Covert communication detection method, device and equipment and storage medium

Abstract

This invention relates to the field of network security technology and discloses a method, apparatus, device, and storage medium for detecting covert communication behavior based on public infrastructure state modulation. The covert communication detection method includes: acquiring time-series behavioral data of multiple monitored target agents and extracting behavioral features of each agent; performing multi-level screening on all agent pairs based on behavioral features to obtain candidate communication pairs; performing causal inference tests on each candidate communication pair to determine whether there is a statistically significant causal dependency between them and outputting a causal strength quantification index; constructing a directed causal graph based on all target agent pairs with statistically significant causal dependencies; calculating anomaly scores for each target agent pair according to preset graph topology anomaly detection rules and latency matching rules; and calculating a comprehensive anomaly score based on the causal strength quantification index and the anomaly score.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, device, and storage medium for detecting covert communications. Background Technology

[0002] In existing network security detection technologies, mainstream protection methods can be mainly divided into three categories: The first category is feature-based intrusion detection systems and deep packet inspection technologies, which identify malicious communication by analyzing the payload content, protocol characteristics, or known attack signatures of network data packets; the second category is network traffic anomaly detection methods, which use statistical modeling to analyze aggregate characteristics such as traffic rate and connection number to discover abnormal patterns that deviate from the normal baseline; the third category is cross-account correlation analysis technologies, such as common Internet Protocol address detection and social network graph analysis, which discover potential connections by looking for explicit correlation signals between accounts. However, all of the above existing technologies are based on a common core assumption—there must be an observable direct information flow path between the two communicating parties, that is, information must be transmitted from one party to the other through network connections, data packets, or content carriers. This assumption is fundamentally invalid when facing covert channels based on public infrastructure state modulation, because in such channels, the two communicating parties never establish a direct connection, but indirectly transmit information through changes in public states such as shared content delivery network cache lifetime, domain name system resolution status, or application programming interface response codes, making traditional methods unable to detect such covert communication behavior. Summary of the Invention

[0003] This invention provides a method, apparatus, device, and storage medium for detecting covert communication, in order to solve the problem that existing technologies cannot detect such covert communication behavior when faced with covert channels based on public infrastructure state modulation due to reliance on the assumption of direct information flow observation.

[0004] The first aspect of this invention provides a covert communication detection method, comprising: acquiring time-series behavioral data of multiple monitored target agents and extracting behavioral features of each agent; performing multi-level screening on all agent pairs based on the behavioral features to obtain candidate communication pairs; performing a causal inference test on each candidate communication pair to determine whether there is a statistically significant causal dependency between them and outputting a causal strength quantification index, wherein the causal inference test includes a conditional causal test to eliminate spurious causal relationships driven by common external events, and the causal strength quantification index is a numerical indicator used to quantify the strength of the causal dependency between the two agents; constructing a directed causal graph based on all target agent pairs with statistically significant causal dependencies, wherein nodes represent target agents and directed edges represent the direction of causal relationships; calculating an anomaly score for each target agent pair based on preset graph topology anomaly detection rules and latency matching rules, wherein the anomaly score includes a target topology anomaly score and a latency matching score; and calculating a comprehensive anomaly score based on the causal strength quantification index and the anomaly score.

[0005] In one feasible implementation, the step of performing multi-level screening of all agent pairs based on the behavioral characteristics to obtain candidate communication pairs includes: clustering the behavioral characteristics of all agents and grouping agents with similar behavioral fingerprints into the same category; screening out agent pairs belonging to different categories; calculating the mutual information value between behavioral time sequences for agent pairs across categories, and taking agent pairs whose mutual information value exceeds a preset mutual information threshold as candidate communication pairs.

[0006] In one feasible implementation, the step of performing causal inference tests on each candidate communication pair to determine whether there is a statistically significant causal dependency between them and outputting a causal strength quantification index includes: performing a Granger causality test on each candidate communication pair to test the predictive ability of one party's historical behavior on the other party's future behavior; performing a Transfer Entropy test on each candidate communication pair to test for non-linear causal dependencies; performing a conditional causality test on each candidate communication pair, introducing global event time series as a conditional variable to eliminate spurious causal relationships driven by common externalities; and comprehensively determining whether there is a statistically significant causal dependency based on the results of the above multiple tests, and outputting a causal strength quantification index.

[0007] In one feasible implementation, a conditional causal test is performed on each candidate communication pair, and a global event time series is introduced as a conditional variable to eliminate spurious causal relationships driven by common external factors: a global event time series is collected from external data sources, including news sources, market data, and platform announcements; based on the global event time series, the conditional causal strength of one party to the other in each candidate communication pair is calculated; when the conditional causal strength is higher than the null hypothesis distribution after random shuffling, a genuine causal dependency is determined to exist.

[0008] In one feasible implementation, the construction of a directed causal graph based on all pairs of target agents with statistically significant causal dependencies includes: treating each target agent in the pair as a node in the graph; treating the pair as a directed edge with a statistically significant causal dependency, with the edge direction aligned with the causal relationship direction; and assigning a corresponding causal strength quantification index as an edge weight to each directed edge, thereby constructing a directed causal graph containing nodes, directed edges, and edge weights.

[0009] In one feasible implementation, the step of calculating the anomaly score of each target agent pair according to preset graph topology anomaly detection rules and delay matching rules includes: performing bidirectional edge detection on each target agent pair according to preset graph topology anomaly detection rules, and determining a first topology anomaly score for each target agent pair based on whether bidirectional edges are detected; performing anomaly subgraph structure detection on the causal graph based on the graph topology anomaly detection rules, adjusting the first topology anomaly score based on whether the target agent pair is located in the anomaly subgraph, and obtaining a target topology anomaly score for each target agent pair; matching the optimal lag order of the causal relationship with the known covert channel slot parameters according to the delay matching rules, determining a delay matching score, and merging the target topology anomaly score and the delay matching score as the anomaly score for each target agent pair.

[0010] In one feasible implementation, the step of calculating the comprehensive anomaly score based on the causal strength quantification index and the anomaly score includes: fusing the causal strength quantification index and the anomaly score of each target agent pair according to a preset weight to calculate the initial comprehensive score of each target agent pair; normalizing the initial comprehensive score and mapping it to a unified scoring interval to obtain a normalized intermediate score; and determining the comprehensive anomaly score of each target agent pair based on the comparison results between the intermediate score and multiple preset anomaly level threshold ranges.

[0011] A second aspect of the present invention provides a covert communication detection device, comprising: an acquisition module for acquiring time-series behavioral data of multiple monitored target agents and extracting behavioral features of each agent; a screening module for performing multi-level screening of all agent pairs based on the behavioral features to obtain candidate communication pairs; a first processing module for performing causal inference tests on each candidate communication pair to determine whether there is a statistically significant causal dependency between them and outputting a causal strength quantification index, wherein the causal inference test includes a conditional causal test to eliminate false causal relationships driven by common external events, and the causal strength quantification index is a numerical index used to quantify the strength of the causal dependency between the two agents; a construction module for constructing a directed causal graph based on all target agent pairs with statistically significant causal dependencies, wherein nodes represent target agents and directed edges represent the direction of causal relationships; a calculation module for calculating an anomaly score for each target agent pair based on preset graph topology anomaly detection rules and latency matching rules, wherein the anomaly score includes a target topology anomaly score and a latency matching score; and a second processing module for calculating a comprehensive anomaly score based on the causal strength quantification index and the anomaly score.

[0012] A third aspect of the present invention provides an electronic device, comprising: a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the electronic device to perform the covert communication detection method described above.

[0013] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the covert communication detection method described above.

[0014] The technical solution provided by this invention introduces a causal inference verification framework based on behavioral time series. First, it performs multi-level screening to reduce the candidate size of agent pairs. Then, it performs multi-level causal inference on each candidate communication pair. This allows for the extraction of statistically significant causal dependencies from behavioral time series data without observing any direct communication links, and outputs a quantitative causal strength index. Based on this, a directed causal graph is further constructed, and anomaly scores are calculated using graph topology anomaly detection rules and delay matching rules. Finally, a comprehensive anomaly score is obtained by fusing causal strength and anomaly scores. This invention fundamentally breaks through the dependence on direct information flow, effectively detecting covert channels based on public infrastructure state modulation. Simultaneously, it eliminates false causal relationships driven by common external events through conditional causality testing. Multi-level screening significantly reduces the number of agent pairs requiring complete causal inference verification, making the detection of large-scale agent networks feasible with limited computing resources. The dual anomaly rules of graph topology and delay significantly improve detection accuracy and reduce false alarm rates. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of one embodiment of the covert communication detection method in this invention; Figure 2 This is a schematic diagram of another embodiment of the covert communication detection method in this invention; Figure 3 This is a schematic diagram of one embodiment of the covert communication detection device of the present invention; Figure 4 This is a schematic diagram of another embodiment of the covert communication detection device of the present invention; Figure 5 This is a schematic diagram of one embodiment of the electronic device in this invention. Detailed Implementation

[0016] This invention provides a method, apparatus, device, and storage medium for detecting covert communication. By mining causal dependencies between agents from behavioral time-series data, it enables effective detection of covert channels based on public infrastructure state modulation.

[0017] The terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" or "having" and any variations thereof are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0018] It is understood that the executing entity of this invention can be a covert communication detection device, a terminal, or a server; no specific limitation is made here. This embodiment of the invention will be described using a server as an example.

[0019] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 One embodiment of the covert communication detection method in this invention includes: 101. Obtain time-series data of the behavior of multiple monitoring target agents and extract the behavioral features of each agent; A lightweight data acquisition agent is deployed within the host or container of each monitored target intelligent agent to collect raw time-series data in parallel across four dimensions: network traffic, platform behavior, computing resources, and economic behavior. For network traffic, timestamps of Hypertext Transfer Protocol (HTTP) requests are collected to statistically analyze request frequency. For platform behavior, timestamps of various social actions are collected through application programming interface (API) call logs to statistically analyze operation counts. For computing resources, CPU utilization is collected through operating system interfaces. For economic behavior, blockchain transaction time-series and transaction amounts are collected as needed based on application scenarios. The acquisition agent employs a multi-scale sliding time window strategy, maintaining three time windows with widths of, for example, 1 second, 1 minute, and 1 hour. Each window independently counts the occurrence of events in each dimension, forming a three-layer granularity counting time series. Within each time window, a short-time Fourier transform is performed on the event counting time series, and the signal is windowed using a Hanning window to calculate the power spectral density of each frequency band. The location and amplitude of the energy-concentrated frequency band are extracted as spectral density features. Simultaneously, the time interval between two consecutive events of the same type is recorded, and the mean, variance, skewness, and kurtosis of the interval sequence are calculated as statistical features characterizing the suddenness of behavior. The original counts, spectral density features, and suddenness statistical features of all dimensions are aligned by timestamps and concatenated into a fixed-dimensional behavior feature vector. Finally, a time-indexed behavior feature vector sequence is output for each monitored target agent.

[0020] It should be noted that the above four dimensions are not all used equally in actual testing. Within the network traffic dimension, the Hypertext Transfer Protocol request frequency and timing are the primary analysis objects, while the platform behavior and computing resource dimensions serve as secondary analysis sources. The economic behavior dimension is activated as needed based on the application scenario.

[0021] 102. Based on behavioral characteristics, perform multi-level screening on all agent pairs to obtain candidate communication pairs; A three-stage progressive screening architecture can be adopted. The first stage uses a density-based spatial clustering algorithm to cluster the projections of each agent in the multi-dimensional behavioral feature space. Since agents with similar functions or roles are adjacent to each other in the feature space and cluster into the same cluster, while the two parties in covert communication often exhibit different behavioral patterns in order to avoid detection, they belong to different clusters. Only agent pairs across clusters are retained. The second stage calculates the mutual information value between the key behavioral dimensions of each cross-cluster agent pair. This calculation only involves the discretized counting sequence rather than the complete time series, and its complexity is much lower than the subsequent causal inference test. It can be used as an efficient filter to screen out random association pairs that do not have statistical dependencies between behaviors, and only retain pairs with mutual information exceeding a preset threshold. The third stage performs lightweight time-domain cross-correlation analysis on the agent pairs screened by the first two stages based on their complete behavioral feature vectors. It calculates the maximum correlation coefficient and its corresponding optimal time delay under different lag orders, and eliminates pairs with too low correlation peaks or completely random time delay distributions, thereby obtaining the candidate communication pairs that are most likely to be covert communication relationships.

[0022] 103. Perform causal inference tests on each candidate communication pair to determine whether there is a statistically significant causal dependency between them and output a causal strength quantification index. The causal inference tests include conditional causal tests to eliminate spurious causal relationships driven by common external events. The causal strength quantification index is a numerical indicator used to quantify the strength of the causal dependency between two agents. For each candidate communication pair, time-series data of all behavioral dimensions of agent A are used as predictor variables to construct a vector autoregressive model. This model is then tested to see if incorporating historical observations of A significantly reduces the prediction error of agent B's current behavior. The lag order is automatically selected using the Bayesian information criterion, and the F-statistic and its associated significance probability are output. Simultaneously, a distance-based Kraskov estimator is used to calculate the transition entropy from A to B. This quantifies, from an information theory perspective, how much uncertainty about B's next state is reduced by A's past states. This indicator does not presuppose a linear relationship and can therefore capture nonlinear causal dependencies. To eliminate spurious causal relationships driven by common external events, global event signals are pre-collected from news sources, market data, and platform announcements to construct a conditional variable time series. Given this conditional variable, the conditional transition entropy from A to B is recalculated. If the conditional transition entropy significantly decreases compared to the unconditional transition entropy, it indicates that the original causal relationship is largely explained by common external drivers; conversely, if the conditional transition entropy remains high, it strongly indicates the existence of a direct causal dependency. Each of the above tests is accompanied by a significance assessment based on permutation tests. The target time series is randomly shuffled thousands of times, and the statistic is recalculated to construct a null hypothesis distribution. The true statistic is considered significant when it exceeds the high percentile of this distribution. Finally, the negative logarithm of the F-statistic, the absolute value of the transition entropy, and the retention strength of the conditional transition entropy are weighted and fused to output a binary judgment of whether there is a statistically significant causal dependency for each candidate communication pair, as well as a continuous causal strength quantification index.

[0023] 104. Construct a directed causal graph based on all target agent pairs that have statistically significant causal dependencies, where nodes represent target agents and directed edges represent the directions of causal relationships. First, an empty directed graph structure is initialized. All target agent pairs that pass the saliency test are traversed. For each target agent pair where the output causal strength quantification index is positive and exceeds a threshold, the causal direction is confirmed and a corresponding directed edge is added. Simultaneously, the edge thickness or color depth is mapped and encoded to the causal strength quantification index value, making strong causal dependencies more prominent in the visualization. The determination of the causal direction here is based on the comprehensive results of the aforementioned multi-layered causal inference tests, including the Granger test to predict future behavior through historical behavior sequences, non-parametric tests based on information transmission volume, and conditional tests to exclude common external interference. All three point to a clear direction of influence. For bidirectional causality, i.e., the simultaneous significance of the path from A to B and from B to A, two directed edges with opposite directions are drawn and specially marked in the graph for subsequent anomaly detection. After adding all edges, a force-directed layout algorithm is used to visualize the graph, so that clusters of agents with dense causal interactions are spatially close to each other, while isolated nodes are distributed on the periphery. The final output is a causal graph that is mainly a directed acyclic graph but allows for a few bidirectional edges, where each node represents a target agent, and the direction of each directed edge strictly corresponds to the causal direction determined by the joint causal inference framework.

[0024] 105. Based on the preset graph topology anomaly detection rules and time delay matching rules, calculate the anomaly score for each target agent pair. The anomaly score includes the target topology anomaly score and the time delay matching score. In graph topology anomaly detection, an anomaly pattern mining method based on graph kernel is adopted. For each pair of agents with directed edges, the local adjacency structure features are analyzed, including whether the pair constitutes a bidirectional edge (i.e., the two sides are mutually causal), whether the in-degree distribution of the two ends of the edge in the whole graph deviates from the norm, and whether the edge belongs to an anomalous subgraph isolated from normal functional clusters. By comparing the degree of difference between the local structure and the reference graph constructed through historical normal behavior, the topology anomaly score is calculated. The greater the deviation, the higher the score. Regarding latency matching rules, the optimal lag order is extracted from the causal edge correspondence. This lag order reflects the time offset between the change in the causal agent's behavior and the response generated by the consequent agent. This lag order is then automatically compared with a pre-built database of known covert channel slot parameters. This database stores typical latency characteristics of various common covert channels, such as content delivery network cache lifetime, domain name system cache period, and application programming interface rate limiting window. A smaller comparison deviation indicates that the latency pattern of the causal edge better matches the operational characteristics of the known covert channel, thus assigning a higher latency matching score. Finally, two independent anomaly scores are output for each directed edge with a causal relationship: a topology anomaly score reflecting the degree of graph structure anomaly and a latency matching score reflecting the degree of latency matching with the known channel.

[0025] 106. Calculate the comprehensive anomaly score based on the causal strength quantification index and the anomaly score.

[0026] The causal strength quantification index output from the causal inference testing stage is used as the benchmark weight. This index integrates the statistical significance of the Granger test, the absolute value of information transmission, and the retention strength after conditional testing. The stronger the causal dependency, the higher the basic priority of the communication pair in the final judgment. Subsequently, the topological anomaly score obtained from graph topological anomaly detection and the time delay matching score obtained from the time delay matching rule are normalized to make them within a comparable dimension. In terms of weight allocation, an adaptive weighting mechanism based on entropy weighting is adopted. The weight coefficients of the two types of anomaly scores of all candidate pairs in the current dataset or sliding time window are dynamically calculated according to their dispersion. The higher the dispersion, the stronger the ability of that dimension to distinguish between normal and abnormal in the current detection environment, and therefore, a higher fusion weight is assigned. After completing the weighted summation, the obtained preliminary fusion score is multiplied and modulated with the aforementioned causal strength quantification index. That is, the causal strength is used as a multiplier factor to scale the weighted fusion score, so that communication pairs with strong causal relationships and high anomaly characteristics receive significantly amplified comprehensive scores, while weak causal relationships are suppressed even if the anomaly score is high to avoid false alarms. The final output is a comprehensive anomaly score for each target agent pair. The higher the score, the more likely the pair is to have both strong causal dependency and anomaly graph topology or time delay characteristics, and the higher the suspicion level of covert communication.

[0027] In this embodiment of the invention, by introducing a causal inference verification framework based on behavioral time series, firstly, multi-level screening is performed on agent pairs to reduce the candidate size, and then multi-level causal inference is performed on each candidate communication pair. Statistically significant causal dependencies can be mined from behavioral time series data without observing any direct communication links, and a quantitative causal strength index is output. Based on this, a directed causal graph is further constructed, and anomaly scores are calculated by combining graph topology anomaly detection rules and delay matching rules. Finally, a comprehensive anomaly score is obtained by fusing causal strength and anomaly scores. This invention fundamentally breaks through the dependence on direct information flow, effectively detecting covert channels based on public infrastructure state modulation. Simultaneously, conditional causality testing eliminates false causal relationships driven by common external events. Multi-level screening significantly reduces the number of agent pairs requiring complete causal inference verification, making the detection of large-scale agent networks feasible with limited computing resources. The dual anomaly rules of graph topology and delay significantly improve detection accuracy and reduce false alarm rates.

[0028] Please see Figure 2 Another embodiment of the covert communication detection method in this invention includes: 201. Obtain the time-series behavioral data of multiple monitored target agents and extract the behavioral features of each agent; 202. Based on behavioral characteristics, perform multi-level screening on all agent pairs to obtain candidate communication pairs; Cluster the behavioral characteristics of all agents and group agents with similar behavioral fingerprints into the same category; filter out agent pairs belonging to different categories; calculate the mutual information value between the behavioral time sequences of agent pairs across categories, and select agent pairs with mutual information values ​​exceeding a preset mutual information threshold as candidate communication pairs.

[0029] The system calculates the average feature vector for each agent across the entire observation window, using this average vector as the agent's behavioral fingerprint. A density-based noise-based application space clustering algorithm is employed, using the Euclidean distance between agent behavioral fingerprints as a similarity metric to cluster all agents in the feature space. The algorithm automatically identifies high-density regions to form clusters and marks agents in low-density regions as noise points. Since the parties in covert communication typically perform different functional roles, resulting in significant differences in behavioral fingerprints, the system only retains cross-class agent pairs located in different clusters or containing noise points, directly excluding agent pairs within the same cluster, thus completing the first level of screening. For each cross-class agent pair that passes the first level of screening, the system extracts the most discriminative behavioral dimension time series, such as the counting time series of network request frequency, and calculates the mutual information value between the two time series. Specifically, the two time series are discretized into multiple equally spaced bins, a joint probability distribution table is constructed, and the information content (base natural constant) is calculated according to the standard definition of mutual information. Only agent pairs with mutual information values ​​exceeding a preset mutual information threshold (e.g., 0.1) are retained for the next level, completing the second level of screening. For agent pairs that pass the first two levels of screening, the system performs a third level of screening: It calculates the cross-correlation function for the network request frequencies of the two agents, iterates within a preset lag order range (e.g., from -50 to +50 time units), calculates the Pearson correlation coefficient for each lag order, and records the maximum correlation coefficient value and its corresponding optimal lag order. If the maximum correlation coefficient is lower than a preset correlation coefficient threshold (e.g., 0.3), or if the optimal lag order exhibits a uniformly random distribution in multiple sliding window calculations, the agent pair is removed. The remaining agent pairs after the above three levels of screening are output as candidate communication pairs.

[0030] 203. Perform Granger causality tests on each candidate communication pair to test the predictive power of one party's past behavior on the other party's future behavior. For each candidate communication pair consisting of two agents, A and B, when extracting multi-dimensional behavioral time-series data, the core variables used for constructing the vector autoregressive model are generally the Hypertext Transfer Protocol (HTTP) request frequency in the network traffic dimension, the number of application programming interface (API) calls in the platform behavior dimension, and the CPU utilization rate in the computing resource dimension. If the application scenario involves cryptocurrency transactions or blockchain agent communication, the average blockchain transaction frequency and transaction amount in the economic behavior dimension are additionally included as supplementary variables. All selected variable time series must undergo stationarity testing and necessary first-order differencing. For each candidate communication pair consisting of two agents, A and B, the selected multi-dimensional behavioral time-series data are extracted, and a multivariate vector autoregressive model is constructed. First, the time-series data for each dimension is tested for stationarity, for example, using the augmented Dickey-Fowler test. If a non-stationary sequence exists, it is differencing first-order until the stationarity requirement is met. Define a maximum candidate lag order, such as 20 time units. Use the Bayesian information criterion to evaluate the balance between goodness of fit and complexity of the model under different lag orders, and select the lag order that minimizes the Bayesian information criterion value as the optimal lag order. Construct two competing models: a restricted model uses only the historical observations of agent B to predict B's current observation, and an unrestricted model uses both the historical observations of agent B and the historical observations of all dimensions of agent A to predict B's current observation. Calculate the sum of squared residuals for both models and construct an F-statistic. The numerator of this statistic is the reduction in the sum of squared residuals of the unrestricted model relative to the restricted model divided by the increase in the number of predictor variables, and the denominator is the sum of squared residuals of the unrestricted model divided by its corresponding degrees of freedom. Compare the significance probability value corresponding to this F-statistic with a preset significance level threshold (e.g., 0.05). If it is less than this threshold, reject the null hypothesis, determining that the historical behavior of agent A has statistically significant predictive power for the future behavior of agent B. Then, the roles of agents A and B are switched, and the entire process is repeated to test whether reverse causality exists. Finally, the F-statistics and corresponding significance probabilities of each direction are output.

[0031] 204. Perform a Transfer Entropy test on each candidate communication pair to examine non-linear causal dependencies; The behavioral sequences of agents A and B are embedded into the reconstructed phase space. The embedding dimension and time delay are determined using the mutual information method. Specifically, the curve of the self-mutual information function of the time sequence as a function of the delay is calculated. The time delay is selected as the point where the curve first drops to the initial value multiplied by one minus one-half of the natural constant. The embedding dimension is determined using the pseudo nearest neighbor method, gradually increasing the dimension until the proportion of pseudo nearest neighbors drops below a preset threshold (e.g., 5%). For each target time step, the nearest neighbor of agent B's current state is found in the high-dimensional phase space, using Chebyshev distance as the distance metric. Then, the proportion of points in a hypercube centered on B's current state and with a radius equal to the distance to its nearest neighbor is calculated, where both A's historical state and B's next state fall into the hypercube. The final estimate of the transition entropy is obtained by averaging the logarithmic ratios over all time steps, with the unit being natural information units. To assess the statistical significance of the transfer entropy, a permutation test is used: the time-series data of agent A is randomly shuffled multiple times (e.g., 1000 times), and the transfer entropy is recalculated after each shuffle, constructing a transfer entropy distribution under the null hypothesis. The actual calculated transfer entropy value is compared with this null hypothesis distribution. If the actual value exceeds the preset percentile of the null hypothesis distribution (e.g., 95%), the nonlinear causal dependency from agent A to agent B is considered statistically significant. Simultaneously, the absolute value of the transfer entropy is recorded as a quantitative indicator of the strength of nonlinear causality. The roles of agents A and B are then swapped to calculate the reverse transfer entropy, and the transfer entropy values ​​for both directions and their significance are output.

[0032] 205. Perform conditional causality checks on each candidate communication pair, and introduce global event timing as a condition variable to eliminate spurious causal relationships driven by common externalities; Global event time series are collected from external data sources, including news sources, market data, and platform announcements. Based on the global event time series, the conditional causal strength of one party to the other in each candidate communication pair is calculated. When the conditional causal strength is higher than the null hypothesis distribution after random shuffling, a real causal dependency is determined to exist.

[0033] The system periodically retrieves the publication times of headlines from mainstream news media via application programming interfaces (APIs), recording the timestamps of each news item as news events. It also collects minute-level returns of major stock indices via financial market data interfaces, marking a market event when the absolute value of the return exceeds a preset volatility threshold (e.g., 2%). Furthermore, it monitors strategy change announcements on major social media platforms via public platform announcement pages, recording the announcement times. The timestamps of these three types of events are merged and deduplicated. Using a preset time window width (e.g., 1 second, 1 minute, or 1 hour) as the granularity, the occurrence of an event within each time window is encoded as a binary variable, forming a global event conditional time series. Given this conditional time series, a Kraskov estimator framework similar to that used for unconditional transition entropy is employed. However, the global event time series is embedded as an additional conditional dimension into the phase space. Specifically, when searching for nearest neighbors, the current state of agent B, the past state of agent A, and the global event time series must all be close simultaneously. This allows the calculation of the conditional transition entropy from agent A to agent B, representing the conditional causal strength. To assess the statistical significance of the conditional causal strength, the system randomly shuffles the time-series data of agent A multiple times (e.g., 1000 times) while maintaining the global event time sequence. After each shuffling, the conditional transition entropy is recalculated, constructing a conditional transition entropy distribution under the null hypothesis. The actual calculated conditional transition entropy value is compared with this null hypothesis distribution. If the actual value exceeds the preset percentile of the null hypothesis distribution (e.g., 99%), it is determined that, after excluding the possibility of common external events driving the relationship, a statistically significant real causal dependency still exists from agent A to agent B. Simultaneously, the system calculates the decrease ratio between the unconditional transition entropy and the conditional transition entropy. If the decrease ratio exceeds a preset threshold (e.g., 50%), it indicates that the original causal relationship mainly originates from a common external driver; conversely, if the decrease ratio is below the preset threshold (e.g., 20%), it further supports the existence of a direct, covert communication relationship.

[0034] To aid in determining the authenticity of causal relationships, a control group agent can be constructed for each candidate communication pair. The specific selection method is as follows: From the set of agents belonging to the same behavioral cluster as agent A, calculate the Euclidean distance between each candidate agent and agent A's behavioral feature vector. Select the agent with the closest distance and no spatiotemporal intersection with agent B as the control group agent, denoted as A'. Given the global event sequence, calculate the conditional transition entropy from A' to B and compare it with the conditional transition entropy from A to B. If the conditional transition entropy from A' to B is significantly lower than that from A to B (e.g., less than 50% of the latter), it indicates that the causal dependency from A to B is specific, further supporting the judgment of a true hidden communication relationship. If the two are similar, it indicates that the causal dependency from A to B may only stem from the shared behavioral patterns of A and A' rather than a specific communication relationship.

[0035] 206. Based on the results of the above tests, determine whether there is a statistically significant causal dependency and output a quantitative index of causal strength. The outputs of Granger causality tests, transition entropy tests, and conditional causality tests are integrated to determine whether each candidate communication pair has a statistically significant causal dependency and to output a quantitative indicator. First, three independent judgment conditions are defined: The first condition is that the significance probability value of the Granger causality test is less than a preset significance level threshold (e.g., 0.05), and the normalized value of the F-statistic after logarithmic transformation exceeds a preset effective threshold (e.g., 0.3). The second condition is that the true value of the transition entropy exceeds a preset percentile of the null hypothesis distribution of the permutation test (e.g., 95%), and the absolute value of the transition entropy after maximum-minimum normalization exceeds a preset effective threshold (e.g., 0.2). The third condition is that the decrease rate of the conditional transition entropy compared to the unconditional transition entropy is less than a preset retention threshold (e.g., 20%), and in the control group test, the conditional transition entropy from third-party agent A' (behaving similarly to A) to B is significantly lower than the conditional transition entropy from A to B. When at least two of the three conditions are met, the candidate communication pair is determined to have a statistically significant causal dependency. To determine the causal direction, the comprehensive scores for the directions from A to B and from B to A are calculated separately. The comprehensive score for each direction is obtained by weighted summing of three factors: the normalized value of the inverse of the significance of the Granger causality test for that direction, the normalized value of the transfer entropy, and the retention strength of conditional causality. The preset weights are, for example, 30%, 40%, and 30%, respectively. The direction with the higher score is designated as the primary direction. If the difference between the scores of the two directions is less than a preset difference threshold (e.g., 10%), it is determined to be bidirectional causality. Subsequently, the continuous causal strength quantification index is calculated. This index is obtained by weighted summing of three parts: the contribution of the Granger causality test is -1 multiplied by the logarithm of the significance probability value to base 10, and then normalized by the minimum and maximum values; the contribution of the transfer entropy is the absolute value of the transfer entropy normalized by the minimum and maximum values; and the contribution of conditional causality is 1 minus the decrease ratio of conditional transfer entropy relative to unconditional transfer entropy. The three terms are multiplied by preset weights, such as 40%, 40%, and 20%, and then summed to obtain a value between 0 and 1, which serves as the final quantitative indicator of causal strength. At the same time, the causal direction indicator and the comprehensive judgment result are output.

[0036] 207. Construct a directed causal graph based on all target agent pairs that have statistically significant causal dependencies, where nodes represent target agents and directed edges represent the directions of causal relationships. Each target agent in a pair of target agents with statistically significant causal dependencies is treated as a node in the graph; the pair of target agents with statistically significant causal dependencies is treated as a directed edge in the graph, with the direction of the edge consistent with the direction of the causal relationship; each directed edge is assigned a corresponding causal strength quantification index as an edge weight, thereby constructing a directed causal graph containing nodes, directed edges, and edge weights.

[0037] Initialize an empty directed graph data structure, where the node set and edge set are initially empty. Iterate through all agent pairs that have been determined to have a significant causal dependency. For each target agent pair, first check if the two agents already exist in the node set. If not, add them as new nodes, using the agent's unique identifier. Then, add directed edges according to the causal direction determined in the causal inference stage: if the determination result is a one-way causal relationship from agent A to agent B, add a directed edge from node A to node B; if the determination result is a one-way causal relationship from B to A, add a directed edge from node B to node A; if the determination result is a two-way causal relationship, add two directed edges in opposite directions, one from A to B and the other from B to A. For each added directed edge, store the causal strength quantification index output from the causal inference stage as the initial weight value of the edge. This weight value is a real number between 0 and 1, reflecting the strength of the causal dependency. After traversing all agent pairs and adding edges, an optional consistency calibration is performed on the edge weights. For example, minimum-maximum normalization is used to map all weights to a unified range to facilitate subsequent visualization and anomaly detection. Simultaneously, the in-degree and out-degree information of each node is recorded. The in-degree indicates how many other agents have a causal influence on that node, and the out-degree indicates how many other agents have a causal influence on that node. Finally, a complete directed causal graph data structure is output. This structure includes a list of nodes and their associated in-degree and out-degree statistics, a list of directed edges and their corresponding causal direction identifiers and edge weight values, and optional graph statistics such as the total number of nodes, the total number of edges, and the average edge weight.

[0038] 208. Based on the preset graph topology anomaly detection rules and time delay matching rules, calculate the anomaly score for each target agent pair. The anomaly score includes the target topology anomaly score and the time delay matching score. According to the preset graph topology anomaly detection rules, bidirectional edge detection is performed on each target agent pair, and the first topology anomaly score of each target agent pair is determined based on whether bidirectional edges are detected. Based on the graph topology anomaly detection rules, abnormal subgraph structure detection is performed on the causal graph, and the first topology anomaly score is adjusted according to whether the target agent pair is located in the abnormal subgraph to obtain the target topology anomaly score of each target agent pair. According to the delay matching rules, the optimal lag order of the causal relationship is matched with the known covert channel slot parameters to determine the delay matching score, and the target topology anomaly score and the delay matching score are combined as the anomaly score of each target agent pair.

[0039] For each directed edge in the causal graph, perform bidirectional edge detection. Traverse all node pairs in the graph. If there are two directed edges simultaneously, one from node A to node B and the other from node B to node A, then the node pair is determined to constitute a bidirectional edge. For node pairs that constitute bidirectional edges, assign a higher basic topological anomaly score to each directed edge, for example, set to 0.6; for unidirectional edges that do not constitute bidirectional edges, assign a lower basic topological anomaly score, for example, set to 0.2. This basic score is the first topological anomaly score.

[0040] Subsequently, anomaly subgraph structure detection is performed. A modularity-based community detection algorithm is used to divide the causal graph into multiple functional communities, calculating the average weight of edges within each community and the distribution of edge weights between communities. For each directed edge, it is determined whether it meets the anomaly subgraph conditions, including the following cases: the edge is a bridge connecting two different functional communities, and the weight of the edge is greater than the standard deviation of the larger of the average weights of edges within the two communities. Specifically, the mean and standard deviation of the weights of all edges within community A and community B are calculated separately, and the larger of the two means is denoted as μ. max Let σ be the standard deviation of the community corresponding to the larger value. If the weight of the bridge side is greater than μ... max Adding σ indicates that the abnormal subgraph condition is met. Another scenario is when the edge belongs to an isolated subgraph with fewer than a preset threshold (e.g., three) and most of its internal edge weights are higher than a preset threshold (e.g., 0.6). In this case, it is considered an abnormal subgraph regardless of the edge weights. If the current edge meets any of the above abnormal subgraph conditions, an adjustment value is added to the first topology anomaly score, for example, by 0.3, but the total score after adjustment cannot exceed 1.0, thus obtaining the target topology anomaly score for each target agent pair.

[0041] Regarding the latency matching rules, the optimal lag order of each agent pair recorded in the previous cross-correlation analysis phase is converted into a time offset in seconds. A database of known covert channel slot parameters is pre-built and stored in the form of configuration files or data tables. This database contains typical latency characteristics of various common covert channels, such as content delivery network cache lifetime values ​​(30 seconds, 60 seconds, 120 seconds, 300 seconds), domain name system cache duration (300 seconds, 600 seconds, 3600 seconds), and application programming interface rate limiting windows (60 seconds, 300 seconds, etc.). The absolute deviation between the optimal lag order time offset of the current target agent pair and each parameter in the database is calculated, and the minimum value among all deviations is taken. The latency matching score is calculated using a relative deviation method, defined as 1 minus the ratio of this minimum absolute deviation value to the current matching parameter value, and the result is restricted to the interval between 0 and 1. For example, if the optimal lag order time offset is 65 seconds and the matched parameter is 60 seconds, the absolute deviation is 5 seconds, the relative deviation is 5 divided by 60, approximately equal to 0.083, and the delay matching score is 1 minus 0.083, approximately equal to 0.917. If the optimal lag order is 180 seconds and the parameter is matched to 60 seconds, the absolute deviation is 120 seconds, the relative deviation is 120 divided by 60, equal to 2, and if it exceeds 1, the delay matching score is 0. The smaller the deviation, the closer the score is to 1; if the deviation exceeds the parameter value itself, the score is 0. Finally, the target topology anomaly score and the delay matching score are combined, for example, by equal weight addition or weighted summation, to obtain the anomaly score for each target agent pair.

[0042] 209. Calculate the comprehensive anomaly score based on the causal strength quantification index and the anomaly score.

[0043] The causal strength quantification index and anomaly score of each target agent pair are fused according to preset weights to calculate the initial comprehensive score of each target agent pair; the initial comprehensive score is normalized and mapped to a unified scoring range to obtain the normalized intermediate score; the comprehensive anomaly score of each target agent pair is determined based on the comparison results of the intermediate score with multiple preset anomaly level threshold ranges.

[0044] Weighted fusion is performed according to a preset weight configuration. The weight of the causal strength quantification index is set to the first weight value, for example, 60%, and the weight of the anomaly score is set to the second weight value, for example, 40%. The initial comprehensive score for each target agent pair is obtained by multiplying the causal strength quantification index by its corresponding weight and adding the anomaly score multiplied by its corresponding weight. Since the causal strength quantification index itself is already a value between 0 and 1 after being fused through Granger test, transition entropy test, and conditional causality test and then normalized to the minimum and maximum value, and the anomaly score is also limited to a value between 0 and 1 after being processed by topological anomaly detection and time delay matching rules, the initial comprehensive score after weighted fusion naturally lies within the 0 to 1 range. To maintain consistency and facilitate subsequent threshold comparison, a confirmatory normalization process is performed again, using the theoretical minimum value of 0 and the theoretical maximum value of 1 as mapping boundaries to confirm that all initial comprehensive scores are within this range, and the normalized intermediate score is output. Three preset anomaly level threshold ranges are defined: the threshold for a red alarm is set at a median score greater than or equal to the first threshold (e.g., 0.85); the threshold for an orange alarm is set at a median score greater than or equal to the second threshold (e.g., 0.60) and less than the first threshold; and the threshold for green (no anomaly detected) is set at a median score less than the second threshold. Based on the threshold range the median score falls into, the system outputs the corresponding alarm level identifier. Simultaneously, the median score is multiplied by a conversion factor (e.g., 100) to convert it to a percentage score, which is then output as the final comprehensive anomaly score. Furthermore, the comprehensive anomaly scores of all target agent pairs within the current detection batch are recorded, and the 99th percentile of that batch is calculated as a reference threshold. When the comprehensive anomaly score of a target agent pair exceeds the 99th percentile of that batch and is simultaneously classified as a red alarm, an automatic manual review work order creation process is triggered. Finally, the comprehensive anomaly score value, corresponding alarm level, and causal direction information for each target agent pair are output.

[0045] In this embodiment of the invention, a multi-layered causal inference framework integrating Granger causality test, Transfer Entropy test, and conditional causality test can be used to mine statistically significant causal dependencies from behavioral time-series data without relying on direct communication link observations. Combined with a multi-level screening mechanism, the scale of candidate communication pairs is significantly reduced, making real-time detection of large-scale intelligent agent networks feasible with limited computing resources. Furthermore, by using directed causal graphs in conjunction with topological anomaly detection and delay matching rules to calculate a comprehensive anomaly score, false causal relationships driven by common external events are effectively eliminated, significantly improving the accuracy of covert communication detection and reducing the false alarm rate.

[0046] The covert communication detection method in the embodiments of the present invention has been described above. The covert communication detection device in the embodiments of the present invention will be described below. Please refer to [link / reference]. Figure 3One embodiment of the covert communication detection device in this invention includes: The acquisition module 301 is used to acquire time-series behavioral data of multiple monitored target intelligent agents and extract behavioral features of each intelligent agent; The filtering module 302 is used to perform multi-level filtering on all agent pairs based on behavioral characteristics to obtain candidate communication pairs; The first processing module 303 is used to perform causal inference tests on each candidate communication pair, determine whether there is a statistically significant causal dependency between the two and output a causal strength quantification index. The causal inference test includes a conditional causal test to eliminate spurious causal relationships driven by common external events. The causal strength quantification index is a numerical index used to quantify the strength of the causal dependency between the two agents. Module 304 is used to construct a directed causal graph based on all target agents with statistically significant causal dependencies, where nodes represent target agents and directed edges represent the directions of causal relationships. The calculation module 305 is used to calculate the anomaly score of each target agent pair according to the preset graph topology anomaly detection rules and time delay matching rules. The anomaly score includes the target topology anomaly score and the time delay matching score. The second processing module 306 is used to calculate the comprehensive anomaly score based on the causal strength quantification index and the anomaly score.

[0047] In this embodiment of the invention, by introducing a causal inference verification framework based on behavioral time series, firstly, multi-level screening is performed on agent pairs to reduce the candidate size, and then multi-level causal inference is performed on each candidate communication pair. Statistically significant causal dependencies can be mined from behavioral time series data without observing any direct communication links, and a quantitative causal strength index is output. Based on this, a directed causal graph is further constructed, and anomaly scores are calculated by combining graph topology anomaly detection rules and delay matching rules. Finally, a comprehensive anomaly score is obtained by fusing causal strength and anomaly scores. This invention fundamentally breaks through the dependence on direct information flow, effectively detecting covert channels based on public infrastructure state modulation. Simultaneously, conditional causality testing eliminates false causal relationships driven by common external events. Multi-level screening significantly reduces the number of agent pairs requiring complete causal inference verification, making the detection of large-scale agent networks feasible with limited computing resources. The dual anomaly rules of graph topology and delay significantly improve detection accuracy and reduce false alarm rates.

[0048] Please see Figure 4 Another embodiment of the covert communication detection device in this invention includes: The acquisition module 301 is used to acquire time-series behavioral data of multiple monitored target intelligent agents and extract behavioral features of each intelligent agent; The filtering module 302 is used to perform multi-level filtering on all agent pairs based on behavioral characteristics to obtain candidate communication pairs; The first processing module 303 is used to perform causal inference tests on each candidate communication pair, determine whether there is a statistically significant causal dependency between the two and output a causal strength quantification index. The causal inference test includes a conditional causal test to eliminate spurious causal relationships driven by common external events. The causal strength quantification index is a numerical index used to quantify the strength of the causal dependency between the two agents. Module 304 is used to construct a directed causal graph based on all target agents with statistically significant causal dependencies, where nodes represent target agents and directed edges represent the directions of causal relationships. The calculation module 305 is used to calculate the anomaly score of each target agent pair according to the preset graph topology anomaly detection rules and time delay matching rules. The anomaly score includes the target topology anomaly score and the time delay matching score. The second processing module 306 is used to calculate the comprehensive anomaly score based on the causal strength quantification index and the anomaly score.

[0049] Optionally, Filter 302 can be specifically used for: Cluster the behavioral characteristics of all agents and group agents with similar behavioral fingerprints into the same category; filter out agent pairs belonging to different categories; calculate the mutual information value between the behavioral time sequences of agent pairs across categories, and select agent pairs with mutual information values ​​exceeding a preset mutual information threshold as candidate communication pairs.

[0050] Optionally, the first processing module 303 includes: The first testing unit 3031 is used to perform Granger causality tests on each candidate communication pair to test the predictive ability of one party's historical behavior on the other party's future behavior. The second testing unit 3032 is used to perform a Transfer Entropy test on each candidate communication pair to test for nonlinear causal dependencies. The third verification unit 3033 is used to perform conditional causal verification on each candidate communication pair, and introduces global event timing as a condition variable to eliminate spurious causal relationships driven by common external factors. Output unit 3034 is used to comprehensively determine whether there is a statistically significant causal dependency based on the above multiple test results, and output the causal strength quantification index.

[0051] Optionally, the third inspection unit 3033 may be specifically used to include: Global event time series are collected from external data sources, including news sources, market data, and platform announcements. Based on the global event time series, the conditional causal strength of one party to the other in each candidate communication pair is calculated. When the conditional causal strength is higher than the null hypothesis distribution after random shuffling, a real causal dependency is determined to exist.

[0052] Optionally, the 304 module can be specifically used for: Each target agent in a pair of target agents with statistically significant causal dependencies is treated as a node in the graph; the pair of target agents with statistically significant causal dependencies is treated as a directed edge in the graph, with the direction of the edge consistent with the direction of the causal relationship; each directed edge is assigned a corresponding causal strength quantification index as an edge weight, thereby constructing a directed causal graph containing nodes, directed edges, and edge weights.

[0053] Optionally, the calculation module 305 can be specifically used for: According to the preset graph topology anomaly detection rules, bidirectional edge detection is performed on each target agent pair, and the first topology anomaly score of each target agent pair is determined based on whether bidirectional edges are detected. Based on the graph topology anomaly detection rules, abnormal subgraph structure detection is performed on the causal graph, and the first topology anomaly score is adjusted according to whether the target agent pair is located in the abnormal subgraph to obtain the target topology anomaly score of each target agent pair. According to the delay matching rules, the optimal lag order of the causal relationship is matched with the known covert channel slot parameters to determine the delay matching score, and the target topology anomaly score and the delay matching score are combined as the anomaly score of each target agent pair.

[0054] Optionally, the second processing module 306 can be specifically used for: The causal strength quantification index and anomaly score of each target agent pair are fused according to preset weights to calculate the initial comprehensive score of each target agent pair; the initial comprehensive score is normalized and mapped to a unified scoring range to obtain the normalized intermediate score; the comprehensive anomaly score of each target agent pair is determined based on the comparison results of the intermediate score with multiple preset anomaly level threshold ranges.

[0055] In this embodiment of the invention, a multi-layered causal inference framework integrating Granger causality test, Transfer Entropy test, and conditional causality test can be used to mine statistically significant causal dependencies from behavioral time-series data without relying on direct communication link observations. Combined with a multi-level screening mechanism, the scale of candidate communication pairs is significantly reduced, making real-time detection of large-scale intelligent agent networks feasible with limited computing resources. Furthermore, by using directed causal graphs in conjunction with topological anomaly detection and delay matching rules to calculate a comprehensive anomaly score, false causal relationships driven by common external events are effectively eliminated, significantly improving the accuracy of covert communication detection and reducing the false alarm rate.

[0056] above Figure 3 and Figure 4 The covert communication detection device in the embodiments of the present invention will be described in detail from the perspective of modular functional entities. The electronic device in the embodiments of the present invention will be described in detail from the perspective of hardware processing.

[0057] See Figure 5 As shown, the electronic device includes a processor 500 and a memory 501. The memory 501 stores machine-executable instructions that can be executed by the processor 500. The processor 500 executes the machine-executable instructions to implement the aforementioned covert communication detection method.

[0058] Furthermore, Figure 5 The electronic device shown also includes a bus 502 and a communication interface 503. The processor 500, the communication interface 503 and the memory 501 are connected via the bus 502.

[0059] The memory 501 may include high-speed random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 503 (which can be wired or wireless), such as the Internet, wide area network, local area network, metropolitan area network, etc. The bus 502 may be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0060] The processor 500 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of the processor 500 or by instructions in software form. The processor 500 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this disclosure. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this disclosure can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 501. The processor 500 reads the information in memory 501 and, in conjunction with its hardware, completes the method steps of the aforementioned embodiment.

[0061] The present invention also provides an electronic device, the computer device including a memory and a processor, the memory storing computer-readable instructions, which, when executed by the processor, cause the processor to perform the steps of the covert communication detection method described in the above embodiments.

[0062] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the covert communication detection method.

[0063] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0064] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0065] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting covert communication, characterized in that, The method includes: Acquire time-series behavioral data of multiple monitored target agents and extract behavioral features of each agent; Based on the behavioral characteristics, all agent pairs are screened at multiple levels to obtain candidate communication pairs; For each candidate communication pair, a causal inference test is performed to determine whether there is a statistically significant causal dependency between them and to output a causal strength quantification index. The causal inference test includes a conditional causal test to eliminate spurious causal relationships driven by common external events. The causal strength quantification index is a numerical indicator used to quantify the strength of the causal dependency between the two agents. A directed causal graph is constructed based on all target agents with statistically significant causal dependencies, where nodes represent target agents and directed edges represent the directions of causal relationships. Based on the preset graph topology anomaly detection rules and time delay matching rules, the anomaly score of each target agent pair is calculated, and the anomaly score includes the target topology anomaly score and the time delay matching score. A comprehensive anomaly score is calculated based on the causal strength quantification index and the anomaly score.

2. The covert communication detection method according to claim 1, characterized in that, The step of performing multi-level screening of all agent pairs based on the behavioral characteristics to obtain candidate communication pairs includes: Cluster the behavioral characteristics of all agents and group agents with similar behavioral fingerprints into the same category; Filter out pairs of intelligent agents belonging to different categories; For cross-category agent pairs, the mutual information value between the time sequence of their calculated behaviors is used to identify agent pairs whose mutual information value exceeds a preset mutual information threshold as candidate communication pairs.

3. The covert communication detection method according to claim 1, characterized in that, The step of performing a causal inference test on each candidate communication pair to determine whether there is a statistically significant causal dependency between them and outputting a quantitative index of causal strength includes: Perform a Granger causality test on each candidate communication pair to examine the predictive power of one party’s past behavior on the other party’s future behavior. Perform a Transfer Entropy test on each candidate communication pair to examine non-linear causal dependencies; For each candidate communication pair, a conditional causal test is performed, and a global event sequence is introduced as a conditional variable to eliminate spurious causal relationships driven by common externalities. Based on the combined results of the above tests, determine whether there is a statistically significant causal dependency and output a quantitative index of causal strength.

4. The covert communication detection method according to claim 3, characterized in that, For each candidate communication pair, a conditional causality test is performed, introducing a global event timeline as a condition variable to eliminate spurious causal relationships driven by common externalities. Global event timelines are collected from external data sources, including news sources, market data, and platform announcements. Based on the global event timeline, calculate the conditional causal strength of one party to the other in each candidate communication pair; When the conditional causal strength is higher than the null hypothesis distribution after random shuffling, a genuine causal dependency is determined to exist.

5. The covert communication detection method according to claim 1, characterized in that, The construction of a directed causal graph based on all target agent pairs with statistically significant causal dependencies includes: Each target agent in a pair of target agents with statistically significant causal dependencies is treated as a node in the graph; The target agent pair with a statistically significant causal dependency is treated as a directed edge in the graph, with the direction of the edge consistent with the direction of the causal relationship. Each directed edge is assigned a corresponding causal strength quantification index as an edge weight, thereby constructing a directed causal graph containing nodes, directed edges, and edge weights.

6. The covert communication detection method according to claim 1, characterized in that, The step of calculating the anomaly score for each target agent pair based on preset graph topology anomaly detection rules and time delay matching rules includes: According to the preset graph topology anomaly detection rules, bidirectional edge detection is performed on each target agent pair, and the first topology anomaly score of each target agent pair is determined based on whether bidirectional edges are detected. Based on the graph topology anomaly detection rules, abnormal subgraph structures are detected in the causal graph. The first topology anomaly score is adjusted according to whether the target agent pair is located in the abnormal subgraph to obtain the target topology anomaly score for each target agent pair. According to the delay matching rule, the optimal lag order of the causal relationship is matched with the known covert channel slot parameters to determine the delay matching score. The target topology anomaly score and the delay matching score are then combined as the anomaly score for each target agent pair.

7. The covert communication detection method according to claim 1, characterized in that, The step of calculating a comprehensive anomaly score based on the causal strength quantification index and the anomaly score includes: The causal strength quantification index and anomaly score of each target agent pair are fused according to preset weights to calculate the initial comprehensive score of each target agent pair. The initial comprehensive score is normalized and mapped to a unified scoring range to obtain the normalized intermediate score. Based on the comparison results between the intermediate score and multiple preset anomaly level threshold ranges, the comprehensive anomaly score of each target agent pair is determined.

8. A covert communication detection device, characterized in that, The covert communication detection device includes: The acquisition module is used to acquire time-series behavioral data of multiple monitored target agents and extract behavioral features of each agent. The filtering module is used to perform multi-level filtering on all agent pairs based on the behavioral characteristics to obtain candidate communication pairs; The first processing module is used to perform causal inference tests on each candidate communication pair, determine whether there is a statistically significant causal dependency between the two and output a causal strength quantification index. The causal inference test includes a conditional causal test to eliminate spurious causal relationships driven by common external events. The causal strength quantification index is used to quantify the numerical index of the strength of the causal dependency between the two agents. The construction module is used to construct a directed causal graph based on all target agents with statistically significant causal dependencies, where nodes represent target agents and directed edges represent the directions of causal relationships. The calculation module is used to calculate the anomaly score of each target agent pair according to the preset graph topology anomaly detection rules and time delay matching rules. The anomaly score includes the target topology anomaly score and the time delay matching score. The second processing module is used to calculate a comprehensive anomaly score based on the causal strength quantification index and the anomaly score.

9. An electronic device, characterized in that, The electronic device includes: a memory and at least one processor, wherein the memory stores instructions; The at least one processor invokes the instructions in the memory to cause the electronic device to execute the covert communication detection method as described in any one of claims 1-7.

10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the covert communication detection method as described in any one of claims 1-7.

Images