Multi-source communication data cross-domain interaction light-load security situation prediction method and communication system

Abstract

The application provides a multi-source communication data cross-domain interaction light-load security situation prediction method and a communication system, and belongs to the field of multi-source communication data security situation prediction; solves the problems of multi-dimensional abnormal feature detection difficulty, low model precision, long time consumption, insufficient real-time performance and generalization ability of communication network security monitoring; the application designs a cross-domain interaction light-load model, which can remove redundant connections and invalid parameters, combine different hierarchical granularity features, reduce the model size, improve the running speed, realize the joint extraction and fusion of three types of features of traffic behavior distribution, sequence dependence and session semantics, fully excavate the traffic behavior distribution features and session semantic structure features through the cross-domain interaction attention mechanism, improve the distinguishing ability and expression performance of the cross-domain features, and realize the adaptive adjustment of the detection threshold. Through a hierarchical progressive defense framework, an integrated closed-loop protection system from state monitoring, threat identification to security prediction is realized.

Description

Technical Field

[0001] This application relates to the field of multi-source communication data security situation prediction technology, and in particular to a lightweight security situation prediction method and communication system for cross-domain interaction of multi-source communication data. Background Technology

[0002] With significant breakthroughs in key technologies such as 5G and 6G, the number of mobile communication terminal devices accessing the network has surged, network size has continued to grow, and business scenarios have become increasingly diverse and complex. As the core of new infrastructure construction, communication networks play a crucial role in supporting the development of the digital economy, shifting from expanding connection scale to building intelligent network capabilities. In multi-source heterogeneous scenarios characterized by multiple communication sources, diverse network access devices, complex transmission protocols, significant differences in data formats, and fragmented and hybrid network architectures, network traffic can reach millions of transactions in a short period. Furthermore, much of this high-dimensional data exhibits non-linear coupling relationships, making network attacks highly stealthy.

[0003] From a technical perspective, existing methods are not adept at multi-dimensional anomaly detection, struggling to cope with the evolving trends of attack methods, frequent variant attacks, and increasingly covert threats. They lack effective fusion analysis of multi-source traffic, with most studies relying on independent feature patterns. Multi-feature fusion is limited to simple combinations and fixed-coefficient weighting, failing to capture the connections between unconventional ports and malicious payload spoofing. Furthermore, their large scale makes it difficult to balance real-time performance with detection accuracy. From a business application perspective, communication system architectures are increasingly revealing numerous shortcomings. Besides the critical security issues, there are also insufficient overall stability, weak dynamic real-time iteration capabilities, high resource overhead and energy consumption, caching mechanisms that only adapt to single databases limiting horizontal scalability, and incomplete operation and management systems, making it difficult to adapt to the development needs of diverse business scenarios.

[0004] Rule-based security monitoring methods for communication networks suffer from several drawbacks: fixed features, reliance on manual updates, weak generalization ability, vulnerability to encrypted communication and obfuscation attacks, bloated rule bases, high computational costs, and significant false positives and false negatives. Statistical analysis-based security monitoring methods can only capture surface-level data fluctuations, rely on the assumption of stable traffic, experience a sharp drop in prediction accuracy under dynamic network loads and heterogeneous scenarios, exhibit strong lag, are mostly post-event analyses, cannot predict unknown threats in advance, have weak anti-interference capabilities, and are prone to false alarms due to normal business fluctuations. Traditional machine learning-based security monitoring relies heavily on manual feature engineering, with the quality of feature selection directly determining the effectiveness. It has limited processing capabilities for high-dimensional, massive, and encrypted communication data, poor robustness to adversarial examples and attack variants, and insufficient generalization ability. Game theory-based security monitoring is challenging to quantify attack and defense payoffs and weight indicators, subjective assignment affects prediction objectivity, idealized model assumptions make it difficult to adapt to complex topologies and multi-agent attack and defense scenarios in real communication networks, and it suffers from high computational complexity and insufficient dynamic real-time simulation capabilities.

[0005] Deep learning, with its powerful feature extraction, predictive analysis, and adaptive capabilities, has been widely applied to various complex engineering problems, and the deep integration of artificial intelligence and communication networks has long been a focus. However, the application of deep learning and the security of communication networks still have limitations: complex model structures, high training costs, and difficulties in deploying edge communication and devices; reliance on high-quality labeled datasets, resulting in a scarcity of communication attack samples and severe imbalance issues; vulnerability to adversarial attacks, and difficulty in meeting the real-time requirements of high-speed communication networks. All of these problems greatly increase the difficulty of network anomaly identification and security situation prediction. Newer representative baseline models in machine learning and deep learning include: Random Forest Regression with multi-decision tree fusion, which is suitable for nonlinear coupling and structured relationships but not adept at capturing long-term temporal relationships; SVM based on RBF kernels, which has strong high-dimensional information classification capabilities and robustness against anomalies but lacks temporal modeling; Transformer multi-layer encoding, which can process data in a distributed and synchronous manner but requires a large number of redundant parameters; and heterogeneous graph neural networks based on multi-level graph aggregation, which can handle node connection topologies but are costly.

[0006] Further research is needed on how to optimize model resource allocation to achieve comprehensive intrusion prediction, fault self-healing, and energy efficiency improvement. Summary of the Invention

[0007] To address the technical bottlenecks in communication network security monitoring, such as difficulties in detecting multi-dimensional anomalies, low model accuracy, long processing time, insufficient real-time performance and generalization ability, as well as poor system architecture stability and high resource consumption, this application proposes a lightweight security situation prediction method and communication system based on cross-domain interaction of multi-source communication data.

[0008] The technical solution adopted in this application is: a lightweight security situation prediction method for cross-domain interaction of multi-source communication data, including the following steps:

[0009] Step 1: Data preparation and preprocessing. A distributed parallel system is adopted, and data acquisition modules are set up at key traffic nodes to acquire communication data in real time. The data is then standardized, feature-engineered, and augmented.

[0010] The construction steps for building a lightweight cross-domain interaction model include:

[0011] Step 2: Construct a hierarchical constraint pruning low-load model: This model is based on CNN and integrates positional encoding, heterogeneous convolution optimization, depthwise convolution fusion pointwise convolution, and structural layer light-load reduction;

[0012] Step 3: Construct a cross-domain attention-coupled interaction model: This model is based on an improved IP2Vec to complete the data flow communication behavior coding modeling and anomaly probability discrimination, uses multi-layer Bi-LSTM to extract the temporal evolution correlation of the data packet layer, uses an autoencoder to complete the abstract modeling of the session layer payload features, and finally realizes the interaction between behavior distribution, sequence dependency and session semantics through a coupling interaction unit based on the attention mechanism.

[0013] The optimal model is obtained by training a cross-domain interaction lightweight model. The optimal model is then used to process the real-time acquired communication data and output the predicted network security situation.

[0014] Furthermore, the communication data collected in step one includes signal strength affected by noise, interference, or signal attenuation; loss of effective signal due to bit errors or signal loss; signal-to-noise ratio; frame check error and delimitation error; rate mismatch; bit error rate; data retransmission rate; data status monitored by the network layer; port occupancy status and network connection status of the transport layer; and protocol information.

[0015] Furthermore, in step one, data augmentation techniques are used to optimize the samples when there is a highly skewed distribution of normal or abnormal communication data.

[0016] Step one also maps streaming data into fixed-dimensional sequence data based on the time dependence and correlation of communication data.

[0017] Furthermore, in step two, the position encoding is implemented based on the principle that the position encodings of adjacent time steps are similar. By preserving the sequence structure information and adding it to the initial information, the model can explicitly perceive and capture the time dependence and dynamic change patterns.

[0018] Furthermore, the optimization of heterogeneous convolutions in the hierarchical constraint pruning low-load model is as follows:

[0019] By focusing on detailed information in the data packet dimension using a 3×3 small-size convolutional kernel, refined local features are obtained. The receptive field is gradually expanded by using 5×5 and 7×7 convolutional blocks respectively, and the mesoscale features and global end-to-end features in the data stream dimension are extracted respectively.

[0020] Then, the computational overhead of the model is reduced by using deep convolutional fusion and pointwise convolutional fusion. Pointwise linear transformation is achieved by using a 1×1 convolutional cascade structure, and different levels of fusion features are obtained on the basis of simplifying the operation logic.

[0021] Furthermore, to prevent the input features from being diluted layer by layer, residual path connections are introduced in each layer of the network to ensure the integrity of the information;

[0022] Then, the gradient propagation path of the deep network is optimized by batch normalization;

[0023] The pooled features are obtained by fusion of linear weighted max pooling and average pooling, and the probability of each category is calculated through a fully connected layer after pooling.

[0024] Furthermore, the structural layer lightweighting in the hierarchical constraint pruning low-load model is achieved by pruning redundant channels and channels with low feature contribution during the feature extraction stage, removing invalid convolution kernels, and realizing lightweight model structure design. The specific steps include:

[0025] Initialize key parameters such as feature map size, pruning threshold, and non-maximum suppression enabled status, solve each feature map and confidence score in sequence, and define the cumulative value of each category probability as the confidence evaluation index.

[0026] For different channel features, calculate the weighted sum of positive and negative sample features separately. The pruning score of each feature channel is obtained by the difference between the two.

[0027] All feature channels are sorted according to their pruning scores, and redundant feature channels with scores below a threshold are removed.

[0028] The feature representation ability and contribution of different channels are quantified, a significance score is calculated, and the average of the significance scores is used as the single-channel quantitative evaluation standard. Based on the evaluation value of the channel, invalid channels and redundant connections with low contribution in the network are screened and removed.

[0029] Finally, nonmaximum suppression is used to retain the feature channel with the best score among all feature channels;

[0030] Continuously iterate through the above pruning steps until both the model accuracy and model size meet the standards.

[0031] Furthermore, the steps for completing data flow communication behavior coding modeling and anomaly probability discrimination based on the improved IP2Vec include:

[0032] 1) Training of quintuple semantics and embedding vectors:

[0033] A global semantic dictionary is constructed using the five-tuple fields of source IP, destination IP, source port, destination port, and protocol of data packets, and the embedding matrix corresponding to the network elements is initialized. Based on the traffic temporal arrangement relationship, the contextual relationship of each field of the five-tuple is established, and a negative sampling strategy is introduced with reference to the Skip-Gram training logic to iteratively optimize the low-dimensional embedding vector of each field.

[0034] 2) Discrimination module: Calculates the confidence probability of traffic anomalies based on maximum likelihood estimation.

[0035] Let the abnormal flow unit to be detected be... , This represents the current field's position in the time series. For location labeling, Given the sample length of a single flow sequence; calculate the average log probability of the current sample using the log-maximum likelihood formula. :

[0036] ;

[0037] In the formula: For a given context At that time, the central element The conditional probability of occurrence is calculated using Softmax normalization:

[0038] ;

[0039] in, The current central element Corresponding raw score For the semantic table of the first The original scores corresponding to each field are used to calculate the maximum likelihood value based on the conditional probability. ,by The degree to which communication behavior deviates from the normal baseline is quantified to identify abnormal traffic.

[0040] Furthermore, the steps for extracting packet layer temporal evolution correlations using Bi-LSTM include:

[0041] A deep network with a vertically stacked three-layer Bi-LSTM structure is designed to extract temporal features from abstract sequence data level by level. The hyperparameter hidden units of the three layers of Bi-LSTM are 256, 128, and 64, respectively. The output of each layer serves as the input of the next layer. The bottom layer captures local, low-level temporal patterns, while the top layer integrates more complex and abstract semantic dependency information. Through a bidirectional multi-layer structure, a network structure is formed that is progressively inductive from bottom to top and progressively refined from top to bottom.

[0042] Furthermore, the attention-based coupled interaction unit utilizes a small-dimensional query vector. key vector value vector The attention value is calculated, with the behavior distribution map as the input to the coupled interaction unit. Sequence dependency mapping Session semantic mapping The output is an interactive mapping. The interaction steps include:

[0043] Define three cross-domain interaction modes;

[0044] For each pattern, first project Q / K / V into the attention space;

[0045] Perform attention calculations to obtain the features after cross-domain interaction;

[0046] After processing all patterns in a loop, three cross-domain attention features are obtained. The three cross-domain attention features are then fused and ReLU calculation is performed to obtain the interaction mapping.

[0047] A communication system, the system comprising:

[0048] Interactive Interface Module: This module is used to realize bidirectional transmission of business commands, full-domain data docking, and scenario visualization and situation presentation. This module has a security module deployed within it. This security module is used to execute the methods described, perform fine-grained parameter discrimination on external access to the system, and efficiently and accurately filter multiple types of network security threats.

[0049] Logic module: Equipped with IDMM message middleware, Zookeeper distributed scheduling middleware, BaaS on / off chain service, and microservice gateway, it standardizes and encapsulates core business capabilities and coordinates the internal and external message transmission and communication scheduling of the system.

[0050] Functional support module: Used to complete the compliant transformation of raw data, and output basic capabilities in multiple dimensions such as network connectivity, computing power coordination, dynamic resource scheduling, intelligent prediction algorithms, and security protection as needed;

[0051] Storage module: It undertakes real-time transmission of traffic across the entire link, distributed secure storage, unified interface access to multiple core businesses, and covers accurate collection of traffic from different sources, closed-loop transmission across nodes, distributed persistent archiving storage, as well as various preprocessing compliance operations such as standardized encoding and decoding formats, redundant data compression, and link encryption and hardening.

[0052] The advantages of this application over the prior art are as follows:

[0053] 1. This application integrates deep learning hierarchical performance constraints to reduce load and cross-domain attention coupling interaction into the extraction and identification of data features for communication network security, forming a hierarchical progressive security defense framework, which promotes the cross-integration of artificial intelligence and communication network disciplines.

[0054] 2. The model is designed using global hierarchical performance constraints and pruning to reduce load. It merges features at different granular levels, reducing the model size while improving running speed, and ensuring the effective mining of associated features and differentiated granular representations. It achieves joint extraction and fusion of traffic behavior, sequence dependency, and session semantic features. It uses a cross-domain interactive attention mechanism strategy to represent the high-order correlation between heterogeneous features. It can maintain model stability, accuracy, and good generalization ability even when facing changes in the temporal distribution of communication traffic and the continuous evolution of attack behavior. It also achieves adaptive adjustment of detection thresholds.

[0055] 3. Based on the model and technical points, the system architecture is described, and its security, stability, data transmission rate, ease of use, and operation and maintenance capabilities have been improved to varying degrees, while reducing human resource costs, thus promoting the digital transformation and upgrading of the industry from the application level. Attached Figure Description

[0056] The following description, in conjunction with the accompanying drawings, further illustrates this application:

[0057] Figure 1 This is a schematic diagram of the cross-domain interaction lightweight model structure provided in the embodiments of this application;

[0058] Figure 2 A flowchart of the pruning process;

[0059] Figure 3 System architecture diagram provided for embodiments of this application;

[0060] Figure 4 Flowchart for network security deployment;

[0061] Figure 5 This is a diagram illustrating traffic transmission.

[0062] Figure 6 This is a graph showing the convergence trend of the loss function.

[0063] Figure 7 This is a ROC curve. Detailed Implementation

[0064] like Figures 1 to 7As shown, this application provides a lightweight security situation prediction method and communication system for cross-domain interaction of multi-source communication data. A lightweight cross-domain interaction model is designed, which can reduce the model size and improve running speed by removing redundant connections and invalid parameters, merging features at different levels of granularity, and ensuring the effective mining of associated features and differentiated representations. It also achieves the joint extraction and fusion of three types of features: traffic behavior distribution, sequence dependency, and session semantics. Through pairwise interaction, a cross-domain interaction attention mechanism is designed to fully mine traffic behavior distribution features and session semantic structure features, improving the discriminative ability and expressive performance of cross-domain features, and enabling adaptive adjustment of detection thresholds. A hierarchical progressive defense framework is used to achieve an integrated closed-loop protection system from state monitoring and threat identification to security prediction. Even when facing changes in the temporal distribution of communication traffic and the continuous evolution of attack behaviors, the model can still maintain stability, accuracy, and strong generalization ability. Based on the model, a system architecture is built, using IDMM, Redis, and DMDB components in collaboration with BaaS technology deployment. This integrates technological advantages and achieves high concurrency, low latency, low cost traffic transmission and accurate security protection through asynchronous and decoupled mechanisms.

[0065] This method mainly includes the following steps:

[0066] Step 1: Data preparation and preprocessing. A distributed parallel system is adopted, and data acquisition modules are set up at key traffic nodes to acquire communication data in real time. The data is then standardized, feature-engineered, and augmented.

[0067] The specific implementation steps of step one include:

[0068] Step 1.1: Data Acquisition;

[0069] Based on the communication function, the data acquisition module sequentially acquires relevant communication data from the physical layer, link layer, network layer, and transport layer. This includes signal strength affected by noise, interference, or signal attenuation; loss of effective signals due to module errors or signal loss; and indicators such as signal-to-noise ratio, frame check error and delimitation error, rate mismatch, bit error rate, and data retransmission rate. Simultaneously, it collects data status monitored by the network layer, port occupancy status and network connection status of the transport layer, and protocol information.

[0070] This application uses a distributed, parallel data acquisition module to obtain the aforementioned parameters of key traffic nodes, thereby achieving real-time data acquisition.

[0071] Step 1.2: Standardization process;

[0072] Encoding and preprocessing the raw data reduces the impact of dimensional differences between features on the computation process, improves the stability of model training, and enables faster convergence. Specifically, the time window length for continuously collected data is set to... Standardize the data within the time window:

[0073] ;

[0074] in The original data sequence, and These are the mean and standard deviation of the data, respectively.

[0075] Step 1.3: Feature engineering and data augmentation;

[0076] Design a complete feature engineering module Data sampling and distribution adjustment are performed to prepare for model training. Indicates the first The feature vectors include three types: raw data features, aggregated data features (data obtained by grouping according to a certain dimension), and constructed data features (data formed through combination, calculation, transformation, and logical construction).

[0077] To address the highly skewed distribution of normal or anomalous data, data augmentation techniques are employed to optimize the samples and resolve the data imbalance problem. Specifically, KNN is used to filter the data and expand the sample size, resulting in new features: In the formula: For imbalanced class features, To incorporate features, It is a random number between [0,1].

[0078] To address the imbalance between time complexity and prediction accuracy, based on the temporal dependencies and correlations between communication data, we assume a sliding window length of... Using a scrolling window mechanism to... real-time streaming data According to step size Mapped to fixed-dimensional sequence data :

[0079] .

[0080] Step 2: Construct a hierarchical constraint pruning and low-load model;

[0081] A low-load method is designed using global hierarchical performance constraint pruning to optimize CNNs by merging features at different hierarchical granularities. This reduces model size, removes redundant connections and invalid parameters, and lowers computational load and storage resource consumption. Simultaneously, it mines correlated features and differentiated granular representations to ensure stable model feature extraction and classification performance. The construction process includes: positional encoding, heterogeneous convolution optimization, depthwise convolution fusion with pointwise convolution, and lightweighting of structural layers.

[0082] Step 2.1: Position Encoding: Based on the principle that the position codes of adjacent time steps are similar, a position encoding module is added.

[0083] Positional encoding, by preserving sequence structure information and adding it to the initial information, enables the model to explicitly perceive and capture temporal dependencies and dynamic change patterns. It maps the original data to... dimensional matrix Current dimension The sequence position encoding is defined as: , ,in, The length of the sliding window. For batch samples, This is location information.

[0084] Step 2.2: During feature extraction, feature channels are grouped and convolved independently, with no interference between groups. Different sized convolution kernels are used to balance fine-grained local features, medium-scale information, and global representation, achieving depthwise convolution. Specific method:

[0085] First, a small 3×3 convolutional kernel is selected to focus on detailed information at the data packet level, specifically capturing features such as abnormal port communication, field tampering and missing data, illegal parameter injection, malicious payloads, and abnormal protocol interactions, thereby obtaining refined local features. The feature mapping of the first convolutional layer is as follows:

[0086] ;

[0087] The number of feature dimensions is Each feature dimension Responsible for extracting a class of fine-grained flow characteristics. That is, spatial location The response values ​​for this type of fine-grained flow characteristics, For current data, As weight, For bias, , The values ​​are 0, 1, and 2 respectively.

[0088] Similarly, the receptive field can be gradually expanded using 5×5 and 7×7 convolutional blocks to extract mesoscale features and global end-to-end features from the data stream dimension, respectively.

[0089] ;

[0090] .

[0091] By fusing depthwise convolution and pointwise convolution, the computational cost of the model is reduced. A pointwise linear transformation is achieved using a 1×1 convolutional cascade structure, and different levels of fused features are obtained while simplifying the computational logic.

[0092] .

[0093] In the above network, to avoid the input features being diluted layer by layer, residual path connections are introduced in each layer to ensure information integrity. Let the input of a given convolutional block be... Then its output is:

[0094] ;

[0095] In the formula, This represents the residual connection value.

[0096] To optimize the gradient propagation path of deep neural networks, reduce the risk of gradient vanishing, and improve the stability and convergence efficiency of the training process, batch normalization is used to accelerate convergence and improve model training efficiency and generalization ability. Batch normalization is defined as:

[0097] ;

[0098] In the above formula, a smoothing term is included to avoid invalid denominators. , For normalized data, Refers to features in a batch. and These are the mean and variance, respectively. , Here are the affine transformation parameters in batch normalization. Combining the advantages of max pooling and average pooling, and overcoming the limitations of single pooling, a linear weighted fusion pooling method is adopted to obtain:

[0099] ;

[0100] in, Features after pooling It is a learnable hyperparameter used to balance the weights between max pooling salient features and average pooling contextual information. For the feature space. This represents the maximum value of the output from the aforementioned convolutional channels. After pooling, the probability of each class is calculated through a fully connected layer.

[0101] Step 2.3: In the feature extraction stage, channel pruning is performed on redundant channels and channels with low feature contribution to remove invalid convolution kernels. This reduces the number of parameters and floating-point computation overhead, while achieving a lightweight model structure design. The algorithm flow is as follows:

[0102] Initialization operations are performed on key parameters such as feature map size, pruning threshold, and non-maximum suppression enabled status. Each feature map and its confidence score are then calculated sequentially, and the accumulated probability of each class obtained in step 2.2 is defined as the confidence evaluation index. The confidence score for a given feature map unit is... This indicator is used to represent valid test samples. In all samples The proportion of.

[0103] For different channel features, calculate the weighted sum of positive and negative sample features separately. The pruning score for each feature channel is obtained by comparing the two values. The weighted sum is shown in the following formula: , For two feature mapping units Association weights, The contribution weight of the feature.

[0104] All feature channels are sorted according to their pruning scores, and redundant feature channels with scores below a threshold are removed. The node pruning evaluation value is: , and These are the weighted sums of the positive and negative sample features within the channel, respectively.

[0105] The feature representation ability and contribution of different channels are quantified. A significance score is calculated and the average of the significance scores is used as the single-channel quantitative evaluation standard. Based on the evaluation value of the channel, invalid channels and redundant connections with low contribution in the network are screened and removed.

[0106] Non-maximum suppression preserves the feature channels with the best scores across all feature channels. This pruning process is iterated until both model accuracy and size meet the required standards.

[0107] The above method effectively optimizes the network and achieves lightweighting, reducing the model size and parameters while improving computational speed and maintaining high accuracy. The standard model without optimization has a running speed of 1.2 bps. After parameterization and knowledge distillation lightweighting, the computational speed is increased to 1.9 bps and 2.4 bps, respectively. After global channel performance constraint pruning lightweighting, the computational speed is increased to 3.6 bps. The resource consumption ratio is reduced by 32% compared to the original model. The detection accuracy for different types of data reaches or exceeds 95%, which cannot be achieved by other current lightweighting methods. Because its scale is reduced after lightweighting, it has the shortest running time.

[0108] Step 3: Construct a cross-domain attention coupling interaction model;

[0109] For multi-source random network traffic, this paper achieves the joint extraction and fusion of three types of features: behavioral distribution, sequence dependency, and conversational semantics. Based on the mapping and coupling of these three types of features, a cross-domain interactive attention mechanism is designed to represent the high-order correlation characteristics between heterogeneous features. The model fully leverages the traffic behavior distribution and semantic structure features, reduces the interference of invalid information at the lower level on the upper-level semantic abstraction, completes deep correlations between multiple feature domains, and thus improves the discriminative power and expressive performance of cross-domain features. The implementation steps are as follows:

[0110] Step 3.1: Complete data flow communication behavior coding modeling and anomaly probability discrimination based on improved IP2Vec.

[0111] An improved IP2Vec algorithm is used to encode and model the communication behavior of the data flow layer to obtain feature vectorization and acquire the behavioral distribution characteristics of the traffic. This scheme introduces an improved quintuple semantic construction and log-maximum likelihood probability discrimination mechanism on the basis of the original IP2Vec. The whole scheme is divided into two stages: embedding pre-training and maximum likelihood probability solution (discrimination module).

[0112] 1) Five-tuple semantics and embedding vector training (IP2Vec representation stage)

[0113] A global semantic dictionary (semantic table) is constructed using the five-tuple fields of source IP, destination IP, source port, destination port, and protocol of data packets, and the embedding matrix corresponding to the network elements is initialized. Based on the traffic temporal arrangement relationship, the contextual relationship of each field of the five-tuple is established, and a negative sampling strategy is introduced with reference to the Skip-Gram training logic to iteratively optimize the low-dimensional embedding vector of each field.

[0114] 2) Discrimination module: Calculates the confidence probability of flow anomalies based on maximum likelihood estimation.

[0115] Let the abnormal flow unit to be detected be... , This represents the current field's position in the time series. For location labeling, Given the sample length of a single flow sequence; calculate the average log probability of the current sample using the log-maximum likelihood formula. :

[0116] ;

[0117] In the formula: For a given context At that time, the central element The conditional probability of occurrence is calculated using Softmax normalization:

[0118] ;

[0119] in, The current central element Corresponding raw score For the semantic table of the first The original scores corresponding to each field are used to calculate the maximum likelihood value based on the conditional probability. ,by The degree to which communication behavior deviates from the normal baseline is quantified to identify abnormal traffic.

[0120] Step 3.2: Extract packet layer temporal evolution correlation using Bi-LSTM

[0121] A deep network with three vertically stacked Bi-LSTM layers is designed to extract temporal features from abstract sequential data level by level. The three Bi-LSTM layers have 256, 128, and 64 hyperparameter hidden units, respectively. The output of each layer serves as the input to the next layer. The lower layers capture local, low-level temporal patterns, while the higher layers integrate more complex and abstract semantic dependency information. This bidirectional multilayer structure forms a network structure that is progressively inductive from bottom to top and progressively refined from top to bottom. By increasing the network depth, the model's expressive power is significantly enhanced, enabling it to better model long-term dependencies.

[0122] The linear propagation of network states allows gradients to propagate stably over long sequences, and the three gates (forget gate, input gate, and output gate) work together to allow the model to focus on key information that depends on long-term factors. , , The gates are the forget gate, input gate, and output gate, and the calculation steps are as follows:

[0123] , ;

[0124] , ;

[0125] ,

[0126] By integrating state information into the network, long-term memory can be directly accessed, enabling more precise gating. All of these... and Let each gating unit have its weight vector and bias. It is a hidden state. This is an intermediate update state. It is the peephole weight matrix of each gated unit. for Activation function.

[0127] Complete sequence dependency information is obtained through bidirectional concatenation, defined as:

[0128] , ;

[0129] Given input , No. The layered structure is represented as: ;

[0130] in, This is a hidden state in the positive network. This represents the positive network state from the previous moment. To hide the state in the reverse network, This is the reverse network state for the next moment.

[0131] Step 3.3: Use an autoencoder to complete the abstract modeling of session layer load features to ensure efficient information integration.

[0132] The encoder feature mapping is as follows: ;

[0133] The decoder feature map is as follows: .

[0134] Assuming the feature dimension is , For the first One input data, For the first After integrating the data, the loss function is defined as:

[0135] .

[0136] The aforementioned autoencoder learns core features during the encoding-decoding process, minimizes the loss function, and improves prediction accuracy. The encoder reconstructs features through three fully connected layers, and the feature dimension is determined by the number of units in the third layer of the encoder.

[0137] Step 3.4: The three types of features obtained above are analyzed from the perspectives of behavioral distribution, contextual sequence dependency, and conversation semantics. A coupled interaction unit for the three types of features is designed based on an attention mechanism. Through cross-domain targeted and differentiated modeling, interference is reduced and redundant information is eliminated, achieving a lightweight model while incorporating behavioral distribution and semantic structure features.

[0138] Coupled interaction units utilize small-dimensional query vectors key vector value vector Calculate the attention value, assuming the key vector dimension is . The attention weight is calculated as follows:

[0139] .

[0140] The specific algorithm flow is as follows:

[0141] Step 1: Input: Behavior distribution mapping Sequence dependency mapping Session semantic mapping ;

[0142] Output: Interactive Mapping ;

[0143] Step 2: Train three types of feature parameters ;

[0144] Step 3: ;

[0145] ;

[0146] ;

[0147] ;

[0148] ;

[0149] Step 4:

[0150] Step 5: .

[0151] The final dimensionality reduction operation gives it a lower complexity, with a time complexity of O(n log n). The feature structures at each level are independent of each other, and their semantics support each other. This allows the model to maintain network stability and accuracy even when faced with changes in the temporal distribution of communication traffic and the continuous evolution of attack behaviors. The model algorithm achieves 3-5 percentage points higher precision and recall rates than similar models for different attack categories, and still maintains high precision and generalization ability when dealing with more complex intrusion types.

[0152] Through steps two and three above, a lightweight cross-domain interaction model was constructed, realizing the fusion, extraction, differentiation, and expressive performance of cross-domain features of traffic behavior distribution, sequence dependency, and conversation semantics.

[0153] This application also proposes a mobile communication system based on a cross-domain interaction lightweight model, the system architecture of which is as follows: Figure 3As shown, targeting intelligent communication networks, computing networks, and 5G / 6G network scenarios, this architecture leverages business capabilities and employs a collaborative BaaS technology deployment using three components: IDMM, Redis, and DMDB. By integrating technological advantages, it reduces system size through global-level performance constraints, pruning to reduce load, and cross-domain attention coupling, achieving state detection, anomaly prediction, and protection for mobile communication systems. The entire technical architecture, through four modules, achieves front-end and back-end business logic coupling, microservice-based centralized and elastic deployment, persistent database storage and distributed caching unit isolation, and partition management, effectively improving system scalability and operational performance. Each layer interacts using standardized communication interfaces and common networking transmission protocols, reducing the overall architecture complexity and module coupling.

[0154] 1. Interactive Interface Module: Primarily responsible for bidirectional transmission of business commands, full-domain data integration, and scenario visualization. Through a lightweight communication network security situation prediction mechanism based on cross-domain interaction, a security module is deployed to perform refined parameter discrimination on external access to the system, efficiently and accurately filtering various network security threats, including but not limited to: defending against remote file inclusion (FRI) attacks, mitigating potential data leakage risks caused by SQL injection, controlling and blocking malicious file uploads, resisting cross-site scripting (XSS) attacks to protect the system from malicious script intrusion, strictly preventing directory traversal attacks to ensure system file security, accurately identifying and intercepting cross-site request forgery (CSRF) attacks to curb the risk of unauthorized identity impersonation, and filtering XPath injection behavior in real time to maintain data integrity and trustworthiness, comprehensively strengthening the system's proactive defense and anti-attack capabilities.

[0155] The entire dynamic learning mechanism continuously optimizes communication network security protection strategies. The learning mode does not require direct interception of access requests; it can collect and analyze traffic flow in real time, aggregate and mine the behavioral characteristics of normal business requests, and form a standardized behavioral dataset. The network security deployment process is as follows: Figure 4 As shown in the diagram, the overall business process can be seen.

[0156] 2. Logic Module: Equipped with IDMM message middleware, Zookeeper distributed scheduling middleware, BaaS on / off chain services, and a microservice gateway, this module standardizes and encapsulates core business capabilities, adapting to various business applications. It handles functions such as request routing, load balancing, security authentication, circuit breaking, and rate limiting, and coordinates message transmission and communication scheduling both within and outside the system. Leveraging an asynchronous communication and module decoupling design, this component supports high-concurrency business scenarios, achieving low-latency, high-efficiency data transmission and information flow.

[0157] BaaS (Blockchain as a Service) technology enables system node interconnection and information synchronization, abandoning the characteristics of traditional centralized control. Multiple peer-to-peer nodes across the network collaborate to complete transactions, consensus, verification, and link integration, fundamentally avoiding operational risks such as single points of failure and centralized authority hijacking. Once data is solidified, it is difficult to reverse-engineer or illegally delete, creating a closed-loop, tamper-proof, and trustworthy data channel. Compliant transaction data is visible and verifiable, comprehensively improving process transparency and trustworthiness. High-security protection combines high-strength encryption algorithms with a distributed node consensus mechanism for dual protection, effectively resisting various network attacks such as illegal intrusion, malicious tampering, and link eavesdropping. This module is crucial for upgrading communication networks to trusted digital infrastructure.

[0158] 3. Functional Support Module: This module is used to complete the compliant transformation of raw data and output basic capabilities in different dimensions, such as network connectivity, computing power coordination, dynamic resource scheduling, intelligent prediction algorithms, and security protection, as needed. Based on a microservice architecture, the system application is finely decomposed into multiple independent microservice units with lightweight, high cohesion, and low coupling characteristics. Services use a lightweight RESTful communication mechanism to achieve decoupling of business logic, independent service operation and maintenance, and elastic distributed deployment. It is equipped with the JCF microservice full-stack framework and the Fortress distributed task scheduling framework. The JCF framework uses Spring Cloud and Dubbo as underlying technologies to achieve modular operation. Based on business function division standards, it is decomposed into seven types of sub-projects, supporting independent start / stop of individual projects, distributed parallelism, and steady-state operation, achieving elastic horizontal scaling.

[0159] 4. Storage Module: It undertakes core businesses such as real-time transmission of traffic across the entire link, distributed secure storage, and unified interface access. It covers accurate collection of traffic from different sources, closed-loop transmission across nodes, distributed persistent archiving storage, as well as preprocessing compliance operations such as encoding and decoding format standardization, redundant data compression, and link encryption and hardening.

[0160] The collaborative deployment and integration of IDMM, Redis, and DMDB components leverages the advantages of technology. IDMM ensures reliable delivery and efficient processing of messages, enabling queue scheduling and asynchronous processing of massive requests in high-concurrency scenarios, alleviating short-term access pressure. Redis and DMDB work together to provide the system with high-speed data reading, real-time computation, and rapid analysis capabilities. Relying on message middleware, they achieve asynchronous data flow and interactive collaboration, and routinely cache high-frequency hot data, reducing the frequency of underlying accesses and effectively improving the overall system throughput and response efficiency. An analysis of a mobile communication terminal transaction scenario illustrates the traffic transmission diagram as follows: Figure 5 As shown.

[0161] This application also provides the process and data for model training and system evaluation in its embodiments.

[0162] The training data underwent a preprocessing procedure as described in the data acquisition section. Z-score standardization was used, and data sequences were generated with parameters L=90s and S=30s. The training, validation, and test sets were randomly allocated in a 7:2:1 ratio. Smote oversampling and data augmentation techniques were used to balance the data. To improve training speed, DDP+NCCL was applied to large-scale data training. The Adam optimizer was used, with neural network parameters set to Batch=128, Dropout=0.3, and L2 regularization parameter (1×10⁻⁶). -4 Construct a network model.

[0163] The parameter with the greatest impact on the model is the time window length. Validation showed that the model reaches its optimal performance when L = 90s. Increasing the number of hidden units from 256 to 512 improves the model accuracy by 0.3%, but increases the time by 40%. The initial learning rate was set to 1×102. -3 If so, the model needs 40 iterations to reach its optimal state, and its settings have a significant impact on the convergence speed. The convergence trend of the model's loss function is as follows: Figure 6 As shown.

[0164] The ROC value curve during the verification process is as follows: Figure 7 As shown, the AUC is approximately 0.994, close to 1.0, indicating that the model has achieved a relatively good level of feature classification. When the threshold is 0.5, the accuracy remains at 96.7%. When the threshold is adjusted to 0.6, the accuracy remains unchanged, but the false positive rate decreases. Thus, the threshold can be dynamically adjusted to obtain a better state. For misclassified samples, the confidence level is only 0.71. This parameter can also be used to judge the classification accuracy.

[0165] The method in this application effectively reduces the model size and parameters, while reducing time consumption and increasing computation speed. It still has high accuracy and generalization ability when facing complex intrusion categories.

[0166] The standard unoptimized model has a computation speed of 1.2 bps. Existing methods, after parameterization and knowledge distillation for lightweighting, have achieved computation speeds of 1.9 bps and 2.4 bps, respectively. This application, after global channel performance constraint pruning for lightweighting, achieves a computation speed of 3.6 bps, with resource consumption reduced by 32% compared to the initial model. Validation results show significant superiority over mainstream deep learning baseline models based on machine learning, achieving speedups of 7.6% and 3.7% respectively, and reducing the error rate to 0.71%. The model's performance varies across different types of intrusions, generally remaining above 96%. Accuracy drops to 94.5% for encrypted traffic and data containing obfuscation techniques, increasing detection difficulty. Accuracy reaches 89% for highly challenging APT attacks, demonstrating the model's good generalization ability.

[0167] Based on the proposed architecture, a system is built using high-frequency transactions of mobile communication terminals as the application scenario. Through transaction data analysis of a mobile communication operator, the overall success rate of the platform's monthly payment business can be improved by 19%, the annual maintenance manpower and labor costs can be reduced by 113 man-days, the compliant business categories can be significantly expanded, and the blockchain intelligent reconciliation mode can be used to avoid manual offline review processes, realize real-time closed-loop reconciliation of funds, achieve T+0 day account reconciliation, fundamentally solve the problem of reconciliation delay, and improve the operational efficiency and accuracy of cross-terminal transaction reconciliation.

[0168] A specific embodiment of this application also provides a computer device comprising: a memory and a processor, wherein the memory stores instructions executable on the processor. When the processor executes the instructions, it implements the methods described in the above embodiments. The number of memories and processors can be one or more. This computer device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The computer device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present application described and / or claimed herein.

[0169] The computer device may also include a communication interface for communicating with external devices and exchanging data. The devices are interconnected using different buses and can be mounted on a common motherboard or otherwise installed as needed. The processor processes instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as a display device coupled to the interface). In other embodiments, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple electronic devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). The bus can be divided into address buses, data buses, control buses, etc.

[0170] Optionally, in a specific implementation, if the memory, processor, and communication interface are integrated on a single chip, then the memory, processor, and communication interface can communicate with each other through an internal interface.

[0171] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting advanced RISC machines (ARM) architecture.

[0172] This application also provides a computer-readable storage medium (such as the memory described above) that stores computer instructions that, when executed by a processor, implement the methods provided in this application.

[0173] Optionally, the memory may include a stored program area and a stored data area, wherein the stored program area may store the operating system and application programs required for at least one function; the stored data area may store data created based on the use of the computer device for mapping. Furthermore, the memory may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the computer device for mapping via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0174] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A lightweight security situation prediction method for cross-domain interaction of multi-source communication data, characterized in that: Includes the following steps: Step 1: Data preparation and preprocessing. A distributed parallel system is adopted, and data acquisition modules are set up at key traffic nodes to acquire communication data in real time. The data is then standardized, feature-engineered, and augmented. The construction steps for building a lightweight cross-domain interaction model include: Step 2: Construct a hierarchical constraint pruning low-load model: This model is based on CNN and integrates positional encoding, heterogeneous convolution optimization, depthwise convolution fusion pointwise convolution, and structural layer light-load reduction; Step 3: Construct a cross-domain attention-coupled interaction model: This model is based on an improved IP2Vec to complete the data flow communication behavior coding modeling and anomaly probability discrimination, uses multi-layer Bi-LSTM to extract the temporal evolution correlation of the data packet layer, uses an autoencoder to complete the abstract modeling of the session layer payload features, and finally realizes the interaction between behavior distribution, sequence dependency and session semantics through a coupling interaction unit based on the attention mechanism. The optimal model is obtained by training a cross-domain interaction lightweight model. The optimal model is then used to process the real-time acquired communication data and output the predicted network security situation.

2. The method for predicting a lightweight security situation through cross-domain interaction of multi-source communication data according to claim 1, characterized in that: The communication data collected in step one includes signal strength affected by noise, interference or signal attenuation, loss of effective signal due to bit errors or signal loss, as well as signal-to-noise ratio, frame check error and delimitation error, rate mismatch, bit error rate, data retransmission rate, data status monitored by the network layer, port occupancy status and network connection status of the transport layer, and protocol information.

3. The method for predicting a lightweight security situation through cross-domain interaction of multi-source communication data according to claim 2, characterized in that: Step one also involves using data augmentation techniques to optimize samples when there is a highly skewed distribution of data, whether the communication is normal or abnormal. Step one also maps streaming data into fixed-dimensional sequence data based on the time dependence and correlation of communication data.

4. The method for predicting a lightweight security situation through cross-domain interaction of multi-source communication data according to claim 1, characterized in that: In step two, positional encoding is implemented based on the principle that the positional encodings of adjacent time steps are similar. By preserving the sequence structure information and adding it to the initial information, the model can explicitly perceive and capture time dependencies and dynamic change patterns.

5. The method for predicting a lightweight security situation through cross-domain interaction of multi-source communication data according to claim 1, characterized in that: The optimization of heterogeneous convolutions in the hierarchical constraint pruning low-load model is as follows: By focusing on detailed information in the data packet dimension using a 3×3 small-size convolutional kernel, refined local features are obtained. The receptive field is gradually expanded by using 5×5 and 7×7 convolutional blocks respectively, and the mesoscale features and global end-to-end features in the data stream dimension are extracted respectively. Then, the computational overhead of the model is reduced by using deep convolutional fusion and pointwise convolutional fusion. Pointwise linear transformation is achieved by using a 1×1 convolutional cascade structure, and different levels of fusion features are obtained on the basis of simplifying the operation logic. Furthermore, to prevent the input features from being diluted layer by layer, residual path connections are introduced in each layer of the network to ensure the integrity of the information; Then, the gradient propagation path of the deep network is optimized by batch normalization; The pooled features are obtained by fusion of linear weighted max pooling and average pooling, and the probability of each category is calculated through a fully connected layer after pooling.

6. The method for predicting a lightweight security situation through cross-domain interaction of multi-source communication data according to claim 5, characterized in that: The lightweighting of structural layers in the hierarchical constraint pruning model is achieved by pruning redundant and low-contribution channels during feature extraction, removing invalid convolutional kernels, and thus realizing a lightweight model structure design. Specific steps include: Initialize key parameters such as feature map size, pruning threshold, and non-maximum suppression enabled status, solve each feature map and confidence score in sequence, and define the cumulative value of each category probability as the confidence evaluation index; For different channel features, the weighted sum of positive and negative sample features is calculated separately, and the pruning score of each feature channel is obtained by the difference between the two. All feature channels are sorted according to their pruning scores, and redundant feature channels with scores below a threshold are removed. The feature representation ability and contribution of different channels are quantified, a significance score is calculated, and the average of the significance scores is used as the single-channel quantitative evaluation standard. Based on the evaluation value of the channel, invalid channels and redundant connections with low contribution in the network are screened and removed. Finally, nonmaximum suppression is used to retain the feature channel with the best score among all feature channels; Continuously iterate through the above pruning steps until both the model accuracy and model size meet the standards.

7. The method for predicting a lightweight security situation through cross-domain interaction of multi-source communication data according to claim 1, characterized in that: The steps for data stream communication behavior coding modeling and anomaly probability discrimination based on improved IP2Vec include: 1) Training of quintuple semantics and embedding vectors: A global semantic dictionary is constructed using the five-tuple fields of source IP, destination IP, source port, destination port, and protocol of data packets, and the embedding matrix corresponding to the network elements is initialized. Based on the traffic temporal arrangement relationship, the contextual relationship of each field of the five-tuple is established, and a negative sampling strategy is introduced with reference to the Skip-Gram training logic to iteratively optimize the low-dimensional embedding vector of each field. 2) Discrimination module: Calculates the confidence probability of traffic anomalies based on maximum likelihood estimation. Let the abnormal flow unit to be detected be... , This represents the current field's position in the time series. For location labeling, Given the sample length of a single flow sequence; calculate the average log probability of the current sample using the log-maximum likelihood formula. : ； In the formula: For a given context At that time, the central element The conditional probability of occurrence is calculated using Softmax normalization: ； in, The current central element Corresponding raw score For the semantic table of the first The original scores corresponding to each field are used to calculate the maximum likelihood value based on the conditional probability. ,by The degree to which communication behavior deviates from the normal baseline is quantified to identify abnormal traffic.

8. The method for predicting a lightweight security situation through cross-domain interaction of multi-source communication data according to claim 1, characterized in that: The steps for extracting packet layer temporal evolution correlations using Bi-LSTM include: A deep network with a vertically stacked three-layer Bi-LSTM structure is designed to extract temporal features from abstract sequence data level by level. The hyperparameter hidden units of the three layers of Bi-LSTM are 256, 128, and 64, respectively. The output of each layer serves as the input of the next layer. The bottom layer captures local, low-level temporal patterns, while the top layer integrates more complex and abstract semantic dependency information. Through a bidirectional multi-layer structure, a network structure is formed that is progressively inductive from bottom to top and progressively refined from top to bottom.

9. The method for predicting a lightweight security situation through cross-domain interaction of multi-source communication data according to claim 1, characterized in that: Attention-based coupled interaction units utilize small-dimensional query vectors key vector value vector The attention value is calculated, with the behavior distribution map as the input to the coupled interaction unit. Sequence dependency mapping Session semantic mapping The output is an interactive mapping. The interaction steps include: Define three cross-domain interaction modes; For each pattern, first project Q / K / V into the attention space; Perform attention calculations to obtain the features after cross-domain interaction; After processing all patterns in a loop, three cross-domain attention features are obtained. The three cross-domain attention features are then fused and ReLU calculation is performed to obtain the interaction mapping.

10. A communication system, characterized in that: The system includes: Interactive Interface Module: This module is used to realize bidirectional transmission of business instructions, full-domain data docking, and scenario visualization and situation presentation. This module has a security module deployed within it. This security module is used to perform the method described in any one of claims 1-9 to conduct fine-grained parameter discrimination on external access to the system and efficiently and accurately filter multiple types of network security threats. Logic module: Equipped with IDMM message middleware, Zookeeper distributed scheduling middleware, BaaS on / off chain service, and microservice gateway, it standardizes and encapsulates core business capabilities and coordinates the internal and external message transmission and communication scheduling of the system. Functional support module: Used to complete the compliant transformation of raw data, and output basic capabilities in multiple dimensions such as network connectivity, computing power coordination, dynamic resource scheduling, intelligent prediction algorithms, and security protection as needed; Storage module: It undertakes real-time transmission of traffic across the entire link, distributed secure storage, unified interface access to multiple core businesses, and covers accurate collection of traffic from different sources, closed-loop transmission across nodes, distributed persistent archiving storage, as well as various preprocessing compliance operations such as standardized encoding and decoding formats, redundant data compression, and link encryption and hardening.

Images