Network security data privacy protection management system and method based on secure communication

Abstract

This invention relates to the field of network security technology and discloses a network security data privacy protection management system and method based on secure communication, including the following steps: collecting session handshake messages and application data statistical records and dividing them into handshake means and application data segments; extracting protocol elements to construct a protocol syntax tree set; generating a handshake embedding vector set through BYOL dual-view representation; selecting the handshake end embedding vector as a bridging vector; sliding window segmenting of application data segments and encoding them into an application latent representation vector set; performing CPC segmented bridging prediction on the bridging vector and the application latent representation vector set to generate a context representation vector set; generating a risk score vector from the context representation vector set and updating encrypted transmission control parameters to perform session key updates and session persistence control. This invention achieves continuous risk awareness across encrypted sessions, improving the timeliness of privacy protection and the reliability of transmission control.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security data privacy protection management system and method based on secure communication. Background Technology

[0002] In the process of secure data transmission over a network, session data is typically encrypted and protected using secure communication protocols. Existing technologies generally collect session handshake messages and application data statistics records, and assess risks based on information such as protocol status, connection duration, number of bytes transmitted, number of retransmissions, and access frequency. Based on the assessment results, session key updates, session persistence, or session termination controls are implemented to reduce the risk of privacy leaks during data transmission.

[0003] Existing technologies typically employ separate modeling for handshake techniques and application data segments. Protocol elements in handshake techniques often participate in analysis using ordinary fields or flat features, making it difficult to express the hierarchical, nested, and value-related relationships between these elements. This results in insufficient stability in identifying risk features such as handshake spoofing and abnormal negotiation. Risk assessment in application data segments primarily relies on the application data statistical records themselves. Risk representations formed by handshake techniques are difficult to continuously contribute to the context construction of application data segments, easily leading to breaks in risk evidence at stage transitions.

[0004] Existing encrypted transmission controls often employ fixed thresholds or fixed-period strategies, resulting in insufficient linkage between risk scores and session key updates and session persistence controls. When application data segments experience abnormal access density, retransmission fluctuations, or latency anomalies, key update responses are prone to lag, affecting the timeliness and reliability of network security data privacy protection management.

[0005] Therefore, how to provide a network security data privacy protection management system and method based on secure communication is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a network security data privacy protection management system and method based on secure communication. This invention utilizes protocol syntax trees, BYOL handshake representation, and CPC segmented bridging prediction to perform continuous risk modeling of handshake methods and application data segments, and dynamically executes session key updates and session persistence control based on risk scores. It has the advantages of strong risk perception continuity, high privacy protection timeliness, and good encrypted transmission stability.

[0007] The network security data privacy protection management system and method based on secure communication according to embodiments of the present invention includes the following steps: Collect session handshake messages and application data statistics records, and divide the handshake method and application data segment according to the protocol status; Extract protocol elements from the grasping methods and construct a set of protocol syntax trees; Perform BYOL handshake representation, re-encode the protocol syntax tree set to obtain a first view set and a second view set, input the first view set into the online tree encoder to obtain an online handshake representation vector set, input the second view set into the target tree encoder to obtain a target handshake representation vector set, the online handshake representation vector set is subjected to projection mapping and prediction mapping to obtain a predicted handshake representation vector set, and the predicted handshake representation vector set and the target handshake representation vector set generate a handshake embedding vector set; Select the handshake method ending embedding vector from the handshake embedding vector set, and denote it as the bridging vector; The application data segment statistical records are divided into a sliding window to obtain an application segment set, and the application segment set is input into a time encoder to obtain an application latent representation vector set. Perform CPC segmented bridging prediction, concatenate the bridging vector with the application latent representation vector set segment by segment to obtain the bridging latent representation vector set, input the bridging latent representation vector set into the CPC context network to obtain the context representation vector set, and output the subsequent application latent representation vector from the CPC prediction head; A risk score vector is generated from the context representation vector set, the encrypted transmission control parameter set is updated according to the risk score vector, and session key update and session persistence control are performed according to the encrypted transmission control parameter set.

[0008] Optionally, the set of protocol syntax trees specifically includes: Extract protocol element fields from the handshake message and form a protocol element set; The root node of the protocol syntax tree is constructed using the set of protocol elements as the root node data. The protocol element set is split into a first-level element set and a child-level element set according to the hierarchical relationship of the protocol element fields, and a first-level child node is constructed and connected to the root node; Merge the child element sets according to the parent node number to which the elements belong, construct child nodes and connect them to the corresponding parent nodes, and repeat the node construction and connection process until the child element sets are completely split. Write a node type identifier and a node value identifier for each node in the protocol syntax tree, and output a set of protocol syntax trees.

[0009] Optionally, the BYOL specifically includes: The BYOL handshake representation uses the protocol syntax tree as the input object. The BYOL network consists of an online branch and a target branch. The online branch includes an online tree encoder, a projection mapping structure, and a prediction mapping structure. The target branch includes a target tree encoder and a projection mapping structure. Both the online tree encoder and the target tree encoder are tree structure coding networks. The tree structure coding network is configured with a root node representation generation unit and a parent-child node recursive aggregation unit. The root node representation generation unit is used to write the node features corresponding to the protocol element fields. The parent-child node recursive aggregation unit is used to generate node representation vectors according to the connection relationship from parent node to child node and output handshake representation vectors. The online branch outputs the online handshake representation vector set, which is then processed by the projection mapping structure and the prediction mapping structure to output the predicted handshake representation vector set. The target branch outputs the target handshake representation vector set, which is then processed by the projection mapping structure to output the target projected representation vector set.

[0010] Optionally, the recoding of the protocol syntax tree set specifically includes: Obtain the parent-child node connection relationship, node level number, node type identifier, and node value identifier for each protocol syntax tree in the protocol syntax tree set; perform node order reordering on the child node set corresponding to each parent node. The node order reordering is limited to the child node set corresponding to the same parent node. The parent-child node connection relationship remains unchanged, and the node level number remains unchanged. The reordered protocol syntax trees constitute the first view set. For each node's value identifier, a value replacement mapping is performed. The value replacement mapping is limited to the set of node value identifiers with the same node type identifier. The node type identifier remains unchanged, and the fixed-length encoding length of the node value identifier remains unchanged. The protocol syntax tree after the value replacement mapping constitutes the second view set.

[0011] Optionally, the generation of the handshake embedding vector set specifically includes: Perform a vector dimension consistency check on the predicted handshake representation vector set and the target handshake representation vector set to obtain a predicted handshake representation vector set and a target handshake representation vector set with consistent dimensions. Establish a one-to-one correspondence between the predicted handshake representation vector set and the target handshake representation vector set according to the sample order, and generate a set of vector pairs; Calculate the vector similarity for each vector pair in the set of vector pairs and obtain the similarity set; The predicted handshake representation vector set is output as a handshake embedding vector set in the order of vector pair sets, and the similarity set is associated with the handshake embedding vector set according to the correspondence.

[0012] Optionally, the CPC specifically includes: CPC segmented bridging prediction is implemented by combining a bridging input structure and a CPC network structure. The CPC network consists of a timing encoder, a CPC context network, and a CPC prediction head. The bridging input structure is used to receive the bridging vector and the application latent representation vector set, and uses the bridging vector as a fixed splicing vector to splice the application latent representation vector set piece by piece to generate the bridging latent representation vector set; The CPC context network receives the bridging latent representation vector set and outputs the context representation vector set. The CPC context network configures the context state update unit and the segmented bridging unit. The segmented bridging unit is used to keep the bridging vectors continuously present in the input vector of the context state update unit within the application data segment. The CPC prediction head receives the context representation vector set and outputs the subsequent application latent representation vector. The subsequent application latent representation vector maintains the same vector dimension as the application latent representation vector set. The number of steps output by the CPC prediction head is determined by the prediction step size.

[0013] Optionally, the execution of CPC segmented bridging prediction specifically includes: Obtain the bridging vector and apply the latent representation vector set; Determine the bridging vector dimension and the application latent representation vector dimension; read the application latent representation vectors one by one in the fragment order of the application latent representation vector set, perform vector concatenation with the current application latent representation vector to obtain the bridging latent representation vector corresponding to the current application fragment, repeat the vector concatenation until the application latent representation vector set is traversed to form the bridging latent representation vector set; The bridging latent representation vector set is input into the CPC context network in fragment order to obtain a context representation vector set that corresponds one-to-one with the bridging latent representation vector set; Obtain the prediction step size and output quantity, input the context representation vector set into the CPC prediction head and generate the subsequent application latent representation vector set according to the prediction step size. The vector dimension of the subsequent application latent representation vector set is consistent with the vector dimension of the application latent representation vector set. The subsequent application latent representation vector set and the context representation vector set are established in the order of the segments and then output.

[0014] Optionally, the context state update of the CPC context network adopts a non-consistent update method between the application update branch and the bridge driver branch, including the following steps: Set the initial context state as the initial state vector, and obtain the corresponding application latent representation vector for each application segment of the application data segment; In the application update branch, the current application latent representation vector and the context state vector of the previous time step are used to perform state update calculation, and the intermediate update vector is output. In the bridged driving branch, the bridging vector is input into the fixed mapping structure to obtain the driving vector. The fixed mapping structure remains unchanged throughout the application data segment, and the driving vector maintains the same value throughout the application data segment. In the state synthesis step, the intermediate update vector and the driving vector execution vector are superimposed and input into the nonlinear mapping structure to output the current context state vector; Repeat the application update branch, bridge-driven branch and state synthesis steps until all application fragments of the application data segment are processed, and obtain the context state vector set and output it as the context representation vector set; The application update branch performs a state update calculation once at each application segment and outputs the corresponding intermediate update vector. The bridging drive branch only performs a fixed mapping structure calculation once at the beginning of the application data segment and outputs the drive vector, which is then reused in the subsequent state synthesis step.

[0015] Optionally, generating the risk score vector from the context representation vector set specifically includes: Obtain the context representation vector set; perform risk mapping calculation on each context representation vector in the context representation vector set to obtain the risk score vector set. The risk mapping calculation uses a risk mapping layer to map the context representation vectors to risk score vectors; perform threshold determination on the risk score vector set to obtain the risk control mark set; generate the encrypted transmission control parameter set based on the risk control mark set; trigger the session key update operation according to the encrypted transmission control parameter set and perform the session persistence control operation.

[0016] The network security data privacy protection management system based on secure communication according to an embodiment of the present invention includes: The session segmentation module is used to collect session handshake messages and application data statistics records, and to divide the handshake method and application data segments according to the protocol status; The protocol syntax tree construction module is used to extract protocol elements from the control method, construct a protocol syntax tree set, and write node type identifiers and node value identifiers for nodes. The BYOL handshake representation module is used to re-encode the protocol syntax tree set to obtain the first view set and the second view set, which are then passed through the online tree encoder and the target tree encoder to obtain the online handshake representation vector set and the target handshake representation vector set, respectively, and generate the handshake embedding vector set. The cross-segment bridging module is used to select the corresponding embedding vector for the end of the handshake method from the handshake embedding vector set as the bridging vector, and the handshake method risk representation enters the application data segment; The CPC segmented bridging prediction module is used to divide the application data segment statistical records into application segment sets, generate application latent representation vector sets through a time encoder, and then concatenate the bridging vectors and application latent representation vector sets segment by segment into the CPC context network to obtain the context representation vector set. The risk control module is used to generate a risk score vector from the context representation vector set, update the encrypted transmission control parameter set according to the risk score vector, and perform session key update and session persistence control.

[0017] The beneficial effects of this invention are: (1) This invention extracts protocol elements from the handshake and constructs a protocol syntax tree set, so that the hierarchical relationship, nesting relationship and value association relationship between protocol elements can be expressed in a structured way. Combined with the BYOL handshake representation, a handshake embedding vector set is generated, which improves the identification stability of risk features such as handshake spoofing and abnormal negotiation.

[0018] (2) The present invention uses the handshake embedding vector corresponding to the end of the handshake as the bridging vector, and performs CPC segmented bridging prediction in the application data segment in combination with the application latent representation vector set, so that the risk representation of the handshake can continuously participate in the context construction of the application data segment, reducing the break of risk evidence at the stage switching point and improving the continuity of risk perception.

[0019] (3) The present invention generates a risk score vector based on the context representation vector set and updates the encrypted transmission control parameter set according to the risk score vector to perform session key update and session persistence control, so that key update and session control can be dynamically adjusted with risk changes, thereby improving the timeliness and reliability of network security data privacy protection management. Attached Figure Description

[0020] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of the network security data privacy protection management method based on secure communication proposed in this invention; Figure 2 This is a schematic diagram of session segmentation for the network security data privacy protection management method based on secure communication proposed in this invention; Figure 3 This is a two-view BYOL schematic diagram of the network security data privacy protection management method based on secure communication proposed in this invention. Detailed Implementation

[0021] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0022] refer to Figures 1-3 A network security data privacy protection management system and method based on secure communication includes the following steps: Collect session handshake messages and application data statistics records, and divide the handshake method and application data segment according to the protocol status; Extract protocol elements from the grasping methods and construct a set of protocol syntax trees; Perform BYOL handshake representation, re-encode the protocol syntax tree set to obtain a first view set and a second view set, input the first view set into the online tree encoder to obtain an online handshake representation vector set, input the second view set into the target tree encoder to obtain a target handshake representation vector set, the online handshake representation vector set is subjected to projection mapping and prediction mapping to obtain a predicted handshake representation vector set, and the predicted handshake representation vector set and the target handshake representation vector set generate a handshake embedding vector set; Select the handshake method ending embedding vector from the handshake embedding vector set, and denote it as the bridging vector; The application data segment statistical records are divided into a sliding window to obtain an application segment set, and the application segment set is input into a time encoder to obtain an application latent representation vector set. Perform CPC segmented bridging prediction, concatenate the bridging vector with the application latent representation vector set segment by segment to obtain the bridging latent representation vector set, input the bridging latent representation vector set into the CPC context network to obtain the context representation vector set, and output the subsequent application latent representation vector from the CPC prediction head; A risk score vector is generated from the context representation vector set, the encrypted transmission control parameter set is updated according to the risk score vector, and session key update and session persistence control are performed according to the encrypted transmission control parameter set.

[0023] In this embodiment, the collection of session handshake messages and application data statistics records specifically includes: Handshake message collection: Collect single-session handshake messages and form a handshake message set in the order of arrival. The handshake message includes message type, protocol status field, protocol element field, message length, and arrival timestamp. Application data statistics records are collected, and single-session application data statistics records are collected. Application data statistics record sets are formed according to the statistical period. Application data statistics records include message length, packet interval, round-trip delay, retransmission count, and record timestamp. The handshake mechanism and application data segment are separated. The protocol status field in the handshake message is parsed to determine the handshake completion position. The handshake message before the handshake completion position is identified as the handshake mechanism, and the application data statistics record after the handshake completion position is identified as the application data segment.

[0024] In this embodiment, constructing the protocol syntax tree set specifically includes: Extract protocol element fields from the handshake message and form a protocol element set; The root node of the protocol syntax tree is constructed using the set of protocol elements as the root node data. The protocol element set is split into a first-level element set and a child-level element set according to the hierarchical relationship of the protocol element fields, and a first-level child node is constructed and connected to the root node; Merge the child element sets according to the parent node number to which the elements belong, construct child nodes and connect them to the corresponding parent nodes, and repeat the node construction and connection process until the child element sets are completely split. Write a node type identifier and a node value identifier for each node in the protocol syntax tree, and output a set of protocol syntax trees.

[0025] In this implementation, the hierarchical relationship of the protocol syntax tree is determined by field attribution and nesting: In the handshake message, the parent and child fields of the protocol element fields are determined according to the carrying relationship. For protocol element fields with nested structures, the parent and child nodes are determined according to the order in which the outer field contains the inner field. The protocol element fields of the set type are used as the parent nodes and each element field in the set is used as the child node. The protocol element fields that appear repeatedly are numbered according to the order of appearance to generate multiple nodes of the same type and connected to the same parent node. When constructing the protocol syntax tree, protocol element fields are extracted from the handshake message to form a protocol element set. The root node data is generated from the protocol element set and the root node of the protocol syntax tree is created. Nodes are created sequentially according to the correspondence between parent and child fields and parent-child connections are established. The set fields are split into elements and the element-child node connections are established. The parent-child connection direction is corrected according to the inclusion relationship of nested fields. Duplicate fields are written with serial numbers according to the order of appearance and the connection is completed. After writing the node type identifier and node value identifier for each node, the protocol syntax tree set is output. The protocol element fields are parsed from the protocol element fields of the handshake message. The node type identifier is generated by combining the protocol element field name and the level number. The node value identifier is obtained by performing fixed-length encoding on the protocol element field value. The root node data is obtained by writing the session-level protocol element fields in the protocol element set in a fixed key order. When a protocol element field is missing, node creation is skipped. When a protocol element field value is empty, an empty value identifier is written and the node type identifier is retained.

[0026] In this embodiment, BYOL specifically includes: The BYOL handshake representation uses the protocol syntax tree as input. The BYOL network consists of an online branch and a target branch. The online branch includes an online tree encoder, a projection mapping structure, and a prediction mapping structure. The target branch includes a target tree encoder and a projection mapping structure. The projection mapping structure adopts a fully connected layer concatenation structure. The input is the handshake representation vector, and the output is the projection representation vector. The prediction mapping structure adopts a fully connected layer concatenation structure. The input is the projection representation vector, and the output is the predicted handshake representation vector. The dimensions of the projection representation vector and the predicted handshake representation vector are both set to the same fixed dimension. The projection mapping structure and the prediction mapping structure are concatenated in the online branch. The target branch is only connected to the projection mapping structure and not to the prediction mapping structure. Both the online tree encoder and the target tree encoder are tree-structured coding networks. The tree-structured coding network is configured with a root node representation generation unit and a parent-child node recursive aggregation unit. The root node representation generation unit is used to write the node features corresponding to the protocol element fields. The parent-child node recursive aggregation unit is used to generate node representation vectors according to the connection relationship from parent to child nodes and outputs a handshake representation vector. In this embodiment, the parent-child node recursive aggregation uses a bottom-up traversal method to generate node representation vectors. The traversal terminates when all leaf nodes have completed representation generation and the root node has completed representation generation. The parent-child node recursive aggregation unit executes node calculations according to the parent-child node connection relationship table. Leaf nodes generate node representation vectors first and recursively pass them upwards to the parent node. The parent node generates its own representation vector after receiving all child node representation vectors. The root node generates its own representation vector after receiving all first-level child node representation vectors and outputs a handshake representation vector. The online branch outputs the online handshake representation vector set, which is then processed by the projection mapping structure and the prediction mapping structure to output the predicted handshake representation vector set. The target branch outputs the target handshake representation vector set, which is then processed by the projection mapping structure to output the target projected representation vector set.

[0027] In this embodiment, the recoding of the protocol syntax tree set specifically includes: Obtain the parent-child node connection relationship, node level number, node type identifier, and node value identifier for each protocol syntax tree in the protocol syntax tree set; perform node order reordering on the child node set corresponding to each parent node. The node order reordering is limited to the child node set corresponding to the same parent node. The parent-child node connection relationship remains unchanged, and the node level number remains unchanged. The reordered protocol syntax trees constitute the first view set. For each node's value identifier, a value replacement mapping is performed. This mapping is limited to the set of value identifiers with the same node type identifier. The node type identifier remains unchanged, and the fixed-length encoding length of the value identifier remains unchanged. The protocol syntax tree after the value replacement mapping forms the second view set. If the number of elements in the set of value identifiers with the same node type identifier is less than a preset threshold, the value replacement mapping is skipped. The first and second view sets employ two different recoding methods to construct two distinct handshake representation inputs without altering the parent-child node connections in the protocol syntax tree. The first view set rearranges the node order within the child node set corresponding to the same parent node, preserving node type and value identifiers to form a structural view oriented towards differences in node arrangement. This ensures the online tree encoder maintains a consistent representation of changes in node order at the same level when processing handshake messages. The second view set replaces the mapping with node value identifiers within the same range of node type identifiers, preserving parent-child node connections and node hierarchy numbers. This forms a value view oriented towards differences in value perturbation, ensuring the target tree encoder maintains a consistent representation of changes in node values ​​when processing handshake messages. Both views are used together to construct the input for the BYOL handshake representation, enabling the handshake embedding vector set to simultaneously cover changes in the structural arrangement and field values ​​of handshake protocol elements.

[0028] In this embodiment, generating the handshake embedding vector set specifically includes: Perform a vector dimension consistency check on the predicted handshake representation vector set and the target handshake representation vector set to obtain a predicted handshake representation vector set and a target handshake representation vector set with consistent dimensions; use equal vector length as the consistency condition; the dimension mapping function adopts a fully connected linear mapping structure, the input dimension of the dimension mapping function is equal to the dimension of the predicted handshake representation vector, and the output dimension of the dimension mapping function is equal to the dimension of the target handshake representation vector. After the dimension mapping is completed, proceed to the vector pair set generation step. Establish a one-to-one correspondence between the predicted handshake representation vector set and the target handshake representation vector set according to the sample order, and generate a set of vector pairs; Calculate the vector similarity for each vector pair in the vector pair set and obtain the similarity set; the similarity is calculated using cosine similarity. The predicted handshake representation vector set is output as a handshake embedding vector set in the order of the vector pair sets, and the similarity set is associated with the handshake embedding vector set according to the correspondence. The handshake embedding vector set is composed of the predicted handshake representation vector set in the pairing order, and the numbering mapping relationship with the similarity set is retained.

[0029] In this embodiment, selecting the handshake termination corresponding embedding vector from the handshake embedding vector set specifically includes: Get the handshake completion location; Arrange the handshake embedding vector set according to the arrival order of the handshake messages within the handshake means, and establish a one-to-one correspondence with the handshake messages within the handshake means. Locate the handshake embedding vector corresponding to the handshake completion position in the one-to-one correspondence; determine the handshake embedding vector corresponding to the handshake completion position as the bridging vector.

[0030] In this embodiment, the application fragment set is input into the timing encoder to obtain the application latent representation vector set, specifically including: Obtain application data segment statistics records; set the sliding window length and sliding step size; extract continuous statistics records from the application data segment statistics records according to the sliding window length to form application segments, and repeat the extraction by moving the window position according to the sliding step size until the end of the application data segment statistics records, to obtain a set of application segments; Perform fixed-length alignment on each application fragment in the application fragment set, pad the end of application fragments with fewer statistical records than the length of the sliding window, and truncate the end of application fragments with more statistical records than the length of the sliding window to obtain a fixed-length application fragment set. The set of fixed-length application segments is input into the timing encoder to obtain the application latent representation vector set.

[0031] In this embodiment, CPC specifically includes: CPC segmented bridging prediction is implemented by combining a bridging input structure and a CPC network structure. The CPC network consists of a timing encoder, a CPC context network, and a CPC prediction head. The bridging input structure is used to receive the bridging vector and the application latent representation vector set, and uses the bridging vector as a fixed splicing vector to splice the application latent representation vector set piece by piece to generate the bridging latent representation vector set; The CPC context network receives the bridging latent representation vector set and outputs the context representation vector set. The CPC context network configures the context state update unit and the segmented bridging unit. The segmented bridging unit is used to keep the bridging vectors continuously present in the input vector of the context state update unit within the application data segment. The CPC prediction head receives the context representation vector set and outputs the subsequent application latent representation vector. The subsequent application latent representation vector maintains the same vector dimension as the application latent representation vector set. The number of steps output by the CPC prediction head is determined by the prediction step size.

[0032] In this embodiment, the context state update unit inputs the bridging latent representation vector segment by segment according to the segment order of the application segment set and performs state update, outputting the context representation vector corresponding to each segment, forming a context representation vector set with the same number as the bridging latent representation vector set; the CPC prediction head generates subsequent application latent representation vectors under the prediction step size constraint, and the subsequent application latent representation vectors establish a correspondence with the context representation vector set according to the segment order, and the subsequent application latent representation vectors correspond to the application segment latent representation vectors at the subsequent step positions in the application latent representation vector set.

[0033] In this embodiment, performing CPC segmented bridging prediction specifically includes: Obtain the bridging vector and apply the latent representation vector set; Determine the bridging vector dimension and the application latent representation vector dimension; read the application latent representation vectors one by one in the fragment order of the application latent representation vector set, perform vector concatenation with the current application latent representation vector to obtain the bridging latent representation vector corresponding to the current application fragment, repeat the vector concatenation until the application latent representation vector set is traversed to form the bridging latent representation vector set; The bridging latent representation vector set is input into the CPC context network in fragment order to obtain a context representation vector set that corresponds one-to-one with the bridging latent representation vector set; Obtain the prediction step size and output quantity, input the context representation vector set into the CPC prediction head and generate the subsequent application latent representation vector set according to the prediction step size. The vector dimension of the subsequent application latent representation vector set is consistent with the vector dimension of the application latent representation vector set. The subsequent application latent representation vector set and the context representation vector set are established in the order of the segments and then output.

[0034] In this embodiment, vector concatenation adopts a fixed concatenation order. The bridging vector and the application latent representation vector are concatenated according to their respective positions to form the bridging latent representation vector. The number of bridging latent representation vector sets is the same as the number of application latent representation vector sets. The bridging latent representation vector sets are arranged according to the application segment order and the segment order remains unchanged. The CPC context network receives the bridging latent representation vectors vector by vector according to the arrangement order of the bridging latent representation vector sets and outputs the context representation vectors. The number of context representation vector sets is the same as the number of bridging latent representation vector sets. The context representation vector sets are arranged according to the order of the bridging latent representation vector sets and the order remains unchanged.

[0035] In this embodiment, the context state update of the CPC context network adopts a non-consistent update method between the application update branch and the bridge driver branch, which includes the following steps: Set the initial context state as the initial state vector, and obtain the corresponding application latent representation vector for each application segment of the application data segment; In the application update branch, the current application latent representation vector and the context state vector of the previous time step are used to perform state update calculation, and the intermediate update vector is output. In the bridged driving branch, the bridging vector is input into the fixed mapping structure to obtain the driving vector. The fixed mapping structure remains unchanged throughout the application data segment, and the driving vector maintains the same value throughout the application data segment. In the state synthesis step, the intermediate update vector and the driving vector execution vector are superimposed and input into the nonlinear mapping structure to output the current context state vector; Repeat the application update branch, bridge-driven branch and state synthesis steps until all application fragments of the application data segment are processed, and obtain the context state vector set and output it as the context representation vector set; The application update branch performs a state update calculation once at each application segment and outputs the corresponding intermediate update vector. The bridging drive branch only performs a fixed mapping structure calculation once at the beginning of the application data segment and outputs the drive vector, which is then reused in the subsequent state synthesis step.

[0036] In this embodiment, the first mapping structure is a first linear mapping layer. The first linear mapping layer performs linear mapping on the current application latent representation vector and the previous context state vector, and then performs element-wise superposition. The superposition result is then subjected to element-wise nonlinear activation to obtain an intermediate update vector. The second mapping structure is a second linear mapping layer. The second linear mapping layer performs linear mapping on the bridging vector and performs element-wise nonlinear activation on the mapping result to obtain a driving vector. The state synthesis step performs element-wise addition on the intermediate update vector and the driving vector to obtain a synthesized vector. The synthesized vector is then subjected to element-wise nonlinear activation to obtain the current context state vector. The initial context state vector is initialized with a zero vector. The output dimensions of the first linear mapping layer and the second linear mapping layer are the same and are the same as the dimension of the context state vector.

[0037] In this embodiment, generating the risk score vector from the context representation vector set specifically includes: Obtain the context representation vector set; perform risk mapping calculation on each context representation vector in the context representation vector set to obtain the risk score vector set. The risk mapping calculation uses a risk mapping layer to map the context representation vectors to risk score vectors; perform threshold determination on the risk score vector set to obtain the risk control mark set; generate the encrypted transmission control parameter set based on the risk control mark set; trigger the session key update operation according to the encrypted transmission control parameter set and perform the session persistence control operation.

[0038] In this embodiment, risk mapping calculation is performed using a risk mapping layer. Context representation vectors are input to the risk mapping layer vector by vector in chronological order. The risk mapping layer is a cascaded structure of a fully connected linear mapping layer and a normalization function. The fully connected linear mapping layer outputs risk scores, and the normalization function maps these risk scores to risk scores between 0 and 1, forming a risk score vector set that corresponds one-to-one with the context representation vector set. A threshold of 0.7 is used for threshold determination; each risk score higher than 0.7 outputs a high-risk flag, and a persistent high-risk flag is output when three consecutive flags are high-risk. Risk control flags are used to generate a set of encrypted transmission control parameters. These risk control flags include low-risk, high-risk, and persistent high-risk flags. When the risk control flag is low-risk, the encrypted transmission control parameter set is set to... The standard key update cycle and standard session validity period are defined. When the risk control flag is set to high risk, the encrypted transmission control parameter set is set to shorten the key update cycle and enable the immediate key update trigger flag. When the risk control flag is set to persistent high risk, the encrypted transmission control parameter set is set to the immediate key update trigger flag and the session validity period is shortened. The session key update operation includes key update triggering and new key activation switching. The key update request is triggered according to the encrypted transmission control parameter set, the intra-session key update process is completed, and the new key is switched to participate in subsequent encrypted transmission. The session persistence control operation includes session validity period timing and session termination processing. The session validity period parameter is updated according to the encrypted transmission control parameter set. Sessions that have exceeded their validity period are terminated, and subsequent data transmission requests are rejected.

[0039] The network security data privacy protection management system based on secure communication according to an embodiment of the present invention includes: The session segmentation module is used to collect session handshake messages and application data statistics records, and to divide the handshake method and application data segments according to the protocol status; The protocol syntax tree construction module is used to extract protocol elements from the control method, construct a protocol syntax tree set, and write node type identifiers and node value identifiers for nodes. The BYOL handshake representation module is used to re-encode the protocol syntax tree set to obtain the first view set and the second view set, which are then passed through the online tree encoder and the target tree encoder to obtain the online handshake representation vector set and the target handshake representation vector set, respectively, and generate the handshake embedding vector set. The cross-segment bridging module is used to select the corresponding embedding vector for the end of the handshake method from the handshake embedding vector set as the bridging vector, and the handshake method risk representation enters the application data segment; The CPC segmented bridging prediction module is used to divide the application data segment statistical records into application segment sets, generate application latent representation vector sets through a time encoder, and then concatenate the bridging vectors and application latent representation vector sets segment by segment into the CPC context network to obtain the context representation vector set. The risk control module is used to generate a risk score vector from the context representation vector set, update the encrypted transmission control parameter set according to the risk score vector, and perform session key update and session persistence control.

[0040] Example 1: To verify the feasibility of this invention in practice, it was applied to a multi-service access link of a cloud service platform. This platform has a large number of encrypted sessions with complex access sources. Some sessions exhibit normal negotiation during the handshake phase, but show abnormal request density, abnormal retransmissions, or abnormal latency fluctuations in the application data segment. Traditional risk models typically rely on application data statistics for judgment. However, the lack of continuous correlation between the handshake mechanism and the application data segment makes it easy to lose handshake phase evidence at phase transitions, leading to a decrease in risk score, delayed key update triggering, and abnormal sessions continuously consuming connection resources, thus affecting the timeliness of network security and data privacy protection management.

[0041] In this scenario, the present invention employs an online bypass evaluation and control linkage approach. The platform access side continuously collects session handshake messages and application data statistics records, and divides the handshake mechanism and application data segments according to protocol status. Within the handshake mechanism, protocol element fields are extracted from the handshake messages to construct a protocol syntax tree set. The protocol syntax tree describes field carrying relationships, nesting and inclusion relationships, set field expansion relationships, and repeated field numbering relationships through parent-child node connections. Node type identifiers and node value identifiers are written for each node, transforming the handshake mechanism protocol elements from ordinary field representations into a structured expression.

[0042] The protocol syntax tree set enters the BYOL handshake representation process. The system re-encodes the protocol syntax tree set to obtain a first view set and a second view set. The first view set is input into the online tree encoder to obtain the online handshake representation vector set; the second view set is input into the target tree encoder to obtain the target handshake representation vector set. The online handshake representation vector set is then subjected to projection mapping and prediction mapping to obtain the predicted handshake representation vector set, and together with the target handshake representation vector set, a handshake embedding vector set is generated. Through this process, the system can learn the protocol structure relationships and field value perturbation relationships of the handshake means, improving the stability of identifying risk features such as handshake spoofing and abnormal negotiation.

[0043] After the handshake process concludes, the system selects the corresponding embedding vector from the handshake embedding vector set, denoted as the bridging vector. This bridging vector is used to transmit the risk representation of the handshake process to the application data segment, ensuring that the protocol structure information formed during the handshake phase remains usable in subsequent encrypted transmission phases. Within the application data segment, the system performs sliding window segmentation on the application data statistical records to obtain a set of application segments. This set of application segments is then input into a timing encoder to generate an application latent representation vector set. The bridging vector is then concatenated segment by segment with the application latent representation vector set to obtain the bridging latent representation vector set.

[0044] After the bridging latent representation vector set is input into the CPC context network, a context representation vector set is generated, and the CPC prediction head outputs the subsequent application latent representation vector. Through CPC segmented bridging prediction, the system can combine risk characterization of control methods and changes in application data segment behavior to continuously judge abnormal request density, retransmission fluctuations, and latency anomalies, reducing the breakage of risk evidence at stage switching. After obtaining the context representation vector set, the system generates a risk score vector and updates the encrypted transmission control parameter set according to the risk score vector. When the risk is low, the standard key update cycle and session validity period are maintained; when the risk increases, the key update cycle is shortened and an immediate key update is triggered; when the risk remains high, the session persistence parameters are adjusted, and termination control is performed on abnormal sessions.

[0045] To provide comparative verification, three control schemes were selected for evaluation. Control scheme A uses fixed-period key updates and fixed session validity periods, without risk awareness; control scheme B uses a time-series model based on application data statistical records to output risk scores and trigger control, without introducing handshake structure representation and bridging; control scheme C uses only handshake rule matching for risk assessment and trigger control, without introducing application data segment prediction and context modeling. The present invention employs a joint process of BYOL representation of the handshake protocol syntax tree and CPC segmented bridging prediction of application data segments. The evaluation samples cover normal and abnormal sessions, including high-frequency reconnection, abnormal calls after negotiation spoofing, sudden high retransmissions during the application phase, and abnormal latency fluctuations.

[0046] Table 1: Comparison of the Effectiveness of Secure Communication Data Privacy Protection Management

[0047] As shown in Table 1, Comparative Scheme A, due to its fixed-period control and lack of continuous risk awareness, has a risk identification accuracy of only 0.81, an anomaly false negative rate of 0.16, a key update response latency of 65.4 milliseconds, and an average duration of abnormal sessions of 182.5 seconds. This indicates that abnormal sessions may maintain their original key and connection states for a considerable period. Comparative Scheme B, by introducing application data statistics, improves the risk identification accuracy to 0.89 and reduces the key update response latency to 28.7 milliseconds. However, due to the lack of handshake protocol structure representation, it still suffers from discontinuous risk evidence when faced with abnormal behavior exposed in the application data segment after handshake spoofing. Comparative Scheme C can identify some anomalies in the handshake phase, but it does not perform continuous context prediction for the application data segment, resulting in an average duration of abnormal sessions of 121.7 seconds and insufficient control response.

[0048] The risk identification accuracy of this invention reaches 0.94, the false negative rate is reduced to 0.05, the key update response latency is shortened to 12.6 milliseconds, the session termination accuracy is improved to 0.93, the average duration of abnormal sessions is shortened to 58.9 seconds, and the business request success rate remains at 0.986. These results demonstrate that this invention, by expressing the structure of handshake protocol elements through a protocol syntax tree set, generating a handshake embedding vector set through BYOL handshake representation, and continuously introducing handshake risk representations into application data segments using bridging vectors and CPC segmented bridging prediction, can improve the accuracy of risk identification, reduce the false negative rate, make session key updates and session persistence control more timely and reliable, and enhance the effectiveness of network security data privacy protection management.

[0049] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network security data privacy protection management method based on secure communication, characterized in that, Includes the following steps: Collect session handshake messages and application data statistics records, and divide the handshake method and application data segment according to the protocol status; Extract protocol elements from the grasping methods and construct a set of protocol syntax trees; Perform BYOL handshake representation, re-encode the protocol syntax tree set to obtain a first view set and a second view set, input the first view set into the online tree encoder to obtain an online handshake representation vector set, input the second view set into the target tree encoder to obtain a target handshake representation vector set, the online handshake representation vector set is subjected to projection mapping and prediction mapping to obtain a predicted handshake representation vector set, and the predicted handshake representation vector set and the target handshake representation vector set generate a handshake embedding vector set; Select the handshake method ending embedding vector from the handshake embedding vector set, and denote it as the bridging vector; The application data segment statistical records are divided into a sliding window to obtain an application segment set, and the application segment set is input into a time encoder to obtain an application latent representation vector set. Perform CPC segmented bridging prediction, concatenate the bridging vector with the application latent representation vector set segment by segment to obtain the bridging latent representation vector set, input the bridging latent representation vector set into the CPC context network to obtain the context representation vector set, and output the subsequent application latent representation vector from the CPC prediction head; A risk score vector is generated from the context representation vector set, the encrypted transmission control parameter set is updated according to the risk score vector, and session key update and session persistence control are performed according to the encrypted transmission control parameter set. 2.The method of claim 1, wherein, The specific set of construction protocol syntax trees includes: Extract protocol element fields from the handshake message and form a protocol element set; The root node of the protocol syntax tree is constructed using the set of protocol elements as the root node data. The protocol element set is split into a first-level element set and a child-level element set according to the hierarchical relationship of the protocol element fields, and a first-level child node is constructed and connected to the root node; Merge the child element sets according to the parent node number to which the elements belong, construct child nodes and connect them to the corresponding parent nodes, and repeat the node construction and connection process until the child element sets are completely split. Write a node type identifier and a node value identifier for each node in the protocol syntax tree, and output a set of protocol syntax trees. 3.The method of claim 2, wherein, The BYOL specifically includes: The BYOL handshake representation uses the protocol syntax tree as the input object. The BYOL network consists of an online branch and a target branch. The online branch includes an online tree encoder, a projection mapping structure, and a prediction mapping structure. The target branch includes a target tree encoder and a projection mapping structure. Both the online tree encoder and the target tree encoder are tree structure coding networks. The tree structure coding network is configured with a root node representation generation unit and a parent-child node recursive aggregation unit. The root node representation generation unit is used to write the node features corresponding to the protocol element fields. The parent-child node recursive aggregation unit is used to generate node representation vectors according to the connection relationship from parent node to child node and output handshake representation vectors. The online branch outputs the online handshake representation vector set, which is then processed by the projection mapping structure and the prediction mapping structure to output the predicted handshake representation vector set. The target branch outputs the target handshake representation vector set, which is then processed by the projection mapping structure to output the target projected representation vector set.

4. The network security data privacy protection management method based on secure communication according to claim 3, characterized in that, The re-encoding of the protocol syntax tree set specifically includes: Obtain the parent-child node connection relationship, node level number, node type identifier, and node value identifier for each protocol syntax tree in the protocol syntax tree set; perform node order reordering on the child node set corresponding to each parent node. The node order reordering is limited to the child node set corresponding to the same parent node. The parent-child node connection relationship remains unchanged, and the node level number remains unchanged. The reordered protocol syntax trees constitute the first view set. For each node's value identifier, a value replacement mapping is performed. The value replacement mapping is limited to the set of node value identifiers with the same node type identifier. The node type identifier remains unchanged, and the fixed-length encoding length of the node value identifier remains unchanged. The protocol syntax tree after the value replacement mapping constitutes the second view set.

5. The network security data privacy protection management method based on secure communication according to claim 4, characterized in that, The generated handshake embedding vector set specifically includes: Perform a vector dimension consistency check on the predicted handshake representation vector set and the target handshake representation vector set to obtain a predicted handshake representation vector set and a target handshake representation vector set with consistent dimensions. Establish a one-to-one correspondence between the predicted handshake representation vector set and the target handshake representation vector set according to the sample order, and generate a set of vector pairs; Calculate the vector similarity for each vector pair in the set of vector pairs and obtain the similarity set; The predicted handshake representation vector set is output as a handshake embedding vector set in the order of vector pair sets, and the similarity set is associated with the handshake embedding vector set according to the correspondence.

6. The network security data privacy protection management method based on secure communication according to claim 5, characterized in that, The CPC specifically includes: CPC segmented bridging prediction is implemented by combining a bridging input structure and a CPC network structure. The CPC network consists of a timing encoder, a CPC context network, and a CPC prediction head. The bridging input structure is used to receive the bridging vector and the application latent representation vector set, and uses the bridging vector as a fixed splicing vector to splice the application latent representation vector set piece by piece to generate the bridging latent representation vector set; The CPC context network receives the bridging latent representation vector set and outputs the context representation vector set. The CPC context network configures the context state update unit and the segmented bridging unit. The segmented bridging unit is used to keep the bridging vectors continuously present in the input vector of the context state update unit within the application data segment. The CPC prediction head receives the context representation vector set and outputs the subsequent application latent representation vector. The subsequent application latent representation vector maintains the same vector dimension as the application latent representation vector set. The number of steps output by the CPC prediction head is determined by the prediction step size.

7. The network security data privacy protection management method based on secure communication according to claim 6, characterized in that, The specific steps of performing CPC segmented bridging prediction include: Obtain the bridging vector and apply the latent representation vector set; Determine the bridging vector dimension and the application latent representation vector dimension; read the application latent representation vectors one by one in the fragment order of the application latent representation vector set, perform vector concatenation with the current application latent representation vector to obtain the bridging latent representation vector corresponding to the current application fragment, repeat the vector concatenation until the application latent representation vector set is traversed to form the bridging latent representation vector set; The bridging latent representation vector set is input into the CPC context network in fragment order to obtain a context representation vector set that corresponds one-to-one with the bridging latent representation vector set; Obtain the prediction step size and output quantity, input the context representation vector set into the CPC prediction head and generate the subsequent application latent representation vector set according to the prediction step size. The vector dimension of the subsequent application latent representation vector set is consistent with the vector dimension of the application latent representation vector set. The subsequent application latent representation vector set and the context representation vector set are established in the order of the segments and then output.

8. The network security data privacy protection management method based on secure communication according to claim 7, characterized in that, The context state update of the CPC context network adopts a non-consistent update method between the application update branch and the bridge driver branch, which includes the following steps: Set the initial context state as the initial state vector, and obtain the corresponding application latent representation vector for each application segment of the application data segment; In the application update branch, the current application latent representation vector and the context state vector of the previous time step are used to perform state update calculation, and the intermediate update vector is output. In the bridged driving branch, the bridging vector is input into the fixed mapping structure to obtain the driving vector. The fixed mapping structure remains unchanged throughout the application data segment, and the driving vector maintains the same value throughout the application data segment. In the state synthesis step, the intermediate update vector and the driving vector execution vector are superimposed and input into the nonlinear mapping structure to output the current context state vector; Repeat the application update branch, bridge-driven branch and state synthesis steps until all application fragments of the application data segment are processed, and obtain the context state vector set and output it as the context representation vector set; The application update branch performs a state update calculation once at each application segment and outputs the corresponding intermediate update vector. The bridging drive branch only performs a fixed mapping structure calculation once at the beginning of the application data segment and outputs the drive vector, which is then reused in the subsequent state synthesis step.

9. The network security data privacy protection management method based on secure communication according to claim 8, characterized in that, The generation of the risk score vector from the context representation vector set specifically includes: Obtain the context representation vector set; perform risk mapping calculation on each context representation vector in the context representation vector set to obtain the risk score vector set. The risk mapping calculation uses a risk mapping layer to map the context representation vectors to risk score vectors; perform threshold determination on the risk score vector set to obtain the risk control mark set; generate the encrypted transmission control parameter set based on the risk control mark set; trigger the session key update operation according to the encrypted transmission control parameter set and perform the session persistence control operation.

10. A network security data privacy protection management system based on secure communication, applied to any one of the network security data privacy protection management methods based on secure communication as described in claims 1 to 9, characterized in that, include: The session segmentation module is used to collect session handshake messages and application data statistics records, and to divide the handshake mechanism and application data segments according to the protocol status; The protocol syntax tree construction module is used to extract protocol elements from the control method, construct a protocol syntax tree set, and write node type identifiers and node value identifiers for nodes. The BYOL handshake representation module is used to re-encode the protocol syntax tree set to obtain the first view set and the second view set, which are then passed through the online tree encoder and the target tree encoder to obtain the online handshake representation vector set and the target handshake representation vector set, respectively, and generate the handshake embedding vector set. The cross-segment bridging module is used to select the corresponding embedding vector for the end of the handshake method from the handshake embedding vector set as the bridging vector, and the handshake method risk representation enters the application data segment; The CPC segmented bridging prediction module is used to divide the application data segment statistical records into application segment sets, generate application latent representation vector sets through a time encoder, and then concatenate the bridging vectors and application latent representation vector sets segment by segment into the CPC context network to obtain the context representation vector set. The risk control module is used to generate a risk score vector from the context representation vector set, update the encrypted transmission control parameter set according to the risk score vector, and perform session key update and session persistence control.

Images