standardizes the fields for session time, protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status. It also performs local irreversible mapping on the communication source identifier, communication destination identifier, and service link identifier to generate session elements. Subsequently, the system determines the session identifier based on the source-end mapping value, destination-end mapping value, link mapping value, protocol version, and cipher suite, and generates a session sequence according to time slices. The system performs field-by-field comparison of session elements in adjacent time slices, classifying consecutive consistent session elements into a steady-state segment and session elements with state differences into a change segment. It then reviews session elements belonging to the same session identifier after the change segment. If the reviewed session elements still retain the same state difference, the corresponding session sequence is marked as a review segment. This process can distinguish between short-term communication fluctuations, normal cryptographic configuration changes, and persistent cryptographic risks.

[0031] During the 30-day verification process, data from the first 20 days was used to generate global situational parameters, and data from the last 10 days was used to verify the effectiveness of situational awareness. A total of 18.634 million cryptographic communication session data entries were recorded during the test, resulting in 18.634 million session elements, 417,000 session sequences, 32,600 change segments, and 8,124 replay segments. After manual review, 1,487 persistent risks related to certificate chain verification failures, key negotiation failures, and signature verification failures were identified in the replay segments. These risks primarily fell into three categories: failure to synchronize the trust chain after certificate chain updates, inconsistent cipher suite configurations, and failure to synchronize key negotiation strategies.

[0032] Table 1. Comparison of the effectiveness of cryptographic communication state segmentation and risk identification.

[0033] As shown in Table 1, traditional single-point anomaly monitoring mainly relies on single handshake failures, certificate chain verification failures, or session return anomalies for judgment. It cannot identify whether state differences under the same session identifier persist, thus easily misjudging short-term state fluctuations and normal configuration changes as risks. This invention constructs a sample pool by defining steady-state segments, change segments, and lookback segments, and performs ordinal correction based on offset spectra. This further marks persistent state differences as lookback segments, increasing the persistent risk identification rate from 73.03% to 92.74%. Simultaneously, the number of false alarms for normal configuration changes decreased from 416 to 129, indicating that lookback processing can effectively distinguish between normal changes and persistent risks; the average risk location time was shortened from 21.6 minutes to 8.4 minutes, demonstrating the supporting role of primacy and consequence factors in risk source location.

[0034] Table 2 Comparison of FedProx Algorithm's Federated Near-End Update Performance

[0035] As shown in Table 2, none of the three federation methods uploaded the original cryptographic communication session data, which meets the local data protection requirements. However, FedAvg lacks constraints on the differences in session distribution between different network devices, and the cross-device risk identification accuracy is only 84.18%. The FedProx algorithm reduces local parameter deviation through near-end constraints, improving the accuracy to 88.63%, but it lacks detailed processing of differences in link groups, session families, primacy items, consequence items, and sample pools. The improved FedProx algorithm further introduces near-end items for link groups, session families, primacy items, and pooling, reducing the global situation parameter convergence rounds to 24 rounds, increasing the low-frequency combination risk recall rate to 89.32%, and reducing the single link abnormal interference rate to 5.91%. This demonstrates that the present invention can improve the stability of federated collaborative aggregation and the accuracy of cryptographic security situation awareness while maintaining the non-centralized sharing of original data.

[0036] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A cryptographic security situation awareness method based on federated learning, characterized in that, Includes the following steps: S1. Multiple network devices respectively obtain the cryptographic communication session data associated with their respective network devices, perform field normalization and local irreversible mapping, and generate session elements; S2. Determine the session identifier based on the session element, sort the session elements under the same session identifier according to the time slice, and generate a session sequence; S3. Based on the state differences between session elements in adjacent time slices in the session sequence, the session sequence is segmented to generate steady-state segments and change segments; session elements located after the change segment and belonging to the same session identifier are reviewed. If the same state differences are retained in the reviewed session elements, the corresponding session sequence is marked as a review segment, and a sample pool is generated based on the steady-state segment, change segment, and review segment. S4. Generate an offset spectrum based on the session sequence and sample pool, and perform ordinal correction on the offset spectrum to generate primacy and consequence terms; S5. Generate link groups based on session elements, generate session families within the same link group based on the ordered combination of cryptographic communication states, and generate local situational parameters based on link groups, session families, primary factors, secondary factors, and sample pools. S6. The improved FedProx algorithm is used to perform federated near-end updates on the local situation parameters to generate a local update summary. The local update summaries generated by multiple network devices are federated and aggregated to generate global situation parameters. Situation awareness results are generated based on the global situation parameters.

2. The cryptographic security situation awareness method based on federated learning according to claim 1, characterized in that, Specifically, S1 is: Multiple network devices read the secure communication handshake record, cryptographic service call record, and session return record of their respective network devices. Extract session time, communication source identifier, communication destination identifier, business link identifier, protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason and session return status from secure communication handshake record, cryptographic service call record and session return record to form cryptographic communication session data; The cryptographic communication session data is standardized according to unified field names, unified time granularity, and unified status coding. Perform local irreversible mapping on the communication source identifier, communication destination identifier, and service link identifier to generate source-end mapping value, destination-end mapping value, and link mapping value; The session element consists of the normalized session time, source mapping value, destination mapping value, link mapping value, protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status.

3. The cryptographic security situation awareness method based on federated learning according to claim 1, characterized in that, Specifically, S2 is: The session identifier is obtained by combining the source mapping value, destination mapping value, link mapping value, protocol version, and cipher suite from the session element; Convert the session time in the session element into time slices according to a uniform time granularity; Arrange session elements with the same session identifier in ascending order of time slice to generate a session sequence; If multiple session elements exist within the same time slice under the same session identifier, they are arranged in the order of the fields: session return status, handshake failure reason, certificate chain verification result, key negotiation result, signature verification result, and encryption / decryption call result, to generate a session sequence.

4. The cryptographic security situation awareness method based on federated learning according to claim 1, characterized in that, The step of segmenting the session sequence based on the state differences between session elements in adjacent time slices to generate steady-state segments and change segments specifically involves: Select the preceding and following session elements corresponding to adjacent time slices from the session sequence in sequence; The protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason, and session return status in the previous and next session units are compared field by field to obtain the status differences; If the field-by-field comparison results of the previous session element and the next session element are consistent, then the previous session element and the next session element are classified into the steady state segment. If there are inconsistent fields in the field-by-field comparison results between the previous session element and the next session element, then the previous session element and the next session element will be classified into the change segment. Based on the ascending time slice order in the session sequence, session elements that are consecutively assigned to the steady-state segment are merged to generate a steady-state segment. The session cells that are consecutively assigned to the change segment are merged in ascending order of time slices in the session sequence to generate the change segment.

5. The cryptographic security situation awareness method based on federated learning according to claim 1, characterized in that, The process involves reviewing session elements located after the change segment and belonging to the same session identifier. If the reviewed session elements retain the same state differences, the corresponding session sequence is marked as a review segment. A sample pool is then generated based on the steady-state segment, the change segment, and the review segment. Specifically: Under the same session identifier, select session cells located after the change segment in ascending order of time slices to generate review session cells; The review session element is compared field by field with the last session element in the change segment to obtain the review status difference. If the lookback state difference contains the same state difference as the change segment, then the session sequence corresponding to the lookback session element is marked as a lookback segment. Session elements in the steady-state segment are written to the steady-state pool, session elements in the change segment are written to the change pool, and session elements in the lookback segment are written to the lookback pool. These are then combined to generate the sample pool.

6. The cryptographic security situation awareness method based on federated learning according to claim 1, characterized in that, Specifically, S4 is: Generate protocol offset, package offset, certificate offset, negotiation offset, signature verification offset, call offset, failure offset, and return offset based on the fields to which the state differences belong; Arrange the protocol offsets, package offsets, certificate offsets, negotiation offsets, signature verification offsets, call offsets, failure offsets, and return offsets in ascending order according to session identifier and time slice to generate an offset spectrum; The offset items in the offset spectrum are corrected according to the field order of protocol version, cipher suite, certificate chain verification result, key negotiation result, signature verification result, encryption / decryption call result, handshake failure reason and session return status. The offset items that are ranked first after ordinal correction and are associated with the risk category are marked as primacy items; Offset items that are sorted after the primary item after the ordinal correction and are associated with the session return status, handshake failure reason, or encryption / decryption call result are marked as consequence items.

7. The cryptographic security situation awareness method based on federated learning according to claim 1, characterized in that, The step of generating link groups based on session elements, and generating session families within the same link group based on ordered combinations of cryptographic communication states, specifically involves: The source mapping value, destination mapping value, link mapping value, protocol version, and cipher suite are combined to generate a link group; session elements with the same link group are grouped into the same link group. Within the same link group, extract the certificate chain verification results, key negotiation results, signature verification results, encryption / decryption call results, handshake failure reasons, and session return status in ascending order of time slices to generate an ordered combination of cryptographic communication states; group session elements with the same ordered combination into the same session family.

8. The cryptographic security situation awareness method based on federated learning according to claim 1, characterized in that, The generation of local situational parameters based on link groups, session families, primacy items, consequence items, and sample pools is specifically as follows: The distribution values ​​of link groups, session families, primary causes, and secondary causes in the sample pool are statistically analyzed. The corresponding values ​​of primary causes and secondary causes under the same session identifier are also statistically analyzed to generate local situational parameters.

9. The cryptographic security situation awareness method based on federated learning according to claim 1, characterized in that, Specifically, S6 is: The link group near-end weight is generated based on the link group distribution value in the local situation parameters; the session family near-end weight is generated based on the session family distribution value in the local situation parameters; the primary cause near-end weight is generated based on the primary cause and consequence distribution values ​​in the local situation parameters; and the pool near-end weight is generated based on the number of session elements in the steady-state pool, change pool, and lookback pool in the sample pool. The link group near-end term is generated based on the link group near-end weight and the link group distribution value in the local situation parameters. The session family near term is generated based on the session family near term weight and the session family distribution value in the local situation parameters; The primary factor proximal term is generated based on the primary factor proximal weight, the distribution values ​​of the primary factor term and the distribution values ​​of the consequence term in the local situation parameters; Pooled near-end items are generated based on the pooled near-end weights and the number of session elements in the steady-state pool, change pool, and lookback pool in the sample pool; The risk assessment loss, source attribution loss, co-occurrence offset loss, link group near-end item, session family near-end item, primary cause near-end item, and pooling near-end item are combined into the local training objective of the improved FedProx algorithm. The local situation parameters are then federated near-end updated to generate a local update summary. Federated collaborative aggregation of local update summaries generated by multiple network devices is performed to generate global situational parameters. Situational calculations are then performed on the cryptographic communication session data to be identified to generate situational awareness results.

10. A cryptographic security situation awareness system based on federated learning, comprising executing the cryptographic security situation awareness method based on federated learning as described in any one of claims 1 to 9, characterized in that, Includes the following modules: The session generation module is used by multiple network devices to obtain the password communication session data associated with their respective network devices, perform field normalization and local irreversible mapping, and generate session elements. The sequence generation module is used to determine the session identifier based on the session element, sort the session elements under the same session identifier according to the time slice, and generate a session sequence. The segmented review module is used to segment the session sequence based on the state differences between session elements in adjacent time slices, generating steady-state segments and changed segments; it reviews session elements that are located after the changed segment and belong to the same session identifier. If the same state differences are retained in the reviewed session elements, the corresponding session sequence is marked as a review segment, and a sample pool is generated based on the steady-state segment, changed segment, and review segment. The offset correction module is used to generate an offset spectrum based on the session sequence and sample pool, and to perform ordinal correction on the offset spectrum to generate primacy and consequence terms. The situation generation module is used to generate link groups based on session elements, generate session families within the same link group based on the ordered combination of cryptographic communication states, and generate local situation parameters based on link groups, session families, primary factors, consequences, and sample pools. The federated update module is used to perform federated near-end updates of local situation parameters using an improved FedProx algorithm, generate local update summaries, perform federated collaborative aggregation of local update summaries generated by multiple network devices, generate global situation parameters, and generate situation awareness results based on global situation parameters.

Images