A strategy self-adaptive regulation method based on data feedback analysis

Abstract

The present application relates to the field of information security technology, specifically to a strategy self-adaptive regulation and control method based on data feedback analysis. The method includes comparing handshake request flow with historical strategy set, generating initial configuration strategy to configure main processor; extracting hardware monitoring flow to generate computing power state set, when exceeding preset computing power threshold, according to privacy weight value of business data flow, cutting load data area into core encryption block and basic verification block; respectively configuring full encryption operation code and sampling verification operation code to generate bypass verification task, importing bypass trusted execution area to generate security verification result; extracting reverse frequency of change record in main processor, when greater than preset oscillation threshold, generating damping isolation instruction to lock strategy update thread. The present application optimizes throughput and security distribution mechanism of data management in concurrent scenario through overall architecture design of low coupling execution and high cohesion regulation and control.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a strategy adaptive control method based on data feedback analysis. Background Technology

[0002] In today's complex distributed network computing environment, efficient and secure data management of large-scale concurrent business flows is an important technological application direction. This is especially true in scenarios involving high-value marketing data management, where the secure isolation and real-time rapid flow of massive amounts of data face extremely high demands. Existing technologies generally employ a combination of global static security control and data encryption methods intercepted by a single gateway. This involves monitoring the establishment status of external network connections, automatically identifying requests at the traffic entry point, and assigning pre-defined, fixed-strength global encryption and verification policies to all data flows. This is currently the mainstream technical approach for achieving system security protection and data management.

[0003] However, existing data management solutions have significant shortcomings in balancing security and transmission processing speed. First, the security control mechanisms used for data protection suffer from rigid resource allocation and excessive computing power overhead. Existing methods are mostly based on uniform coarse-grained configuration and forced execution, making it difficult to adapt to different security needs. This results in a large amount of redundant computation without differentiation excessively consuming main processor resources when the system handles massive concurrent requests, severely slowing down the overall data management flow rate. Second, existing systems lack effective mechanisms to cope with network throughput fluctuations and high concurrency loads. Their security verification process is usually deeply coupled with the main business flow and processed serially. Once encountering computing power bottlenecks, it is easy to cause network congestion and data read / write delays, failing to resolve the inherent conflict between high-strength security protection and low-latency transmission from the bottom up. Finally, even if some existing solutions attempt to introduce thresholds for dynamic management, their control mechanisms often have serious stability risks. When faced with sudden changes in external traffic or performance fluctuations, the system is prone to frequent switching between different security control levels, resulting in a large amount of computing resources being wasted on state updates and context changes, which in turn leads to thread blocking and service degradation, severely restricting the continuity and effective speed of data management in actual business scenarios.

[0004] To address this, a strategy adaptive control method based on data feedback analysis is proposed. Summary of the Invention

[0005] The purpose of this invention is to provide a strategy adaptive control method based on data feedback analysis to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a strategy adaptive control method based on data feedback analysis, comprising: Receive handshake request stream, service data stream, hardware monitoring stream and historical policy set; generate network feature vector based on handshake request stream; compare with historical policy set to generate initial configuration policy; configure main processor based on initial configuration policy. The business data stream and hardware monitoring stream are input to the main processor. The queue backlog depth and network throughput in the hardware monitoring stream are extracted and combined to generate a computing power status set. Extract the protocol header features of the business data stream to generate a privacy weight value. When the computing power status set exceeds the preset computing power threshold, divide the payload data of the business data stream into a core encryption block and a basic verification block according to the privacy weight value. Extract the full encryption opcode and the sampling verification opcode from the initial configuration strategy. Configure the full encryption opcode for the core encryption block and the sampling verification opcode for the basic verification block, and combine them to generate a bypass verification task. The bypass verification task is imported into the bypass trusted execution area to generate a security verification result. The change record in the main processor is extracted to generate a policy switching set. The reversal frequency of the policy switching set is calculated. When it is greater than the preset oscillation threshold, a damping isolation instruction is generated. The damping isolation instruction is input into the main processor to lock the policy update thread.

[0007] Preferably, the specific generation process of the initial configuration policy includes: receiving handshake request streams arriving from outside via the network interface and loading the local historical policy set; extracting the source address field, destination port field, and packet arrival time interval parameter of the handshake request stream, and outputting a generated network feature vector through numerical conversion; reading the baseline feature matrix and associated configuration set contained in the historical policy set; calling the cosine similarity function to calculate the similarity value between the network feature vector and each row vector within the baseline feature matrix; extracting the index of the row vector with the highest similarity value; based on the row vector index, extracting the corresponding secure handshake parameters, number of encryption threads allocated, sampling step size, encryption standard identifier, key sequence, and cyclic redundancy check identifier from the associated configuration set, and generating the initial configuration policy through encapsulation; and configuring the main processor's policy scheduling engine based on the initial configuration policy.

[0008] Preferably, the specific generation process of the computing power state set includes: controlling the network interface controller to intercept service data streams; starting the low-level probe program of the main processor to generate a hardware monitoring stream; importing the service data stream and the hardware monitoring stream into the kernel buffer area of ​​the main processor; parsing the hardware monitoring stream into a memory state stream and a network interface card (NIC) traffic stream; in the memory state stream, reading the task counter value of the main processor's direct memory access controller; performing a moving average calculation on the task counter value to generate a queue backlog depth; in the NIC traffic stream, reading the total number of received bytes and the total number of sent bytes of the main processor's physical NIC interface; merging the total number of received bytes with the total number of sent bytes to calculate and output the network throughput; constructing a data encapsulation body containing horizontal and vertical coordinates; mapping the queue backlog depth to the horizontal coordinate field of the data encapsulation body, and mapping the network throughput to the vertical coordinate field of the data encapsulation body; appending a collection timestamp to the end of the data encapsulation body, closing the data encapsulation body, and generating the computing power state set.

[0009] Preferably, the specific process for generating the privacy weight value includes: intercepting the header message area of ​​the business data stream; extracting protocol header features containing application layer protocol identifier, payload length, and authentication type fields from the header message area, converting them into floating-point numbers, and combining them to generate a one-dimensional feature row vector; retrieving a preset sensitivity weight matrix; performing matrix multiplication between the one-dimensional feature row vector and the sensitivity weight matrix to calculate and output a one-dimensional scoring row vector; calling the Euclidean norm formula; calculating the Euclidean norm value of the one-dimensional scoring row vector; and outputting the Euclidean norm value as a scalar to generate the privacy weight value.

[0010] Preferably, the specific generation process of the core encryption block and the basic verification block includes: comparing the privacy weight value with a preset hierarchical threshold table to obtain the target encryption depth level; applying a message structure parser to scan the payload data area of ​​the service data stream; identifying the type length value structure boundary within the payload data area and marking the boundary physical address; matching the corresponding boundary physical address set according to the target encryption depth level; truncating the message fields within the hit boundary physical address set and encapsulating them to generate the core encryption block; truncating the remaining message fields that do not hit the boundary physical address set and encapsulating them to generate the basic verification block; and recording the physical memory pointers of the core encryption block and the basic verification block respectively.

[0011] Preferably, the specific generation process of the bypass verification task includes: extracting the encryption standard identifier and key sequence from the initial configuration strategy to generate a full encryption opcode; extracting the cyclic redundancy check identifier and sampling step size from the initial configuration strategy to generate a sampling verification opcode; merging the full encryption opcode with the physical memory pointer of the core encryption block to generate a heavy-load execution subtask; merging the sampling verification opcode with the physical memory pointer of the basic verification block to generate a light-load execution subtask; establishing an asynchronous communication mailbox pointing to the protected shared memory area within the main processor; and pushing the heavy-load execution subtask and the light-load execution subtask into the asynchronous communication mailbox to generate the bypass verification task.

[0012] Preferably, the specific generation process of the policy switching set includes: enabling a direct memory access channel between the main processor and the bypass trusted execution area; pushing the bypass verification task into the protected shared memory area through the direct memory access channel; the bypass trusted execution area reading the bypass verification task in the protected shared memory area, performing cryptographic operations, and outputting the security verification result; establishing a state change listener in the policy scheduling engine of the main processor; intercepting policy downgrade events and policy upgrade events triggered by the policy scheduling engine for the global session as change records; parsing the call stack information of the change records; extracting the change occurrence timestamp, policy revocation identifier, and policy mounting identifier from the call stack information; concatenating the change occurrence timestamp, policy revocation identifier, and policy mounting identifier into a log tuple of a fixed format; collecting all log tuples generated within a preset time window; sorting all log tuples according to the order of change occurrence timestamps, and outputting the generated policy switching set.

[0013] Preferably, the specific process of locking the policy update thread includes: extracting the revocation policy identifier and the mounting policy identifier from the sorted log tuples within the policy switching set; counting the total number of times within a fixed time length, the mounting policy identifier of the previous log tuple is used as the revocation policy identifier of the next log tuple, and the revocation policy identifier of the previous log tuple is used as the mounting policy identifier of the next log tuple; performing a division operation between the total number of alternations and the fixed time length to calculate the output reversal frequency; when the reversal frequency is greater than a preset oscillation threshold, extracting the configuration policy identifier currently held by the policy scheduling engine; packaging the configuration policy identifier with preset cooling countdown parameters to generate a damping isolation instruction; writing the damping isolation instruction into the policy scheduling engine control register of the main processor; the policy scheduling engine locking the policy update thread according to the damping isolation instruction; and maintaining the currently held configuration policy identifier unchanged until the cooling countdown parameters are cleared.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. By extracting protocol header features from the business data stream, a privacy weight value is generated. When the computing power state set exceeds a preset computing power threshold, the payload data area of ​​the business data stream is physically segmented based on this privacy weight value to generate core encryption blocks and basic verification blocks. This mechanism can rationally allocate resources to data areas with different characteristics when the hardware faces high load. By ensuring that payload data containing sensitive information receives deep security protection, while allowing ordinary verification data to flow quickly, the limited underlying computing power is accurately guided to critical nodes, breaking the congestion bottleneck caused by unified processing. Furthermore, it can still output consistent data protection capabilities even when computing power fluctuates drastically.

[0015] 2. Extract full encryption opcodes and sampling verification opcodes from the initial configuration strategy. Configure full encryption opcodes for the core encryption block and sampling verification opcodes for the basic verification block, and combine them to generate a bypass verification task. Import the bypass verification task into the bypass trusted execution area to generate secure verification results. This process decouples complex cryptographic operations from conventional verification operations at the instruction level, reasonably distributing the concurrent load on the main processor. Relying on a hardware-level isolated environment to perform intensive computations, it not only physically isolates the risk of sensitive data being spied on in main memory but also fully releases the overall throughput potential of the underlying network through a parallel task scheduling mechanism.

[0016] 3. A policy switching set is generated by extracting change records from the main processor, and the reversal frequency of the policy switching set is continuously calculated. When the frequency is greater than a preset oscillation threshold, a damping isolation instruction is generated and input into the main processor to lock the policy update thread. When dealing with sudden changes in network traffic or unstable environments, this mechanism can avoid additional computational losses caused by frequent state jumps in the control architecture. By locking the policy update thread in a timely manner, the established configuration state is maintained within a specific time window, ensuring the continuity of internal resource scheduling, eliminating meaningless scheduling inefficiencies, and being able to cope with complex and ever-changing extreme network interaction scenarios.

[0017] 4. A deep logical closed loop is established across the three dimensions of perception, execution, and control. By extracting the characteristics of business data flow and the computing power status of hardware, a cross-level linkage feedback is established between application-layer privacy requirements and underlying physical resources. Simultaneously, the segmented data blocks are imported into a bypass trusted execution area via asynchronous communication, achieving loose coupling between the main processor and the bypass engine at the execution level, effectively removing the performance constraints of traditional serial processing architectures. Combined with damped isolation instructions based on inversion frequency, a strongly consistent global scheduling perspective can be maintained on this loosely coupled execution framework. Fluctuations at the perception end trigger data diversion, asynchronous offloading at the execution end alleviates computing power pressure, and the damping mechanism at the control end acts as a buffer valve for regulating the link. This holistic architecture design of "loosely coupled execution and highly cohesive control" allows each module to operate independently and efficiently, while also precisely engaging through feedback mechanisms. This ensures that the control architecture itself does not experience logical collapse, and effectively improves the security and speed of data management in the long term. Attached Figure Description

[0018] Figure 1 A flowchart illustrating a strategy adaptive control method based on data feedback analysis proposed in an embodiment of this invention application; Figure 2 This is a flowchart of the data physical segmentation and bypass combination mechanism based on privacy weight proposed in an embodiment of this invention application; Figure 3 This is a flowchart of the strategy damping anti-shake control mechanism based on reversal frequency proposed in an embodiment of this invention application. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Please see Figures 1-3 The present invention provides a strategy adaptive control method based on data feedback analysis, the specific steps of which are as follows: Receive handshake request stream, service data stream, hardware monitoring stream and historical policy set; generate network feature vector based on handshake request stream; compare with historical policy set to generate initial configuration policy; configure main processor based on initial configuration policy. The business data stream and hardware monitoring stream are input to the main processor. The queue backlog depth and network throughput in the hardware monitoring stream are extracted and combined to generate a computing power status set. Extract the protocol header features of the business data stream to generate a privacy weight value. When the computing power status set exceeds the preset computing power threshold, divide the payload data of the business data stream into a core encryption block and a basic verification block according to the privacy weight value. Extract the full encryption opcode and the sampling verification opcode from the initial configuration strategy. Configure the full encryption opcode for the core encryption block and the sampling verification opcode for the basic verification block, and combine them to generate a bypass verification task. The bypass verification task is imported into the bypass trusted execution area to generate a security verification result. The change record in the main processor is extracted to generate a policy switching set. The reversal frequency of the policy switching set is calculated. When it is greater than the preset oscillation threshold, a damping isolation instruction is generated. The damping isolation instruction is input into the main processor to lock the policy update thread.

[0021] The technical solution of the present invention will be further described in detail below with reference to specific embodiments.

[0022] Example 1 This application discloses a strategy adaptive control method based on data feedback analysis, see embodiments. Figure 1 The specific steps proposed in this invention include: S1. Receiving a handshake request stream, a service data stream, a hardware monitoring stream, and a historical policy set; generating a network feature vector based on the handshake request stream; comparing it with the historical policy set to generate an initial configuration policy; configuring the main processor based on the initial configuration policy; S2. Inputting the service data stream and the hardware monitoring stream into the main processor; extracting the queue backlog depth and network throughput from the hardware monitoring stream; and combining them to generate a computing power state set; S3. Extracting the protocol header features of the service data stream to generate a privacy weight value; and when the computing power state set exceeds a preset computing power threshold, adjusting the privacy weight value accordingly. The payload data area of ​​the business data stream is segmented to generate a core encryption block and a basic verification block; full encryption opcodes and sampling verification opcodes are extracted from the initial configuration policy, full encryption opcodes are configured for the core encryption block, and sampling verification opcodes are configured for the basic verification block, and combined to generate a bypass verification task; S4, the bypass verification task is imported into the bypass trusted execution area to generate a security verification result, the change record in the main processor is extracted, and a policy switching set is generated; the reversal frequency of the policy switching set is calculated, and when it is greater than the preset oscillation threshold, a damping isolation instruction is generated, and the damping isolation instruction is input into the main processor to lock the policy update thread.

[0023] Further, the system receives handshake request streams, service data streams, hardware monitoring streams, and historical policy sets. It generates network feature vectors based on the handshake request streams, compares these vectors with the historical policy sets, and generates an initial configuration policy. The main processor is then configured based on this initial configuration policy. This corresponds to step S1 above. The specific implementation process includes: The system receives handshake request streams from external sources via the network interface and loads the local historical policy set. It extracts the source address field, destination port field, and packet arrival time interval parameter from the handshake request stream, performs numerical conversion, and outputs a network feature vector. It reads the baseline feature matrix and associated configuration set contained in the historical policy set. It calls the cosine similarity function to calculate the similarity value between the network feature vector and each row vector within the baseline feature matrix. It extracts the index of the row vector with the highest similarity value. Based on the row vector index, it extracts the corresponding secure handshake parameters, number of encryption threads allocated, sampling step size, encryption standard identifier, key sequence, and cyclic redundancy check identifier from the associated configuration set, and encapsulates these to generate an initial configuration policy. Finally, it configures the main processor's policy scheduling engine based on the initial configuration policy.

[0024] Specifically, the initial configuration strategy is generated as follows: In digital marketing data management scenarios, massive distributed advertising terminals, mobile applications, or web-based tracking pixels continuously initiate connection handshakes with the server to simultaneously carry network packet data containing key user profiles, behavioral trajectories, and device fingerprints.

[0025] First, the underlying network interface controller receives the handshake request stream from outside. This handshake request stream typically appears as a sequence of client initial request messages sent to the server cluster. When these messages arrive at the network protocol stack, the packet filter module begins to work, extracting three core protocol header fields from the handshake request stream: the source address field, the destination port field, and the packet arrival time interval parameter.

[0026] For the source address field, a normalization mapping mechanism based on cryptographic hashing is employed. Specifically, the extracted source address field is used as input, a secure hash algorithm is called to generate a digest value, and then a specific low-order bit of this digest value (e.g., the lower 16 bits) is truncated to convert it into an integer. This integer is then divided by the maximum value corresponding to that bit width, generating a floating-point number strictly within the closed interval of 0 to 1. This method ensures that even addresses distributed across different network operator segments can be uniformly and non-linearly mapped to a one-dimensional mathematical space.

[0027] For the destination port field, since marketing application interfaces are typically bound to specific well-known ports, a direct linear proportional normalization method is used. Dividing the actual captured port number by the maximum number of ports allowed by the transmission control protocol will also output a floating-point value less than 1.

[0028] The packet arrival time interval parameter characterizes the sending frequency of the data source. The arrival timestamps of two adjacent handshake request packets from the same source address are recorded, and their difference is calculated. Considering the long-tail effect typically present in network latency distributions, a logarithmic compression function is used to smooth and normalize the time difference. This numerical transformation process involves adding a one-millisecond smoothing bias constant to the time difference in milliseconds, calculating its logarithmic value with a base of the natural constant, and then dividing the result by a preset maximum logarithmic scaling factor (e.g., a maximum logarithmic scaling factor set based on historical network statistics could be 10.0). The result is ultimately mapped to a normalized value representing the request frequency.

[0029] Through the above numerical conversion process, the originally heterogeneous source address mapping values, destination port mapping values, and packet arrival time interval mapping values ​​are sequentially concatenated to generate a three-dimensional network feature vector. This network feature vector is temporarily stored in the main processor's cache as a floating-point array.

[0030] While generating network feature vectors, a historical strategy set is loaded from local storage to main memory via asynchronous input / output operations. This historical strategy set is the result of convergent clustering of massive historical network connections using an unsupervised clustering algorithm (such as the K-Means algorithm) over a long period of operation. During offline clustering, the elbow rule is used to determine the value of K, calculating the sum of squares within clusters for different K values ​​and taking the value corresponding to the inflection point of the curve (e.g., K is set to 8 in this embodiment). The convergence criterion for clustering iteration is set to a drift distance of less than 0.001 for the center point coordinates. To ensure spatial consistency in online computation, the input feature dimensions extracted by the unsupervised clustering algorithm maintain strict three-dimensional consistency with the source address mapping value, destination port mapping value, and packet arrival time interval mapping value generated in the online phase. The historical strategy set is structurally composed of two strictly bound parts: a baseline feature matrix composed of the cluster centers output by the clustering algorithm, and an associated configuration set. The baseline feature matrix is ​​a multi-row, three-column two-dimensional floating-point matrix, where each row represents a typical historical marketing traffic pattern. The associated configuration set is a set of security policies that are manually configured and bound to each historical pattern generated by clustering, based on the risk level and computing power consumption of that type of traffic in advance, offline.

[0031] To find the best match for the current traffic, the vector operation instruction set of the main processor is invoked, and the cosine similarity function is called to calculate the similarity value between the network feature vector and each row vector within the baseline feature matrix. First, the inner product of the network feature vector and the historical baseline row vector is calculated, which is the sum of the products of the three elements at corresponding positions of the two vectors; this result is used as the numerator of the formula. Then, the Euclidean norm of the real-time network feature vector and the Euclidean norm of the historical baseline row vector are calculated separately. The product of these two norms is then multiplied by a preset minimum value (e.g., 10). -6 To prevent the denominator from being zero, the numerator is used as the denominator in the formula. Finally, the numerator is divided by the denominator to calculate and output the similarity value, which represents the cosine of the angle between the two vectors in three-dimensional space. The theoretical range of this similarity value is -1 to 1. The closer the value is to 1, the higher the geometrical overlap between the current network handshake behavior and a certain historical traffic pattern.

[0032] After traversing and calculating the similarity values ​​between the network feature vectors and all row vectors in the baseline feature matrix, a max-heap data structure is maintained in memory to extract the row number of the row vector with the highest similarity value. This row number is the row vector index.

[0033] After extracting the similarity value of the first-ranked item, it is compared with a preset confidence threshold (e.g., 0.5, determined based on the optimal balance point of the cross-test curve of false positive and false negative rates in historical data). If the value is lower than the preset confidence threshold, it indicates that the current traffic pattern is unknown and untrustworthy, triggering a fallback protection strategy. This involves skipping hash table addressing and directly using the highest security level encryption standard and the densest verification step size as the initial configuration strategy. If the value is equal to or greater than the threshold, hash table addressing is performed based on the row vector index and the associated configuration set contained in the historical strategy set. Since the associated configuration set is a collection of key-value pairs with predefined parameters, it can extract three core scheduling parameters that best match the historical pattern: The first is the secure handshake parameter, which determines the cipher suite to be used for subsequent secure connections (e.g., extracting an identifier that uses a combination of Advanced Encryption Standard and a specific counter pattern); the second is the number of encryption threads allocated, which determines the total number of concurrent worker threads that the main processor operating system should reserve for subsequent data processing of this connection; the third is the sampling step size, which determines the spatial sampling interval for subsequent data integrity checks; the fourth is the encryption standard identifier, which guides the specific symmetric encryption algorithm used by the underlying hardware for full encryption protection; the fifth is the key sequence, which is the session-level encryption credential solidified during the asymmetric negotiation phase; and the sixth is the cyclic redundancy check identifier, which guides the sampling anti-tampering algorithm for the basic data.

[0034] After obtaining the above parameters, a memory serialization operation is performed to encapsulate the security handshake parameters, the number of encryption threads allocated, the sampling step size, the encryption standard identifier, the key sequence, and the cyclic redundancy check identifier into a standardized configuration structure. This configuration structure is the initial configuration policy generated at output. Finally, based on this initial configuration policy, kernel function calls are used to write its internal parameters one by one into the relevant control registers of the policy scheduling engine within the main processor, completing the policy preloading and configuration of the main processor.

[0035] Multidimensional features of the handshake request are extracted to generate network feature vectors. By calling the cosine similarity function and matching it with the historical benchmark feature matrix, the cold start response latency is effectively reduced, ensuring the accuracy of the initial configuration strategy and the reliability of operation.

[0036] Furthermore, the business data stream and hardware monitoring stream are input to the main processor, and the queue backlog depth and network throughput in the hardware monitoring stream are extracted and combined to generate a computing power state set; corresponding to step S2 above; the specific implementation process includes: The process involves: controlling the network interface controller to intercept service data streams; initiating the main processor's low-level probe program to generate a hardware monitoring stream; importing the service data stream and hardware monitoring stream into the main processor's kernel buffer area; parsing the hardware monitoring stream into a memory state stream and a network interface card (NIC) traffic stream; reading the task counter value of the main processor's direct memory access controller from the memory state stream; performing a moving average calculation on the task counter value to generate the queue backlog depth; reading the total number of received bytes and the total number of sent bytes from the main processor's physical NIC interface from the NIC traffic stream; merging the total number of received bytes with the total number of sent bytes to calculate and output the network throughput; constructing a data encapsulation containing horizontal and vertical coordinates; mapping the queue backlog depth to the horizontal coordinate field of the data encapsulation and mapping the network throughput to the vertical coordinate field of the data encapsulation; appending a collection timestamp to the end of the data encapsulation, closing the data encapsulation, and outputting the generated computing power state set.

[0037] Specifically, the process of generating the computing power state set is as follows: First, at the driver level, the network interface controller intercepts the incoming service data stream after the handshake verification. Simultaneously, the main processor's operating system kernel starts a low-level probe program, which is attached to key trace points in the kernel with minimal performance loss, generating a hardware monitoring stream that reflects the actual operating metrics of the hardware.

[0038] Subsequently, through the kernel direct memory access mechanism, the business data stream and the hardware monitoring stream are imported in parallel into the kernel buffer area pre-allocated by the main processor. Within the kernel buffer area, the probe program's parsing module demultiplexes and parses the received mixed hardware monitoring stream, separating it into two independent and frequently updated sub-data streams: one is a memory status stream reflecting the congestion between main memory and peripheral devices; the other is a network interface card (NIC) traffic stream reflecting the physical layer network load pressure.

[0039] For memory state stream processing, the focus is on the operational status of the Direct Memory Access Controller (DMI) on the motherboard. The DMI is responsible for moving data from the network interface card's (NIC) hardware queue to the main processor's memory space without consuming core clock cycles. By calling performance monitoring interfaces provided by the operating system kernel (such as the perf_event subsystem or IOMMU performance tracer on Linux), the task counter value (or the equivalent I / O wait queue depth register mapping value) of the main processor's DMI is read. This value represents the total number of micro-operation requests currently queued in the physical hardware. However, because network packet arrivals exhibit a pronounced Poisson distribution, a single sample of the task counter value often contains a large amount of high-frequency glitches and noise, making direct use highly susceptible to mis-triggering of subsequent strategies.

[0040] To this end, an exponential moving average is calculated on the continuously read task counter values ​​to filter out transient noise and extract trend signals. Specifically, the task counter value sampled at the current moment is extracted and multiplied by a preset smoothing weight coefficient (0.1 in this embodiment). Simultaneously, the old queue stacking depth result calculated in the previous sampling period is read and multiplied by a residual weight coefficient (0.9 in this embodiment), wherein the sum of the smoothing weight coefficient and the residual weight coefficient is strictly equal to 1. Finally, the two multiplication results are summed to generate a highly smooth queue stacking depth with true physical meaning at the current moment.

[0041] Simultaneously, for processing network interface card (NIC) traffic, the underlying hardware statistics registers of the main processor's physical NIC interface are read to extract the total number of received bytes and the total number of transmitted bytes within a fixed time window (e.g., set to 1 second or 100 milliseconds, the window length of which is set according to the main processor's hardware interrupt cycle). To intuitively reflect the overall external bandwidth consumption level, an addition operation is performed to combine the total number of received bytes with the total number of transmitted bytes, yielding the total number of bytes transmitted. Subsequently, a division operation is performed to divide the total number of transmitted bytes by the duration of the time window (and divide by a megabyte conversion factor according to calculation requirements), outputting the network throughput.

[0042] After obtaining the two hardware metrics mentioned above, to eliminate the difference in dimensions, the pre-configured queue depth limit and bandwidth physical limit are extracted. By performing division, the smoothed queue stack depth is divided by the queue depth limit, and the network throughput is divided by the bandwidth physical limit, thus converting these two absolute physical quantities into dimensionless relative values ​​between 0 and 1. Subsequently, a data encapsulation containing horizontal and vertical coordinate structures is constructed in the contiguous memory space of the kernel. The converted dimensionless relative queue stack depth is used as the horizontal variable and mapped to the horizontal coordinate field of the data encapsulation; simultaneously, the converted dimensionless relative network throughput is used as the vertical variable and mapped to the vertical coordinate field of the data encapsulation, constructing a two-dimensional phase space representing the current computing power level. The queue depth limit can be set according to the hardware specifications of the motherboard's direct memory access controller, and the bandwidth physical limit can be set according to the physical network card specifications.

[0043] To ensure the time-series traceability of data throughout its entire lifecycle, the operating system's clock mechanism is invoked to obtain the current collection timestamp, which is then appended to the end of the data encapsulation body to generate a computing power status set.

[0044] In this embodiment, local density outlier detection is performed on the closed data encapsulation. Historical coordinates from the preceding time window are extracted, and the average Euclidean distance from the current coordinates to several nearest neighbors is calculated. Transient pseudo-peaks caused by underlying hardware interrupts are eliminated by comparing the distance to a dynamic distance threshold. Specifically, a coordinate point cache queue is maintained, keeping the horizontal queue stacking depth and vertical network throughput of the most recent fifty historical data encapsulations in memory constant. When a new data encapsulation closes, its two-dimensional coordinates are extracted. The Euclidean distance algorithm is used, specifically calculating the sum of squares of the differences between the current data encapsulation's horizontal and vertical coordinates and the historical coordinates in the corresponding dimensions. Then, the square root of this sum is taken, and so on, to calculate the distance to all historical coordinate points in the cache queue. During extraction, if it is in the cold start phase and the number of points in the cache queue is less than 5, outlier detection is skipped, and the current data encapsulation is considered safe and pushed into the queue. If the number of points is greater than or equal to 5, the five points with the smallest distances are extracted, and the arithmetic mean of these five smallest distances is calculated and recorded as the local dispersion. Simultaneously, the average and standard deviation of the distances between all pairs of points in the cache queue are calculated to construct a dynamic distance threshold. Specifically, the average is calculated by adding three times the standard deviation. The local dispersion is compared to the dynamic distance threshold. If the local dispersion is greater than the dynamic distance threshold, the current data encapsulation is determined to be a spurious peak caused by a hardware interruption, discarded, and replaced with smoothed data from the previous normal data encapsulation. If the local dispersion is less than or equal to the dynamic distance threshold, it is pushed into the cache queue, and the average and standard deviation are updated. The number of points selected is typically 10% of the total length of the cache queue to balance computational load and smoothing effect. This process effectively filters out the interference of occasional hardware glitches on the underlying computing power evaluation, significantly improving the physical accuracy of the input state set.

[0045] The aforementioned local density outlier detection algorithm is deployed and runs in a separate, low-priority asynchronous monitoring thread. This thread does not block the critical path of packet forwarding on the main processor, and the dynamic distance threshold it calculates is periodically updated to the shared memory used by the main path in a bypass manner.

[0046] By using low-level probes to read DMA counters and network card transmit / receive data and perform moving average calculations, monitoring overhead is reduced and it is easier to obtain the underlying computing power and throughput status.

[0047] Further, the protocol header features of the business data stream are extracted to generate a privacy weight value. When the computing power state set exceeds a preset computing power threshold, the payload data of the business data stream is segmented according to the privacy weight value to generate a core encryption block and a basic verification block. Full encryption opcodes and sampling verification opcodes are extracted from the initial configuration strategy. Full encryption opcodes are configured for the core encryption block, and sampling verification opcodes are configured for the basic verification block, combining them to generate a bypass verification task; this corresponds to step S3 above; see [link to relevant documentation]. Figure 2 The specific implementation process includes: The system intercepts the header area of ​​the business data stream; extracts protocol header features containing application layer protocol identifier, payload length, and authentication type fields from the header area, converts them to floating-point numbers, and combines them to generate a one-dimensional feature row vector; retrieves a preset sensitivity weight matrix; performs matrix multiplication between the one-dimensional feature row vector and the sensitivity weight matrix, calculates and outputs a one-dimensional scoring row vector; calls the Euclidean norm formula; calculates the Euclidean norm value of the one-dimensional scoring row vector; and outputs the Euclidean norm value as a scalar to generate a privacy weight value.

[0048] Specifically, the process for generating the privacy weight value is as follows: This embodiment pre-trains the deep model on an offline high-performance computing cluster. Its core objective is to produce a sensitivity weight matrix that can map unstructured message features to continuous privacy scores. The deep model employs a typical fully connected feedforward neural network design. In terms of hierarchical structure, the model includes an input layer with three neurons, corresponding to the three subsequently extracted protocol header features. Finally, the model includes a linear output layer without bias terms, which is configured to contain a predetermined number (e.g., five) of abstract evaluation neurons. The weight set of the fully connected synapses between the three-neuron input layer and the output layer constitutes the required sensitivity weight matrix (essentially a 3x5 dimensionality-reduced projection matrix).

[0049] Regarding the specific steps and parameters of offline training, a training dataset containing a large number of real but anonymized marketing message headers was first collected. In the anonymization process, a combination of field masking and salted hashing was used to irreversibly replace the real source IP address and user identifier string within the message, generating an anonymized training dataset. Each data point was labeled with a real privacy score between 0 and 10 as a supervision label. During training, at each forward propagation, the five-dimensional output vector generated by the network mapping of the input data was first calculated. Then, the computation node was called to solve the Euclidean norm of the five-dimensional output vector, transforming it into a single scalar prediction score. Subsequently, mean squared error was used as the loss function to measure the deviation between this scalar prediction score and the real privacy score label. The specific scoring and labeling rules are based on a multi-dimensional historical leakage risk probability weighted mapping of three core features. In this embodiment, taking sensitivity control in the digital marketing scenario as an example, the business-related protocol identifiers are used as dynamically configurable security assessment parameters: (1) Application layer protocol identifier risk mapping: According to historical data statistics, the baseline leakage probability mapping for plaintext HTTP is 0.0, the standard HTTPS mapping is 0.2, and the specific financial private encryption protocol is mapped to 0.8 because it carries extremely high-value assets; (2) Authentication type risk mapping: No authentication is mapped to 0.0, one-way TLS authentication is mapped to 0.1, and two-way mTLS authentication is mapped to 0.3; (3) Payload length risk mapping: A segmented step mapping is adopted, with a payload less than 512 bytes mapped to 0.0, 512 bytes to 2KB mapped to 0.1, and greater than 2KB mapped to 0.3. The above three risk probability mapping values ​​are aggregated through a specific nonlinear function to obtain a comprehensive real privacy risk assessment value between 0 and 10.

[0050] An adaptive moment estimation (IME) optimization algorithm was selected to perform backpropagation and gradient descent. The initial learning rate was set to 0.0001, with an exponential decay strategy to minimize the mean squared error after a certain number of training epochs. The learning rate was decayed at a specific rate to avoid oscillations around the optimal solution. The batch size was parameterized to strike a balance between memory usage and gradient computation stability. After hundreds of iterations of training, training terminated when the loss function value on the validation set converged to a minimum. The connection weights between the input and output layers of the neural network were extracted, specifically the 3x5 fully connected projection matrix between the three-neuron input layer and the five-neuron output layer.

[0051] When the business data stream enters, the protocol stack parsing engine intercepts the header segment. Instead of deeply dissecting the computationally intensive payload, it quickly extracts three highly representative protocol header features from the header segment: the application layer protocol identifier, the payload length, and the authentication type field. Using a pre-built risk mapping benchmark table in memory, these three protocol features are mapped to consecutive floating-point risk probabilities according to the aforementioned rules. Subsequently, these three floating-point numbers representing local physical risks are linearly arranged in a fixed order in memory, combining to generate a one-dimensional feature row vector. This one-dimensional feature row vector constitutes the input representation of the privacy attributes of the current business message, with each dimension of the vector representing the exposure risk intensity of an independent physical dimension.

[0052] In this embodiment, the generated one-dimensional feature row vector is corrected for information entropy. The prefix bytes of the protocol header payload are extracted, their frequencies are statistically analyzed, and Shannon entropy is calculated. This entropy value is normalized as a correction coefficient, which is then used to perform scalar multiplication scaling on each dimension element of the feature row vector. Specifically, after obtaining the initial one-dimensional feature row vector, to address obfuscated and mutated traffic, the first 64 bytes immediately following the protocol header in the header message area are extracted as an analysis segment. This segment is traversed, and a hash array of capacity 256 is used to count the frequency of each hexadecimal byte value. The frequency of each byte is divided by 64 to obtain the probability of a single byte occurrence. The Shannon entropy algorithm is then used to calculate the disorder of the segment. Specifically, byte elements with a probability of zero are first filtered out, and only the probability of each actually occurring single byte is extracted. This probability is multiplied by the base-2 logarithm of that probability, and then all multiplication results are summed and their absolute values ​​are taken. To match the neural network input, the disorder is divided by the maximum theoretical information content of a single-byte structure (i.e., the logarithm of 2^256), yielding a normalized entropy coefficient ranging from 0 to 1. A baseline bias constant of 0.5 is set. The normalized entropy coefficient is subtracted from this baseline bias constant, and the difference is multiplied by a scaling factor of 0.2, then added back to the base value of 1 to construct a scaling factor. Subsequently, each element in the one-dimensional feature row vector is multiplied by this scaling factor to update the original feature row vector. A baseline bias constant of 0.5 (representing the theoretical neutral entropy boundary) and a scaling factor of 0.2 are set (verified through stress testing to ensure that the maximum perturbation to the feature row vector does not exceed ±10%, avoiding model recognition failure). This process dynamically adjusts the feature values ​​through information entropy, enhancing the model's ability to generalize and recognize the privacy attributes of unknown or encrypted / obfuscated traffic. Using the entropy value, which represents disorder, as a scalar multiplier is equivalent to applying a nonlinear uncertainty risk penalty amplification factor to the original multidimensional physical risk intensity. This results in the final extracted features not only reflecting static protocol risk but also incorporating dynamic mutation risk.

[0053] Subsequently, the main processor retrieves the resident preset sensitivity weight matrix and performs a standard matrix multiplication operation between the one-dimensional feature row vector and the sensitivity weight matrix: the one-dimensional feature row vector is multiplied by each column vector of the sensitivity weight matrix, that is, the corresponding elements are multiplied and then summed. The result of each dot product constitutes one dimension value of the new vector. After a complete traversal, it is mapped to a set with multiple abstract privacy evaluation indicators, and this is calculated and output as a brand-new one-dimensional scoring row vector.

[0054] The tensor operation instructions are further invoked to calculate the Euclidean norm of the one-dimensional scoring row vector. Each independent dimension element in the one-dimensional scoring row vector is extracted and squared; then, the squared values ​​of all dimension elements are summed; finally, the square root of this sum is taken. The final value obtained from this square root operation is the absolute geometric distance of the one-dimensional scoring row vector from the zero-risk baseline origin in the multi-dimensional abstract risk space.

[0055] This absolute geometric distance is output as an absolute scalar representing the extreme value of the overall exposure deviation of the service message, thereby generating a privacy weight value specific to this particular data packet.

[0056] Calculating the Euclidean norm by combining protocol header features with the sensitivity matrix helps to transform qualitative privacy attributes into quantitative scalars, providing a numerical reference for subsequent data payload segmentation.

[0057] The target encryption depth level is obtained by comparing the privacy weight value with the preset classification threshold table; the payload data area of ​​the business data stream is scanned using a message structure parser; the type length value structure boundaries within the payload data area are identified, and the boundary physical addresses are marked; the corresponding set of boundary physical addresses is matched according to the target encryption depth level; the message fields within the hit boundary physical address set are truncated and encapsulated to generate the core encryption block; the remaining message fields that do not hit the boundary physical address set are truncated and encapsulated to generate the basic verification block; the physical memory pointers of the core encryption block and the basic verification block are recorded respectively.

[0058] Specifically, the generation process of the core encryption block and the basic verification block is as follows: First, the computing power state set, including queue backlog depth and network throughput, is logically compared with a preset computing power threshold configured in the kernel. The preset computing power threshold is typically defined as a Boolean expression with two conditions. For example, operations personnel can set threshold requirements based on historical stress test data: when queued tasks exceed extremely high boundaries and network throughput approaches physical limits, it is determined to be in an overload state. When the physical conditions are simultaneously met, it is successfully determined that the computing power state set exceeds the preset computing power threshold, thereby triggering the degradation and splitting logic of adaptive policy adjustment.

[0059] After triggering the segmentation logic, the calculated privacy weight values ​​are extracted. A preset grading threshold table is maintained in memory, and the interval division of this table is set based on the statistical normal distribution of offline business data. Specifically, the mean μ of the privacy score of this batch of samples is approximately 4.5, and the standard deviation σ is approximately 1.5; μ-0.67σ (rounded to approximately 3.5, corresponding to approximately the top 25% percentile) and μ+2σ (rounded to approximately 7.5, corresponding to approximately the 97th percentile) are used as the grading boundaries. For example: privacy weight values ​​in the interval [0, 3.5) correspond to the first protection level (basic verification); weight values ​​in the interval [3.5, 7.5) correspond to the second protection level (partial field encryption); and high-scoring weight values ​​in the interval [7.5, 10] correspond to the highest core sensitive protection level. By comparing the privacy weight values ​​with the preset grading threshold table, it is found that they fall into specific intervals, thus accurately obtaining the target encryption depth level.

[0060] Subsequently, the application message structure parser is invoked to begin scanning the payload data area of ​​the business data stream residing in the kernel buffer region. In marketing scenarios, the data payload is typically serialized using a highly structured tag encapsulation protocol. Unlike traditional application-layer proxies that deserialize the entire message into user-space memory, the parser moves the pointer sequentially as a byte stream, scanning and identifying the type, length, and value structure boundaries within the payload data area. For example, if the parser matches a type byte indicating highly sensitive identity characteristics during the scan, it will immediately read the corresponding length field. At this point, the parser immediately stops scanning the current data block, records the starting physical address of the current type byte in main memory, and calculates the ending address by adding the length offset to that address, thus marking the boundary physical address of this entire data block in the physical memory mapping table.

[0061] Based on the target encryption depth level obtained from the lookup table, the corresponding boundary physical address set filtering rules are matched in the local policy library. The specific mapping rules are as follows: When the target encryption depth level is the first protection level (basic verification), the matching rule is empty, that is, no core fields are truncated; when it is the second protection level, the matching rule matches the boundary of TLV fields containing non-core identity tags such as device fingerprint and general geographic location; when it is the highest core protection level, the matching rule matches all TLV field boundary addresses containing strong identity tags such as payment token, precise latitude and longitude coordinates, and core user identifier.

[0062] Guided by higher-level rules, only memory blocks corresponding to type tags indicating strong privacy characteristics can be included in the hit set. By comparing the parsed type tags with the rule base, blocks that meet the conditions are selected, thus establishing the set of physical addresses that form the hit boundary. Figure 2As shown, the two links converge at this segmentation stage: on the one hand, the target encryption depth level derived from the privacy weight value constitutes the logical control flow marked by the dashed line in the figure, which guides the data classification strategy; on the other hand, the parsed boundary physical address constitutes the entity data flow marked by the solid line in the figure, providing precise physical landing points. The two are coupled here, jointly triggering subsequent data interception actions.

[0063] After identifying the sensitive data distribution in memory, the core data interception and encapsulation operations are performed. To completely avoid the high overhead of data transfer, a zero-copy mechanism is adopted. The packet fields within the set of hit boundary physical addresses are logically intercepted (i.e., only the start and end address pointers and data length fields are extracted). By constructing a lightweight memory descriptor structure, these scattered sensitive fragments are logically assembled and encapsulated to generate the core encryption block.

[0064] For the remaining message fields in the payload data area that do not hit the boundary physical address set (such as data blocks containing regular timestamps or links to publicly available materials), the same method of extracting pointers and length information is used for logical truncation, and these are then encapsulated to generate basic verification blocks. Finally, the physical memory pointers pointing to these two logical blocks are recorded in the task dispatch register queue of the main processor.

[0065] Data truncation and encapsulation based on type length value structure boundaries can maintain the intrinsic integrity of data packets during segmentation, thereby reducing the risk of memory overflow during cryptographic operations.

[0066] Extract the encryption standard identifier and key sequence from the initial configuration strategy to generate a full encryption opcode; extract the cyclic redundancy check identifier and sampling step size from the initial configuration strategy to generate a sampling check opcode; merge the full encryption opcode with the physical memory pointer of the core encryption block to generate a heavy-load execution subtask; merge the sampling check opcode with the physical memory pointer of the basic check block to generate a light-load execution subtask; establish an asynchronous communication mailbox pointing to the protected shared memory area within the main processor; push the heavy-load execution subtask and the light-load execution subtask into the asynchronous communication mailbox to generate a bypass check task.

[0067] Specifically, the generation process of the bypass verification task is as follows: First, the initial configuration policy object is retrieved by backtracking. From the parameter set contained in this object, the encryption standard identifier indicated in the secure handshake parameters is extracted. Simultaneously, the session key sequence generated during the handshake phase through asymmetric algorithm negotiation is extracted from the secure memory context. The extracted encryption standard identifier and this key sequence are then tightly concatenated using specific bitwise operations to generate a microinstruction stream that can be directly parsed by the underlying hardware computing unit, thus generating the full encryption opcode.

[0068] Using similar operational logic, the system re-enters the initial configuration strategy object to extract the cyclic redundancy check (CRC) identifier used for basic integrity verification, as well as the sampling step size parameter previously determined based on the baseline. The CRC identifier and sampling step size parameter are then assembled into binary instructions to generate a sampling verification opcode. The special feature of this opcode is that it instructs the hardware, when processing large volumes of basic data, not to perform intensive hash operations byte-by-byte, but instead to collect samples at specific intervals and incorporate them into the verification matrix.

[0069] After constructing the instruction set described above, the task execution structures are merged and bound. The newly generated full-scale encryption opcode is merged with the physical memory pointer to the core encryption block pointing to sensitive data, packaged into a workflow entity with strong computationally intensive characteristics, generating a heavy-load execution subtask. Simultaneously, the sampling verification opcode used for tamper prevention is merged with the physical memory pointer to the basic verification block pointing to non-sensitive, large amounts of data, packaged into a workflow entity with lightweight computational characteristics, generating a lightweight execution subtask.

[0070] To ensure that the main processor can return to process the next highly concurrent handshake request after issuing a task, an efficient asynchronous decoupling mechanism is needed. A special shared memory region using a circular queue data structure is allocated and established between the kernel space where the main processor schedules tasks and the peripherals. This region is marked as a protected shared memory area in the hardware page table that cannot be read by ordinary application processes. The entry address of the main processor writing data to this region, along with its associated interrupt semaphore mechanism, together construct a virtual asynchronous communication mailbox.

[0071] Subsequently, a lock-free enqueue algorithm is invoked to push the constructed heavy-load and light-load execution subtasks as independent data packets into the tail of the asynchronous communication mailbox queue. Once these two subtasks are successfully enqueued and their execution order is established, this group of associated queue elements is combined and encapsulated into a complete scheduling unit, ultimately outputting a bypass verification task.

[0072] Combining the opcode and physical memory pointer into the asynchronous communication mailbox reduces redundant data movement and helps improve the speed of task collaborative unloading.

[0073] Further, the bypass verification task is imported into the bypass trusted execution area to generate a security verification result, and the change records in the main processor are extracted to generate a policy switching set; the reversal frequency of the policy switching set is calculated, and when it is greater than a preset oscillation threshold, a damping isolation instruction is generated and input into the main processor to lock the policy update thread; this corresponds to step S4 above; see reference. Figure 3 The specific implementation process includes: Enable a direct memory access channel between the main processor and the bypass trusted execution area; push the bypass verification task into the protected shared memory area through the direct memory access channel; the bypass trusted execution area reads the bypass verification task in the protected shared memory area, performs cryptographic operations, and outputs the security verification result; establish a state change listener within the main processor's policy scheduling engine; intercept policy downgrade and policy upgrade events triggered by the policy scheduling engine for the global session as change records; parse the call stack information of the change records; extract the change occurrence timestamp, policy revocation flag, and policy mounting flag from the call stack information; concatenate the change occurrence timestamp, policy revocation flag, and policy mounting flag into a log tuple with a fixed format; collect all log tuples generated within a preset time window; sort all log tuples according to the order of change occurrence timestamps, and output the generated policy switching set.

[0074] Specifically, the process of generating the policy switching set is as follows: When a new bypass verification task is pushed into the asynchronous communication mailbox, the daemon thread on the main processor actively notifies and triggers the bypass trusted execution area to take over the task by calling the platform-specific security monitor's call instruction. In actual deployment, this area is acted by a security coprocessor with independent bus mastering capabilities (such as a hardware security module HSM with a PCIe interface), which has physically isolated internal memory.

[0075] Once awakened, the bypass trusted execution region actively initiates a master control request to the system bus through its built-in DMA controller (rather than the DMA dependent on the main processor), opening a direct memory access channel between the main processor and the bypass trusted execution region. Through this high-speed bus channel, the bypass component completely bypasses the computational intervention of the main processor, directly pushing the bypass verification task temporarily stored in the asynchronous communication mailbox into its own isolated protected shared memory area from the physical memory level.

[0076] Next, the microcontroller within the bypass trusted execution area parses and branches according to the task instructions: for subtasks containing full encryption opcodes and overloaded pointers, the bypass hardware calls its built-in dedicated cryptographic acceleration engine to directly extract sensitive data asymmetrically from main memory based on the pointers and perform full matrix encryption transformation; for subtasks containing sampling verification opcodes and lightly loaded pointers, the bypass hardware performs hash calculations by jumping across the massive basic data block according to a specified step size. After all parallel cryptographic operations have been completed, the bypass component merges and encapsulates the generated ciphertext with the tamper-proof hash signature to generate the final security verification result.

[0077] To ensure network protocol integrity and message timing, a distributed-gather direct memory access (DDMA) mechanism is employed for message reassembly. Specifically, the bypass trusted execution region writes the security verification result containing the ciphertext to a specific offset address in the protected shared memory area and generates a local transmission descriptor pointing to that ciphertext physical address. Simultaneously, the main processor generates a local transmission descriptor pointing to the original physical address of the underlying verification block (plaintext data) temporarily stored in the kernel buffer area. Subsequently, the network interface card's (NIC) multi-queue transmission engine logically links these two sets of local transmission descriptors together based on the sequence number index at the time of initial splitting, forming a complete transmission descriptor ring. When the physical NIC transmits a message, its built-in Scatter-GatherDMA hardware unit sequentially retrieves data fragments from the plaintext area of ​​main memory and the ciphertext area of ​​protected memory along this descriptor linked list, performing zero-copy physical-level reassembly in the NIC hardware's transmit FIFO register. Finally, the reassembled complete message is pushed into the external network transmission queue, completing the secure transmission of the service message.

[0078] During the extremely frequent downgrade splitting and encryption recovery processes described above, a self-censorship mechanism is essential to prevent adaptive regulation from becoming chaotic. To this end, a state change listener based on function interception technology was established within the main processor's policy scheduling engine.

[0079] In an environment of extremely unstable marketing traffic, when the queue depth of concentrated computing power states sometimes exceeds the threshold and sometimes falls below it due to degradation processing, "policy degradation events" will be continuously triggered for the global network session, reducing the encryption level from full to partial partitioning, and "policy upgrade events" will be triggered, restoring full strong encryption when computing power recovers. The established state change listener continuously intercepts these interrupt events triggered by the policy scheduling engine and temporarily stores them as change records in a dedicated kernel log buffer.

[0080] The log analysis daemon is periodically woken up to retrieve these intercepted change records from the buffer. The daemon parses the data structure of the change records, extracting the underlying operating system-level call stack information. Through retrieval, three key metadata fields are extracted: first, a timestamp indicating the absolute time of the switchover; second, an identifier representing the undo policy being used before the switchover; and third, an identifier representing the newly loaded and effective mount policy after the switchover is completed.

[0081] The concatenation command retrieves the three isolated data fragments—the change occurrence timestamp, the revocation policy identifier, and the mounting policy identifier—and concatenates them into a fixed-format log tuple in a strictly predefined order.

[0082] To generate statistically significant historical samples, a pre-defined time window queue with sliding behavior is maintained in memory. All log tuples generated within the pre-defined time window (e.g., a 60-second lifespan) are collected and pushed into this queue. When an analysis condition is triggered, a built-in sorting algorithm is invoked, strictly using the "change occurrence timestamp" field within the log tuple as the key, to sort all collected log tuples in chronological order. This entire set, with a strict temporal relationship after sorting, is packaged and output to generate a strategy switching set. This switching set details the decision-making trajectory made in response to drastic traffic fluctuations.

[0083] By parsing the call stack information of the change records and concatenating and sorting them into log tuples, it is helpful to reconstruct the timing trajectory of engine scheduling and provide a basis for tracing whether the control architecture has oscillated.

[0084] Extract the revocation and mounting policy identifiers from the sorted log tuples within the policy switching set; count the total number of times within a fixed time period, where the mounting policy identifier of the previous log tuple is used as the revocation policy identifier of the next log tuple, and vice versa; perform a division operation between the total number of alternations and the fixed time period to calculate the output reversal frequency; when the reversal frequency is greater than a preset oscillation threshold, extract the configuration policy identifier currently held by the policy scheduling engine; package the configuration policy identifier and preset cooling countdown parameters to generate a damping isolation instruction; write the damping isolation instruction into the policy scheduling engine control register of the main processor; the policy scheduling engine locks the policy update thread according to the damping isolation instruction; maintain the currently held configuration policy identifier unchanged until the cooling countdown parameters are cleared.

[0085] Specifically, the process of the locking policy update thread is as follows: First, extract the policy switching set output from the previous step, which is already sorted chronologically. Then, by traversing each log tuple within this set, extract the undo policy identifier and the mount policy identifier contained in each tuple structure.

[0086] Subsequently, the alternating feature recognition loop begins. A fixed time length (e.g., a 10-second sliding evaluation window, shorter than a preset time window) is set for the observation parameters. Within this fixed time length, a specific closed-loop reversal condition is statistically analyzed based on logical conditions. This condition strictly requires that, in two temporally adjacent log tuples, the mounting policy identifier of the preceding log tuple must be completely identical to the unmounting policy identifier of the following log tuple; furthermore, the unmounting policy identifier of the preceding log tuple must be completely identical to the mounting policy identifier of the following log tuple. Through loop iteration and counter accumulation, the total number of alternations occurring within the set fixed time length is rigorously counted.

[0087] After obtaining the absolute number of alternating actions, the floating-point arithmetic unit is invoked to perform a division operation between the total number of alternations and the fixed time length parameter. This evenly distributes the total number of lateral jumps, thereby calculating the reversal frequency, which characterizes the intensity of the decision.

[0088] A preset oscillation threshold is pre-set in memory. This threshold is selected based on the theoretical time required for the main processor to perform a single complete policy context switch and issue underlying parameters, aiming to filter out invalid scheduling that exceeds the system's physical response speed (meaning it can tolerate a certain range of reasonable policy fluctuations; in this embodiment, it is set to 2 inversion switches per second). The inversion frequency value and the preset oscillation threshold are fed into a numerical comparator. If the comparison determines that the inversion frequency is indeed numerically greater than the preset oscillation threshold, it is concluded that the control mechanism has entered a physical oscillation state and mandatory isolation measures must be taken.

[0089] Once the threshold is exceeded, the exception handling interrupt service routine is activated. First, the configuration policy identifier currently held by the policy scheduling engine is extracted by directly reading the state memory address within the policy scheduling engine.

[0090] In this embodiment, the difference between the current reversal frequency and the preset oscillation threshold is extracted as the overshoot amplitude. The overshoot amplitude is converted into an amplification factor using an exponential expansion algorithm and multiplied by the baseline lock-in time to generate dynamic cooling countdown parameters. Specifically, a baseline lock-in time value and a maximum lock-in limit value are pre-configured and maintained in memory. After the comparator determines that the control mechanism has entered a physical oscillation state, the currently calculated reversal frequency is extracted, and the system's preset oscillation threshold is subtracted to calculate the overshoot overflow. This overshoot overflow is divided by a fixed frequency normalization constant (this constant is numerically set to be equivalent to the aforementioned preset oscillation threshold, such as 2 times / second; its physical meaning is that when the overshoot reaches one times the threshold, the base of exponential expansion is exactly the natural constant e), to calculate the dimensionless overshoot ratio. To cope with severe jitter caused by extreme network storms, the exponential expansion algorithm is invoked, specifically, using the natural constant as the base and the overshoot ratio as the exponent for power operation, to calculate the dynamic amplification factor. Subsequently, the baseline lock-in time value maintained in memory is multiplied by this dynamic amplification factor to calculate and output the dynamic cooling countdown parameters. Furthermore, the dynamic parameter is compared with the maximum lockout limit. If it exceeds the limit, it is forcibly truncated to the maximum lockout limit. Finally, a cooling countdown parameter is generated. The baseline lockout time is set based on the average time taken for the main processor to clear the current regular backlog queue (e.g., 10 seconds), and the maximum lockout limit is set based on the maximum tolerable timeout time of the upper-layer application (e.g., 300 seconds to prevent widespread connection interruptions due to excessive locking). This process applies a geometrically increasing punitive cooling time to malicious high-frequency jitter, thereby quickly and forcibly terminating internal control oscillations; it allows the damped isolation sleep duration to elastically scale with the severity of network oscillations, preventing excessive or insufficient locking.

[0091] Subsequently, the cooling countdown parameters are automatically allocated and read from the configuration storage area. A bit-by-bit merging operation is performed, and the extracted current configuration policy identifier and the cooling countdown parameters are packaged and compactly arranged to generate a proprietary low-level control code. This control code, containing dual semantics, is the output damping isolation command.

[0092] Ultimately, by obtaining the highest level of privileges, the damping isolation instruction is directly written into a dedicated flag bit of the control state structure belonging to the policy scheduling engine in the main processor's memory using kernel-level memory mapping technology.

[0093] When the register's level state is written and toggled, the policy scheduling engine's internal logic triggers a forced response. The policy scheduling engine hardware module directly executes a sleep operation on the scheduling thread responsible for receiving change signals, based on the forced suspension flag bit in the read damping isolation instruction. This fundamentally cuts off and locks the policy update thread. Before the cooling countdown parameter gradually decreases to zero, the policy scheduling engine ignores all adaptive adjustment signals, regardless of any further reports of computing power changes from the underlying hardware monitoring stream. It is strictly limited to maintaining the currently held configuration policy identifier unchanged until the cooling countdown parameter is cleared.

[0094] This damping physical isolation mechanism effectively blocks scheduling losses caused by vicious cycle oscillations, allowing the main processor to stably digest and clear the currently backlogged queues.

[0095] The reversal frequency is calculated by counting the number of alternations, and a damping instruction is written to the control register when the threshold is exceeded. This helps to alleviate the high-frequency jumps in the strategy and promotes a smooth transition of the operating environment.

[0096] This invention provides a strategy adaptive control method based on data feedback analysis. When facing high computing loads, it divides the business data load into core encryption blocks and basic verification blocks according to privacy weights, facilitating fine-grained resource allocation and prioritizing the security of sensitive data. Simultaneously, data blocks with different security levels are combined with heterogeneous opcodes to form bypass verification tasks, which are then asynchronously processed by a trusted execution area. This instruction-level decoupling alleviates some of the main processor's load, improving overall network throughput. Furthermore, by calculating the strategy to switch the record reversal frequency and generating damped isolation instructions to lock the update thread, it mitigates scheduling jitter and internal overhead caused by frequent upgrades and downgrades. This interconnected closed loop adds operational resilience to the overall architecture, helping to improve data management security and processing speed in complex scenarios.

[0097] Example 2 This embodiment describes the specific implementation process of a strategy adaptive control method based on data feedback analysis applied to an e-commerce platform during its annual global promotional period, within the production environment of its core customer data platform. During the pre-event period, the underlying network interface receives a massive stream of secure connection handshake requests from mobile devices across various regions. The source Internet Protocol address, destination port, and packet arrival time interval are extracted from these requests and mapped to network feature vectors through numerical conversion. By calculating the cosine similarity with historical peak-event traffic models, the parameters of the top-ranked request are extracted, and an initial configuration strategy is output, including the Advanced Encryption Standard identifier, the specified number of encryption threads (e.g., 32 threads), and the sampling step size (e.g., 16 bytes). The main processor is then configured accordingly.

[0098] At midnight, the flash sale began, and the marketing data flow exploded instantly. The underlying probe program intercepted the task counter of the direct memory access controller in real time. After calculating the moving average, the queue backlog depth surged to 25,000 tasks. Combined with the network interface card's (NIC) byte transmission and reception count, the network throughput reached 12 gigabytes per second. The combination of these two metrics generated a computing power status set, determining that the current state had exceeded the preset computing power threshold.

[0099] Faced with extreme computing power bottlenecks, the main processor quickly intercepted the header of the business data stream, extracted application layer protocol actions, payload length, and verification type characteristics, and input them into a pre-set matrix to calculate the Euclidean norm score of privacy sensitivity. Comparison revealed that highly sensitive messages containing payment preferences and precise location information accounted for only 18%. This highly sensitive data was then encapsulated into a core encryption block using a zero-copy method; the remaining 82% of ordinary product click data was encapsulated into a basic verification block.

[0100] Subsequently, the full set of encryption opcodes is extracted from the initial configuration and bound to the core encryption block, while the sampled verification opcodes are extracted and bound to the basic verification block. Both are then pushed into the asynchronous communication mailbox to generate a bypass verification task. The bypass trusted execution area takes over the heavy cryptographic operations and outputs the secure verification result, allowing the high load on the main processor to quickly decrease.

[0101] During the event, extreme congestion on the external network caused severe fluctuations in traffic characteristics, leading to frequent switching between full encryption and partial data splitting in the underlying control system. By collecting change records and generating a policy switching set, the reversal frequency was calculated to be as high as 8 times per second, far exceeding the preset oscillation threshold of 2 times per second. Immediately, a damped isolation instruction containing a 60-second cooldown countdown was generated, forcibly written to the control register, and the policy update thread was locked. During this one-minute lockout, the partial data splitting state was forcibly maintained, completely eliminating the additional bus overhead caused by the high-frequency switching, smoothly handling the backlog of data, and safely weathering the traffic surge.

[0102] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A strategy adaptive control method based on data feedback analysis, characterized in that, include: Receive handshake request stream, service data stream, hardware monitoring stream and historical policy set, generate network feature vector based on handshake request stream, compare with historical policy set, and generate initial configuration policy; Configure the main processor's policy scheduling engine based on the initial configuration policy; The business data stream and hardware monitoring stream are input to the main processor. The queue backlog depth and network throughput in the hardware monitoring stream are extracted and combined to generate a computing power status set. Extract the protocol header features of the business data stream to generate a privacy weight value. When the computing power status set exceeds the preset computing power threshold, the payload data area of ​​the business data stream is divided into core encryption blocks and basic verification blocks according to the privacy weight value. Specifically, the privacy weight value is compared with the preset hierarchical threshold table to obtain the target encryption depth level. The message structure parser is then used to scan the payload data area of ​​the business data stream. Identify the type, length, and value structure boundaries within the payload data area and mark the boundary physical addresses; based on the target encryption depth level, match the corresponding boundary physical address set filtering rules in the local policy library; by comparing the parsed types with the filtering rules, filter out blocks that meet the conditions and establish the hit boundary physical address set; extract the message fields within the hit boundary physical address set and encapsulate them to generate the core encryption block; extract the remaining message fields of the non-hit boundary physical address sets and encapsulate them to generate the basic verification block; record the physical memory pointers of the core encryption block and the basic verification block respectively; extract the full encryption opcode and the sampling verification opcode from the initial configuration policy; specifically, merge the full encryption opcode and the physical memory pointer of the core encryption block to generate the overloaded execution subtask; merge the sampling verification opcode and the physical memory pointer of the basic verification block to generate the light-load execution subtask. Establish a virtual asynchronous communication mailbox pointing to a protected shared memory area within the main processor; Push the heavily loaded and lightly loaded subtasks into the asynchronous communication mailbox to generate a bypass verification task. The bypass verification task is imported into the bypass trusted execution area to generate security verification results. Change records in the main processor are extracted. Policy downgrade events triggered by the policy scheduling engine for global sessions, which reduce the encryption level from full to partial, and policy upgrade events that restore full strong encryption after computing power is restored, are intercepted as change records to generate a policy switching set. The reversal frequency of the policy switching set, which represents the severity of the decision, is calculated. When the reversal frequency is greater than the preset oscillation threshold, a damping isolation instruction is generated and input into the main processor's lock strategy update thread.

2. The strategy adaptive control method based on data feedback analysis according to claim 1, characterized in that, The specific generation process of the initial configuration policy includes: receiving handshake request streams arriving from outside via the network interface and loading the local historical policy set; extracting the source address field, destination port field, and packet arrival time interval parameter of the handshake request stream, and outputting a generated network feature vector through numerical conversion; reading the baseline feature matrix and associated configuration set contained in the historical policy set; calling the cosine similarity function to calculate the similarity value between the network feature vector and each row vector within the baseline feature matrix; extracting the index of the row vector with the highest similarity value; based on the row vector index, extracting the corresponding secure handshake parameters, number of encryption threads allocated, sampling step size, encryption standard identifier, key sequence, and cyclic redundancy check identifier from the associated configuration set, and generating the initial configuration policy through encapsulation; and configuring the main processor's policy scheduling engine based on the initial configuration policy.

3. The strategy adaptive control method based on data feedback analysis according to claim 1, characterized in that, The specific generation process of the computing power state set includes: controlling the network interface controller to intercept service data streams; starting the low-level probe program of the main processor to generate a hardware monitoring stream; importing the service data stream and hardware monitoring stream into the kernel buffer area of ​​the main processor; parsing the hardware monitoring stream into a memory state stream and a network interface card (NIC) traffic stream; in the memory state stream, reading the task counter value of the main processor's direct memory access controller; performing a moving average calculation on the task counter value to generate the queue backlog depth; in the NIC traffic stream, reading the total number of received bytes and the total number of sent bytes of the main processor's physical NIC interface; merging the total number of received bytes with the total number of sent bytes to calculate and output the network throughput; constructing a data encapsulation body containing horizontal and vertical coordinates; mapping the queue backlog depth to the horizontal coordinate field of the data encapsulation body, and mapping the network throughput to the vertical coordinate field of the data encapsulation body; appending a collection timestamp to the end of the data encapsulation body, closing the data encapsulation body, and combining to generate the computing power state set.

4. The strategy adaptive control method based on data feedback analysis according to claim 1, characterized in that, The specific process for generating the privacy weight value includes: intercepting the header segment of the business data stream; extracting protocol header features containing application layer protocol identifier, payload length, and authentication type fields from the header segment, converting them into floating-point numbers, and combining them to generate a one-dimensional feature row vector; retrieving a preset sensitivity weight matrix; performing matrix multiplication between the one-dimensional feature row vector and the sensitivity weight matrix to calculate and output a one-dimensional scoring row vector; calling the Euclidean norm formula; calculating the Euclidean norm value of the one-dimensional scoring row vector; and outputting the Euclidean norm value as a scalar to generate the privacy weight value.

5. The strategy adaptive control method based on data feedback analysis according to claim 1, characterized in that, The specific generation process of the bypass verification task includes: extracting the encryption standard identifier and key sequence from the initial configuration strategy to generate a full encryption operation code; and extracting the cyclic redundancy check identifier and sampling step size from the initial configuration strategy to generate a sampling verification operation code.

6. The strategy adaptive control method based on data feedback analysis according to claim 1, characterized in that, The specific generation process of the policy switching set includes: enabling a direct memory access channel between the main processor and the bypass trusted execution area; pushing the bypass verification task into the protected shared memory area through the direct memory access channel; the bypass trusted execution area reading the bypass verification task in the protected shared memory area, performing cryptographic operations, and outputting the security verification result; establishing a state change listener in the policy scheduling engine of the main processor; intercepting policy downgrade and policy upgrade events triggered by the policy scheduling engine for the global session as change records; parsing the call stack information of the change records; extracting the change occurrence timestamp, policy revocation identifier, and policy mounting identifier from the call stack information; concatenating the change occurrence timestamp, policy revocation identifier, and policy mounting identifier into a log tuple of a fixed format; collecting all log tuples generated within a preset time window; sorting all log tuples according to the order of change occurrence timestamps, and outputting the generated policy switching set.

7. The strategy adaptive control method based on data feedback analysis according to claim 6, characterized in that, The specific process of locking the policy update thread includes: extracting the revocation policy identifier and the mounting policy identifier from the sorted log tuples within the policy switching set; counting the total number of times within a fixed time length, the mounting policy identifier of the previous log tuple is used as the revocation policy identifier of the next log tuple, and the revocation policy identifier of the previous log tuple is used as the mounting policy identifier of the next log tuple; performing a division operation between the total number of alternations and the fixed time length to calculate the output reversal frequency; when the reversal frequency is greater than a preset oscillation threshold, extracting the configuration policy identifier currently held by the policy scheduling engine; packaging the configuration policy identifier with preset cooling countdown parameters to generate a damping isolation instruction; writing the damping isolation instruction into the policy scheduling engine control register of the main processor; the policy scheduling engine locking the policy update thread according to the damping isolation instruction; and maintaining the currently held configuration policy identifier unchanged until the cooling countdown parameters are cleared.

Images