AI chip-based real-time classification of encrypted malicious traffic and abnormal connection identification method and system

Abstract

This invention relates to a method and system for real-time classification of encrypted malicious traffic and identification of abnormal connections based on an AI chip, used to extend the Detection and Response (XDR) platform. The method includes: capturing real-time encrypted traffic on the XDR platform; extracting only the packet length sequence and packet arrival time interval sequence as meta-feature time series from the encrypted session, without parsing the encrypted payload during the extraction process; and performing one-way hash anonymization on the network endpoint identifier of the session; inputting the meta-feature time series into a first deep learning model deployed in the AI ​​chip, whereby the first deep learning model encodes the meta-feature time series using a time encoder, outputting a session behavior embedding vector; and within the AI ​​chip, using its parallel computing array to construct a session interaction graph from the behavior embedding vectors of multiple concurrent sessions within the current time window, where nodes correspond to anonymized sessions. This invention can accurately identify malicious traffic while protecting privacy.

Description

Technical Field

[0001] This invention relates to the field of anomaly identification, specifically to a method and system for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips. Background Technology

[0002] With the widespread adoption of network encryption technologies such as HTTPS, encrypted traffic has become the mainstream form of network communication. Malicious attack traffic also leverages encryption mechanisms to achieve covert transmission, making it difficult for traditional network security detection methods to effectively identify. Extended Detection and Response (XDR) platforms, as the core of enterprise-level security operations, urgently need to perform real-time classification and abnormal connection identification of encrypted malicious traffic. However, existing encrypted traffic detection technologies have several core flaws: First, most solutions require parsing the encrypted payload to extract features, violating the privacy protection principles of encrypted communication and failing to adapt to fully encrypted network environments. Second, they only focus on single-session temporal feature analysis, ignoring the communication pattern correlation and temporal coupling relationship between concurrent sessions, failing to identify clusters of abnormal connections, resulting in insufficient detection coverage and accuracy. Third, malicious traffic judgment relies on a single detection dimension, lacking a fusion mechanism of temporal reconstruction anomalies and graph structure classification, leading to persistently high false positive and false negative rates. The existing technologies suffer from several drawbacks: Model training requires a large number of labeled samples, resulting in weak unsupervised learning capabilities, poor generalization, and poor scenario adaptability; they fail to leverage the parallel computing advantages of AI chips, leading to high inference latency in high-concurrency encrypted traffic scenarios, which cannot meet the real-time detection requirements of the XDR platform; the detection process uses sensitive features such as network endpoint identity and location, resulting in insufficient privacy compliance and difficulty in adapting to privacy-sensitive business scenarios such as healthcare and government affairs; and the use of fixed thresholds for anomaly detection cannot be dynamically adjusted according to real-time traffic distribution, leading to poor detection stability and robustness. To address these shortcomings, there is an urgent need for an encrypted malicious traffic identification solution that does not require parsing encrypted payloads, balances privacy protection, relies on parallel computing with AI chips, integrates temporal features and session correlation analysis, and adaptively performs dynamic detection, in order to meet the real-time security protection requirements of the XDR platform. Therefore, this paper proposes a method and system for real-time classification and abnormal connection identification of encrypted malicious traffic based on AI chips. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips, applied to the Extended Detection and Response (XDR) platform, including: The XDR platform captures real-time encrypted traffic, extracts only the packet length sequence and packet arrival time interval sequence as meta-feature time series for encrypted sessions, does not parse the encrypted payload during the extraction process, and performs one-way hash anonymization processing on the network endpoint identifier of the session. The meta-feature time series is input into the first deep learning model deployed in the AI ​​chip. The first deep learning model uses a time encoder to encode the meta-feature time series and outputs the behavior embedding vector of the session. Within the AI ​​chip, its parallel computing array is used to construct a session interaction graph by embedding the behavior vectors of multiple concurrent sessions within the current time window. The nodes correspond to the anonymized sessions, and the edge weights are calculated based on the similarity of communication patterns and time correlation between sessions. The conversation interaction graph is input into a second deep learning model deployed on an AI chip. The second deep learning model is a graph neural network. The hidden representation of each node is updated through a message passing mechanism, and the malicious probability of each conversation is calculated based on the updated node representation. Based on the probability of malice and the connection patterns in the session interaction graph, abnormal connections are identified, and the anonymous identifier and risk level of the abnormal connections are returned to the XDR platform.

[0004] Furthermore, the first deep learning model includes a variational autoencoder, and the behavior embedding vector is composed of the mean of the latent variables output by the encoder in the variational autoencoder; the first deep learning model also includes a decoder, which is used to reconstruct the latent variables to obtain the reconstructed packet length sequence and the reconstructed packet arrival time interval sequence. Furthermore, obtaining the probability of malice includes: Within the AI ​​chip, the point-by-point reconstruction difference between the meta-feature time series and the reconstructed meta-feature time series is calculated, and the distribution difference between the latent variables and the prior distribution is calculated. The reconstruction error obtained by averaging the point-by-point reconstruction differences over time is summed with the distribution difference to form a comprehensive reconstruction bias; The overall reconstruction bias is converted into a preliminary anomaly score through a nonlinear mapping with a temperature coefficient; The initial anomaly score is weighted and fused with the classification probability output by the graph neural network to obtain the final malicious probability.

[0005] Furthermore, the calculation process for the overall reconstruction deviation includes: First, for each time step, calculate the square of the difference between the actual packet length and the reconstructed packet length, and the square of the difference between the actual packet arrival time interval and the reconstructed packet arrival time interval. Sum these squared differences over all time steps and divide by the total number of time steps to obtain the reconstruction error. Then, the KL divergence between the latent variable posterior distribution of the encoder output and the preset standard normal prior distribution is calculated; Finally, the reconstruction error is added to the KL divergence weighted by the distribution regularization coefficient to form the comprehensive reconstruction bias. Its expression is: ; In the formula, and Let be the actual packet length and the actual arrival time interval at time step t, respectively. and Let be the packet length of the reconstruction and the arrival time interval of the reconstruction, respectively; T be the total number of time steps; q(z|X) be the latent distribution of the encoder output; p(z) be the preset prior distribution; and γ be the distribution regularization coefficient.

[0006] Furthermore, the process of obtaining the initial abnormal scores is as follows: Statistical analysis of the overall reconstruction bias of all sessions within the current time window The median and interquartile range are calculated by multiplying the reciprocal of the interquartile range by a preset constant. Multiplying them yields an adaptive scaling factor α, which allows the scaling factor to automatically adjust the mapping steepness according to the dispersion of the overall deviation. After multiplying the overall reconstruction bias by an adaptive scaling factor, the result is input into a Sigmoid-type nonlinear mapping function, which outputs a preliminary anomaly score. The specific formula is as follows: ; in Interquartile range, To prevent small constants from being divided by zero.

[0007] Furthermore, the implementation process of weighted fusion is as follows: Obtain preliminary anomaly scores for all sessions within the current time window and calculate their variance. This variance reflects the degree of fluctuation in the reconstruction bias; Obtain the classification probability of the graph neural network output for each session within the current window. Calculate its information entropy This information entropy reflects the uncertainty of the classification results of the graph neural network; The normalized fusion weights are determined by the following formula: ; When the reconstruction deviation fluctuation increases Automatically increases when the uncertainty of graph neural network classification increases. Automatically increases in size; Preliminary anomaly score Compared with graph neural network classification probability The weighted sum, after being mapped by an activation function, yields the final malicious probability. The formula for its calculation is: .

[0008] Furthermore, the calculation of edge weights in the session interaction graph is achieved using a parallel computing array of the AI ​​chip through a multi-head attention mechanism. The specific process includes: For each session node, its behavior embedding vector is used to generate query vectors and key vectors through multiple sets of independent linear mappings, with different mappings corresponding to different attention heads; For any two session nodes i and j under the m-th attention head, calculate the dot product of the query vector of node i and the key vector of node j, and scale the dot product by dividing the result by the square root of the key vector dimension. Then, perform Softmax normalization on all neighbors of node i to obtain the attention score under that head. Meanwhile, the communication time overlap coefficient between the two sessions is calculated, and the attention score is penalized by the time correlation using the exponential decay function. The decay factor controls the suppression strength when the time does not overlap. The average of the penalized attention scores calculated by each attention head is used as the final edge weight between session nodes i and j. ; Wherein, the initial value of the edge weight under the m-th attention head It is given by the following formula: ; In the formula, The dimension of the key vector. This is the overlap coefficient for communication time between two sessions. This is the attenuation factor.

[0009] Furthermore, the process by which graph neural networks update the hidden representations of nodes in parallel through message passing mechanisms is as follows: For the l-th layer of a graph neural network, each node i first collects the hidden representations of all its neighboring nodes j in the (l-1)-th layer, using the edge weights. The neighbor representations are weighted and then linearly mapped using a learnable transformation matrix to aggregate the neighbor message vectors. Meanwhile, the (l-1)th layer hidden representation of node i is processed by another learnable transformation matrix, added to the neighbor message vector, and then passed through a non-linear activation function to generate the hidden representation of this layer. The above aggregation and update operations utilize the parallel computing array of the AI ​​chip to execute independently on multiple nodes simultaneously, in order to achieve real-time inference; The update formula for the hidden representation of a node is: ; ; in Let i be the set of neighbors of node i. For edge weights, and This is a learnable weight matrix.

[0010] Furthermore, the first and second deep learning models are trained using a two-stage strategy before being deployed to the AI ​​chip. In the first stage, the variational autoencoder is trained unsupervised using only normal encrypted traffic feature samples that have been anonymized, with the goal of minimizing the sum of reconstruction error and latent space regularization term. In the second stage, the encoder parameters are frozen, and the graph neural network is trained end-to-end using session samples containing malicious and normal labels and a session interaction graph constructed from the samples. The training loss function includes node classification cross-entropy loss and graph structure consistency loss. Furthermore, the abnormal connections identified include: Malicious nodes are marked by comparing the probability of malice in each session with the dynamic threshold of the current window. The dynamic threshold is determined based on the statistical distribution of the global probability of malice in the current window and does not introduce identity or region-sensitive features. When there is a node directly connected to a malicious node whose edge weight is greater than the association threshold and whose own malicious probability also exceeds the dynamic threshold, the two nodes and their connecting edges are marked as an abnormal connection cluster, and the anonymous identifier and risk level of the cluster are reported to the XDR platform.

[0011] A real-time classification and abnormal connection identification system for encrypted malicious traffic based on AI chips, comprising: The meta-feature extraction module, deployed on the XDR platform, is used to capture real-time encrypted traffic. It extracts only the packet length sequence and packet arrival time interval sequence as meta-feature time series for encrypted sessions. The extraction process does not parse the encrypted payload and performs one-way hash anonymization processing on the network endpoint identifier of the session. The first inference module, deployed on the AI ​​chip, has a built-in first deep learning model. The first deep learning model includes a time encoder, which is used to encode the meta-feature time series input to the AI ​​chip and output the behavior embedding vector of the session. The graph construction module, deployed on the AI ​​chip, uses the parallel computing array of the AI ​​chip to construct a session interaction graph from the behavioral embedding vectors of multiple concurrent sessions within the current time window. The nodes correspond to the anonymized sessions, and the edge weights are calculated based on the similarity of communication patterns and time correlation between sessions. The second inference module, deployed on the AI ​​chip, has a built-in second deep learning model, which is a graph neural network. It is used to receive the session interaction graph, update the hidden representation of each node through a message passing mechanism, and calculate the malicious probability of each session based on the updated node representation. The anomaly identification and reporting module, deployed on the AI ​​chip, is used to identify abnormal connections based on the probability of malice and the connection patterns in the session interaction graph, and return the anonymous identifier and risk level of the abnormal connection to the XDR platform.

[0012] The present invention has the following advantages over the prior art: The encrypted payload needs to be parsed, and only the packet length sequence and packet arrival time interval sequence are extracted as meta-features. One-way hashing anonymization is applied to the network endpoint identifier to balance the needs of encrypted traffic identification with privacy and security. Parallel execution of operations such as session interaction graph construction and node hiding representation updates is achieved using an AI chip parallel computing array, ensuring real-time classification of encrypted malicious traffic and identification of abnormal connections. A two-stage strategy of unsupervised training with a variational autoencoder and supervised training with a graph neural network is adopted to reduce label dependence and improve model generalization ability. Preliminary anomaly scores are generated by comprehensively considering reconstruction bias, and the results are combined with the fluctuation of reconstruction bias and the uncertainty of graph neural network classification. Adaptive weighted fusion yields the final malicious probability, significantly improving the accuracy of malicious traffic identification. The fusion of session interaction graph edge weights with multi-head attention mechanisms and communication time correlation penalties accurately characterizes the inter-session association features. The graph neural network efficiently updates node representations through a message passing mechanism, accurately identifying abnormal connection clusters. A dynamic threshold based on global statistical distribution is used to determine malicious nodes, without introducing sensitive features such as identity or region, adapting to various network environments. Finally, anonymous identifiers and risk levels are reported to the XDR platform, perfectly adapting to extended detection and response scenarios, achieving efficient, accurate, and secure real-time classification of encrypted malicious traffic and identification of abnormal connections. Attached Figure Description

[0013] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0014] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0015] like Figure 1 As shown, the AI ​​chip-based real-time classification of encrypted malicious traffic and identification of abnormal connections is applied to the Extended Detection and Response (XDR) platform, including: The XDR platform captures real-time encrypted traffic, extracts only the packet length sequence and packet arrival time interval sequence as meta-feature time series for encrypted sessions, does not parse the encrypted payload during the extraction process, and performs one-way hash anonymization processing on the network endpoint identifier of the session. The meta-feature time series is input into the first deep learning model deployed in the AI ​​chip. The first deep learning model uses a time encoder to encode the meta-feature time series and outputs the behavior embedding vector of the session. Within the AI ​​chip, its parallel computing array is used to construct a session interaction graph by embedding the behavior vectors of multiple concurrent sessions within the current time window. The nodes correspond to the anonymized sessions, and the edge weights are calculated based on the similarity of communication patterns and time correlation between sessions. The conversation interaction graph is input into a second deep learning model deployed on an AI chip. The second deep learning model is a graph neural network. The hidden representation of each node is updated through a message passing mechanism, and the malicious probability of each conversation is calculated based on the updated node representation. Based on the probability of malice and the connection patterns in the session interaction graph, abnormal connections are identified, and the anonymous identifier and risk level of the abnormal connections are returned to the XDR platform.

[0016] The first deep learning model includes a variational autoencoder, and the behavior embedding vector is composed of the mean of the latent variables output by the encoder in the variational autoencoder; the first deep learning model also includes a decoder, which is used to reconstruct the latent variables to obtain the sequence of reconstructed packet lengths and the sequence of reconstructed packet arrival time intervals. Furthermore, obtaining the probability of malice includes: Within the AI ​​chip, the point-by-point reconstruction difference between the meta-feature time series and the reconstructed meta-feature time series is calculated, and the distribution difference between the latent variables and the prior distribution is calculated. The reconstruction error obtained by averaging the point-by-point reconstruction differences over time is summed with the distribution difference to form a comprehensive reconstruction bias; The overall reconstruction bias is converted into a preliminary anomaly score through a nonlinear mapping with a temperature coefficient; The initial anomaly score is weighted and fused with the classification probability output by the graph neural network to obtain the final malicious probability. A variational autoencoder is used to generate session behavior embedding vectors and reconstruct packet length sequences and packet arrival time interval sequences. By calculating the differences in point-by-point reconstruction of meta-features and the differences in the distribution of latent variables, a comprehensive reconstruction bias is obtained. The bias is converted into a preliminary anomaly score and then fused with the classification probability of a graph neural network to obtain the final malicious probability. It can capture the normal behavior patterns of encrypted traffic and accurately identify abnormal features without parsing the encrypted payload. By integrating the dual judgment criteria of reconstructed anomalies and graph structure classification, the accuracy and robustness of malicious probability calculation are greatly improved. At the same time, it takes into account privacy protection and real-time detection efficiency, and is suitable for the needs of accurate identification of encrypted malicious traffic in privacy-sensitive scenarios such as medical care and government affairs.

[0017] The use case is for real-time detection of malicious HTTPS encrypted traffic (malicious connections stealing registration system data) at the hospital's XDR platform, capturing the time series and packet length sequence of a specific encrypted session at the registration area. Packet arrival time interval sequence Total number of time steps T=5, distribution regularization coefficient The prior distribution is assumed to be the standard normal distribution p(z); Reconstructed packet length sequence The reconstructed packet arrival time interval sequence .

[0018] The formula for calculating the overall reconstruction deviation is as follows: Calculate the difference of squares point by point: the sum of squares of the differences in package lengths is The sum of squares of the time intervals is The reconstruction error is The KL divergence between the posterior and prior distributions of the encoder latent variables Comprehensive reconstruction deviation ; Calculate the preliminary anomaly score and take... The current window's overall reconstruction deviation is the interquartile range. Adaptive scaling factor Preliminary abnormal score ; The weighted fusion yields the final malicious probability, and the variance of the reconstructed anomaly score is defined. Graph Neural Network Classification Probability Its information entropy fusion weight , Final malicious probability The result accurately identified the encrypted session as a malicious connection that steals data from the registration system. The encrypted payload was not parsed throughout the entire process, which strictly protects the privacy of patients' registration information and meets the hospital's real-time security detection requirements for the registration network.

[0019] The calculation process for the overall reconstruction deviation includes: First, for each time step, calculate the square of the difference between the actual packet length and the reconstructed packet length, and the square of the difference between the actual packet arrival time interval and the reconstructed packet arrival time interval. Sum these squared differences over all time steps and divide by the total number of time steps to obtain the reconstruction error. Then, the KL divergence between the latent variable posterior distribution of the encoder output and the preset standard normal prior distribution is calculated; Finally, the reconstruction error is added to the KL divergence weighted by the distribution regularization coefficient to form the comprehensive reconstruction bias. Its expression is: ; In the formula, and Let be the actual packet length and the actual arrival time interval at time step t, respectively. and Here, q(z|X) represents the packet length and arrival time interval of the reconstruction, respectively; T represents the total number of time steps; q(z|X) represents the latent distribution of the encoder output; p(z) represents the preset prior distribution; and γ represents the distribution regularization coefficient. By clarifying the standardized calculation rules for comprehensive reconstruction deviation, the reconstruction error is accurately quantified by summing and averaging the point-by-point squared differences to obtain the differences in the reconstruction of meta-features. The KL divergence is used to measure the degree of deviation between the distribution of latent variables and the standard normal prior. Combined with the distribution regularization coefficient weighting, the deviation quantification is made stable and controllable, eliminating subjective calculation bias, improving the objectivity and reproducibility of anomaly detection, adapting to the high-efficiency parallel computing requirements of AI chips, and completing the calculation solely based on time-series meta-features without parsing encrypted payloads, thus ensuring user privacy and security throughout the process.

[0020] Encrypted traffic detection scenario at hospital registration desk: The use case is a hospital XDR platform that monitors malicious traffic encrypted with HTTPS at the registration desk in real time, identifies abnormal connections that steal registration information, and captures the time series and packet length sequence of a specific encrypted session at the registration desk. Packet arrival time interval sequence Total number of time steps T=5, distribution regularization coefficient The KL divergence between the posterior distribution of the encoder latent variables and the standard normal prior distribution. The reconstructed packet length sequence The reconstructed packet arrival time interval sequence .

[0021] Calculate the overall reconstruction deviation using the formula: Calculate the difference of squares point by point, and the sum of squares of the differences in package lengths is... The sum of squares of the time intervals is The reconstruction error is Comprehensive reconstruction deviation The calculation results accurately quantify the degree of session anomaly, and the detection can be completed without parsing the encrypted payload, thus protecting the patient's registration privacy information.

[0022] The process of obtaining the initial anomaly score is as follows: Statistical analysis of the overall reconstruction bias of all sessions within the current time window The median and interquartile range are calculated by multiplying the reciprocal of the interquartile range by a preset constant. Multiplying them yields an adaptive scaling factor α, which allows the scaling factor to automatically adjust the mapping steepness according to the dispersion of the overall deviation. After multiplying the overall reconstruction bias by an adaptive scaling factor, the result is input into a Sigmoid-type nonlinear mapping function, which outputs a preliminary anomaly score. The specific formula is as follows: ; in Interquartile range, To prevent division by zero of small constants; An adaptive scaling factor is obtained by statistically analyzing the median and interquartile range of the comprehensive reconstruction deviation within the current time window. Then, a sigmoid-type nonlinear mapping is used to convert the comprehensive reconstruction deviation into a preliminary anomaly score. The mapping steepness can be automatically adjusted according to the real-time traffic deviation distribution to avoid false detections and missed detections caused by fixed thresholds. This makes the anomaly score more consistent with the actual business traffic characteristics. The calculation is lightweight and adapted to real-time inference with AI chips. The entire process does not parse encrypted payloads or rely on sensitive privacy data, which improves the rationality of anomaly score calculation and detection stability while ensuring privacy and security.

[0023] Encrypted traffic detection scenario at hospital registration desk: The use case is a hospital XDR platform that monitors malicious traffic encrypted with HTTPS at the registration desk in real time, and calculates the overall reconstruction deviation of the current session. The interquartile range of the overall reconstruction deviation of all registered sessions within the current time window Preset constant , prevent zero small constant .

[0024] Calculate the adaptive scaling factor: ; The second step is to calculate the preliminary anomaly score: ; This adaptive calculation method aligns with the normal traffic distribution of hospital registration services, accurately distinguishes between normal registration encrypted sessions and malicious theft sessions, and can complete abnormal score calculation without parsing the encrypted payload, thus strictly protecting patients' registration privacy information.

[0025] The implementation process of weighted fusion is as follows: Obtain preliminary anomaly scores for all sessions within the current time window and calculate their variance. This variance reflects the degree of fluctuation in the reconstruction bias; Obtain the classification probability of the graph neural network output for each session within the current window. Calculate its information entropy This information entropy reflects the uncertainty of the classification results of the graph neural network; The normalized fusion weights are determined by the following formula: ; When the reconstruction deviation fluctuation increases Automatically increases when the uncertainty of graph neural network classification increases. Automatically increases in size; Preliminary anomaly score Compared with graph neural network classification probability The weighted sum, after being mapped by an activation function, yields the final malicious probability. The formula for its calculation is: ; By calculating the variance of the initial anomaly score to quantify the fluctuation of the reconstruction deviation and calculating the information entropy of the graph neural network classification probability to quantify the uncertainty of the classification, normalized dynamic fusion weights are automatically generated and weighted to obtain the final malicious probability. When the fluctuation of the reconstruction deviation increases, the weight of the reconstruction anomaly score is automatically increased, and when the uncertainty of the graph neural network classification increases, the weight of the classification probability is automatically increased. This achieves adaptive collaboration between the two dimensions of judgment criteria: temporal reconstruction anomaly and graph structure classification. It effectively avoids the problem of false positives and false negatives in a single detection dimension, significantly improves the accuracy and robustness of malicious probability calculation, and is suitable for real-time detection of encrypted traffic in privacy-sensitive business scenarios such as hospital registration. It does not parse the encrypted payload or touch the patient's privacy data throughout the process, balancing detection accuracy and privacy security.

[0026] Encrypted traffic detection scenario at hospital registration desk: The use case is a hospital XDR platform that monitors malicious traffic at the registration desk using HTTPS encryption in real time, identifies abnormal connections that steal registration information, and uses a preliminary anomaly score for the current session obtained previously. Variance of preliminary anomaly scores for all registered sessions within the current time window The graph neural network outputs classification probabilities for this session. The corresponding classification result information entropy H_{gnn}=0.15.

[0027] Calculate the normalized fusion weights: , ; The final probability of malice is calculated using the Sigmoid function as the activation function. Substituting the values, we get: ; Final malicious probability after Sigmoid mapping The dynamic fusion result accurately identifies sessions as malicious connections, and the detection can be completed without parsing the encrypted payload, thus strictly protecting the privacy information of patients during registration.

[0028] The calculation of edge weights in the session interaction graph is achieved using a parallel computing array of an AI chip through a multi-head attention mechanism. The specific process includes: For each session node, its behavior embedding vector is used to generate query vectors and key vectors through multiple sets of independent linear mappings, with different mappings corresponding to different attention heads; For any two session nodes i and j under the m-th attention head, calculate the dot product of the query vector of node i and the key vector of node j, and scale the dot product by dividing the result by the square root of the key vector dimension. Then, perform Softmax normalization on all neighbors of node i to obtain the attention score under that head. Meanwhile, the communication time overlap coefficient between the two sessions is calculated, and the attention score is penalized by the time correlation using the exponential decay function. The decay factor controls the suppression strength when the time does not overlap. The average of the penalized attention scores calculated by each attention head is used as the final edge weight between session nodes i and j. ; Wherein, the initial value of the edge weight under the m-th attention head It is given by the following formula: ; In the formula, The dimension of the key vector. This is the overlap coefficient for communication time between two sessions. It is the attenuation factor; By leveraging a parallel computing array of AI chips to calculate the edge weights of the session interaction graph using a multi-head attention mechanism, and by applying a time correlation penalty using a communication time overlap coefficient and an exponential decay function, the system can accurately characterize the similarity of communication patterns and time correlation characteristics between sessions from multiple dimensions. This makes the edge weights more consistent with the real network interaction patterns. Parallel computing can ensure real-time performance in high-concurrency scenarios. The system does not parse encrypted payloads or collect privacy data throughout the process, making it suitable for privacy-sensitive high-concurrency encrypted traffic detection scenarios such as hospital registration. This significantly improves the accuracy of session interaction graph construction and the reliability of subsequent abnormal connection identification.

[0029] Encrypted traffic detection scenario at hospital registration desk: The use case involves a hospital XDR platform constructing a session interaction graph for high-concurrency HTTPS encrypted traffic at the registration desk, calculating the edge weights between registration session i and registration session j, and simplifying the calculation by using a single attention head. The key vector dimension is... The overlap coefficient of communication time between two sessions With a decay factor β=2, the dot product of the query vector of session i and the key vector of session j is 128.

[0030] Calculate the initial weight of the m-th attention head according to the formula: Calculate the scaled dot product: In the single-neighbor scenario, the Softmax normalization result is 16; Calculate the time correlation penalty term: ; Calculate the weights below the attention head: The final edge weight under single attention The edge weights accurately reflect the communication similarity and temporal correlation between the two sessions, providing an accurate graph structure basis for subsequent graph neural network inference. The encrypted payload is not parsed throughout the process, strictly protecting the privacy information of patients' registration information.

[0031] The process by which a graph neural network updates the hidden representation of nodes in parallel through a message-passing mechanism is as follows: For the l-th layer of a graph neural network, each node i first collects the hidden representations of all its neighboring nodes j in the (l-1)-th layer, using the edge weights. The neighbor representations are weighted and then linearly mapped using a learnable transformation matrix to aggregate the neighbor message vectors. Meanwhile, the (l-1)th layer hidden representation of node i is processed by another learnable transformation matrix, added to the neighbor message vector, and then passed through a non-linear activation function to generate the hidden representation of this layer. The above aggregation and update operations utilize the parallel computing array of the AI ​​chip to execute independently on multiple nodes simultaneously, in order to achieve real-time inference; The update formula for the hidden representation of a node is: ; ; in Let i be the set of neighbors of node i. For edge weights, and The weight matrix is ​​a learnable weight matrix; Leveraging the parallel computing array of AI chips, the graph neural network performs weighted aggregation of neighbor node messages and updates its own hidden representation in parallel through a standardized message passing mechanism. The fixed calculation formula ensures that the feature update process is reproducible and the results are stable. The parallel computing mode can significantly improve the node feature inference speed in high-concurrency scenarios, accurately capture the correlation features between sessions, and does not parse encrypted payloads or collect privacy data. It balances real-time detection efficiency, detection accuracy, and privacy security, making it perfectly suited for privacy-sensitive high-concurrency encrypted traffic detection scenarios such as hospital registration.

[0032] Encrypted traffic detection scenario at hospital registration desk: The application scenario involves a hospital XDR platform equipped with the Cambricon Siyuan 270AI chip. This chip features a built-in 256-core tensor parallel computing array, supporting parallel inference across multiple session nodes. It handles high-concurrency HTTPS encrypted traffic at the registration desk in real time, based on the previously obtained edge weights between session i and its adjacent registration session j. Perform hidden representation update calculation on the l-th layer of the graph neural network; set the hidden representation of node i in the (l-1)-th layer. The hidden representation of neighbor node j at level l-1 Learnable weight matrix The activation function is ReLU.

[0033] The formula for calculating the neighbor message vector is as follows: ; First calculate Then substitute the edge weights to get ; The formula for calculating the hidden representation of nodes at this layer is as follows: ; First calculate The vectors are added together to get After ReLU activation ; The Cambricon Siyuan 270 AI chip's parallel computing array simultaneously performs the above update operations on 32 concurrent registration session nodes. The time taken for a single node update is less than 1ms, meeting the requirements for real-time detection. The encrypted payload is not parsed throughout the process, strictly protecting the privacy information of patients' registration information.

[0034] The first and second deep learning models were obtained using a two-stage training strategy before being deployed to the AI ​​chip: In the first stage, the variational autoencoder is trained unsupervised using only normal encrypted traffic feature samples that have been anonymized, with the goal of minimizing the sum of reconstruction error and latent space regularization term. In the second stage, the encoder parameters are frozen, and the graph neural network is trained end-to-end using session samples containing malicious and normal labels and a session interaction graph constructed from the samples. The training loss function includes node classification cross-entropy loss and graph structure consistency loss. Furthermore, the abnormal connections identified include: Malicious nodes are marked by comparing the probability of malice in each session with the dynamic threshold of the current window. The dynamic threshold is determined based on the statistical distribution of the global probability of malice in the current window and does not introduce identity or region-sensitive features. When there is a node directly connected to a malicious node whose edge weight is greater than the association threshold and whose own malicious probability also exceeds the dynamic threshold, the two nodes and their connecting edges are marked as an abnormal connection cluster, and the anonymous identifier and risk level of the cluster are reported to the XDR platform. A two-stage training strategy is adopted. First, the variational autoencoder is trained unsupervised with anonymized normal encrypted traffic to reduce the dependence on labeled data and improve the model's generalization ability. Then, the encoder parameters are frozen and the graph neural network is trained in a supervised manner with labeled samples to optimize the classification effect. Malicious nodes are identified by dynamic thresholds based on the global malicious probability statistical distribution of the current window. Abnormal connection clusters are identified by combining edge weights and malicious probability. No sensitive features such as identity or region are introduced throughout the process. It is adapted to parallel inference execution of AI chips and takes into account model training efficiency, detection accuracy, privacy compliance and real-time performance. It can stably identify encrypted malicious connection clusters in privacy-sensitive scenarios.

[0035] Encrypted traffic detection scenario at hospital registration desk: The application scenario involves a hospital XDR platform equipped with the Cambricon Siyuan 270AI chip (with a built-in 256-core tensor parallel computing array that supports multi-session parallel training and inference) to complete model training and abnormal connection identification for HTTPS encrypted traffic at the registration desk.

[0036] Two-stage model training: Phase 1: Collect anonymized meta-feature samples from normal encrypted traffic of the hospital registration system, and train an unsupervised variational autoencoder to minimize... To achieve the goal, complete the temporal feature modeling; The second stage involves freezing the variational autoencoder parameters, using registration session samples and session interaction graphs with normal / malicious labels, and training the graph neural network end-to-end. The loss function is the sum of node classification cross-entropy loss and graph structure consistency loss, optimizing the malicious classification effect.

[0037] Dynamic threshold determination and abnormal cluster identification: Set the dynamic threshold for the global malicious probability in the current time window (based on the 95th quantile of the statistical distribution) to 0.8, and the threshold for malicious node association to 2; Final malicious probability of target session i Marked as a malicious node; Edge weights between session i and its neighboring session j Furthermore, the probability of session j being malicious is 0.92 > 0.8; Cambricon's Siyuan 270 AI chip uses parallel computing to quickly determine whether sessions i and j, along with their connecting edges, are abnormal connection clusters that steal registration information. It then reports the anonymization identifier and high-risk level to the XDR platform. The single-window identification time is less than 1ms. It does not parse encrypted payloads or collect patient privacy data, fully complying with privacy compliance requirements in medical scenarios.

[0038] A real-time classification and abnormal connection identification system for encrypted malicious traffic based on AI chips, comprising: The meta-feature extraction module, deployed on the XDR platform, is used to capture real-time encrypted traffic. It extracts only the packet length sequence and packet arrival time interval sequence as meta-feature time series for encrypted sessions. The extraction process does not parse the encrypted payload and performs one-way hash anonymization processing on the network endpoint identifier of the session. The first inference module, deployed on the AI ​​chip, has a built-in first deep learning model. The first deep learning model includes a time encoder, which is used to encode the meta-feature time series input to the AI ​​chip and output the behavior embedding vector of the session. The graph construction module, deployed on the AI ​​chip, uses the parallel computing array of the AI ​​chip to construct a session interaction graph from the behavioral embedding vectors of multiple concurrent sessions within the current time window. The nodes correspond to the anonymized sessions, and the edge weights are calculated based on the similarity of communication patterns and time correlation between sessions. The second inference module, deployed on the AI ​​chip, has a built-in second deep learning model, which is a graph neural network. It is used to receive the session interaction graph, update the hidden representation of each node through a message passing mechanism, and calculate the malicious probability of each session based on the updated node representation. The anomaly identification and reporting module, deployed on the AI ​​chip, is used to identify abnormal connections based on the probability of malice and the connection patterns in the session interaction graph, and return the anonymous identifier and risk level of the abnormal connection to the XDR platform.

[0039] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips, applied to the Extended Detection and Response (XDR) platform, characterized in that... include: The XDR platform captures real-time encrypted traffic, extracts only the packet length sequence and packet arrival time interval sequence as meta-feature time series for encrypted sessions, does not parse the encrypted payload during the extraction process, and performs one-way hash anonymization processing on the network endpoint identifier of the session. The meta-feature time series is input into the first deep learning model deployed in the AI ​​chip. The first deep learning model uses a time encoder to encode the meta-feature time series and outputs the behavior embedding vector of the session. Within the AI ​​chip, its parallel computing array is used to construct a session interaction graph by embedding the behavior vectors of multiple concurrent sessions within the current time window. The nodes correspond to the anonymized sessions, and the edge weights are calculated based on the similarity of communication patterns and time correlation between sessions. The conversation interaction graph is input into a second deep learning model deployed on an AI chip. The second deep learning model is a graph neural network. The hidden representation of each node is updated through a message passing mechanism, and the malicious probability of each conversation is calculated based on the updated node representation. Based on the probability of malice and the connection patterns in the session interaction graph, abnormal connections are identified, and the anonymous identifier and risk level of the abnormal connections are returned to the XDR platform.

2. The method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips according to claim 1, characterized in that: The first deep learning model includes a variational autoencoder, and the behavior embedding vector is composed of the mean of the latent variables output by the encoder in the variational autoencoder; the first deep learning model also includes a decoder, which is used to reconstruct the latent variables to obtain the sequence of reconstructed packet lengths and the sequence of reconstructed packet arrival time intervals. Furthermore, obtaining the probability of malice includes: Within the AI ​​chip, the point-by-point reconstruction difference between the meta-feature time series and the reconstructed meta-feature time series is calculated, and the distribution difference between the latent variables and the prior distribution is calculated. The reconstruction error obtained by averaging the point-by-point reconstruction differences over time is summed with the distribution difference to form a comprehensive reconstruction bias; The overall reconstruction bias is converted into a preliminary anomaly score through a nonlinear mapping with a temperature coefficient; The initial anomaly score is weighted and fused with the classification probability output by the graph neural network to obtain the final malicious probability.

3. The method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips according to claim 2, characterized in that: The calculation process for the overall reconstruction deviation includes: First, for each time step, calculate the square of the difference between the actual packet length and the reconstructed packet length, and the square of the difference between the actual packet arrival time interval and the reconstructed packet arrival time interval. Sum these squared differences over all time steps and divide by the total number of time steps to obtain the reconstruction error. Then, the KL divergence between the latent variable posterior distribution of the encoder output and the preset standard normal prior distribution is calculated; Finally, the reconstruction error is added to the KL divergence weighted by the distribution regularization coefficient to form the comprehensive reconstruction bias. .

4. The method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips according to claim 3, characterized in that: The process of obtaining the initial anomaly score is as follows: Statistical analysis of the overall reconstruction bias of all sessions within the current time window The median and interquartile range are calculated by multiplying the reciprocal of the interquartile range by a preset constant. Multiplying them yields an adaptive scaling factor α, which allows the scaling factor to automatically adjust the mapping steepness according to the dispersion of the overall deviation. After multiplying the overall reconstruction bias by an adaptive scaling factor, the result is input into a Sigmoid-type nonlinear mapping function, which outputs a preliminary anomaly score. .

5. The method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips according to claim 4, characterized in that: The implementation process of weighted fusion is as follows: Obtain preliminary anomaly scores for all sessions within the current time window and calculate their variance. This variance reflects the degree of fluctuation in the reconstruction bias; Obtain the classification probability of the graph neural network output for each session within the current window. Calculate its information entropy This information entropy reflects the uncertainty of the classification results of the graph neural network; Preliminary anomaly score Compared with graph neural network classification probability The weighted sum, after being mapped by an activation function, yields the final malicious probability. .

6. The method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips according to claim 5, characterized in that: The calculation of edge weights in the session interaction graph is achieved using a parallel computing array of an AI chip through a multi-head attention mechanism. The specific process includes: For each session node, its behavior embedding vector is used to generate query vectors and key vectors through multiple sets of independent linear mappings, with different mappings corresponding to different attention heads; For any two session nodes i and j under the m-th attention head, calculate the dot product of the query vector of node i and the key vector of node j, and scale the dot product by dividing the result by the square root of the key vector dimension. Then, perform Softmax normalization on all neighbors of node i to obtain the attention score under that head. Meanwhile, the communication time overlap coefficient between the two sessions is calculated, and the attention score is penalized by the time correlation using the exponential decay function. The decay factor controls the suppression strength when the time does not overlap. The average of the penalized attention scores calculated by each attention head is used as the final edge weight between session nodes i and j. .

7. The method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips according to claim 6, characterized in that: The process by which a graph neural network updates the hidden representation of nodes in parallel through a message-passing mechanism is as follows: For the l-th layer of a graph neural network, each node i first collects the hidden representations of all its neighboring nodes j in the (l-1)-th layer, using the edge weights. The neighbor representations are weighted and then linearly mapped using a learnable transformation matrix to aggregate the neighbor message vectors. Meanwhile, the (l-1)th layer hidden representation of node i is processed by another learnable transformation matrix, added to the neighbor message vector, and then passed through a non-linear activation function to generate the hidden representation of this layer. The above aggregation and update operations utilize the parallel computing array of the AI ​​chip to execute independently on multiple nodes simultaneously, thereby enabling real-time inference.

8. The method for real-time classification of encrypted malicious traffic and identification of abnormal connections based on AI chips according to claim 7, characterized in that: The first and second deep learning models were obtained using a two-stage training strategy before being deployed to the AI ​​chip: In the first stage, the variational autoencoder is trained unsupervised using only normal encrypted traffic feature samples that have been anonymized, with the goal of minimizing the sum of reconstruction error and latent space regularization term. In the second stage, the encoder parameters are frozen, and the graph neural network is trained end-to-end using session samples containing malicious and normal labels and a session interaction graph constructed from the samples. The training loss function includes node classification cross-entropy loss and graph structure consistency loss. Furthermore, the abnormal connections identified include: Malicious nodes are marked by comparing the probability of malice in each session with the dynamic threshold of the current window. The dynamic threshold is determined based on the statistical distribution of the global probability of malice in the current window and does not introduce identity or region-sensitive features. When there is a node directly connected to a malicious node whose edge weight is greater than the association threshold and whose own malicious probability also exceeds the dynamic threshold, the two nodes and their connecting edges are marked as an abnormal connection cluster, and the anonymous identifier and risk level of the cluster are reported to the XDR platform.

9. A real-time classification and abnormal connection identification system for encrypted malicious traffic based on an AI chip, wherein the system is applied in the identification method described in any one of claims 1-8, characterized in that: The system includes: The meta-feature extraction module, deployed on the XDR platform, is used to capture real-time encrypted traffic. It extracts only the packet length sequence and packet arrival time interval sequence as meta-feature time series for encrypted sessions. The extraction process does not parse the encrypted payload and performs one-way hash anonymization processing on the network endpoint identifier of the session. The first inference module, deployed on the AI ​​chip, has a built-in first deep learning model. The first deep learning model includes a time encoder, which is used to encode the meta-feature time series input to the AI ​​chip and output the behavior embedding vector of the session. The graph construction module, deployed on the AI ​​chip, uses the parallel computing array of the AI ​​chip to construct a session interaction graph from the behavioral embedding vectors of multiple concurrent sessions within the current time window. The nodes correspond to the anonymized sessions, and the edge weights are calculated based on the similarity of communication patterns and time correlation between sessions. The second inference module, deployed on the AI ​​chip, has a built-in second deep learning model, which is a graph neural network. It is used to receive the session interaction graph, update the hidden representation of each node through a message passing mechanism, and calculate the malicious probability of each session based on the updated node representation. The anomaly identification and reporting module, deployed on the AI ​​chip, is used to identify abnormal connections based on the probability of malice and the connection patterns in the session interaction graph, and return the anonymous identifier and risk level of the abnormal connection to the XDR platform.

Images