A network information security intelligent monitoring management method and system

Abstract

The application discloses a kind of network information security intelligent monitoring management method and system, it is related to network information security management technical field.The network information security intelligent monitoring management method, by continuously collecting the plaintext record length and ciphertext record length of each outbound TLS connection of source service in network, corresponding length sequence is adaptively divided, is constructed joint fractal feature vector by multiple fractal spectrum estimation, generates direction anchor point and normal deviation upper limit relying on historical joint fractal feature vector set clustering, calculates direction deviation evaluation value, and obtains trend mutation evaluation value by trajectory mutation analysis, obtains anchor internal structure deviation degree by internal structure self-consistent analysis, and is comprehensively handled, obtains comprehensive threat score, and the application is threatened by comprehensive threat score, and the security management of source service is carried out, to meet the threat determination demand of actual business scene in turn, then improve network anomaly threat identification accuracy, guarantee source service operation safety.

Description

Technical Field

[0001] This invention relates to the field of network information security management technology, specifically to an intelligent monitoring and management method and system for network information security. Background Technology

[0002] As enterprises deepen their digital transformation, the external threats to network information security continue to evolve. While encrypted communication ensures data confidentiality, it also provides attackers with covert channels, posing new technical challenges to security detection and access control.

[0003] In cloud-native microservice architecture, service mesh technology achieves end-to-end encryption and identity verification for inter-service communication through a two-way transport layer security protocol. Specifically, mTLS requires both parties to present identity certificates issued by a unified certificate authority and complete two-way verification during the handshake phase. Each workload is given a unique identity identifier that follows standardized naming conventions. This identifier clearly reflects the trust domain, namespace, and service name to which the workload belongs.

[0004] This fine-grained security framework effectively defends against traditional man-in-the-middle attacks and unauthorized access, but it also renders classic security measures such as deep packet inspection and payload signature matching ineffective due to encryption. Once an attacker obtains a legitimate identity certificate through credential theft or software supply chain attacks, their malicious behavior can remain hidden within the encrypted channel, making it difficult for traditional perimeter defenses to detect.

[0005] The limitations of existing technologies include at least the following issues: Existing network security monitoring technologies for TLS encrypted traffic ignore the multifractal fine features of the length sequences of TLS plaintext and ciphertext traffic. Existing technologies typically capture overt attacks with drastic traffic jumps, but struggle to identify subtle fractal spectrum shifts, feature space direction deviations, temporal trajectory abrupt changes, and anchor structure distortions in traffic. This makes it easy to mistake malicious structural traffic disturbances for normal business fluctuations, ultimately leading to the failure to detect a large number of low-intensity, highly covert network attacks. This results in insufficient accuracy in detecting overall encrypted traffic anomalies, leading to management deviations. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides an intelligent monitoring and management method and system for network information security, which solves the problems of existing technologies lacking fine-grained identification of TLS traffic multifractal features, making it easy to miss covert and progressive attacks, and resulting in large monitoring and management deviations.

[0007] To achieve the above objectives, the present invention provides the following technical solution: an intelligent monitoring and management method for network information security, comprising the following steps: continuously collecting the plaintext record length and ciphertext record length of each outbound TLS connection of a source service in the network, and adaptively dividing them into a plaintext length sequence and a ciphertext length sequence; performing multifractal spectrum estimation on the plaintext length sequence and the ciphertext length sequence respectively to form a joint fractal feature vector; collecting the historical joint fractal feature vector set of the source service, performing directional aggregation analysis to generate several directional anchor points and the normal deviation upper limit of each directional anchor point, and performing directional matching and deviation fusion with the joint fractal feature vector to analyze the directional deviation evaluation value; performing evolution trajectory mutation processing on the historical joint fractal feature vector set and the joint fractal feature vector to analyze the trend mutation evaluation value; performing internal structure self-consistency analysis on the joint fractal feature vector to generate the anchor internal structure offset, and performing comprehensive processing with the directional deviation evaluation value and the trend mutation evaluation value to obtain a comprehensive threat score; and performing security management on the source service based on the comprehensive threat score.

[0008] Furthermore, the specific steps for adaptively dividing the plaintext length sequence are as follows: the plaintext record lengths of all outbound TLS connections are accumulated sequentially according to their timestamps; during the accumulation process, the fluctuation range and number of records of the currently accumulated plaintext record lengths are statistically analyzed; and when the number of records reaches a preset minimum record number threshold, the rate of change of the fluctuation range is detected. If the rate of change exceeds the preset change threshold, the lengths of all currently accumulated plaintext records are output in sequence as a plaintext length sequence.

[0009] Further, the specific steps for forming the joint fractal feature vector are as follows: For the plaintext length sequence, based on the preset scale parameters, calculate the plaintext fluctuation function at each scale, and obtain the plaintext multifractal spectrum by analyzing the plaintext scaling features between the plaintext fluctuation function and the scale parameters; for the ciphertext length sequence, obtain the ciphertext multifractal spectrum through fractal analysis constrained by the plaintext scaling features; based on the plaintext multifractal spectrum and the ciphertext multifractal spectrum, extract the plaintext spectrum morphological features and the ciphertext spectrum morphological features respectively; and perform cross-spectral feature fusion on the plaintext spectrum morphological features and the ciphertext spectrum morphological features to construct the joint fractal feature vector.

[0010] Furthermore, the specific steps to obtain the ciphertext multifractal spectrum are as follows: Based on the ciphertext length sequence, analyze the ciphertext fluctuation function at each scale; when establishing the ciphertext scaling relationship between the ciphertext fluctuation function and the scale parameter, use the plaintext scaling feature as a constraint to regularize the ciphertext scaling relationship to obtain the corrected ciphertext scaling relationship; based on the corrected ciphertext scaling relationship, generate the ciphertext multifractal spectrum.

[0011] Furthermore, the specific steps for generating several directional anchor points and the normal deviation upper limit of each directional anchor point, based on the historical joint fractal feature vector set being multiple historical joint fractal feature vectors, are as follows: Calculate the directional similarity between each historical joint fractal feature vector, group historical joint fractal feature vectors with a value higher than a preset aggregation threshold into the same directional group, and determine the directional anchor points; calculate the deviation distance set of each directional anchor point and perform sparse removal processing; analyze the similarity between any two directional anchor points, and when it exceeds a preset overlap threshold, reduce the sparse removal set of the deviation distances corresponding to the two directional anchor points to determine the normal deviation upper limit of each directional anchor point.

[0012] Further, the specific steps for analyzing the directional deviation evaluation value are as follows: calculate the matching degree between the joint fractal feature vector and each directional anchor point, and take the directional anchor point with the largest matching degree as the best matching anchor point; analyze the deviation distance of the joint fractal feature vector from the best matching anchor point, and perform ratio processing with the normal deviation upper limit of the best matching anchor point to obtain the relative deviation ratio; input the deviation distance and the relative deviation ratio into the preset deviation coordination function to generate the directional deviation evaluation value.

[0013] Further, the specific steps for analyzing the trend mutation evaluation value are as follows: Arrange the historical joint fractal feature vector set in sequence to form a historical feature vector sequence, calculate the historical change step size in the sequence, and construct a historical change step size sequence; perform distribution modeling on the historical change step size sequence to determine the step size mutation threshold; read the joint fractal feature vector and obtain the neighboring historical joint fractal feature vectors to calculate the current change step size; based on the current change step size and the step size mutation threshold, calculate the trend mutation evaluation value.

[0014] Further, the specific steps for generating the anchorage structural offset are as follows: read the best matching anchor point matched by the joint fractal feature vector, and obtain the historical distribution set belonging to the best matching anchor point; add the joint fractal feature vector to the historical distribution set to form an extended distribution set; perform distribution structure analysis on the historical distribution set and the extended distribution set respectively to obtain the historical distribution structure features and the extended distribution structure features; perform structural perturbation processing on the historical distribution structure features and the extended distribution structure features to obtain the anchorage structural offset.

[0015] Furthermore, the specific steps for obtaining the comprehensive threat score are as follows: The anchorage structural offset, directional deviation assessment value, and trend change assessment value are normalized; and the normalized anchorage structural offset, directional deviation assessment value, and trend change assessment value are input into a preset comprehensive assessment model to analyze the comprehensive threat score; wherein, the comprehensive assessment model is expressed in the following form: ;in, For comprehensive threat scoring, The following are, in order: normalized directional deviation assessment value, trend change assessment value, and anchorage structural offset. These are the preset fusion weights, This is the preset synergistic amplification index.

[0016] A network information security intelligent monitoring and management system includes: a data acquisition unit for continuously acquiring the plaintext record length and ciphertext record length of each outbound TLS connection of a source service in the network, and adaptively dividing them into plaintext length sequences and ciphertext length sequences; a fractal feature extraction unit for performing multifractal spectrum estimation on the plaintext length sequences and ciphertext length sequences respectively to form a joint fractal feature vector; a direction deviation analysis unit for collecting the historical joint fractal feature vector set of the source service, performing direction aggregation analysis to generate several direction anchor points and the normal deviation upper limit of each direction anchor point, and performing direction matching and deviation fusion with the joint fractal feature vector to analyze the direction deviation evaluation value; a trend mutation analysis unit for performing evolution trajectory mutation processing based on the historical joint fractal feature vector set and the joint fractal feature vector, and analyzing the trend mutation evaluation value; a comprehensive evaluation unit for performing internal structure self-consistency analysis on the joint fractal feature vector to generate the anchor internal structure offset, and performing comprehensive processing with the direction deviation evaluation value and the trend mutation evaluation value to obtain a comprehensive threat score; and a security management unit for performing security management of the source service based on the comprehensive threat score.

[0017] The present invention has the following beneficial effects:

[0018] (1) This intelligent monitoring and management method for network information security synchronously collects the plaintext and ciphertext record lengths of TLS outbound connections, adaptively constructs a time-series length sequence, and completes ciphertext fractal analysis based on plaintext scaling feature constraints. It achieves joint feature extraction of plaintext and ciphertext multifractal spectra, avoiding the method of judging anomalies based solely on surface traffic data. Based on multi-scale fluctuation function calculation, scaling relationship regularization correction, and cross-spectral feature fusion, it deeply mines the hidden time-series distribution patterns and feature correlations of TLS encrypted traffic. It can accurately capture the subtle spectral shifts caused by attackers simulating normal business fluctuations and gradually tampering with traffic distribution. It can accurately distinguish between normal business fluctuations and malicious traffic disturbances, reduce the probability of missed detection of covert attacks, and thus improve the accuracy of security management.

[0019] (2) This intelligent monitoring and management method for network information security completes directional aggregation analysis through historical joint fractal feature vectors, constructs stable business directional anchor points, and accurately delineates the normal deviation range corresponding to each directional anchor point through optimization processing methods such as sparse elimination and anchor point overlap reduction. It obtains the directional deviation evaluation value by combining anchor point matching and deviation ratio collaborative calculation, and aggregates and classifies to form directional anchor points that fit the normal business situation. At the same time, it eliminates the problem of feature boundary ambiguity through distance reduction processing of overlapping anchor points, accurately quantifies the degree of deviation between the current traffic characteristics and the normal business characteristics, so as to accurately identify small abnormal offsets in the traffic feature space, thereby avoiding the problems of blurred boundaries and insufficient recognition accuracy of traditional judgment methods, and making the judgment of traffic anomalies more in line with the actual business operation status.

[0020] (3) This intelligent monitoring and management method for network information security completes multi-indicator fusion evaluation by combining three dimensions: feature space direction deviation, temporal trend mutation, and anchor internal structure offset. It identifies trajectory mutation by modeling historical feature sequences, obtains structural offset by comparing the structural differences between historical distribution sets and extended distribution sets, and finally outputs a comprehensive threat score through a comprehensive evaluation model. This comprehensively depicts the abnormal state of traffic from the dimensions of static feature deviation, dynamic evolution trend, and internal structural disturbance, thereby meeting the threat judgment needs of actual business scenarios, accurately assessing the threat level of network traffic, improving the accuracy of network abnormal threat identification, and ensuring the safe operation of source services.

[0021] (4) The intelligent monitoring and management system for network information security continuously captures outbound TLS connection data through the data acquisition unit and adaptively generates corresponding length sequences to ensure that the original traffic data is regular and usable. The fractal feature extraction unit delves into the inherent laws of traffic and constructs a joint fractal feature vector. The direction deviation analysis unit and the trend mutation analysis unit complete the anomaly judgment from the perspectives of feature distribution and time series change, respectively. The comprehensive evaluation unit integrates multiple evaluation results to calculate a comprehensive threat score, thereby realizing the full-process automated processing of TLS network traffic from the acquisition of original data to threat judgment. It relies on the cooperation of each unit to complete the anomaly identification, thereby improving the credibility of network security management and making network security monitoring work more coherent and efficient.

[0022] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0023] Figure 1 This is a flowchart of an intelligent monitoring and management method for network information security according to the present invention.

[0024] Figure 2 This is a flowchart illustrating the specific steps involved in analyzing trend mutation evaluation values ​​in an intelligent monitoring and management method for network information security according to the present invention.

[0025] Figure 3 This is a block diagram of an intelligent monitoring and management system for network information security according to the present invention. Detailed Implementation

[0026] Please see Figure 1 This invention provides a technical solution: an intelligent monitoring and management method for network information security, comprising the following steps: continuously collecting the plaintext record length (before encryption at the application layer) and the ciphertext record length (after encryption) of each outbound TLS connection of a source service in the network, and adaptively dividing them into a plaintext length sequence and a ciphertext length sequence; performing multifractal spectrum estimation on the plaintext length sequence and the ciphertext length sequence respectively to form a joint fractal feature vector of the source service; collecting the historical joint fractal feature vector set of the source service, performing directional aggregation analysis to generate several directional anchor points (each anchor point represents a different normal behavior pattern) and the normal deviation upper limit of each directional anchor point, and performing directional matching and deviation fusion with the joint fractal feature vector to analyze the directional deviation evaluation value of the source service; performing evolution trajectory mutation processing on the historical joint fractal feature vector set and the joint fractal feature vector to analyze the trend mutation evaluation value of the source service; performing internal structure self-consistency analysis on the joint fractal feature vector to generate the anchor internal structure offset of the source service, and performing comprehensive processing with the directional deviation evaluation value and the trend mutation evaluation value to obtain a comprehensive threat score of the source service; and performing security management of the source service based on the comprehensive threat score, specifically:

[0027] When the overall threat score is lower than When the current behavior is determined to be within the normal fluctuation range, no security response is triggered. Only the current feature vector and score are recorded in the log for subsequent auditing. Three score ranges are preset, each corresponding to a different level of management action.

[0028] When the overall threat score falls within the first preset range [0.3, 0.6), a Level 1 response is triggered. The Level 1 response involves flexible containment and mirroring forensics: through the service mesh's traffic management interface, a maximum request rate limit is set for outbound connections from the source service to the suspicious target service, limited to a percentage of the historical average QPS. Simultaneously, set the upper limit for the number of concurrent connections; issue a traffic mirroring policy to send a complete copy of all matching traffic to the evidence analysis module for retention, without interrupting the original traffic; and generate intermediate alarms in the management plane.

[0029] When the comprehensive threat score When the value falls within the second preset range [0.6, 0.85), a secondary response is triggered. The secondary response is a transparent honeypot deception redirection: the security management module applies to the certificate authority of the service mesh to issue a temporary certificate with the same identity as the real target service and a short validity period for the pre-deployed honeypot service.

[0030] Modify the routing rules to include traffic matching the identity of this suspicious origin service. Redirect to the honeypot service; adjust the security policy so that the client verifies the dedicated certificate provided by the honeypot when communicating with the honeypot, ensuring a successful mTLS handshake without the attacker's knowledge;

[0031] Honeypot services automatically generate interactive interfaces based on the OpenAPI specifications of the real target service. They can return responses with correct formats but false data, and fully record the attacker's API call sequence, passed parameter values, and lateral movement attempts, forming a complete chain of evidence of attack intent.

[0032] When the overall threat score falls into the third preset range [0.85, 1.0], a Level 3 response is triggered. The Level 3 response is a forced block and identity revocation: immediately invoke the Certificate Authority interface to revoke the TLS certificate of the suspicious source service identity, preventing it from establishing any mTLS connections within the mesh;

[0033] Issue network policies to block all inbound and outbound traffic to the Pod corresponding to the source service; call the container orchestration system API to forcibly remove the Pod, making it completely offline from the cluster; if the identity has entered the secondary honeypot, dynamically update the attack indicators collected in the honeypot to the WAF rule base and RBAC blacklist to achieve real-time linkage updates of the defense system.

[0034] Generate the highest-level security incident notification and push it to the security operations team, along with all behavioral and environmental evidence collected during the Level 1 to Level 3 response period, forming a complete threat response loop.

[0035] The steps for collecting the plaintext record length (before encryption at the application layer) and the ciphertext record length (after encryption) of each outbound TLS connection from the source service in the network can be as follows:

[0036] A lightweight eBPF probe is deployed on each worker node where the source service resides. This probe is simultaneously mounted at the entry point of the cryptographic library function in the kernel space and at the sending path after the TLS record encapsulation is completed. For each outbound TLS connection of the source service, the length of the application layer plaintext record before encryption is captured at the entry point of the cryptographic library function, denoted as . At the same time, a unique identifier for the record is generated;

[0037] The plaintext record length corresponds to the length of the complete data generated by a single write operation at the application layer, which will be used as the payload of the TLS record. Even if the application layer data is segmented by TCP, the length of each segment before encryption is still observed at the entry point of the encryption library, maintaining a one-to-one correspondence.

[0038] Using eBPFmap, the identifier and plaintext length are temporarily stored with the connection identifier as the key. At the point just before the TLS record is pushed to the TCP send buffer after encapsulation, the identifier is matched based on the connection information, and the length of the complete encrypted TLS record ciphertext for the same connection is synchronously captured, denoted as . Thus, each TLS record generates a metadata record containing plaintext length, ciphertext length, and timestamp. All data is extracted without decrypting the payload, only the length metadata is extracted.

[0039] Specifically, the steps for adaptively dividing the data into plaintext length sequences are as follows:

[0040] The plaintext record lengths of all outbound TLS connections from the source service are accumulated sequentially according to their timestamps, specifically as follows:

[0041] The length of plaintext records generated by all outbound TLS connections, based on their timestamps. The data are fed into the accumulation buffer in the order they are received;

[0042] During the accumulation process, the fluctuation range of the length of the currently accumulated plaintext records and the number of records are statistically analyzed, specifically as follows:

[0043] During the accumulation process, the fluctuation range of the currently accumulated plaintext record length and the number of accumulated records are statistically analyzed in real time. Let the currently accumulated plaintext record length sequence be... Where k is the current cumulative record count, and the fixed end length is a preset value. Take the last part of the sequence The first record is considered the last segment, and all records preceding it are considered the first segment (when...). (If no calculation is performed at any time, continue accumulating), calculate the mean of the first segment and the mean of the second segment separately, and define the fluctuation range as the absolute value of the difference between the mean of the first and second segments. ;

[0044] This ensures that the fluctuation range always reflects the degree of deviation of recent behavior from historical cumulative behavior, avoiding statistical bias introduced by the inconsistency of time spans between periods due to the increase in the number of cumulative records;

[0045] And when the number of records reaches a preset minimum record count threshold, the rate of change of the fluctuation amplitude is detected. If the rate of change exceeds a preset threshold, the lengths of all currently accumulated plaintext records are output in sequence as a plaintext length sequence, specifically as follows:

[0046] The cumulative number of records is directly determined by the count variable. Give,

[0047] When the cumulative number of records The first time the preset minimum record number threshold is reached When the value range is [50, 200], with a preferred value of 100, the first rate of change detection is performed, and the current value is set to [value missing]. and Record the fluctuation amplitude at the previous detection time as the initial value. and the previous cumulative record number ;

[0048] After that, each time the cumulative number of records is increased by a fixed step size When a record is recorded, a new rate of change detection is triggered. Let the cumulative number of records corresponding to the previous detection time be . The fluctuation range is The current cumulative number of records is The fluctuation range is Then the rate of change for:

[0049] ;

[0050] when Exceeding the preset change threshold When the value ranges from [0.01, 0.10], with a preferred value of 0.03, it indicates that the statistical structure of the cumulative sequence has changed significantly and the behavior state has switched. At this time, the lengths of all currently accumulated plaintext records are output in sequence as a plaintext length sequence. ;

[0051] It should be noted that if, during the accumulation process, the accumulation time since the first record exceeds the preset maximum waiting time limit... (Its value range is [10s, 60s], with 30s being the preferred value), but the cumulative number of records The minimum number of records has not yet been reached. If the current accumulated plaintext record length is forced to be output as a plaintext length sequence, the accumulated ciphertext record length is output as a ciphertext length sequence, and the accumulation buffer is cleared to start the next round of accumulation, so as to ensure that window data available for analysis can be continuously produced even during low-frequency business periods.

[0052] The logic for partitioning the ciphertext length sequence is consistent with that for partitioning the plaintext length sequence. Both are accumulated and output synchronously to ensure that each plaintext length sequence... With the corresponding ciphertext length sequence They correspond one-to-one in the order of timestamps.

[0053] The specific steps for forming the joint fractal eigenvector of the source service are as follows:

[0054] For a plaintext length sequence, based on preset scale parameters, the plaintext fluctuation function at each scale is calculated. By analyzing the plaintext scaling characteristics between the plaintext fluctuation function and the scale parameters, the plaintext multifractal spectrum is obtained, specifically as follows:

[0055] We define multiple scale parameters for analyzing the fluctuation characteristics of sequences at different observation granularities, denoted as the set of scale parameters. Where M is the total number of scales. The scale parameter increases exponentially, covering multiple observation granularities from fine to coarse.

[0056] plaintext length sequence Perform mean removal and construct a cumulative deviation sequence: Let Calculate the cumulative deviation for the series mean. ;

[0057] Multifractal detrending fluctuation analysis is used to extract multifractal features. The order q of the statistical moments is assumed to take a series of discrete values. Step size is For each order q and each scale The cumulative deviation sequence Y is divided into non-overlapping segments of length . The interval segments, the total number of interval segments is denoted as . ,in Indicates rounding down; For range segment index, For each interval segment Perform polynomial trend fitting and calculate the root mean square of detrended variability to obtain the local variability. Then, by averaging by the qth order, the q-order oscillation function is obtained:

[0058] ;

[0059] when Logarithmic mean was used, and the result was fitted to each q in a double logarithmic coordinate system. and The slope of the scale exponential function is obtained. The scaling exponential function characterizes the scaling relationship between the fluctuation function and the scaling parameter of the plaintext length sequence, and is defined as the plaintext scaling feature. Through Legendre transformation, it is derived from... The fractal dimension distribution as a function of the Hölder exponent is obtained, i.e., the plaintext multifractal spectrum. ;

[0060] By performing fractal analysis on the ciphertext length sequence with plaintext scaling features as constraints, the multifractal spectrum of the ciphertext is obtained;

[0061] Based on plaintext and ciphertext multifractal spectra, morphological features of the plaintext spectrum (plaintext spectrum width, plaintext peak position, and plaintext asymmetry) and morphological features of the ciphertext spectrum (ciphertext spectrum width, ciphertext peak position, and ciphertext asymmetry) are extracted respectively. Specifically:

[0062] Determine the support set of the plaintext multifractal spectrum, i.e., all those that make the fractal dimension... Given a set of Hölder exponents, find the minimum Hölder exponent on that support set. and the maximum Hölder index ;

[0063] Calculate plaintext spectral width , which is the width of the support set: ;

[0064] Determine the position of plaintext peaks It is to make the fractal dimension within the support set. The Hölder exponent value corresponding to the attainment of the maximum value, i.e.: ;

[0065] Calculate plaintext asymmetry It is used to characterize the shape difference on the left and right sides of the multifractal spectrum, defining the width on the left side of the peak. The width to the right of the peak The plaintext asymmetry is then: ;

[0066] when When the peak of the spectrum is shifted to the left, the left tail is longer; when When, it indicates that the peak value is off to the right, and the right tail is longer; when At that time, the spectrum exhibits a symmetrical distribution;

[0067] Similarly, the morphological features of the ciphertext spectrum are extracted: ciphertext spectrum width. ciphertext peak position Ciphertext asymmetry ;

[0068] Furthermore, cross-spectral feature fusion is performed on the plaintext spectrum morphological features and the ciphertext spectrum morphological features to construct a joint fractal feature vector, namely: extracting the plaintext peak position and plaintext asymmetry from the plaintext spectrum morphological features, and extracting the ciphertext peak position and ciphertext asymmetry from the ciphertext spectrum morphological features;

[0069] Calculate the offset between the plaintext peak position and the ciphertext peak position, and use it as the peak offset feature:

[0070] ;

[0071] Calculate the difference between plaintext asymmetry and ciphertext asymmetry as the asymmetry difference characteristic:

[0072] ;

[0073] By combining plaintext spectral morphology features, peak shift features, and asymmetry difference features, a joint fractal feature vector of the source service in the current window is constructed:

[0074] This vector simultaneously represents the cross-layer mapping relationship between application layer business logic and the physical fingerprint of the cryptographic stack.

[0075] The specific steps to obtain the encrypted multifractal spectrum are as follows:

[0076] Based on the ciphertext length sequence, the ciphertext fluctuation function at various scales is analyzed, specifically as follows:

[0077] For ciphertext length sequence Similarly, first construct the cumulative deviation sequence, and then calculate the q-order wave function at each scale based on the same preset parameters at each scale. ;

[0078] When establishing the ciphertext scaling relationship between the ciphertext fluctuation function and the scaling parameter, the ciphertext scaling relationship is regularized using plaintext scaling features as constraints to suppress scaling shifts caused by random padding of the encryption layer, resulting in a corrected ciphertext scaling relationship, specifically as follows:

[0079] Fitting the encrypted scaling exponential function When introducing a regularization term ,in The regularization intensity coefficient ( >0), which makes the ciphertext scaling exponent converge towards the plaintext scaling exponent in the overall trend, suppresses the scaling offset introduced by the random padding of TLS records in the encryption layer, and at the same time preserves the local deviation of the ciphertext sequence itself due to the physical characteristics of the encryption stack, thus obtaining the corrected ciphertext scaling relationship.

[0080] Based on the corrected ciphertext scaling relation, a ciphertext multifractal spectrum is generated, specifically by using Legendre transformation to generate the ciphertext multifractal spectrum based on the corrected ciphertext scaling relation. .

[0081] In this implementation plan, traffic data is accumulated in chronological order, fluctuation status is determined by the average values ​​of the preceding and following segments, data sequences are divided according to changes in sequence structure, and time limits are set to ensure data output under low-frequency services. Plaintext and ciphertext sequences are processed simultaneously, and the inherent patterns of the sequences are mined by multifractal methods. The plaintext scaling features constrain the ciphertext analysis process to weaken the interference caused by random factors in encryption. Finally, multiple types of spectral morphology indicators are extracted and cross-spectral feature fusion is completed. The resulting feature vector can reflect the correlation between the service and the encryption layer, improving the accuracy of subsequent anomaly analysis.

[0082] Specifically, the historical joint fractal feature vector set consists of multiple historical joint fractal feature vectors. The specific steps for generating several directional anchor points and the normal deviation upper limit of each directional anchor point are as follows:

[0083] Calculate the directional similarity between historical joint fractal feature vectors. Historical joint fractal feature vectors with directional similarity exceeding a preset clustering threshold are grouped into the same directional group. The average direction of all vectors within each directional group is taken as the directional anchor point of that group. Specifically:

[0084] All historical joint fractal eigenvectors generated by the source service during normal business hours constitute the historical joint fractal eigenvector set, denoted as . Where u is the total number of historical windows, and for each historical joint fractal feature vector conduct Normalization process: The normalized vectors are all projected onto the unit hypersphere.

[0085] Calculate the directional similarity between the historical joint fractal eigenvectors, for the normalized vectors. Directional similarity is measured by the cosine of the angle between the two:

[0086] ;

[0087] Clustering groups with directional similarity higher than a preset clustering threshold The historical joint fractal feature vectors are grouped into the same direction group. The division of the direction group adopts the clustering rule based on connected components: each vector is a node, and when the similarity between two vectors exceeds a threshold, an edge is established between them. All vectors falling into the same connected component constitute a direction group, and the average direction of all vectors in each direction group is taken as the direction anchor point of the direction group.

[0088] For the i-th direction group directional anchor point The calculation method is as follows:

[0089] ;

[0090] Each directional anchor point represents a typical behavior pattern of the source service during normal business operations;

[0091] The set of deviation distances from each historical joint fractal eigenvector belonging to each directional anchor point to that directional anchor point is calculated and then sparsely purged. Specifically:

[0092] Anchor points in each direction Calculate the deviation distance of each historical joint fractal feature vector belonging to the anchor point in that direction from the anchor point. The deviation distance is defined as the cosine distance of the angle between the normalized vector and the anchor point in that direction.

[0093] ;

[0094] will be attributed to the directional anchor point The set of deviations is the sum of the deviations of all vectors. ;

[0095] For each deviation distance set Perform sparse culling on the offset distance set. For each deviation distance value in the data, find the vector corresponding to that value in the direction group. The neighborhood range in the vector, that is, the range centered on the vector within a preset angle. (For example The number of vectors belonging to the same direction group within a range of radians is taken as the local density of that vector. The local density is lower than the preset density threshold. ( Take the total number of vectors in that direction group multiplied by a preset ratio. , For example, a deviation distance value of 5% is used as a sparse edge value from... By removing sparsity from the middle, we obtain the offset distance set after sparse removal. ;

[0096] Analyze the similarity between any two directional anchor points. When the similarity exceeds a preset overlap threshold, reduce the deviation distance values ​​in the sparsely pruned deviation distance set corresponding to the two directional anchor points to determine the normal upper limit of deviation for each directional anchor point. Specifically:

[0097] Analyze the directional similarity between any two directional anchor points; when it exceeds a preset overlap threshold... This indicates that the two behavioral patterns are too close in the orientation space, which may cause the boundary to be blurred;

[0098] At this point, a reduction constraint is applied to the sparse culling set of deviation distances corresponding to each of the two directional anchor points, that is, each deviation distance value in its corresponding deviation distance set is reduced by a preset ratio. ( Compression is performed using values ​​between 0.8 and 0.9 (to avoid over-compression), with each deviation distance value multiplied by... This yields the reduced set of offset distances for anchor points in each direction. ;

[0099] For the deviation distance set The deviation distance values ​​are sorted, and the deviation distance value at the preset quantile Q (e.g., the 95th percentile) is taken as the normal upper limit of the anchor point in that direction. This means that, under normal business operation conditions, it belongs to the directional anchor point. The deviation distance of the joint fractal eigenvector from the anchor point is: The probability does not exceed .

[0100] The specific steps for analyzing the deviation of the source service from the evaluation value are as follows:

[0101] Calculate the matching degree between the joint fractal eigenvector and the anchor points in each direction, and take the anchor point with the highest matching degree as the best matching anchor point. Specifically:

[0102] Joint fractal feature vector to be detected First, Normalization yields Calculate its directional matching degree with anchor points in each direction: ;

[0103] The anchor point with the highest directional matching degree is taken as the best matching anchor point, denoted as . ;

[0104] The deviation distance of the joint fractal eigenvector from the best matching anchor point is analyzed, and the ratio is calculated with the upper limit of the normal deviation of the best matching anchor point to obtain the relative deviation ratio, which is as follows:

[0105] Calculate the joint fractal eigenvector To the best matching anchor point Deviation distance: ;

[0106] Get the best matching anchor point The corresponding normal deviation range, and denoted as Calculate the relative deviation ratio: ;

[0107] The deviation distance and relative deviation ratio are input into a preset deviation coordination function to generate a directional deviation evaluation value, which is as follows:

[0108] Deviation distance Ratio of relative deviation Input to the preset deviation cooperative function The generated direction deviates from the evaluation value. Deviation from the cooperative function It is constructed as a composite function with asymmetric cooperative amplification characteristics. When only one of the deviation distance and the relative deviation ratio is abnormal, the function output is nonlinearly suppressed to avoid false alarms caused by single-factor disturbances.

[0109] The function generates a magnitude leap through multiplicative coupling and exponential mapping, forming a sharp anomalous signal, if and only if the deviation distance and the relative deviation ratio simultaneously exceed their respective empirical safety boundaries.

[0110] In one implementation, the deviation from the cooperative function takes the following form:

[0111] ;

[0112] in, The abnormal amplification factor ( The value is ), used to regulate the steepness of abnormal signal growth; This is a threshold truncation term, meaning: only if the relative deviation ratio... breakthrough This term is only a non-zero positive value when the deviation distance exceeds the upper limit of the normal deviation range; otherwise, the function output is always 0, ensuring that the abnormal assessment is activated only when both the directional deviation and the amplitude exceed the limit are met simultaneously.

[0113] This implementation scheme relies on vector clustering to classify behavioral patterns corresponding to normal business operations, combines local density filtering to eliminate interfering data, and then tightens the judgment boundary for similar behavioral patterns to reasonably define the normal deviation range. Furthermore, it uses vector matching to lock in the behavioral benchmark corresponding to the current traffic, and completes a comprehensive judgment based on the deviation magnitude. In addition, it uses preset processing functions to analyze multiple indicators, filtering out interference from single factors and triggering judgment only when multiple indicators show anomalies simultaneously, effectively reducing false judgments and improving the reliability of traffic anomaly identification.

[0114] Specifically, such as Figure 2 As shown, the specific steps for analyzing the trend mutation assessment value of the source service are as follows:

[0115] The historical joint fractal eigenvector set is arranged in order to form a historical eigenvector sequence, and the historical change step size between adjacent vectors in the sequence is calculated, specifically as follows:

[0116] All normalized vectors in the historical joint fractal eigenvector set are arranged in chronological order according to their timestamps of generation to form a historical eigenvector sequence. Calculate the historical change step size between adjacent vectors in the sequence: ;

[0117] Obtain the historical change step sequence This sequence characterizes the rate of evolution of normal business behavior in the orientation space;

[0118] Distribution modeling is performed on the historical change step size sequence to determine the step size abrupt change threshold, specifically as follows:

[0119] Distribution modeling is performed on the historical change step length sequence, specifically by taking the 95th percentile of the historical change step length as the step length abrupt change threshold. And record the maximum value in the historical change step sequence. ,like (i.e., the historical step size distribution is extremely concentrated), then the trend change assessment value is directly used. Set to 0 to avoid division by zero exception;

[0120] Read the joint fractal feature vector and obtain the neighboring historical joint fractal feature vector of the previous window immediately preceding the current window (this vector has been previously collected and normalized). Calculate the current step size, specifically:

[0121] Read the current joint fractal eigenvector And obtain the historical joint fractal feature vector of the window immediately preceding the current window, denoted as Calculate the current change step size: ;

[0122] Based on the current change step size and the step size mutation threshold, the trend mutation assessment value is calculated as follows:

[0123] when At that time, based on the deviation of the current change step size from the step size mutation threshold, the trend mutation assessment value is calculated. :

[0124] ;

[0125] when When TMI is 0, it indicates that the current rate of change is well within the normal evolutionary range; when When the threshold is exceeded, the TMI increases linearly with the degree of exceedance, with an upper limit of 1, indicating a drastic change.

[0126] In one implementation, to avoid false alarms caused by brief anomalies in the previous window, a short-term smoothing mechanism is further introduced: caching the most recent... Historical feature vectors of each window ( (Usually 3-5), calculate the current vector to the previous... The step size of the average direction change of each vector, replacing the above This is to suppress interference caused by instantaneous fluctuations.

[0127] The specific steps for generating the anchor internal structure offset are as follows:

[0128] Read the best matching anchor point matched by the joint fractal feature vector, and obtain all historical joint fractal feature vectors belonging to the best matching anchor point to form a historical distribution set, which is as follows:

[0129] Reading the joint fractal eigenvector Best matching anchor points Obtain all historical joint fractal feature vectors belonging to the best matching anchor point, i.e., direction groups. All normalized vectors in the set constitute the historical distribution set. ;

[0130] Joint fractal eigenvectors Add to historical distribution set , forming an extended distribution set ;

[0131] Distribution structure analysis was performed on the historical distribution set and the extended distribution set respectively to obtain the characteristics of the historical distribution structure and the extended distribution structure, which are as follows:

[0132] Perform distribution structure analysis on the historical distribution set and the extended distribution set respectively, and calculate their respective covariance matrices. The covariance matrix of the historical distribution set is: (i.e., historical distribution structure characteristics), the covariance matrix of the extended distribution set is (i.e., extended distribution structure characteristics);

[0133] Structural perturbation processing is performed on historical and extended distribution structural features to obtain the internal structural offset, i.e., extracting... and The diagonal elements are denoted as the historical variance vector and the expanded variance vector, and the variance inflation is calculated, which is defined as the absolute deviation of the mean of the ratios of the components of the two variance vectors (based on the historical variance) from 1.

[0134] Will and Normalize them into correlation matrices, where the elements of the correlation matrices are the correlation coefficients between the corresponding dimensions, and calculate the correlation distortion, which is defined as the root mean square deviation of the off-diagonal elements of the two correlation matrices.

[0135] The correlation distortion and variance inflation are normalized, and the normalized variance inflation is denoted as VE, and the correlation distortion is denoted as CD. The variance inflation weight is preset. Its value ranges from [0.4, 0.6], with a preferred value of 0.5; correlation distortion weight. Introducing a co-regulatory factor Its value range is [1.0, 3.0], and the preferred value is And by fusing them, the anchor internal structure offset ASD is obtained:

[0136] ASD reflects the degree of perturbation to the entire distribution structure after the vector to be detected is added to the historical distribution set.

[0137] The specific steps to obtain the comprehensive threat score of the source service are as follows:

[0138] The evaluation values ​​of anchor internal structural offset, directional deviation, and trend change abruptness are normalized as follows:

[0139] DDI and TMI are already in a state of... For the interval, ASD has no natural upper limit, so the normalization parameter is determined based on historical statistics: collect the ASD values ​​corresponding to all windows of anchor points in each direction throughout history, and take the 99th percentile as the range. Take 0 as ;

[0140] Then the normalized for: ;

[0141] Accordingly, ;

[0142] The normalized anchor internal structure offset, directional deviation assessment value, and trend change assessment value are then input into the preset comprehensive assessment model to analyze the comprehensive threat score.

[0143] The comprehensive evaluation model is presented in the following form:

[0144] ;

[0145] in, For comprehensive threat scoring, The following are, in order: normalized directional deviation assessment value, trend change assessment value, and anchorage structural offset. The preset fusion weights are, in order, satisfied. ,and ; The preset synergistic amplification index, .

[0146] In one implementation example, the fusion weights and synergistic amplification index The value of is determined in the following way:

[0147] Construct a labeled sample set by collecting window data generated by the source service during its historical operation, covering normal behavior samples of at least one complete business cycle and abnormal behavior samples corresponding to known attack events. For each window data, calculate its directional deviation evaluation value, trend change evaluation value and anchor structure offset according to the aforementioned steps, and complete the normalization process. Each sample is accompanied by a real label (normal / attack) to form a labeled sample set.

[0148] Define the parameter search space and evaluation metric, and set the weight search step size as... , In satisfying And each Traverse all valid combinations under the constraints; The search scope is The F1 score of the comprehensive threat score on the labeled sample set (i.e., the harmonic mean of precision and recall) is used as an evaluation index for the merits of parameter combinations.

[0149] Within the parameter search space, traverse each group. Calculate the TS value for all samples; with a step size Traversal For each interval, the TS that maximizes the F1 score is taken as the classification threshold for that parameter combination. The best F1 score corresponding to this threshold is recorded. After completing all iterations, the parameter combination with the highest F1 score is selected as the optimal parameter combination.

[0150] In this implementation plan, by tracking the temporal evolution step size of business feature vectors, defining abrupt change judgment criteria based on historical data distribution, and using a window smoothing mechanism to weaken the interference caused by instantaneous fluctuations, dynamic abnormal changes in business behavior are stably captured. At the same time, by comparing the overall distribution differences before and after the addition of vectors, internal structural disturbances are perceived from the perspective of variance and correlation, hidden abnormal information is mined from multiple dimensions, and the indicator range is unified by adaptive normalization. The optimal fusion parameters are determined through sample optimization to achieve the fusion of multi-dimensional evaluation indicators and comprehensively and accurately assess the overall threat level of network traffic.

[0151] Please see Figure 3This invention provides a technical solution: an intelligent monitoring and management system for network information security, comprising: a data acquisition unit for continuously acquiring the plaintext record length and ciphertext record length of each outbound TLS connection of a source service in the network, and adaptively dividing them into a plaintext length sequence and a ciphertext length sequence; a fractal feature extraction unit for performing multifractal spectrum estimation on the plaintext length sequence and the ciphertext length sequence respectively to form a joint fractal feature vector; a direction deviation analysis unit for collecting the historical joint fractal feature vector set of the source service, performing direction aggregation analysis to generate several direction anchor points and the normal deviation upper limit of each direction anchor point, and performing direction matching and deviation fusion with the joint fractal feature vector to analyze the direction deviation evaluation value; a trend mutation analysis unit for performing evolution trajectory mutation processing based on the historical joint fractal feature vector set and the joint fractal feature vector to analyze the trend mutation evaluation value; a comprehensive evaluation unit for performing internal structure self-consistency analysis on the joint fractal feature vector to generate the anchor internal structure offset, and performing comprehensive processing with the direction deviation evaluation value and the trend mutation evaluation value to obtain a comprehensive threat score; and a security management unit for performing security management of the source service based on the comprehensive threat score.

[0152] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0153] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for intelligent monitoring and management of network information security, characterized in that, Includes the following steps: The plaintext record length and ciphertext record length of each outbound TLS connection of the source service in the network are continuously collected and adaptively divided into plaintext length sequence and ciphertext length sequence; The plaintext length sequence and the ciphertext length sequence are respectively subjected to multifractal spectrum estimation to form a joint fractal feature vector; Collect the historical joint fractal feature vector set of the source service, perform directional aggregation analysis to generate several directional anchor points and the normal deviation upper limit of each directional anchor point, and perform directional matching and deviation fusion with the joint fractal feature vector to analyze the directional deviation evaluation value. Based on the historical joint fractal feature vector set and joint fractal feature vector, evolution trajectory mutation processing is performed, and trend mutation evaluation value is analyzed. The internal structure self-consistency analysis of the joint fractal eigenvectors generates the anchor internal structure offset, which is then combined with the directional deviation assessment value and the trend change assessment value to obtain the comprehensive threat score. Security management of source services is carried out based on comprehensive threat scoring.

2. The intelligent monitoring and management method for network information security according to claim 1, characterized in that, The specific steps for adaptively dividing the data into plaintext length sequences are as follows: Accumulate the plaintext record lengths of all outbound TLS connections sequentially according to their timestamps. During the accumulation process, the fluctuation range of the length of the currently accumulated plaintext records and the number of records are statistically analyzed; And when the number of records reaches the preset minimum record number threshold, the rate of change of the fluctuation amplitude is detected. If the rate of change exceeds the preset change threshold, the lengths of all currently accumulated plaintext records are output in sequence as a plaintext length sequence.

3. The intelligent monitoring and management method for network information security according to claim 2, characterized in that, The specific steps for forming the joint fractal eigenvectors are as follows: For a plaintext length sequence, based on preset scale parameters, the plaintext fluctuation function at each scale is calculated, and the plaintext scaling characteristics between the plaintext fluctuation function and the scale parameters are analyzed to obtain the plaintext multifractal spectrum. By performing fractal analysis on the ciphertext length sequence with plaintext scaling features as constraints, the multifractal spectrum of the ciphertext is obtained; Based on plaintext multifractal spectrum and ciphertext multifractal spectrum, morphological features of plaintext spectrum and ciphertext spectrum are extracted respectively; Furthermore, cross-spectral feature fusion is performed on the plaintext spectrum morphological features and the ciphertext spectrum morphological features to construct a joint fractal feature vector.

4. The intelligent monitoring and management method for network information security according to claim 3, characterized in that, The specific steps to obtain the encrypted multifractal spectrum are as follows: Based on the ciphertext length sequence, the ciphertext fluctuation function at various scales is analyzed; When establishing the ciphertext scaling relationship between the ciphertext fluctuation function and the scaling parameter, the ciphertext scaling relationship is regularized using plaintext scaling features as constraints to obtain the modified ciphertext scaling relationship. Based on the corrected ciphertext scaling relation, a multifractal spectrum of the ciphertext is generated.

5. The intelligent monitoring and management method for network information security according to claim 1, characterized in that, The historical joint fractal feature vector set consists of multiple historical joint fractal feature vectors. The specific steps for generating several directional anchor points and the normal deviation upper limit of each directional anchor point are as follows: Calculate the directional similarity between each historical joint fractal feature vector, group historical joint fractal feature vectors with a value higher than a preset clustering threshold into the same directional group, and determine the directional anchor point; Calculate the set of deviation distances of anchor points in each direction and perform sparse culling; Analyze the similarity between any two directional anchor points. When the similarity exceeds a preset overlap threshold, reduce the set of deviation distances after sparse removal of the two directional anchor points to determine the normal upper limit of deviation for each directional anchor point.

6. The intelligent monitoring and management method for network information security according to claim 5, characterized in that, The specific steps for analyzing deviations from the evaluation value are as follows: Calculate the matching degree between the joint fractal eigenvector and the anchor points in each direction, and take the anchor point with the highest matching degree as the best matching anchor point; Analyze the deviation distance of the joint fractal eigenvector from the best matching anchor point, and process the ratio with the upper limit of the normal deviation of the best matching anchor point to obtain the relative deviation ratio; Input the deviation distance and relative deviation ratio into the preset deviation coordination function to generate the directional deviation evaluation value.

7. The intelligent monitoring and management method for network information security according to claim 1, characterized in that, The specific steps for analyzing the trend change assessment value are as follows: Arrange the historical joint fractal eigenvector set in order to form a historical eigenvector sequence, calculate the historical change step size in the sequence, and construct a historical change step size sequence; Distribution modeling is performed on the historical change step size sequence to determine the step size mutation threshold; Read the joint fractal eigenvectors and obtain the neighboring historical joint fractal eigenvectors to calculate the current change step size; Calculate the trend mutation assessment value based on the current change step size and the step size mutation threshold.

8. The intelligent monitoring and management method for network information security according to claim 6, characterized in that, The specific steps for generating the anchor internal structure offset are as follows: Read the best matching anchor point matched by the joint fractal feature vector, and obtain the historical distribution set belonging to the best matching anchor point; The joint fractal eigenvectors are added to the historical distribution set to form an extended distribution set; Distribution structure analysis was performed on the historical distribution set and the extended distribution set respectively to obtain the characteristics of the historical distribution structure and the extended distribution structure. Structural perturbation processing is performed on the historical distribution structural features and the extended distribution structural features to obtain the structural offset within the anchor.

9. The intelligent monitoring and management method for network information security according to claim 1, characterized in that, The specific steps to obtain the comprehensive threat score are as follows: The evaluation values ​​of anchor internal structure offset, directional deviation, and trend change were normalized. The normalized anchor internal structure offset, directional deviation assessment value, and trend change assessment value are then input into the preset comprehensive assessment model to analyze the comprehensive threat score. The comprehensive evaluation model is presented in the following form: ； in, For comprehensive threat scoring, The following are, in order: normalized directional deviation assessment value, trend change assessment value, and anchorage structural offset. These are the preset fusion weights, This is the preset synergistic amplification index.

10. A network information security intelligent monitoring and management system, employing the network information security intelligent monitoring and management method according to any one of claims 1-9, characterized in that, include: The data acquisition unit is used to continuously collect the plaintext record length and ciphertext record length of each outbound TLS connection of the source service in the network, and adaptively divide them into plaintext length sequences and ciphertext length sequences; The fractal feature extraction unit is used to perform multifractal spectrum estimation on the plaintext length sequence and the ciphertext length sequence respectively to form a joint fractal feature vector; The directional deviation analysis unit is used to collect the historical joint fractal feature vector set of the source service, generate several directional anchor points and the normal deviation upper limit of each directional anchor point through directional aggregation analysis, and analyze the directional deviation evaluation value by directional matching and deviation fusion with the joint fractal feature vector. The trend mutation analysis unit is used to perform evolution trajectory mutation processing based on the historical joint fractal feature vector set and joint fractal feature vector, and to analyze the trend mutation evaluation value. The comprehensive evaluation unit is used to generate the anchor internal structure offset by analyzing the joint fractal feature vector through internal structure self-consistency analysis, and to comprehensively process it with the directional deviation evaluation value and the trend change evaluation value to obtain the comprehensive threat score. The security management unit is used to manage the security of source services based on a comprehensive threat score.

Images