A network security threat real-time detection and defense system

Abstract

The application provides a network security threat real-time detection and defense system, and relates to the technical field of network security protocols.The application extracts application layer identity features and collects underlying throughput and concurrent baseline and network delay sequence through a multi-source traffic control module;the core security verification server uses concurrent baseline to calculate queuing time consumption execution difference filtering noise, peels off compliance congestion, and calculates net transmission delay deviation;by comparing identity and impedance characteristics to solve trust deviation index, combining two-dimensional punishment addressing mechanism of deterioration severity and cumulative time length, the zero trust control threshold is adaptively contracted;finally, the network connection cutting instruction or large concurrent compliance release signaling is issued by the boundary module.The application realizes the space-time decoupling of physical impedance and logical identity, overcomes the algorithm congestion and extreme value misjudgment caused by frequent verification in the traditional mechanism, and realizes the gain of network communication efficiency on the premise of guaranteeing the agile interception of hidden threats.

Description

Technical Field

[0001] This invention relates to the field of network security protocol technology, specifically to a real-time network security threat detection and defense system. Background Technology

[0002] In existing network security protocols for digital information transmission, zero-trust network architecture, due to its core principle of "never trusting, always verifying," is widely deployed in enterprise-level security protection systems. With the generalization of network boundaries and the exponential growth of endpoint interactions, systems face an increasingly severe objective challenge in maintaining high-frequency deep verification while ensuring the performance of underlying physical transmission.

[0003] In actual network session data interaction, existing defense mechanisms face limitations in effectiveness and physical computing power allocation: when facing legitimate high-volume concurrent traffic, the system frequently performs deep decomposition and verification of data streams based on static fixed rules, causing queuing congestion and forwarding delay distortion in communication channels, and the fixed threshold scale is prone to causing false isolation of normal connections; when advanced persistent threats (APTs) steal legitimate credentials and establish covert transmission proxy tunnels in the underlying physical network, the single-layer verification of existing technologies easily leads to serious lag in the extraction of covert features. Patent document CN121309120A proposes a real-time network threat detection and defense method and system based on artificial intelligence. Although it has advantages in model lightweighting and detection speed, its core still relies on pure logical-level data stream statistical analysis and lacks a physical noise reduction mechanism for the queuing time of the underlying hardware network. This lack of decoupling between physical and logical dimensions makes it difficult for the system to distinguish the difference between natural congestion time and illegal proxy hijacking time when facing legitimate traffic peaks, and the sensitivity and anti-interference capability of its defense convergence mechanism still need to be improved. Summary of the Invention

[0004] The purpose of this invention is to provide a real-time network security threat detection and defense system, constructing a dual-track perception hub that simultaneously captures identity credentials and underlying communication impedance. By introducing physical noise filtering operations based on a time baseline, the system eliminates hysteresis noise caused by normal concurrency at its source; furthermore, using the aforementioned net transmission delay deviation as input, it embeds a two-dimensional penalty weight mapping logic to transform discrete abnormal dwell times into an adaptive tightening driving force for zero-trust control thresholds. This addresses the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A real-time network security threat detection and defense system, specifically comprising:

[0007] The multi-source traffic control module is configured to respond to external interaction commands triggered by terminal nodes. Under the premise of meeting the preset security audit authorization policy, it extracts terminal access request data of the corresponding session link at the network protocol layer to map the context identity baseline features.

[0008] The multi-source traffic control module is also configured to extract the current periodic packet transmission and reception rate of the network interface corresponding to the server basic network access device from the server basic network access device to generate a network throughput concurrency baseline, and call the standard network diagnostic component to send network connectivity test data packets to the terminal node to collect network latency fluctuation sequences.

[0009] The core security verification server is configured to use the network throughput concurrency baseline as the queuing delay compensation benchmark, perform timing alignment and differential noise filtering operations on the network delay fluctuation sequence, and calculate the net transmission delay deviation parameter used to characterize the actual forwarding hysteresis state of the communication link.

[0010] The net transmission delay deviation parameter and the context identity benchmark feature are jointly imported into the comprehensive trust assessment module for logical comparison, the dynamic trust deviation index is calculated, the preset historical trust deviation distribution benchmark is obtained, and the zero trust control threshold used to judge the system perception status is adaptively adjusted according to the distribution difference between the dynamic trust deviation index and the historical trust deviation distribution benchmark.

[0011] The dynamic boundary execution module is configured to generate network isolation scheduling instructions for network boundary forwarding nodes based on the adjusted zero-trust control threshold. The network isolation scheduling instructions are configured to trigger the network boundary forwarding nodes to perform communication connection cut-off or data packet drop operations for abnormal network segments in the logical control plane.

[0012] Preferably, the multi-source traffic control module extracts the current periodic packet transmission and reception rate of the corresponding network interface from the server's basic network access device to generate a network throughput concurrency baseline, and is configured as follows:

[0013] The operating system's network interface configuration tool is invoked to periodically read the network interface traffic counting module of the server's basic network access device and extract the original total number of packets sent and received on the network port.

[0014] Obtain the number of bytes consumed by the active probe traffic generated by sending the network connectivity test data packet by invoking the standard network diagnostic component;

[0015] The number of bytes consumed by the active detection traffic is used to perform an algebraic subtraction operation on the original total number of packets sent and received at the network port to filter out redundant traffic components generated by the system's own detection, thereby generating the network throughput concurrency baseline that filters out physical traffic interference.

[0016] Preferably, the multi-source traffic control module is configured to send network connectivity test data packets to terminal nodes to collect network latency fluctuation sequences when calling the standard network diagnostic component:

[0017] Based on a preset time step, the standard network diagnostic component is triggered to inject a standard network speed test data packet sequence into the terminal node;

[0018] The set of node response status data returned in the transmission channel by the intercepted standard network speed test data packet sequence;

[0019] Extract the round-trip time difference and packet loss ratio features from the node response status data set, calculate the fluctuation deviation parameter of the round-trip time difference in a continuous time period, and extract the network delay fluctuation sequence that characterizes non-natural network transmission distortion.

[0020] Preferably, when the core security verification server performs time alignment and differential noise filtering operations on the network latency fluctuation sequence to calculate the net transmission delay deviation parameter, it is configured as follows:

[0021] Using the feedback time point of any single discrete communication delay record in the network delay fluctuation sequence as the alignment benchmark, historical data within a preset time period before the feedback time point are retrieved to construct a comparison time interval;

[0022] The arithmetic mean of the network throughput and concurrency baseline within the comparison time interval is calculated to extract a reference value for normal traffic congestion queuing time that characterizes the current natural queuing state of the network.

[0023] The single discrete communication delay record is subjected to algebraic noise filtering and deduction operation with the normal traffic congestion queuing time reference value to remove the network congestion time caused by high concurrency of compliant network requests, and the net transmission delay deviation parameter used to quantify the degree of network line hijacking by illegal proxies is calculated.

[0024] Preferably, the core security verification server, after calculating the dynamic trust deviation index and adaptively adjusting the zero-trust control threshold, is configured as follows:

[0025] In the comprehensive trust assessment module, the application layer identity legitimacy status contained in the context identity benchmark features is parsed.

[0026] In response to the application layer identity legitimacy status meeting the preset compliance release conditions, and the net transmission delay deviation parameter exceeding the preset network delay abnormal fluctuation tolerance limit, it is determined that the current communication channel has a hidden impedance distortion behavior disguised under a legitimate protocol payload, and a risk penalty weight is injected into the comprehensive trust assessment module, and the dynamic trust deviation index is increased by numerically using the risk penalty weight.

[0027] In response to the dynamic trust deviation index exceeding the preset security baseline after being pushed up, the lower limit setting of the zero trust control threshold is adaptively tightened to trigger the deep defense interception mechanism.

[0028] Preferably, when generating network isolation scheduling instructions for the network boundary forwarding node, the dynamic boundary execution module is configured as follows:

[0029] In response to the adjusted zero trust control threshold reaching the alert level that triggers blocking, the source Internet Protocol address of the terminal node that caused the abnormal dynamic trust deviation index is extracted;

[0030] The source inbound interconnection protocol address is encapsulated into a network layer link isolation policy to generate the network isolation scheduling instruction;

[0031] The network isolation scheduling command is configured to trigger the network boundary forwarding node to perform targeted physical link layer connection blocking and network layer route dropping operations on the data stream originating from the source Internet Protocol address.

[0032] Preferably, the system further includes an application-layer security gateway component, and the dynamic boundary execution module is further configured to execute a closed loop of parallel auxiliary technology, specifically:

[0033] In response to the distribution difference indicating that the system is in a normal office high-volume concurrent state, and the adjusted zero-trust control threshold does not trigger a downward convergence action and remains in the baseline tolerance state, a compliant communication flow release signaling is generated for the application layer security gateway component.

[0034] The compliance communication flow release signaling is configured to drive the application layer security gateway component to skip the deep encryption and decryption and secondary identity verification steps of subsequent compliance communication data flows during the current active network session connection, and establish a pass-through data forwarding mechanism based on the security of the underlying network link.

[0035] Preferably, when the core security verification server performs arithmetic mean calculation on the network throughput and concurrency baseline within the comparison time interval to extract a reference value for normal traffic congestion queuing time that characterizes the current natural queuing state of the network, it is specifically configured as follows:

[0036] Extract the nominal theoretical transmission rate of the port pre-calibrated in the network card driver configuration parameters of the server's basic network access device;

[0037] The network throughput concurrency baseline obtained after performing arithmetic mean calculation is used as the dividend, and the nominal theoretical transmission rate of the port is used as the divisor to perform division ratio calculation, thereby calculating the port throughput load percentage that represents the actual congestion ratio of the current physical link.

[0038] Retrieve the theoretical baseline latency of the network card queue preset by the device at the factory; perform a multiplication proportional conversion process on the theoretical baseline latency of the network card queue and the port throughput load percentage to proportionally map the congestion level of the traffic dimension to the specific queuing time, and calculate the reference value of the normal traffic congestion queuing time with time unit attribute.

[0039] Preferably, when the core security verification server injects risk penalty weights into the comprehensive trust assessment module and uses these risk penalty weights to numerically increase the dynamic trust deviation index, it is specifically configured as follows:

[0040] By comparing the net transmission delay deviation parameter with the network delay abnormal fluctuation tolerance limit, the delay exceedance difference between the two is calculated to extract the single delay degradation severity parameter that characterizes the single abnormal depth of the current communication impedance.

[0041] Track the communication session timing monitoring log of the communication channel, count the duration for which the net transmission delay deviation parameter is continuously maintained outside the upper limit of the network delay abnormal fluctuation tolerance, and extract the cumulative duration of delay exceeding the limit that characterizes the continuous period of network impedance abnormality.

[0042] The single latency degradation severity parameter and the cumulative latency exceedance duration are used as joint retrieval key values ​​and input into a preset two-dimensional penalty weight mapping table. Two-dimensional retrieval and matching extraction processing is performed to dynamically retrieve the risk penalty weight that matches the current network distortion depth and dwell time.

[0043] Extract the basic trust value retained from the previous judgment period, and perform a punitive multiplication amplification calculation on the basic trust value based on the retrieved risk penalty weight, so as to complete the exponential penalty weight increment operation on the dynamic trust deviation index.

[0044] Compared with the prior art, the beneficial effects of the present invention are:

[0045] This invention synchronously collects the current period's throughput concurrency baseline and network latency fluctuation sequence through a multi-source traffic control module, and performs algebraic noise filtering and subtraction operations in the core security verification server. This effectively eliminates the normal hardware queuing time caused by high-volume concurrent traffic on compliant networks, successfully calculating the net transmission latency deviation parameter. It effectively eliminates the interference of high-capacity service peaks on the detection engine, reducing the false isolation rate of legitimate terminal communications.

[0046] This invention uses the severity of a single latency degradation and the cumulative duration of latency exceeding the limit as joint retrieval keys, extracting risk penalty weights from a preset matrix to exponentially amplify the dynamic trust deviation index. This enables the system to generate a highly sensitive degradation amplification effect on persistent threats (APTs) that carry legitimate credentials but execute slow, covert proxies, thereby adaptively tightening the zero-trust control threshold and achieving the disconnection of abnormal network segment connections under the constraint of the circuit breaker bottom line.

[0047] To address the gateway computing power bottleneck and lag issues caused by frequent verification in zero-trust environments, the dynamic boundary execution module of this invention introduces a parallel auxiliary closed loop. When the distribution difference indicates that the physical link is in a secure, legitimate, high-concurrency state and the trust defense has not triggered degradation convergence, the system directly issues a compliant communication flow release signaling to the application layer security gateway. By establishing a pass-through and inspection-free mechanism at the hardware forwarding layer, the deep encryption and unpacking steps are skipped, achieving gains in communication efficiency and security performance while ensuring overall defense stability. Attached Figure Description

[0048] Figure 1 This is a schematic diagram of the structure and technical route of the present invention;

[0049] Figure 2 This is a schematic diagram of the structure and technical route of the present invention. Detailed Implementation

[0050] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0051] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0052] Example 1:

[0053] Please see Figure 1 and Figure 2 The present invention provides a technical solution:

[0054] A real-time network security threat detection and defense system includes: the system relies on a multi-source traffic control module deployed at the network gateway boundary, a core security verification server in the core computing power area of ​​the internal network, and a dynamic boundary execution module connected in series with the firewall to work together.

[0055] The multi-source traffic control module extracts and maps identity features in response to interactive commands:

[0056] The multi-source traffic control module is configured to respond to external interaction commands triggered by terminal nodes (e.g., an HTTPS handshake request from an external enterprise terminal computing device attempting to access the company's internal system). Under the premise of meeting preset security audit authorization policies (the source IP address of the terminal has passed the ACL whitelist access restriction of the peripheral basic firewall), it directly intercepts the terminal access request data of the corresponding session link at the network protocol layer. In specific network packet capture actions, the multi-source traffic control module uses a deep packet inspection (DPI) component to parse the application layer communication payload and extract key authentication fields to map contextual identity baseline features. While extracting the above request data for feature concatenation, the multi-source traffic control module simultaneously stores the parsed source network access protocol address in a local session state table. The local session state table relies on the high-speed state cache registry of the computing device or the network connection state tracking component of the operating system. This ensures that, without affecting the dimensionality reduction and concatenation of backbone identity features, the downstream dynamic boundary execution module can still retrieve the original physical address from this state table at any time using the current session identifier, thus providing a clear data foundation for generating the final network isolation scheduling command. At this stage, the system registers a multi-dimensional identity-aware feature set:

[0057] Contextual identity baseline features are denoted as This indicates the apparent legitimate identity of the terminal device initiating the network request at the application layer, as well as the initial access environment. Its data dimensions consist of the user login password token (authentication string), the device browser fingerprint (User-Agent), and the geolocation resolution tag of the source IP address, all extracted directly from the request payload header.

[0058] For multi-source heterogeneous requests, a structured feature concatenation mapping is performed, and its identity feature mapping logic is defined as follows: The multi-source traffic control module invokes a hardware or system-level deep packet inspection engine to extract the user login password token from the payload header of the current session data unit. Device browser fingerprint And the geolocation resolution label derived from the source IP address. Subsequently, string concatenation and normalization concatenation operations are performed on these three sets of heterogeneous data streams in the cache computing area to output the contextual identity baseline features that represent the terminal's comprehensive static identity. Among them, the user login password token In this embodiment, the dynamic key credential parameter, which characterizes the legitimacy of the session initiator's authorization, is preferably configured as an encrypted hash string with a length limited to the range of [256, 512] bytes.

[0059] Device browser fingerprint Standardized text parameters for characterizing the surface environment of hardware devices; geographic attribution resolution labels. This is an enumerated geographic tag parameter characterizing the legitimacy of the physical access location (its state machine value is: domestic / overseas / internal network whitelist). When the system detects that any of the above parameters has been extracted out of bounds or its state has expired, it will trigger a global defense warning mechanism, directly blocking the flow of the request to the core verification server. In the current system's communication topology, this multidimensional data set maps to the static initial permission level of the current network session, and after extraction, it is continuously and unidirectionally transmitted to the downstream "core security verification server" by the multi-source traffic control module through the internal high-speed data transmission link, serving as the benchmark for all subsequent security assessments and trust deviation calculations.

[0060] Further physical network feature collection and interference cleanup are performed: the multi-source traffic control module is also configured to perform a dual-track parallel collection mechanism: specifically, the current periodic packet transmission and reception rate of the corresponding network interface is extracted from the server's basic network access device to generate a network throughput concurrency baseline; then, the standard network diagnostic component is called to send network connectivity test data packets to the terminal node to collect network latency fluctuation sequences.

[0061] In the first data acquisition track: In the data center switch environment, the traffic carried by the network interface exhibits multi-source heterogeneous characteristics, mixed with traffic injected by the system's own monitoring probes. When generating the network throughput and concurrency baseline, the multi-source traffic control module is configured to call the host operating system's underlying network interface configuration tools (such as the native ethtool command-line tool in Linux distributions) to periodically read the network interface traffic counting module of the server's basic network access devices (such as physical fiber optic network cards) and directly extract the original total number of packets sent and received by the network port from the hardware RX / TX registers.

[0062] Introduction is denoted as The total number of original transmitted and received packets on the network port; it represents the macroscopic absolute number of all incoming and outgoing data frames carried by the current physical Ethernet card chip at the actual hardware interrupt level. The system relies on the interrupt interaction mechanism between the firmware control protocol and the operating system for feature accumulation. Its hardware monitoring accumulation logic is defined as follows: ; By calling the host operating system's network interface to monitor processes, during a complete hardware clock polling cycle. Internally, the system kernel continuously detects and accumulates the number of hardware interrupts for valid data frames sent by the physical fiber optic network card chip. When the clock window closes, a one-dimensional arithmetic summation and aggregation operation is performed, outputting the original total number of packets sent and received by the network ports within the monitoring period. .in, This is a time polling step size parameter used to define the frequency of interaction between the sensor and the physical network interface card. In this embodiment, its preferred value is limited to 50 milliseconds.

[0063] While reading the registers, the multi-source traffic control module statistically analyzes and obtains the actual number of bytes consumed by the active probe traffic generated by sending network connectivity test data packets via the standard network diagnostic component in the background. This number of bytes consumed by the active probe traffic is denoted as... This represents the absolute value of the physical link bandwidth actually occupied by ICMP or TCP-ACK probe packets actively sent by the defense system for detection purposes. The multi-source traffic control module performs algebraic subtraction on the same dimension using the number of bytes consumed by the actively probed traffic from the extracted total number of original transmitted and received packets on the network port. By directly subtracting the known probe data injection consumption from the total network interface card (NIC) traffic, redundant traffic components generated by the system's own detection are filtered out at the NIC stage.

[0064] For physical-level separation filtering of mixed traffic, a dimensional reduction evolution logic is constructed, specifically defined as follows: The multi-source traffic control module calls the arithmetic processing unit to obtain the total number of original packets sent and received by the network ports, representing the scale of all incoming and outgoing physical network interfaces. Synchronously acquire and record the number of bytes consumed by the active probe traffic, representing the scale of probe consumption for internal diagnostic behavior within the system. To overcome the clock conflict between the 50ms network card polling interruption and the 200ms probe transmission action, this embodiment activates a scale resampling and timing alignment mechanism before performing subtraction: specifically, a global statistical reference window with a standard span (1000ms) is established. Within this sliding window, the total number of original transmitted and received packets at high-frequency network ports is... The sequence performs 20 historical cache summations to map the total throughput at the second level, and also counts the number of bytes consumed by low-frequency proactive probe traffic. The sequence performs five cumulative historical probe data injections, converting and unifying them into a rate benchmark unit of bytes per second (Bytes / s). After aligning the communication protocol feature scales as described above, an algebraic linear subtraction process with the same benchmark unit is performed under the same clock scale to eliminate invalid interference components generated by the internal loop of the defense system, thereby outputting a baseline characterizing the network throughput and concurrency imposed by the external network environment. This characterizes the actual concurrent load pressure applied by the external access side on the current communication channel after filtering out internal system traffic interference. Specifically, it includes the number of bytes consumed by actively detected traffic. This is an absolute capacity-type control parameter characterizing the system's intrinsic monitoring overhead. Under the monitoring conditions of this embodiment, its physical bandwidth overhead per second is constrained to

[10] . 3 10 4 Within the byte range. Further settings are provided in Table 1 below:

[0065] Table 1: Mapping Table of Cross-Clock Domain Timing Alignment and Low-Level Probe Physical Hurtance Cleaning Process

[0066]

[0067] Table 1 shows that the multi-source traffic control module takes over the network card polling interrupt interface of the host operating system. This data capture runs directly in the underlying kernel module of a general-purpose Linux server deployed in the data center. By directly performing high-frequency polling and mounting of the hardware directory, it extracts the intrinsic data of the network card optical module in actual throughput. Table 1 illustrates the total number of original packets sent and received by the network ports. The "gross weight" represents the actual load carried by the network interface card (NIC) chip, while the number of bytes consumed by actively detected traffic is... This refers to the "packaging box" that the defense system throws into the channel itself to test network connectivity. This embodiment performs a unified alignment and difference calculation on a 1000-millisecond time scale for the two different sampling frequencies. In the last scenario, it is revealed that when an occasional deadlock occurs during speed measurement, dumping probe data exceeding the safety limit onto the network card, the probe thread is directly "powered down" at the operating system permission level. This ensures the physical survival rate of the entire defense infrastructure under internal failures.

[0068] Further implementation notes: In the second acquisition track: Regarding the microscopic physical impedance state of the external Internet channel, when the multi-source traffic control module calls the standard network diagnostic component to send test packets to the terminal node, it is configured to actively trigger the standard network diagnostic component to inject a standard network speed test data packet sequence into the terminal node based on a preset time step.

[0069] Introducing time step This time step represents the hardware clock interval at which the system continuously transmits diagnostic data packets to external target nodes. In this embodiment, the preferred value for this time step is set to a fixed constant of 200 milliseconds. If this parameter exceeds the preset upper limit of 200 milliseconds (5 seconds), the system's acquisition of the real physical channel state will be excessively sparse, causing a sharp contraction in the number of node response state data samples extracted within the time window. This leads to the subsequent loss of expressive power of the feature vector of the detection model, making it easy for the system to fail to capture the impedance change gap caused by the instantaneous switching of covert proxy routes by abnormal nodes.

[0070] After the probe sequence is successfully sent in this embodiment, the multi-source traffic control module uses the network card loopback mechanism to bypass and intercept the node response status data set that is returned in the wide area network transmission channel of the standard network speed test data packet sequence.

[0071] Define the node response status data set as . It represents the comprehensive channel health status feedback brought back by a series of diagnostic packets after traversing a complex physical network topology. The data dimension of this set consists of the round-trip time difference (RTT) record for each velocity measurement packet, as well as the physical packet loss ratio characteristics within the statistical period; this data set maps the transient conduction quality of the channel, and its flow direction is to be sent as intermediate state material to the wave motion difference extraction module.

[0072] To filter out normal static physical distance hysteresis, this embodiment introduces an absolute discrete fluctuation calculation engine, whose data cleaning logic is defined as follows: The multi-source flow control module extracts the transient round-trip time difference at the current sampling moment. Using the current moment as the base point, trace back a preset number of sampling periods N to record the historical round-trip times within the sliding time window. Perform an arithmetic averaging operation to calculate a smoothed baseline mean that characterizes the current static baseline latency of the physical circuit. Then, calculate the transient round-trip time difference. By performing an absolute discrete subtraction operation with the smoothed baseline mean, the constant delay caused by the physical length of the underlying fiber is removed, and the output is a fluctuation deviation parameter reflecting transient congestion or covert hijacking jitter. .

[0073] Furthermore, a structured sequence aggregation operation is constructed. Specifically, based on a preset sequence sampling window, multiple continuously generated fluctuation deviation parameters are aggregated in chronological order according to their timestamps. Each feature is pushed into the high-speed feature cache queue, generating a one-dimensional time series array. .in This represents the last discrete sampling time point within the current sequence sampling window when the window is closed; the depth of this sequence sampling window is configured to be 10. Here, m=10. The sequence sampling window is used to represent the continuous historical communication feedback span upon which the system relies in a single dynamic evaluation. In this embodiment, the sequence sampling window is preferably configured with a sampling depth of 10 consecutive periods. In practical applications, the communication jitter frequency based on the field conditions can be flexibly configured within the range of [5, 50] periods. Through this data processing action of splicing discrete scalars into a continuous one-dimensional array according to the temporal topology, a network delay fluctuation sequence characterizing non-natural network transmission distortion (eliminating normal fiber optic thermal jitter and truly extracting the regular lag characteristics caused by malicious interception, unpacking, or abnormal routing of communication data frames by illegal man-in-the-middle nodes of hackers) is constructed.

[0074] Set up a core security verification server, which performs sliding timing alignment and heterogeneous physical dimension reduction conversion of network card queuing time: The core security verification server is configured to use the network throughput concurrency baseline as the queuing delay compensation benchmark, perform timing alignment and differential noise filtering operations on the network delay fluctuation sequence, and calculate the net transmission delay deviation parameter used to characterize the actual forwarding hysteresis state of the communication link.

[0075] In the specific execution flow, the feedback time point of any single discrete communication delay record in the network latency fluctuation sequence is used as the alignment benchmark. Historical data within a preset time period prior to this feedback time point is retrieved to construct a comparison time interval. This comparison time interval is denoted as... Its characterization system is used to trace back the time window length of the macroscopic physical flow background behind the current transient delay. In this preferred embodiment, its value is set to a fixed step size of 2 seconds over the past two seconds.

[0076] The core security verification server, when calculating the arithmetic mean of network throughput concurrency baselines within the comparison time interval to generate smoothed throughput, and combining this smoothed throughput with the theoretical rate of the underlying hardware ports to extract a reference value for normal traffic congestion queuing time representing the current natural queuing state of the network, is specifically configured to: call the underlying interface of the operating system to extract the nominal theoretical transmission rate of the port pre-calibrated in the network card driver configuration parameters of the server's basic network access devices. This is defined as... The nominal theoretical transmission rate of the port; it represents the absolute value of the maximum line-speed bandwidth of the physical fiber optic network card of this model, which is locked at the factory when the underlying chip is manufactured (for example, for enterprise-level gigabit network cards, this value is fixed at 1000Mbps).

[0077] This embodiment constructs a homogeneous physical mapping logic to eliminate the capacity dimension differences caused by different hardware models: It extracts the nominal theoretical transmission rate of the port determined by the link layer negotiation of the current basic network access device by calling the network stack interface of the operating system. The previously obtained network throughput and concurrency baseline will be used. As the dividend, the nominal theoretical transmission rate of the port is used as the dividing number. The division ratio is used as a divisor to perform a proportional mapping calculation to output the port throughput load percentage normalized to the closed interval [0,1]. This quantifies the actual physical congestion of the current hardware data pipeline. In real-world operating conditions, if a hardware interface experiences a false negotiation degradation failure (e.g., a gigabit network port downclocking to 10 Mbps due to strong electromagnetic interference), the extracted port's nominal theoretical transmission rate may be affected. An abnormally small value, or even close to zero, will directly affect the calculated port throughput load percentage. Numerical polarization overflow occurs. This embodiment includes hardware benchmark verification logic before the division operation; once the port's nominal theoretical transmission rate is determined... If the speed is below the preset minimum compliance limit of 100Mbps for the physical interface, the division mapping link will be blocked, and the system's preset conservative load constant will be used as a fallback.

[0078] Retrieve the theoretical baseline latency of the network interface card (NIC) queue, preset by the device at the factory. Let this be denoted as... The theoretical baseline latency of the network interface card (NIC) queue represents the maximum physical time it takes for a data packet to queue in the underlying hardware buffer ring queue and wait for bus scheduling when the physical NIC reaches 100% maximum load. In this embodiment, it is set to 15 milliseconds. The system performs a multiplication proportional conversion process between the theoretical baseline latency of the NIC queue and the port throughput load percentage to proportionally map the congestion level in the traffic dimension to a specific queuing time, thus calculating a reference value for normal traffic congestion queuing time with a time unit attribute (if the queuing time at 100% full load is 15 milliseconds, then when the calculated current throughput load percentage is 80%, the proportionally converted legal queuing time is 12 milliseconds). The mapping evolution logic of this time dimension is defined as follows: It extracts the theoretical baseline latency of the network interface card queue from the device's underlying firmware. The system will display the dimensionless port throughput load percentage. The time is linearly multiplied by the theoretical baseline latency of the network interface card queue, and the final output is a reference value for the queuing time of normal traffic congestion caused by the concurrency of legitimate communication flows. Furthermore, the obtained single discrete communication delay records and the calculated reference value of normal traffic congestion queuing time are subjected to algebraic noise filtering and subtraction operations to remove the network congestion time caused by high concurrency of compliant network requests, and to calculate the net transmission delay deviation parameter used to quantify the degree of network line hijacking by illegal proxies. Its underlying sequence noise filtering and aggregation logic is specifically defined as follows: The system extracts the current time window containing... A test sequence is composed of original single discrete communication delay records. A packet loss anomaly circuit breaker and feature substitution mechanism is introduced: specifically, the network stack state identifier of the operating system and the previously acquired packet loss ratio features are extracted. If the probe fails to capture a return frame within the hardware timeout period, or if the packet loss ratio features indicate that the data frame loss rate within the current sampling period exceeds the basic physical transmission safety tolerance (a physical network disconnection and packet loss occur), the discrete communication delay record will be terminated. (If the value is null or extremely incomplete), in response to the underlying packet loss event, the failed discrete record will be assigned a preset extreme disconnection penalty constant. (In this embodiment, the preferred configuration is 3000 milliseconds).

[0079] For the discrete communication delay record corresponding to the i-th network data packet in the sequence Use this as the minuend, and subtract the reference value for normal traffic congestion queuing time dynamically derived in the previous step. As the subtrahend, perform the difference operation under the same time dimension. And invoke the extreme value comparison operator. If the result of a single difference is less than or equal to zero, the noise floor for that difference is cleared to zero. Then, an arithmetic mean aggregation operation is performed on all effective delay differences in the sequence after clearing and filtering, outputting a net transmission delay deviation parameter that characterizes the overall hijacking and hysteresis state of the communication link within that time period. .

[0080] Furthermore, the core security verification server imports the net transmission delay deviation parameter and the extracted context identity benchmark features into the comprehensive trust assessment module for logical comparison in order to calculate the dynamic trust deviation index.

[0081] The comprehensive trust assessment module parses the application-layer identity legitimacy status contained in the context identity baseline features. Pre-defined compliance release conditions are configured as a logical state triggering mechanism based on the local security permission dictionary. In this embodiment, given that identity data has already been cascaded and fused in the preceding data preprocessing stage, the state parsing module is invoked, and based on a preset field length mask or delimiter identifier sequence, reverse segmentation and dimensionality reduction parsing are performed on the incoming context identity baseline features to restore and separate the internally encapsulated user login password token and geolocation resolution tag. The parameters of these two independent dimensions are recombined into a composite retrieval key value, and string-level hash matching verification is performed with the active session authorization dictionary pre-synchronized with the local application-layer security gateway.

[0082] The system's control mechanism will flip the application layer identity legitimacy status flag of the current session from the initial pending verification state to the compliant release state only if the aforementioned features all have corresponding valid records in the authorization dictionary and the user's login password token is determined not to be in an expired or invalid quiescent state. Without this comparison and confirmation mechanism based on the local physical dictionary, the system will be unable to establish clear access boundaries, leading to errors in the core state machine mapping and decision offsets. The system will default any unordered external probe requests carrying forged header formats to a valid state, directly introducing them into the deep internal network verification link, thereby consuming the computing resources of the underlying verification server and causing a performance degradation across the entire link.

[0083] In response to the application layer identity legitimacy status meeting the preset compliance release conditions (the malicious attack source successfully stole the legitimate login token, and the application layer account password verification appears legitimate and without any anomalies), it immediately dives to the underlying network impedance verification defense line to determine whether the net transmission delay deviation parameter exceeds the preset tolerance boundary.

[0084] Introduction is denoted as The network latency anomaly tolerance limit is defined as the maximum allowable latency fluctuation margin of the system to withstand normal communication jitter, fiber thermal attenuation, or compliant routing switching in a wide area network. In this embodiment, the quantized value of this network latency anomaly tolerance limit is set to a static time constant of 25 milliseconds. When the net transmission delay deviation parameter exceeds the above-mentioned network latency anomaly tolerance limit, it is determined that the current communication channel exhibits hidden impedance distortion behavior disguised as legitimate protocol payload.

[0085] Furthermore, when the core security verification server injects risk penalty weights into the comprehensive trust assessment module and uses these weights to numerically increase the dynamic trust deviation index, it is specifically configured to perform cascaded extraction based on a two-dimensional spatiotemporal process:

[0086] By comparing the net transmission delay deviation parameter with the upper limit of network delay anomaly tolerance at the spatial anomaly depth, the delay exceedance difference between the two is calculated to extract a single-event delay degradation severity parameter characterizing the single-event anomaly depth of the current communication impedance. The single-event delay degradation severity parameter is denoted as... Its physical meaning directly represents the absolute time span by which the delay of a single communication transmission exceeds the preset tolerance limit for abnormal fluctuations, and quantifies the physical deterioration of a single hijacking action.

[0087] The logic for determining the severity parameter of single-event latency degradation is as follows: It responds to the net transmission delay deviation parameter by invoking its internal arithmetic logic unit. A status indicator showing a deviation exceeding the network latency anomaly tolerance limit is used. The measured deviation parameter is then subtracted from the fixed network latency anomaly tolerance limit as the minuend. By subtracting the base data from the normal fluctuation range using the same dimensional time characteristic, the output pure numerical result is the parameter for the severity of single-time delay degradation. The communication session timing monitoring logs of the communication channel are tracked in terms of temporal continuity. The duration for which the net transmission delay deviation parameter continuously remains outside the tolerance limit for abnormal network delay fluctuations is statistically analyzed. The cumulative duration of delay exceeding the limit, which characterizes the continuous period of abnormal network impedance, is extracted and denoted as... It represents the temporal span during which the covert proxy tunnel has maintained connectivity and continuously resided in the communication pipeline.

[0088] The logic for determining the cumulative duration of latency exceeding the limit is as follows: It mounts communication session timing monitoring logs to the state tracking registry and uses a sliding time window to extract record segments of consecutive compliance violations. For the log of the j-th detection period, it continuously satisfies... The detection period of the condition, and its corresponding physical time interval. Linear summation is performed. If the deviation falls back to any compliant sampling point within the upper limit during the process, the state machine is reset, and the current accumulation register is cleared. This continuous state aggregation calculation maps the scattered single impedance anomaly judgment results to continuous time span characteristics, thereby outputting the cumulative delay exceeding the limit characterizing the abnormal residence time of the communication channel. .

[0089] The single-instance latency degradation severity parameter and the cumulative latency exceedance duration are used as joint retrieval keys and input into a pre-defined two-dimensional penalty weight mapping table. Two-dimensional retrieval and matching extraction are performed, and risk penalty weights matching the current network distortion depth and dwell time are dynamically retrieved. The two-dimensional penalty weight mapping table is denoted as follows: Its data dimensions are structured as a non-linear cross-reference lookup matrix pre-placed in the high-speed addressing cache node (one dimension is severity, and the other is cumulative duration). See below for details:

[0090] Table 2: Example of Offline Solidified State Two-Dimensional Penalty Weight Mapping Table

[0091]

[0092] This scheme reduces the dimensionality of the output of the exponential penalty weight increment operation and solidifies it into the aforementioned two-dimensional penalty weight matrix during the offline initialization phase. Maximum value truncation boundaries are applied to the ends of the table's vertical and horizontal axes (the maximum value of the single latency degradation severity parameter is set to 50ms, and the maximum value of the cumulative latency exceedance duration is set to 20s). In actual online retrieval flow, when the system detects an abnormal terminal causing an extreme distributed denial-of-service (DDoS) obfuscation hijacking lasting up to 120 seconds with a single distortion as high as 200ms, the underlying extreme value operator clamps its addressing pointer to the absolute physical extreme value (79.5 times penalty) in the lower right corner of the table, thereby avoiding the underlying hardware-level risk of matrix cache addressing out of bounds or memory overflow crashes caused by maliciously constructed ultra-large data packets. Simultaneously, this cross-shaped grid demonstrates the asymmetric attack logic of the defense system: even if the hijacking node deliberately controls the single transmission latency to an extremely low concealment level (such as the vertical column...), (For a state that is 0ms close to the bottom line), as long as its dwell time is... If the long tail boundary of 20 seconds is continuously exceeded, the multiplier obtained by the system table lookup will still climb exponentially to 54.5 times, thereby triggering the contraction of the zero trust control threshold and physical isolation, cutting off the path of "low-frequency, slow but long-term lurking" advanced persistent threats (APTs) to circumvent the gateway.

[0093] During the system pre-configuration and offline calibration phases, historical compliant communication logs and intercepted covert forwarding tunnel communication logs were extracted from the network environment benchmark test library. The two-dimensional distribution patterns of these logs in terms of single-event degradation magnitude and dwell time were compared. Based on the convergence characteristics of high-frequency anomaly data, a series of offline parameters were defined. The evaluation grid matrix composed of coordinate points. Embedded exponential expansion mapping logic: ;in To characterize the continuous numerical pure parameters of the target with a fixed penalty multiplier in grid coordinates, they are directly written as output results to the cache address corresponding to the matrix; and These are the input parameters characterizing the cumulative duration of latency exceeding the limit and the severity of a single latency degradation, respectively. The base scaling factor (preferably 1 in this embodiment); The depth linear penalty coefficient is preferably 0.5; while This refers to the time-decrease inflation factor. (In this embodiment, the preferred calibration value is 0.2)

[0094] To prevent cache out-of-bounds crashes caused by unforeseen attacks leading to infinite index growth, this embodiment constructs a structured matrix retrieval and boundary-control execution chain:

[0095]

[0096]

[0097]

[0098] in and This is used to characterize the maximum physical addressing boundaries of the horizontal and vertical coordinates in the pre-calibrated two-dimensional penalty weight mapping table. By calling the extremum operator to truncate the top of the real-time extracted features, the single-time latency degradation severity parameter calculated in real-time is clamped and output as... And it is clamped to the output amount of the accumulated delay exceeding the limit. As the horizontal and vertical index components of the joint feature vector, they are imported into the mapping table preloaded into the cache space to perform a cache address offset lookup operation, matching and extracting the corresponding multiplier constant as the risk penalty weight. Even if the current single severity is low (malicious proxy nodes control the transmission distortion within the compliance judgment tolerance for each transmission), as long as the abnormal accumulation time exceeds the long tail warning line, the system will still map out a very high multiple of punishment, thereby identifying and blocking long-term slow and covert penetration attacks.

[0099] Before executing the dynamic penalty superposition closed loop, the system performs state machine initialization verification for the session lifecycle. In response to the system determining that the current communication channel belongs to the first newly established monitoring cycle (no historical judgment cache identifier exists in the state register), the system triggers the basic trust initialization logic, assigning a preset baseline state scalar as the initialization basic trust value for the current session. In this embodiment, this initialization basic trust value is configured as a full-score constant of 100, representing the default fully compliant logical state assigned to the terminal device before it successfully passes the handshake protocol and exposes any communication impedance anomalies. After completing the above state machine cold start or confirming the existence of historical records, the system extracts the basic trust value retained from the current or previous judgment cycle, and performs a penalty multiplication amplification calculation on this basic trust value based on the retrieved risk penalty weight (directly multiplying the original trust score by this high-multiplier risk penalty weight) to complete the exponential penalty weight increment operation on the dynamic trust deviation index. Further, a state iteration closed loop based on time-series decay is constructed: after outputting the dynamic trust deviation index, it checks whether the risk penalty weight retrieved within this judgment cycle has fallen back to the abnormal baseline multiplier of 1. If the system determines that the value has not fallen back, it writes the dynamic trust deviation index amplified by the current degradation into the status register and uses it as the base trust value for the next determination cycle to maintain the penalty state. If the system determines that the value has fallen back, it activates the linear self-healing logic and controls the base trust value to fall back step by step with a preset fixed compensation step size until it is restored to the initial base trust value.

[0100] Table 3: Time-based mapping table of impedance degradation of covert tunnel agents and convergence of zero-trust control defense.

[0101]

[0102] To address the communication impedance creep caused by covert proxy tunnels at the physical layer, the actual deployment mapping in this dimension directly relies on the access layer core switch with gigabit backplane bandwidth at the enterprise private network boundary. The core security verification server established earlier is configured in series on the mirror port of this switch, and a slow man-in-the-middle proxy hijacking traffic with valid password credentials is forcibly injected into the target HTTP test link through an external hardware-level weak network entry device, thereby directly reading the hard-action reversal of the system's state machine. The cumulative latency exceeding the limit in the table above... The parameters, represented by the ordinate of the matrix, reveal the system's perception mechanism regarding the time dimension: when facing advanced persistent threats (APTs), attackers often deliberately suppress the perceived lag of a single request to circumvent static firewalls. However, as this abnormally slight lag persists in the network (evolving from T2 to T4), the risk penalty weight derived from addressing changes. Non-linear expansion occurs. This allows for occasional network lag of a few seconds when ordinary employees download large files (no severe penalty in T1 phase), while simultaneously causing hacker programs that secretly occupy a few milliseconds of latency in the background to transfer confidential data to external systems to face increasingly larger trust deductions over time. When this deviation score is eventually amplified to the point that the system defense line drops directly to the red line of 10 points, a level control command to block the port is directly issued to the switch hardware. At the same time, the 10-point baseline ensures that other normal office devices sharing IPs on the same network segment will not suffer a network-wide outage due to the defense line value becoming negative.

[0103] Further, this trust cascade evolution logic is specifically defined as follows: The baseline trust value of the corresponding communication channel, stored in the previous analysis time segment, is read by calling the status register. This is then compared with the risk penalty weight extracted in this addressing process. Perform multiplicative amplification. This calculation directly rewrites the trust score of the current state cache node, outputting a dynamic trust deviation index that includes real-time risk degradation. As continuous anomaly detections lead to increased risk penalty weights... As the dynamic trust deviation index rises exponentially, it will be rapidly amplified and transmitted to the downstream comparison module, constituting the decisive data input for triggering the deep defense interception mechanism.

[0104] This embodiment retrieves core gateway security baseline logs from the deployment architecture over a period of at least 30 days, extracting historical sample features that have been manually audited and confirmed to be compliant and free of anomalies. A one-dimensional statistical distribution aggregation operation is then performed on the trust deviation status of these samples. Specifically, the trust deviation of all retrieved compliant samples is summed and its arithmetic mean is calculated to obtain the compliant sample mean. And calculate the sum of squared discrete differences between each sample and the mean to generate the standard deviation. Based on the statistical distribution patterns of the above operating conditions, the upper limit extreme value of the distribution is calculated using the following linear weighted logic:

[0105]

[0106] The mean of the compliant samples The mean and standard deviation of the base bias concentration are used to characterize the historical compliant network environment. Used to characterize the physical volatility dispersion of compliant sample data. Historical trust deviation distribution benchmark. The upper limit of the statistical distribution is defined and fixed offline. As the dynamic trust deviation index rises above the preset safety baseline, the preset historical trust deviation distribution benchmark is obtained. Based on the distribution difference between the dynamic trust deviation index and the historical trust deviation distribution benchmark, the zero-trust control threshold used to judge the system's perception status is prepared for adaptive tightening.

[0107] A structured dynamic boundary adjustment logic is constructed for this defensive line contraction action, specifically defined as follows: It retrieves the historical trust deviation distribution benchmark from the storage nodes. (The maximum trust deviation score constant allowed by the system under normal compliant conditions). The system calls the arithmetic operation component to generate a dynamic trust deviation index in real time. With preset adaptive convergence coefficients Perform a multiplication operation to calculate the dynamic deduction compensation amount and subtract it from the distribution baseline. Invoke the boundary truncation operator. Subtract the result from the preset global system circuit breaker protection threshold. Perform a limit value comparison. The system only outputs the larger of the two values ​​as the zero-trust control threshold that tightens proportionally with risk. .

[0108] Where the adaptive convergence coefficient The control parameter characterizing the system's defense line contraction sensitivity is preferably standardized to a range of [0.5, 1.5] in this embodiment. Global system circuit breaker protection baseline. The characterization system defines the absolute physical red line value to prevent the defense algorithm from getting stuck in a deadlock and thus incorrectly isolating all normal communication flows. In this embodiment, this parameter is configured as a fixed system constant, and its value is set according to the lower limit of the security classification range set at the system's factory (e.g., the minimum trust score threshold is 10 points). Only when the adjusted lower limit setting is monitored to be no lower than the preset global system circuit breaker protection bottom line will the lower limit setting of the zero trust control threshold be adaptively tightened to trigger the deep defense interception mechanism, thereby providing a solid and legitimate security authorization base for the next step of end-point physical isolation.

[0109] Define a dynamic boundary execution module: configured to generate network isolation scheduling instructions for network boundary forwarding nodes based on an adjusted zero-trust control threshold. In specific enterprise network engineering deployments, to balance system security and high availability of communication links, the system executes a collaborative dual-track closed loop according to different operating conditions.

[0110] First Track: Targeted Physical Blocking Closed Loop of the Interception and Strike Side. When facing a real hijacking threat, the dynamic boundary execution module, when generating network isolation scheduling instructions for network boundary forwarding nodes, responds to the adjusted zero-trust control threshold reaching the alert level for triggering blocking (the system comprehensively determines that the risk penalty has reached its limit, satisfying the triggering conditions for physical isolation and communication cutoff). It traces upstream in the session state and extracts the source inbound interconnection protocol address of the terminal node that caused the abnormal dynamic trust deviation index. The source inbound interconnection protocol address is denoted as... This represents the physical identifier (mapped IPv4 / IPv6 address) of the Layer 3 protocol location assigned to the terminal currently initiating malicious covert tunnel communication at the network layer. The extracted source inbound network interconnection protocol address is encapsulated into a network layer link isolation policy, and a network isolation scheduling instruction is generated based on this. This instruction is directly sent to the underlying hardware via the control plane bus. Regarding the encapsulation and flow details of this isolation policy, the extracted source inbound network interconnection protocol address is obtained, and the system's built-in network layer protocol configuration component is invoked. Based on the standard Access Control List (ACL) protocol format or static route update format supported by the lower-level network boundary forwarding node, a structured control protocol data unit is constructed. During data assembly, the source inbound network interconnection protocol address is injected into the source matching network segment field of the protocol data unit, and the corresponding routing control flag is statically assigned to an enumerated interception parameter (e.g., set to "DROP" for discarding actions, or a forwarding pointer pointing to the "NULL0" blackhole route outgoing interface). After field alignment and assembly, the entire system is packaged into a standard format network layer link isolation policy, and a network isolation scheduling instruction with executable attributes is generated based on this.

[0111] The network isolation scheduling command is configured to trigger network boundary forwarding nodes (core aggregation switches or hardware firewalls on the network perimeter) to perform forced blocking actions: for abnormal network segments, targeted physical link layer connection blocking (e.g., directly sending commands to close the physical port of the switch where the corresponding MAC address is located) and network layer route dropping operations (e.g., directly overwriting the black hole routing rule pointing to Null0 in the core routing table) are implemented on data flows originating from the source inbound Internet Protocol address, thereby completely cutting off the path for abnormal data flows to move laterally in the enterprise intranet from the physical port.

[0112] The second track: Gain-based open-loop under normal high-concurrency conditions. In a network environment, due to centralized periodic concurrent requests or large-capacity data synchronization, the network may experience compliant congestion without any malicious intent. To prevent excessive internal consumption of security devices, this embodiment also includes an application-layer security gateway component (e.g., a full-traffic decryption gateway physically connected behind the border router). For this scenario, the dynamic boundary execution module is also configured to execute a parallel auxiliary technology closed loop based on gain effects. Specifically, the distribution difference calculated in the preceding steps indicates that the current network is in a normal office high-traffic concurrent state (manifested as: the larger the measured "port throughput load percentage," but after queuing time compensation, the closer the "net transmission delay deviation parameter" is to zero, so that the system trust score is not severely penalized, ultimately showing a small distribution difference. This proves that although the physical channel is congested, it has not been subjected to traffic diversion or traffic hijacking distortion by illegal proxy nodes). To transform this physical phenomenon into specific control logic, the system embeds multi-dimensional feature space state mapping rules. By extracting the real-time generated dynamic trust deviation index and the historical trust deviation distribution benchmark, a difference operation is performed to generate a distribution difference parameter characterizing the current degree of deviation, denoted as . Then, perform normalized numerical extraction using the following difference formula:

[0113]

[0114] Among them, the distribution difference parameter This is used to characterize the pure numerical distance between the current real-time deviation index and the compliance benchmark. The specific judgment logic is defined as follows: ;

[0115] Extract the port throughput load percentage that is continuously updated in the preceding process. The newly calculated distribution difference parameter The logic comparison unit is invoked to determine the port throughput load percentage. Is it greater than the preset physical full load warning threshold? (In this embodiment, the preferred standardization value is 85%), and the determination is made simultaneously. Is it less than or equal to the preset compliance fluctuation extreme value? Among them, the extreme values ​​of compliance fluctuations Used to characterize the logical tolerance boundary of a physical channel when it faces congestion but is not hijacked; in this embodiment The preferred setting is 5, but in practical applications, it can be configured within the range of [2, 10] to adapt to different bandwidth infrastructure environments. To achieve fault tolerance for high concurrency peaks, the current channel is determined to exhibit 'high underlying physical throughput and stable logical trust state' if and only if the above two parameters simultaneously satisfy this dual boundary constraint within the same sampling period, thereby identifying the system's global state machine. The transition to the active state (True) confirms that the distribution difference accurately maps to a normal office high-traffic concurrent state. This is based on the physical full-load warning threshold. The setting is as follows: If this value is not set to the preset lower limit (e.g., an abnormal drop to a low load of 20%), the system will face core state machine mapping errors and macro-level decision-making biases. It will incorrectly map and judge the low-frequency routine background data synchronization actions of the enterprise network at night as a high-traffic concurrent state, thereby continuously triggering the exemption direct communication command of the application layer security gateway, causing the defense system to expose physical vulnerabilities in security during non-congested periods, allowing real threats to penetrate the gateway unimpeded. Furthermore, the adjusted zero-trust control threshold did not trigger a downward convergence action and remained at the baseline tolerance state (because the deduction compensation amount obtained from the previous subtraction is close to zero, the calculated output threshold remains at the port throughput load percentage). (Given the undamaged high-level data flow, the system confirms that there is no need to tighten defenses to ensure high-volume traffic efficiency), and determines that the current data flow is whitelisted traffic for security. The dynamic boundary execution module generates compliant communication flow allowance signaling for the application-layer security gateway component in parallel, denoted as... It represents the electronic identification credential issued by the system to the internal gateway hardware, granting "inspection-free" permissions to active sessions.

[0116] In this embodiment, compliant communication flow release signaling Configured as a binary enumeration control parameter driven by a system global state machine, its hardware register states only include active pass-through and silent block-through states. In response to a high-volume concurrent compliance flag issued by the core security verification server, the dynamic boundary execution module allows compliant communication flows of the current session to pass through. The status bit flips from the default silent blocking state to the active pass-through state and is pushed downstream via the bus.

[0117] In this embodiment, the compliant communication flow allowance signaling is configured to directly drive the application-layer security gateway component: during the current active network session connection, it skips the deep encryption / decryption and secondary identity verification steps for subsequent high-concurrency communication data streams. Through this hardware-level exemption intervention, the system directly establishes a pass-through data forwarding mechanism based on the security of the underlying network card driver (constructing a Fast-Path forwarding plane), ensuring the ultra-fast response of the core backbone communication link (efficiency first) while firmly safeguarding the bottom line of defense, achieving a dynamic balance between system performance and security.

[0118] Table 4: Compliant Service Concurrency Dimensionality Reduction Identification and Fast-Path Hardware Passthrough Mapping Table under Full Load Environment of Gigabit Physical Interfaces

[0119]

[0120] When faced with peak traffic loads, the core aggregation switch relies on a dimensionality reduction mechanism to determine the nature of the congestion. To obtain reliable physical interaction data, this verification process directly connects the application-layer security gateway component, equipped with a full-traffic decryption network card, to a hardware channel load tester. The tester's line-speed streaming function injects a high-density mixture of legitimate TCP packets and malicious slow proxy requests into the network card's physical interface. The recorded load test conditions and their corresponding port throughput load percentages directly reflect the data pressure the network card chip is under. During monthly financial closing or major version updates, the network card is pushed to its 95% bottleneck. Packets have to queue in the hardware queue, resulting in a generally longer transient round-trip time difference. Traditional firewalls would perceive this as an attack, leading to incorrect blocking of normal business systems. However, the current mechanism converts the 95% load into a reasonable queuing time of 14.2 milliseconds and subtracts it, revealing a healthy net transmission delay deviation of less than 2 milliseconds. The calculated distance distribution value at this point... Minimal impact; the system is logically certain that although the network cable is extremely congested, it carries only clean and secure data. The system uses the bus to raise the signaling level for compliant communication flows. The hardware register's level signal decisively instructs the downstream decryption gateway to directly exempt these reliable data from deep cryptographic decryption and verification that consumes CPU computing power; however, when faced with the last severe situation of "hackers attempting to secretly transmit data under the cover of high traffic", the system finds that its actual latency of 52 milliseconds far exceeds the limit that the hardware should have under full load, and the exemption signal is immediately blocked by the system hardware level in a blocking state, ensuring the physical isolation between security and performance.

[0121] Figure 1The WAN virtual bus and dual-layer virtual scanning matrix on the left visually demonstrate the feature extraction actions of the "multi-source traffic control module." This module extracts the contextual identity baseline features of terminal access requests by parsing rays at the network protocol layer, and simultaneously captures the timing waveforms of the underlying physical channels to obtain the network latency fluctuation sequence. The multi-layer distributed dynamic algorithm filtering grid in the center of the screen corresponds to the physical queuing time-consuming noise filtering operation performed by the "core security verification server." The digital compensation filter inside the grid successfully removes the normal congestion delay caused by compliance-driven high concurrency, and calculates the net transmission delay deviation parameter. The high-density digital defense boundary that sharply presses down above the grid reflects the system's adaptive tightening of the zero-trust control threshold lower limit after recognizing the exponential amplification of trust deviation. The split dual-track routing channel on the right side of the screen precisely corresponds to the multi-effect action executed by the "dynamic boundary execution module": the unobstructed Fast-Path digital link at the top represents the compliant communication flow release signaling generated by the system under secure concurrent conditions, which establishes a direct forwarding mechanism to release computing power by bypassing deep cryptographic decryption nodes; the routing link at the bottom, which is physically disconnected and connected to the electronic isolation wall, represents the network isolation scheduling command generated by the system under the blocking alert level, which performs connection cut-off and route discard operations on data flows originating from abnormal network segments. Figure 1 The technology roadmap on the right lists the four core operational steps mentioned above, from multi-source feature extraction, time-consuming noise filtering calculation, threshold convergence comparison to final dual-track boundary isolation.

[0122] It should be noted that all calculation formulas in this application employ regression analysis, including but not limited to machine learning algorithms, to deeply analyze the collected parameters and identify their natural trends and interrelationships. Specialized software, such as Python's Scikit-learn library or the R language, is used to automatically generate mathematical models that match the data. Then, cross-validation and other methods are used to objectively evaluate the model performance, and continuous feedback and optimization are combined to ensure that the created formulas truly reflect the inherent laws of the data, thereby guaranteeing their effectiveness and accuracy. In all calculation formulas in this application, the parameters in each formula undergo dimensionless processing within a consistent range to ensure that different physical quantities are compared on the same scale; dimensionless processing techniques include, but are not limited to, min-max-normalization and Z-score standardization.

[0123] The technical solution of this invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random-access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments of this invention.

[0124] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0125] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A real-time network security threat detection and defense system, characterized in that, Specifically, it includes: The multi-source traffic control module is configured to respond to external interaction commands triggered by terminal nodes. Under the premise of meeting the preset security audit authorization policy, it extracts terminal access request data of the corresponding session link at the network protocol layer to map the context identity baseline features. The multi-source traffic control module is also configured to extract the current periodic packet transmission and reception rate of the network interface corresponding to the server basic network access device from the server basic network access device to generate a network throughput concurrency baseline, and call the standard network diagnostic component to send network connectivity test data packets to the terminal node to collect network latency fluctuation sequences. The core security verification server is configured to use the network throughput concurrency baseline as the queuing delay compensation benchmark, perform timing alignment and differential noise filtering operations on the network delay fluctuation sequence, and calculate the net transmission delay deviation parameter used to characterize the actual forwarding hysteresis state of the communication link. The net transmission delay deviation parameter and the context identity benchmark feature are jointly imported into the comprehensive trust assessment module for logical comparison, the dynamic trust deviation index is calculated, the preset historical trust deviation distribution benchmark is obtained, and the zero trust control threshold used to judge the system perception status is adaptively adjusted according to the distribution difference between the dynamic trust deviation index and the historical trust deviation distribution benchmark. The dynamic boundary execution module is configured to generate network isolation scheduling instructions for network boundary forwarding nodes based on the adjusted zero-trust control threshold. The network isolation scheduling instructions are configured to trigger the network boundary forwarding nodes to perform communication connection cut-off or data packet drop operations for abnormal network segments in the logical control plane.

2. The real-time network security threat detection and defense system according to claim 1, characterized in that: The multi-source traffic control module extracts the current periodic packet transmission and reception rate of the corresponding network interface from the server's basic network access device to generate a network throughput concurrency baseline, and is configured as follows: The operating system's network interface configuration tool is invoked to periodically read the network interface traffic counting module of the server's basic network access device and extract the original total number of packets sent and received on the network port. Obtain the number of bytes consumed by the active probe traffic generated by sending the network connectivity test data packet by invoking the standard network diagnostic component; The number of bytes consumed by the active detection traffic is used to perform an algebraic subtraction operation on the original total number of packets sent and received at the network port to filter out redundant traffic components generated by the system's own detection, thereby generating the network throughput concurrency baseline that filters out physical traffic interference.

3. The real-time network security threat detection and defense system according to claim 2, characterized in that: The multi-source traffic control module, when calling the standard network diagnostic component to send network connectivity test data packets to the terminal node to collect network latency fluctuation sequences, is configured as follows: Based on a preset time step, the standard network diagnostic component is triggered to inject a standard network speed test data packet sequence into the terminal node; The set of node response status data returned in the transmission channel by the intercepted standard network speed test data packet sequence; Extract the round-trip time difference and packet loss ratio features from the node response status data set, calculate the fluctuation deviation parameter of the round-trip time difference in a continuous time period, and extract the network delay fluctuation sequence that characterizes non-natural network transmission distortion.

4. The real-time network security threat detection and defense system according to claim 3, characterized in that: When the core security verification server performs timing alignment and differential noise filtering operations on the network latency fluctuation sequence to calculate the net transmission delay deviation parameter, it is configured as follows: Using the feedback time point of any single discrete communication delay record in the network delay fluctuation sequence as the alignment benchmark, historical data within a preset time period before the feedback time point are retrieved to construct a comparison time interval; The arithmetic mean of the network throughput and concurrency baseline within the comparison time interval is calculated to extract a reference value for normal traffic congestion queuing time that characterizes the current natural queuing state of the network. The single discrete communication delay record is subjected to algebraic noise filtering and deduction operation with the normal traffic congestion queuing time reference value to remove the network congestion time caused by high concurrency of compliant network requests, and the net transmission delay deviation parameter used to quantify the degree of network line hijacking by illegal proxies is calculated.

5. The real-time network security threat detection and defense system according to claim 4, characterized in that: The core security verification server, after calculating the dynamic trust deviation index and adaptively adjusting the zero-trust control threshold, is configured as follows: In the comprehensive trust assessment module, the application layer identity legitimacy status contained in the context identity benchmark features is parsed. In response to the application layer identity legitimacy status meeting the preset compliance release conditions, and the net transmission delay deviation parameter exceeding the preset network delay abnormal fluctuation tolerance limit, it is determined that the current communication channel has a hidden impedance distortion behavior disguised under a legitimate protocol payload, and a risk penalty weight is injected into the comprehensive trust assessment module, and the dynamic trust deviation index is increased by numerically using the risk penalty weight. In response to the dynamic trust deviation index exceeding the preset security baseline after being pushed up, the lower limit setting of the zero trust control threshold is adaptively tightened to trigger the deep defense interception mechanism.

6. The real-time network security threat detection and defense system according to claim 5, characterized in that: When generating network isolation scheduling instructions for the network boundary forwarding node, the dynamic boundary execution module is configured as follows: In response to the adjusted zero trust control threshold reaching the alert level that triggers blocking, the source Internet Protocol address of the terminal node that caused the abnormal dynamic trust deviation index is extracted; The source inbound interconnection protocol address is encapsulated into a network layer link isolation policy to generate the network isolation scheduling instruction; The network isolation scheduling command is configured to trigger the network boundary forwarding node to perform targeted physical link layer connection blocking and network layer route dropping operations on the data stream originating from the source Internet Protocol address.

7. A real-time network security threat detection and defense system according to claim 6, characterized in that: The system also includes an application-layer security gateway component, and the dynamic boundary execution module is further configured to execute a closed loop of parallel auxiliary technology, specifically: In response to the distribution difference indicating that the system is in a normal office high-volume concurrent state, and the adjusted zero-trust control threshold does not trigger a downward convergence action and remains in the baseline tolerance state, a compliant communication flow release signaling is generated for the application layer security gateway component. The compliance communication flow release signaling is configured to drive the application layer security gateway component to skip the deep encryption and decryption and secondary identity verification steps of subsequent compliance communication data flows during the current active network session connection, and establish a pass-through data forwarding mechanism based on the security of the underlying network link.

8. The real-time network security threat detection and defense system according to claim 7, characterized in that: When the core security verification server performs an arithmetic mean calculation on the network throughput and concurrency baseline within the comparison time interval to extract a reference value for normal traffic congestion queuing time that characterizes the current natural queuing state of the network, it is specifically configured as follows: Extract the nominal theoretical transmission rate of the port pre-calibrated in the network card driver configuration parameters of the server's basic network access device; The network throughput concurrency baseline obtained after performing arithmetic mean calculation is used as the dividend, and the nominal theoretical transmission rate of the port is used as the divisor to perform division ratio calculation, thereby calculating the port throughput load percentage that represents the actual congestion ratio of the current physical link. Retrieve the theoretical baseline latency of the network card queue preset by the device at the factory; perform a multiplication proportional conversion process on the theoretical baseline latency of the network card queue and the port throughput load percentage to proportionally map the congestion level of the traffic dimension to the specific queuing time, and calculate the reference value of the normal traffic congestion queuing time with time unit attribute.

9. A real-time network security threat detection and defense system according to claim 8, characterized in that: When the core security verification server injects risk penalty weights into the comprehensive trust assessment module and uses these risk penalty weights to numerically increase the dynamic trust deviation index, it is specifically configured as follows: By comparing the net transmission delay deviation parameter with the network delay abnormal fluctuation tolerance limit, the delay exceedance difference between the two is calculated to extract the single delay degradation severity parameter that characterizes the single abnormal depth of the current communication impedance. Track the communication session timing monitoring log of the communication channel, count the duration for which the net transmission delay deviation parameter is continuously maintained outside the upper limit of the network delay abnormal fluctuation tolerance, and extract the cumulative duration of delay exceeding the limit that characterizes the continuous period of network impedance abnormality. The single latency degradation severity parameter and the cumulative latency exceedance duration are used as joint retrieval key values ​​and input into a preset two-dimensional penalty weight mapping table. Two-dimensional retrieval and matching extraction processing is performed to dynamically retrieve the risk penalty weight that matches the current network distortion depth and dwell time. Extract the basic trust value retained from the previous judgment period, and perform a punitive multiplication amplification calculation on the basic trust value based on the retrieved risk penalty weight, so as to complete the exponential penalty weight increment operation on the dynamic trust deviation index.

Images