Deep learning based port dynamic risk level adaptive encryption communication switching system

Abstract

The application discloses a port dynamic risk grade adaptive encryption communication switching system based on deep learning, relates to the technical field of adaptive encryption communication switching, and comprises the following steps: collecting risk values and corresponding risk grades of a port area in real time every day to obtain daily port dynamic risk data; acquiring risk interval data, performing cooling analysis, and obtaining a reference cooling duration of the day; performing risk type analysis according to the daily port dynamic risk data and current change threshold information, and acquiring adaptive risk cooling time; and dynamically switching and recalling the encryption level of port area communication according to the adaptive cooling time. The application is used to solve the problem that the existing adaptive encryption communication switching technology cannot accurately adapt to the dynamic risk situation and differentiated falling characteristics of the port area and the adjustment of the encryption strength is not reliable when the encryption strength is adjusted according to the risk falling.

Description

Technical Field

[0001] This invention relates to the field of adaptive encrypted communication switching technology, specifically a deep learning-based adaptive encrypted communication switching system for dynamic risk levels in port areas. Background Technology

[0002] The adaptive encrypted communication switching technology in the port area is a secure communication technology system that integrates dynamic risk situation awareness and encryption technology for complex communication scenarios in smart ports. Its core logic is to use deep learning to perceive the security risk level of the port area network and business in real time, and dynamically adjust the encryption algorithm strength and key rotation strategy as needed. Under the premise of ensuring low latency and high reliability requirements for port production operations, it achieves dynamic matching between security protection capabilities and risk situation, and solves the dilemma of traditional static encryption protection being insufficient and easily broken or excessive encryption damaging performance.

[0003] Existing adaptive encrypted communication switching technologies in port areas, in order to suppress the problem of frequent switching of encryption strategies caused by fluctuations in risk values ​​around thresholds, often employ a fixed-duration cooling mechanism during the downgrade rollback phase from high risk to low risk. That is, when the regional risk value falls back to the corresponding risk level, the encryption strength is not immediately reduced; instead, it is observed for a period of time. If the risk value does not rise back to the high-risk level within the observation period, the encryption strength is reduced after the cooling-off period is reached. However, existing fixed cooling-off periods are mostly manually preset empirical values ​​and cannot be adaptively calibrated based on the rebound interval patterns of historical risk events in the port area. Furthermore, port operations exhibit significant peak and off-peak seasons; fixed cooling-off periods are prone to being too long or too short, leading to encryption redundancy or frequent encryption switching. Moreover, existing fixed durations do not consider the rate of decline and dissipation of individual risk events. Differentiated processing is applied to different scenarios; a uniform cooling-off time is used for scenarios where risks dissipate quickly, such as instantaneous false alarms and single scans, as well as scenarios where risks dissipate slowly, such as persistent penetration attacks; prone to over-protection and under-protection; for scenarios where risks fall back quickly, such as single external port scans and single false alarms common in the port area, an excessively long cooling-off time will cause high-strength encryption to continue meaninglessly, resulting in wasted computing power and communication; for scenarios where risks fall back slowly, such as persistent penetration attacks, a fixed cooling-off time is insufficient to confirm that the risk has completely dissipated, and secondary attacks are likely to rebound after downgrading, forming a protection window, and failing to balance security reliability and operational efficiency; therefore, the existing adaptive encrypted communication switching technology, when adjusting the encryption strength based on risk fall-off, cannot accurately adapt to the dynamic risk situation and differentiated fall-off characteristics of the port area by setting a fixed cooling-off time, and the adjustment of encryption strength is not reliable enough. Summary of the Invention

[0004] This invention aims to at least partially solve one of the technical problems in the prior art. It obtains daily dynamic risk data of the port by collecting risk values ​​and corresponding risk levels in the port area in real time; acquires risk interval data, performs cooling analysis, and obtains the baseline cooling time for the day; analyzes risk types based on the daily dynamic risk data of the port and current change threshold information, and obtains an adaptive risk cooling time; and dynamically switches and callbacks the encryption level of communication in the port area. This addresses the problem that existing adaptive encrypted communication switching technologies, when adjusting encryption strength based on risk reduction, cannot accurately adapt to the dynamic risk situation and differentiated reduction characteristics of the port area by setting a fixed cooling time, resulting in unreliable adjustments to encryption strength.

[0005] To achieve the above objectives, this application provides a deep learning-based adaptive encrypted communication switching system for dynamic risk levels in port areas, including a risk acquisition module, a benchmark analysis module, a risk cooling module, and an encrypted switching module. The risk acquisition module collects the risk value and corresponding risk level of the port area in real time every day to obtain daily dynamic risk data of the port. The benchmark analysis module includes an interval acquisition unit and a cooling benchmark unit; the interval acquisition unit is used to acquire risk interval data based on port dynamic risk data of historical dates, and the cooling benchmark unit is used to perform cooling analysis, acquire benchmark cooling duration, and obtain the benchmark cooling duration for the day. When a risk occurs in the port area and the encryption level is increased, the risk cooling module analyzes the risk type based on the port's dynamic risk data for the day and the current change threshold information, and obtains an adaptive risk cooling time. The encryption switching module dynamically switches the encryption level of port area communications based on an adaptive risk cooldown period.

[0006] Furthermore, the risk acquisition module is configured with risk acquisition strategies, which include: Any port area to be managed is designated as the first port area; multi-dimensional data of the first port area is collected; and a risk assessment model of the communication behavior of the first port area is constructed using deep learning, which is designated as the port area risk model; based on the port area risk model, the corresponding risk value is output using the collected multi-dimensional data. The risk value is set to a range of [0, 100], and four risk levels are set, namely extremely high risk, high risk, medium risk and low risk; and the risk value range corresponding to each risk level is set.

[0007] Furthermore, risk collection strategies also include: Set the encryption algorithm and corresponding encryption strength for each risk level; and assign encryption strengths for extremely high risk, high risk, medium risk and low risk to encryption levels 4 to 1 respectively. Based on the port area risk model, the risk value of the first port area is obtained daily at the first time interval and arranged in the order of collection time, and recorded as the port dynamic risk data for the corresponding date; the port dynamic risk data is collected repeatedly every day, where the first time interval is t0.

[0008] Furthermore, the interval acquisition unit is configured with an interval acquisition strategy, which includes: Based on the current day, obtain the port dynamic risk data for the most recent 15 days, record the most recent 15 days as the reference day, and use any reference day as the first date; The port dynamic risk data for the first date is recorded as the risk change sequence; the lower limit of the risk value range corresponding to medium risk is recorded as the risk threshold R1. Risk values ​​greater than R1 in the risk change sequence are denoted as risky values, and risk values ​​not greater than R1 are denoted as risk-free values; and consecutive risky values ​​or single risky values ​​in the risk change sequence are denoted as risky segments; Merge adjacent risky segments with a time interval of less than 2 minutes. After merging, obtain the time interval between any two adjacent risky segments and record it as the risk interval. After completion, obtain the risk interval subset of the first date. Repeatedly obtain risk interval subsets for all reference days and merge them to obtain the risk interval set.

[0009] Furthermore, the cooling reference unit is configured with a reference analysis strategy, which includes: Set the original cooling duration to AT; denote the total number of risk intervals in the risk interval set as N0; denote any one risk interval in the risk interval set as TI; Calculate the proportion of risk intervals less than TI in the risk interval set to N0, and denote it as the cumulative rebound probability of TI; repeatedly obtain the cumulative rebound probability of all risk intervals in the risk interval set; Based on the risk interval and the corresponding cumulative probability of rebound, a curve is constructed to show how the cumulative probability of rebound changes with the risk interval, denoted as the cumulative probability curve; and the rate of change of the slope of each point corresponding to the risk interval on the cumulative probability curve is calculated.

[0010] Furthermore, benchmarking strategies also include: Obtain the risk interval with a slope change rate of not less than 0.4×AT and the largest corresponding risk interval, denoted as the optimal cooling time BT, and calculate 0.4×AT+0.6×BT; denoted as CT. If CT < 0.5 × AT, then set CT = 0.5 × AT; if CT > 1.5 × AT, then set CT = 1.5 × AT; otherwise, do not adjust CT; after completion, record CT as the base cooling time for the day.

[0011] Furthermore, the risk cooling module is configured with a risk cooling strategy, which includes: Set the minimum cooling time to DT; denote the base cooling time for the day as RT0; denote the port dynamic risk data collected for the day as the daily risk sequence; based on the daily risk sequence, set the sliding window duration to th, with the current risk value as the endpoint of the sliding window. <DT; Get the maximum risk value RE within the sliding window and the risk value RS at the endpoint (i.e., the current risk value), and calculate the risk dissipation slope KR, where KR = (RE - RS) / tes, and tes represents the time interval from RE to RS; If RE > RS, and the risk levels corresponding to RE and RS are different, then the cooling timer is triggered, RS is marked as the cooling start point, and the slope adjustment coefficient FK is calculated, where FK = max[0.2, min(1.5, 1.5-0.125×K)].

[0012] Furthermore, risk cooling strategies also include: Continue to collect risk values ​​for the first port area, update the daily risk sequence, and continuously slide the sliding window. When the risk value RS is at the starting position of the sliding window, the sliding window at this time is recorded as the evaluation window. If a new cooling start point exists within the evaluation window, or if the risk level of any risk value within the evaluation window is higher than the risk level of RS, then the marking of the cooling start point of RS will be removed. If the starting point of the cooling of RS is not removed, calculate the standard deviation of the risk value within the evaluation window, denoted as BA, calculate BA / (RE-RS), denoted as relative volatility BE, and calculate 1-min(1,BE / 0.3), denoted as volatility score G1.

[0013] Furthermore, risk cooling strategies also include: Perform a univariate linear regression on the risk values ​​within the evaluation window in chronological order to obtain the corresponding trend line; obtain the trend prediction value for each risk value; and calculate the residual for each risk value within the evaluation window based on the trend prediction value. Calculate the sum of all residuals greater than 0, denoted as the total positive residual CX; calculate the absolute difference between the risk values ​​at the beginning and end of the evaluation window, denoted as DW; set the effective threshold as DM, DM=max[5, 0.1×(RE-RS)]; If the slope of the change trend line is negative and DW>DM, calculate CX / DW, which is recorded as the positive residual ratio RP; otherwise, calculate CX / (RE-RS), which is recorded as the positive residual ratio RP; Set the rebound score as G2; if RP≤5%, set G2=1; if 5%<RP≤20%, set G2=0.5; if 20%<RP, set G2=0; Obtain the number of risk values not greater than 1.1×RS within the evaluation window, which is recorded as M1; calculate M1 / M0, which is recorded as the pullback score G3, where M0 is the total number of risk values within the evaluation window; Calculate 0.35×G1+0.35×G2+0.3×G3, which is recorded as the final stability score G0; calculate the stability adjustment coefficient FG, where FG=max[0.3, min(1.5, 1.8-1.5×G0)]; Calculate CT×FK×FG, which is recorded as ZT0; if ZT0<DT, set ZT0=DT; if ZT0>MT, set ZT0=MT; otherwise, do not adjust ZT0; after completion, the obtained ZT0 is recorded as the final cooling duration of the cooling starting point RS, where MT is the set upper limit of the cooling duration.

[0014] Further, the encryption switching module is configured with an encryption switching strategy, and the encryption switching strategy includes: Record the duration of cooling timing triggered from the cooling starting point as the elapsed cooling duration; if the mark of the cooling starting point of RS is not canceled during the cooling timing process and the elapsed cooling duration reaches the final cooling duration, trigger encryption downgrade; Then reduce the encryption level of the communication behavior of the first port area to the encryption level corresponding to the risk level of RS, and cancel the mark of the cooling starting point of RS.

[0015] Beneficial effects of the present invention: According to the present invention, daily real-time risk values and corresponding risk levels of the port area are collected to obtain daily port dynamic risk data; risk interval data is acquired according to the port dynamic risk data of historical dates, cooling analysis is performed to obtain the reference cooling duration of the current day; when a risk occurs in the port area and the encryption level is increased, risk type analysis is performed according to the port dynamic risk data of the current day and current change threshold information, and an adaptive risk cooling time is acquired; dynamic switching and callback of the encryption level of port area communication are performed according to the adaptive cooling time; when adjusting the encryption strength as the risk recedes, the encryption strength can be adjusted according to the dynamic risk situation of the port area and differentiated pullback features, so as to improve the reliability and accuracy of encryption switching; This invention obtains risk interval data from historical port dynamic risk data and constructs a rebound cumulative probability curve corresponding to the risk interval. This determines the optimal cooling time and, combined with the original cooling time, yields the basic cooling time for the day. Compared to using a fixed cooling time, this approach fully leverages the rebound patterns of historical risk events, allowing the basic cooling time to be dynamically adjusted according to the changing characteristics of port area risks. This improves the matching degree between the cooling time and the actual risk situation in the port area. By analyzing the decline process of risk events through multiple dimensions such as risk dissipation slope, fluctuation, rebound degree, and decline stability, this invention more accurately determines whether the risk has truly dissipated. Based on this, a corresponding adaptive cooling time is generated, allowing the cooling time to be dynamically adjusted according to the actual situation of a single risk event. This improves the reliability and accuracy of encrypted switching, thereby enhancing the continuity and stability of the port area communication system. Attached Figure Description

[0016] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a schematic diagram of the system of the present invention; Figure 2 This is a flowchart of the steps of the method of the present invention; Figure 3 This is a schematic diagram of the cumulative probability curve of the present invention; Figure 4 This is a schematic diagram of the electronic device of the present invention. Detailed Implementation

[0017] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0018] Example 1, please refer to Figure 1 As shown, the present invention provides a port area dynamic risk level adaptive encrypted communication switching system based on deep learning, including a risk acquisition module, a benchmark analysis module, a risk cooling module, and an encrypted switching module; The risk acquisition module collects the risk values ​​and corresponding risk levels of the port area in real time every day, and obtains the daily dynamic risk data of the port. The risk acquisition module is configured with a risk acquisition strategy, which includes: designating any port area to be managed as the first port area; collecting multi-dimensional data of the first port area; using deep learning to construct a risk assessment model of the communication behavior of the first port area, which is denoted as the port area risk model; and outputting the corresponding risk value based on the port area risk model and the collected multi-dimensional data. This means collecting multi-dimensional data such as network communication, equipment status, business behavior, security incidents, and environmental status during the operation of the port area, so that risk assessment no longer relies on a single indicator, but can comprehensively reflect the current safe operation status of the port area. The entire port area can be used as the first port area as needed, or the port can be divided into multiple areas, and each area can be processed separately. The risk value is set to a range of [0, 100], and four risk levels are set, namely extremely high risk, high risk, medium risk, and low risk. The risk value range corresponding to each risk level is also set. The risk level and the corresponding risk value range can be divided according to the actual application scenario. In this embodiment, [0, 25) is low risk, [25, 50) is medium risk, [50, 75) is high risk, and [75, 100] is extremely high risk.

[0019] Set the encryption algorithm and corresponding encryption strength for each risk level; and assign encryption strengths for extremely high risk, high risk, medium risk and low risk to encryption levels 4 to 1 respectively. Different encryption algorithms and encryption strengths are used for different risk levels, so that the security protection capabilities can be adjusted synchronously with changes in risk; while ensuring security, the impact on the efficient operation of the port is minimized. Based on the port area risk model, the risk value of the first port area is obtained daily at the first time interval and arranged in the order of collection time, and recorded as the port dynamic risk data for the corresponding date; the port dynamic risk data is collected repeatedly every day; wherein, the first time interval is t0; in this embodiment, t0=10s, which can be flexibly adjusted according to actual needs.

[0020] In actual implementation, a port area risk model is established using deep learning. The model can learn the complex nonlinear relationship between historical normal and abnormal behaviors, realize the automatic fusion analysis between different data features, and convert the original multidimensional data into a unified risk value output, so that complex heterogeneous data can be converted into risk assessment indicators that can be directly used by the subsequent control system.

[0021] The benchmark analysis module includes an interval acquisition unit and a cooling benchmark unit. The interval acquisition unit is used to acquire risk interval data based on port dynamic risk data of historical dates. The cooling benchmark unit is used to perform cooling analysis, acquire the benchmark cooling duration, and obtain the benchmark cooling duration for the current day. The interval acquisition unit is configured with an interval acquisition strategy, which includes: taking the current day as the baseline, acquiring the port dynamic risk data for the most recent 15 days, recording the most recent 15 days as the reference day, and using any reference day as the first date; Selecting data from the most recent 15 days ensures that the port area's recent risk status is covered, including factors such as operational activity levels, vessel throughput, network communication load, and the frequency of safety incidents. On the other hand, it avoids introducing outdated historical risk patterns due to an excessively long time span, ensuring that the statistical results reflect the current risk situation in the port area. The port dynamic risk data for the first date is recorded as a risk change sequence; that is, a sequence of risk values ​​changing over time from the first date. The lower limit of the risk value range corresponding to medium risk is recorded as the risk threshold R1. If the risk value is greater than R1, the encryption level needs to be upgraded. Only risk events that require an upgrade in encryption level are included in the statistics, making subsequent risk interval analysis more valuable. Risk values ​​greater than R1 in the risk change sequence are denoted as risky values, and risk values ​​not greater than R1 are denoted as risk-free values. Continuous risky values ​​or single risky values ​​in the risk change sequence are denoted as risky segments. In other words, we no longer focus on individual risk values, but rather on the entire period during which the risk persists, and data that continuously exceeds the risk threshold is uniformly regarded as a single risk event.

[0022] Merge adjacent risky segments with a time interval of less than 2 minutes. After merging, obtain the time interval between any two adjacent risky segments and record it as the risk interval. After completion, obtain the risk interval subset of the first date. Since actual network attacks or abnormal behavior in the port area may have short-term pauses, such as brief attack interruptions, missed data sampling, or network fluctuations, even if there is a very short time interval between two risk segments, they may belong to the same risk event. Therefore, a 2-minute threshold is set to re-merge the brief interruptions into complete risk events, filter out oscillation noise, improve the accuracy of risk interval statistics, and make the cooldown time calculated later more consistent with the actual risk occurrence pattern. The threshold can be flexibly adjusted. Repeatedly obtain risk interval subsets for all reference days and merge them to obtain the risk interval set.

[0023] The cooling baseline unit is configured with a baseline analysis strategy, which includes: setting the original cooling duration to AT; AT serving as the set cooling time to provide a reference baseline for historical statistical results; recording the total number of risk intervals in the risk interval set as N0; and recording any one risk interval in the risk interval set as TI; in this embodiment, AT = 15 minutes, which can be set according to actual conditions. Calculate the proportion of risk intervals less than TI in the risk interval set to N0, and denote it as the cumulative rebound probability of TI; repeatedly obtain the cumulative rebound probability of all risk intervals in the risk interval set; the cumulative rebound probability of TI represents the probability of a rebound occurring within the TI duration after the risk event ends. Please see Figure 3As shown, based on the risk interval and the corresponding rebound cumulative probability, a curve of the rebound cumulative probability varying with the risk interval is constructed, which is recorded as a cumulative probability curve; and the slope change rate of the corresponding point of each risk interval on the cumulative probability curve is calculated; the cumulative probability curve reflects the variation law of the risk reoccurrence probability with the waiting time.

[0024] Obtain the risk interval that is not less than 0.4×AT and has the maximum corresponding slope change rate, which is recorded as the optimal cooling duration BT, and calculate 0.4×AT+0.6×BT; which is recorded as CT; the slope change rate is the change rate of the slope of the cumulative probability curve, that is, the second derivative, which reflects the bending degree of the curve; the position where the absolute value of the slope change rate is the largest is the turning point where the curve changes from steep rise to gentle rise, which is most suitable as the optimal cooling duration; for example, Figure 3 the risk interval with the maximum slope change rate in is 21 minutes; If CT<0.5×AT, let CT=0.5×AT; if CT>1.5×AT, let CT=1.5×AT; otherwise, CT is not adjusted; after completion, CT is recorded as the basic cooling duration of the current day; boundary limitation is performed on the basic cooling duration; excessive or too small change of the cooling time caused by abnormal historical data is avoided; the cooling time is guaranteed to always be within a reasonable engineering range; For example, CT=21 minutes, AT=15 minutes, then CT=0.4×AT+0.6×BT=18.6 minutes, that is, the basic cooling duration of the current day is 18.6 minutes; In the actual implementation process, the basic cooling duration of the current day is generated through statistical analysis of the recent port dynamic risk data; compared with the fixed cooling duration set according to experience, the cooling time can be dynamically adjusted according to the actual occurrence law of recent risk events in the port area, so that the basic cooling duration can be adaptively updated with the change of the risk activity degree, business operation state and security situation of the port area; on the basis of ensuring communication security, both stability and resource utilization efficiency are considered.

[0025] After a risk occurs in the port area and the encryption level is increased, the risk cooling module performs risk type analysis according to the current day's port dynamic risk data and the current change threshold information, and obtains an adaptive risk cooling time; The risk cooling module is configured with a risk cooling strategy, and the risk cooling strategy includes: setting the minimum cooling duration as DT; recording the basic cooling duration of the current day as RT0; recording the collected port dynamic risk data of the current day as the current day risk sequence; based on the current day risk sequence, setting the time length of the sliding window as th, taking the current risk value as the end point of the sliding window, th<DT; in this embodiment, th=5 minutes, which can be flexibly set; DT=8 minutes, that is, it is ensured that no matter how the risk changes, the cooling time during encryption callback will not be less than DT; Get the maximum risk value RE within the sliding window and the risk value RS at the endpoint (i.e., the current risk value), and calculate the risk dissipation slope KR, where KR = (RE - RS) / tes, and tes represents the time interval from RE to RS; If RE > RS, and the risk levels corresponding to RE and RS are different, then the cooldown timer is triggered. If the conditions are not met, it means that the encryption level does not need to be called back, and no further processing is required. RS is marked as the cooldown start point. The slope adjustment coefficient FK is calculated, where FK = max[0.2, min(1.5, 1.5-0.125×K)]; 0.2 is to avoid FK being too small, and it can be adjusted appropriately. The risk dissipation slope reflects the rate at which risk falls back from its peak. The larger the slope, the faster the risk falls and the greater the compressible cooling range. The faster the risk falls, the smaller the FK value, and the smaller the value, the faster the fall. The slower the risk falls, the larger the FK value. This allows the cooling time to be automatically adjusted according to the risk dissipation speed, so that rapid risk dissipation can shorten the waiting time, while continuous risk can extend the observation time, thus improving the adaptability of the cooling strategy to different risk types. For example, if RE = 45 minutes, RS = 21 minutes, and tes = 4 minutes, then the risk dissipation slope KR = (RE - RS) / tes = 6 minutes / minute; then min(1.5, 1.5 - 0.125 × K) = 0.75, and the slope adjustment coefficient FK = 0.75.

[0026] Continue to collect risk values ​​for the first port area, update the daily risk sequence, and continuously slide the sliding window. When the risk value RS is at the starting position of the sliding window, the sliding window at this time is recorded as the evaluation window. If a new cooling start point exists within the evaluation window, or if the risk level of any risk value within the evaluation window is higher than the risk level of RS, then the marking of the cooling start point of RS is removed; if a new risk decline start point appears within the evaluation window, it indicates that the risk has undergone a new change process; if a higher level of risk appears, it indicates that the risk has rebounded; at this point, the original encrypted callback is no longer needed, the original cooling timer has become meaningless, and the judgment needs to be restarted. If the starting point of the cooling of RS is not removed, calculate the standard deviation of the risk value within the evaluation window, denoted as BA. Calculate BA / (RE-RS), denoted as the relative volatility BE, and calculate 1-min(1, BE / 0.3), denoted as the volatility score G1. 0.3 is the volatility threshold. When the relative volatility reaches 0.3, the volatility score is 0, indicating excessive volatility and extremely poor stability, which can be adjusted appropriately. The volatility score measures the proportion of risk volatility within a window to the total decline of the event, reflecting the overall volatility intensity of the decline process; the smaller the volatility score, the greater the volatility and the longer the subsequent cooling-off period. For example, BA=3.6 points, RE=45 points, RS=21 points, then the relative volatility BE=BA / (RE-RS)=0.15, and the volatility score G1=1-min(1, BE / 0.3)=0.5.

[0027] Performing unary linear regression on the risk values in the evaluation window in chronological order to obtain a corresponding change trend line; and obtaining a corresponding trend predicted value for each risk value; calculating a residual corresponding to each risk value in the evaluation window according to the trend predicted value; Calculating the sum of all residuals greater than 0, which is recorded as the total positive residual CX; and calculating the absolute difference between the risk value at the start position and the risk value at the end position of the evaluation window, which is recorded as DW; setting the effective threshold as DM, where DM=max[5, 0.1×(RE-RS)]; If the slope of the change trend line is negative and DW>DM, then CX / DW is calculated and recorded as the positive residual proportion RP; otherwise, CX / (RE-RS) is calculated and recorded as the positive residual proportion RP; if DW<DM, it indicates that DW is too small to be used as a denominator, so (RE-RS) is used instead as the denominator to calculate RP; Setting the rebound score as G2: if RP≤5%, then G2=1; if 5%<RP≤20%, then G2=0.5; if 20%<RP, then G2=0; The rebound score is used to measure the total intensity of upward risk oscillation; a downward pullback is benign and does not constitute a rebound risk; only upward oscillation will increase the possibility of rebound after downgrading; by stripping the overall trend through linear fitting and accumulating the total positive residual, the degree of risk rebound is further quantified; it can distinguish the risk types of multiple rebounds, for example, even if the overall trend is declining, frequent rebounds also indicate that the risk has not truly dissipated; it can effectively avoid prematurely reducing the encryption level due to local risk recovery, and improve the system's ability to identify persistent attacks and intermittent attacks; For example, CX=1.2, DW=15, then DW>DM, the positive residual proportion RP=CX / DW=8%, and the rebound score G2=0.5.

[0028] Acquiring the number of risk values in the evaluation window that are not greater than 1.1×RS, which is recorded as M1; and calculating M1 / M0, which is recorded as the pullback score G3, where M0 is the total number of risk values in the evaluation window; The pullback score G3 is used to measure whether the risk remains at a low level for a long time; if most of the risk values in the evaluation window are close to RS, it indicates that the risk has entered a stable pullback stage; if only a few risk values are low, it indicates that the risk still has large fluctuations and the rebound risk is high; for example, M1=28, M0=30, then the pullback score G3=M1 / M0=0.93; Calculate 0.35×G1+0.35×G2+0.3×G3, which is denoted as the final stability score G0; and calculate the stability adjustment coefficient FG, where FG=max[0.3, min(1.5, 1.8-1.5×G0)]; 0.35, 0.35 and 0.3 are set weights that can be flexibly adjusted; For example, G1=0.5, G2=0.5, G3=0.93, then the final stability score G0=0.35×G1+0.35×G2+0.3×G3=0.63, then min(1.5, 1.8-1.5×G0)=0.86; then the stability adjustment coefficient FG=max[0.3, 0.86]=0.86; The final stability score G0 is formed through weighted calculation, and then the stability adjustment coefficient FG is generated according to G0, so that the risk stability degree can directly affect the final cooling time; Calculate CT×FK×FG, which is denoted as ZT0. If ZT0<DT, set ZT0=DT; if ZT0>MT, set ZT0=MT; otherwise, do not adjust ZT0. After completion, the obtained ZT0 is recorded as the final cooling duration of the cooling start point RS, where MT is the set upper limit of the cooling duration. In this embodiment, MT=60 minutes, which can be flexibly set; For example, CT=18.6, FK=0.75, FG=0.86, then ZT0=CT×FK×FG=12.0 minutes, and the final cooling duration is 12.0 minutes; Combining the three aspects of information including historical risk rules, risk dissipation rate and risk stability state, the cooling time no longer depends on a single indicator, but can comprehensively reflect the real evolution process of risk events; for risks that dissipate rapidly and stably without obvious rebound, the system can appropriately shorten the cooling time, reduce the encryption level in time, cut down the duration of high-level encryption, and lower communication resource consumption; for risks that decline slowly, fluctuate significantly or show signs of rebound, the system can automatically extend the cooling time, avoid reducing the encryption level before the risk has actually ended, reduce protection gaps, and improve the security, stability and reliability of the port area communication system; In the actual implementation process, for the mapping from the positive residual ratio to the rebound score, the segments and ranges can be set according to the actual application scenarios, or linear mapping can be adopted.

[0029] The encryption switching module dynamically switches and callbacks the encryption level of port area communication according to the adaptive risk cooling time; The encryption switching module is configured with an encryption switching strategy, which includes: recording the duration of the cooling timer triggered from the cooling start point as the elapsed cooling duration, and if the mark of the cooling start point RS is not canceled during the cooling timing process and the elapsed cooling duration reaches the final cooling duration, triggering encryption downgrade; Then the encryption level of communication activities in the first port area will be reduced to the encryption level corresponding to the risk level of RS, and the marking of the cooling start point of RS will be removed. In practice, the encryption level is only reverted when the risk remains stable and meets the adaptive cooling time requirements, thanks to the adaptive final cooling time. Compared to a fixed cooling time, this approach takes into account both historical risk patterns and current risk evolution characteristics, making the encryption level switch more in line with the actual risk situation in the port area.

[0030] Example 2, please refer to Figure 2 As shown, this invention provides a deep learning-based method for adaptive encrypted communication switching based on dynamic risk levels in port areas, comprising the following steps: Step S1 involves collecting the risk values ​​and corresponding risk levels of the port area daily in real time to obtain daily dynamic port risk data. Step S1 includes the following sub-steps: Step S101: Denote any port area to be managed as the first port area; collect multi-dimensional data of the first port area; and use deep learning to construct a risk assessment model of the communication behavior of the first port area, which is denoted as the port area risk model; based on the port area risk model, use the collected multi-dimensional data to output the corresponding risk value. Step S102: Set the range of risk values ​​to [0, 100], set four risk levels, which are respectively denoted as extremely high risk, high risk, medium risk and low risk; and set the risk value range corresponding to each risk level.

[0031] Step S103: Set the encryption algorithm and corresponding encryption strength for each risk level; and record the encryption strengths corresponding to extremely high risk, high risk, medium risk and low risk as encryption level 4 to encryption level 1 respectively. Step S104: Based on the port area risk model, the risk value of the first port area is obtained daily at the first time interval, and arranged in the order of collection time, and recorded as the port dynamic risk data for the corresponding date; the port dynamic risk data is collected repeatedly every day, wherein the first time interval is t0.

[0032] Step S2 involves obtaining risk interval data based on historical port dynamic risk data and performing cooling analysis to obtain the baseline cooling duration, thus determining the baseline cooling duration for the current day. Step S2 includes the following sub-steps: Step S201: Based on the current day, obtain the port dynamic risk data for the most recent 15 days, record the most recent 15 days as the reference day, and use any reference day as the first date; Step S202: Record the port dynamic risk data of the first date as a risk change sequence; record the lower limit of the risk value range corresponding to medium risk as the risk threshold R1; Step S203: Record risk values ​​greater than R1 in the risk change sequence as risky values ​​and risk values ​​not greater than R1 as risk-free values; and record consecutive risky values ​​or single risky values ​​in the risk change sequence as risky segments; Step S204: Merge adjacent risky segments with a time interval of less than 2 minutes. After merging, obtain the time interval between any two adjacent risky segments and record it as the risk interval. After completion, obtain the risk interval subset of the first date. Step S205: Repeatedly obtain risk interval subsets for all reference days and merge them to obtain a risk interval set.

[0033] Step S206: Set the original cooling time to AT; denote the total number of risk intervals in the risk interval set as N0; denote any one risk interval in the risk interval set as TI; Step S207: Calculate the proportion of risk intervals less than TI in the risk interval set to N0, and record it as the cumulative rebound probability of TI; repeatedly obtain the cumulative rebound probability of all risk intervals in the risk interval set. Step S208: Based on the risk interval and the corresponding cumulative probability of rebound, construct a curve showing how the cumulative probability of rebound changes with the risk interval, denoted as the cumulative probability curve; and calculate the rate of change of the slope of each point corresponding to the risk interval on the cumulative probability curve.

[0034] Step S209: Obtain the risk interval with a slope change rate of not less than 0.4×AT and the largest corresponding slope change rate, denoted as the optimal cooling time BT, and calculate 0.4×AT+0.6×BT; denoted as CT. Step S210: If CT < 0.5 × AT, then set CT = 0.5 × AT; if CT > 1.5 × AT, then set CT = 1.5 × AT; otherwise, do not adjust CT; after completion, record CT as the base cooling time for the day.

[0035] Step S3: When a risk emerges in the port area and the encryption level is increased, a risk type analysis is performed based on the port's dynamic risk data for the day and the current change threshold information, and an adaptive risk cooling-off time is obtained. Step S3 includes the following sub-steps: Step S301: Set the minimum cooling time to DT; record the basic cooling time for the day as RT0; record the port dynamic risk data collected for the day as the daily risk sequence; based on the daily risk sequence, set the sliding window time length to th, with the current risk value as the endpoint of the sliding window, th... <DT; Step S302: Obtain the maximum risk value RE within the sliding window and the risk value RS at the endpoint (i.e., the current risk value), and calculate the risk dissipation slope KR, where KR = (RE - RS) / tes, and tes represents the time interval from RE to RS; Step S303: If RE > RS and the risk levels corresponding to RE and RS are different, trigger a cooling timer, mark RS as a cooling starting point; and calculate the slope adjustment coefficient FK, where FK=max[0.2, min(1.5, 1.5-0.125×K)].

[0036] Step S304: Continue to collect the risk values of the first port area, update the daily risk sequence, and continuously slide the sliding window. When the risk value RS is located at the start position of the sliding window, the sliding window at this time is recorded as an evaluation window; Step S305: If there is a new cooling starting point in the evaluation window, or the risk level of any risk value in the evaluation window is higher than the risk level of RS, cancel the mark of RS as the cooling starting point; Step S306: If the mark of RS as the cooling starting point is not cancelled; calculate the standard deviation of the risk values in the evaluation window, denoted as BA, calculate BA / (RE-RS), denoted as the relative volatility BE, and calculate 1-min(1, BE / 0.3), denoted as the fluctuation score G1.

[0037] Step S307: Calculate the sum of all residuals greater than the preset value, denoted as the total positive residual CX; and calculate the absolute difference between the risk value at the start position and the risk value at the end position of the evaluation window, denoted as DW; set the effective threshold as DM, where DM=max[5, 0.1×(RE-RS)]; Step S308: If the slope of the change trend line is negative and DW > DM, calculate CX / DW, denoted as the positive residual ratio RP; otherwise, calculate CX / (RE-RS), denoted as the positive residual ratio RP; Step S309: Set the rebound score as G2. If RP ≤ 5%, let G2=1; if 5% < RP ≤ 20%, let G2=0.5; if 20% < RP, let G2=0; Step S310: Obtain the number of risk values in the evaluation window that are not greater than 1.1×RS, denoted as M1; and calculate M1 / M0, denoted as the fallback score G3, where M0 is the total number of risk values in the evaluation window; Step S311: Calculate 0.35×G1 + 0.35×G2 + 0.3×G3, denoted as the final stability score G0; and calculate the stability adjustment coefficient FG, where FG=max[0.3, min(1.5, 1.8-1.5×G0)]; Step S312: Calculate CT×FK×FG, denoted as ZT0. If ZT0 < DT, let ZT0=DT; if ZT0 > MT, let ZT0=MT; otherwise, do not adjust ZT0; after completion, the obtained ZT0 is recorded as the final cooling duration of the cooling starting point RS, where MT is the set upper limit of the cooling duration.

[0038] Step S4 involves dynamically switching the encryption level of port area communication based on the adaptive cooldown time. Step S4 includes the following sub-steps: Step S401: Record the duration of the cooling timer triggered from the cooling start point as the cooling duration. If the cooling start point mark of RS is not canceled during the cooling timer process and the cooling duration reaches the final cooling duration, then trigger encryption downgrade. In step S402, the encryption level of the communication behavior in the first port area is reduced to the encryption level corresponding to the risk level of RS, and the marking of the cooling start point of RS is removed.

[0039] Example 3, please refer to Figure 4 As shown, Figure 4 A schematic diagram of an electronic device is provided, which may include a processor, a communication interface, a memory, and a communication bus. The processor, communication interface, and memory communicate with each other via the communication bus. The memory stores computer-readable instructions, which the processor can call. When the processor executes a computer-readable instruction, it performs steps such as those in the deep learning-based adaptive encrypted communication switching method for dynamic risk levels in port areas to achieve the following functions: daily real-time collection of risk values ​​and corresponding risk levels in port areas to obtain daily dynamic risk data; obtaining risk interval data based on historical port dynamic risk data and performing cooling-off analysis to obtain a baseline cooling-off time for the current day; when a risk occurs in the port area and the encryption level is increased, performing risk type analysis based on the current day's dynamic risk data and current change threshold information to obtain an adaptive risk cooling-off time; and dynamically switching the encryption level of port area communication based on the adaptive cooling-off time.

[0040] Furthermore, when the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0041] Example 4: This application also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program performs steps such as those in the "Adaptive Encrypted Communication Switching Method for Port Area Dynamic Risk Level Based on Deep Learning" to achieve the following functions: daily real-time collection of risk values ​​and corresponding risk levels in the port area to obtain daily dynamic risk data; obtaining risk interval data based on historical port dynamic risk data and performing cooling analysis to obtain a baseline cooling time for the current day; when a risk occurs in the port area and the encryption level is increased, performing risk type analysis based on the current day's dynamic risk data and the current change threshold information, and obtaining an adaptive risk cooling time; and dynamically switching the encryption level of port area communication based on the adaptive cooling time.

[0042] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the block. Figure 1 The function specified in one or more boxes.

[0043] The above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and are not intended to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the scope of the technology disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of protection of the claims.

Claims

1. A port area dynamic risk level adaptive encrypted communication switching system based on deep learning, characterized in that, It includes a risk acquisition module, a benchmark analysis module, a risk cooling module, and an encryption switching module; The risk acquisition module collects the risk value and corresponding risk level of the port area in real time every day to obtain daily dynamic risk data of the port. The benchmark analysis module includes an interval acquisition unit and a cooling benchmark unit; the interval acquisition unit is used to acquire risk interval data based on port dynamic risk data of historical dates, and the cooling benchmark unit is used to perform cooling analysis, acquire benchmark cooling duration, and obtain the benchmark cooling duration for the day. When a risk occurs in the port area and the encryption level is increased, the risk cooling module analyzes the risk type based on the port's dynamic risk data for the day and the current change threshold information, and obtains an adaptive risk cooling time. The encryption switching module dynamically switches the encryption level of port area communications based on an adaptive risk cooldown period.

2. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 1, characterized in that, The risk collection module is configured with risk collection strategies, which include: Any port area to be managed is designated as the first port area; multi-dimensional data of the first port area is collected; and a risk assessment model of the communication behavior of the first port area is constructed using deep learning, which is designated as the port area risk model; based on the port area risk model, the corresponding risk value is output using the collected multi-dimensional data. The risk value is set to a range of [0, 100], and four risk levels are set, namely extremely high risk, high risk, medium risk and low risk; and the risk value range corresponding to each risk level is set.

3. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 2, characterized in that, Risk collection strategies also include: Set the encryption algorithm and corresponding encryption strength for each risk level; and assign encryption strengths for extremely high risk, high risk, medium risk and low risk to encryption levels 4 to 1 respectively. Based on the port area risk model, the risk value of the first port area is obtained daily at the first time interval and arranged in the order of collection time, and recorded as the port dynamic risk data for the corresponding date; the port dynamic risk data is collected repeatedly every day, where the first time interval is t0.

4. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 3, characterized in that, The interval acquisition unit is configured with an interval acquisition strategy, which includes: Based on the current day, obtain the port dynamic risk data for the most recent 15 days, record the most recent 15 days as the reference day, and use any reference day as the first date; The port dynamic risk data for the first date is recorded as the risk change sequence; the lower limit of the risk value range corresponding to medium risk is recorded as the risk threshold R1. Risk values ​​greater than R1 in the risk change sequence are denoted as risky values, and risk values ​​not greater than R1 are denoted as risk-free values; and consecutive risky values ​​or single risky values ​​in the risk change sequence are denoted as risky segments; Merge adjacent risky segments with a time interval of less than 2 minutes. After merging, obtain the time interval between any two adjacent risky segments and record it as the risk interval. After completion, obtain the risk interval subset of the first date. Repeatedly obtain risk interval subsets for all reference days and merge them to obtain the risk interval set.

5. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 4, characterized in that, The cooling reference unit is configured with a reference analysis strategy, which includes: Set the original cooling duration to AT; denote the total number of risk intervals in the risk interval set as N0; denote any one risk interval in the risk interval set as TI; Calculate the proportion of risk intervals less than TI in the risk interval set to N0, and denote it as the cumulative rebound probability of TI; repeatedly obtain the cumulative rebound probability of all risk intervals in the risk interval set; Based on the risk interval and the corresponding cumulative probability of rebound, a curve is constructed to show how the cumulative probability of rebound changes with the risk interval, denoted as the cumulative probability curve; and the rate of change of the slope of each point corresponding to the risk interval on the cumulative probability curve is calculated.

6. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 5, characterized in that, Benchmarking strategies also include: Obtain the risk interval with a slope change rate of not less than 0.4×AT and the largest corresponding risk interval, denoted as the optimal cooling time BT, and calculate 0.4×AT+0.6×BT; denoted as CT. If CT < 0.5 × AT, then set CT = 0.5 × AT; if CT > 1.5 × AT, then set CT = 1.5 × AT; otherwise, do not adjust CT; after completion, record CT as the base cooling time for the day.

7. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 6, characterized in that, The risk cooling module is configured with risk cooling strategies, which include: Set the minimum cooling time to DT; denote the base cooling time for the day as RT0; denote the port dynamic risk data collected for the day as the daily risk sequence; based on the daily risk sequence, set the sliding window duration to th, with the current risk value as the endpoint of the sliding window. <DT; Get the maximum risk value RE within the sliding window and the risk value RS at the endpoint (i.e., the current risk value), and calculate the risk dissipation slope KR, where KR = (RE - RS) / tes, and tes represents the time interval from RE to RS; If RE > RS, and the risk levels corresponding to RE and RS are different, then the cooling timer is triggered, RS is marked as the cooling start point, and the slope adjustment coefficient FK is calculated, where FK = max[0.2, min(1.5, 1.5-0.125×K)].

8. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 7, characterized in that, Risk cooling strategies also include: Continue to collect risk values ​​for the first port area, update the daily risk sequence, and continuously slide the sliding window. When the risk value RS is at the starting position of the sliding window, the sliding window at this time is recorded as the evaluation window. If a new cooling start point exists within the evaluation window, or if the risk level of any risk value within the evaluation window is higher than the risk level of RS, then the marking of the cooling start point of RS will be removed. If the starting point of the cooling of RS is not removed, calculate the standard deviation of the risk value within the evaluation window, denoted as BA, calculate BA / (RE-RS), denoted as relative volatility BE, and calculate 1-min(1,BE / 0.3), denoted as volatility score G1.

9. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 8, characterized in that, Risk cooling strategies also include: Perform a univariate linear regression on the risk values ​​within the evaluation window in chronological order to obtain the corresponding trend line; obtain the trend prediction value for each risk value; and calculate the residual for each risk value within the evaluation window based on the trend prediction value. Calculate the sum of all residuals greater than a preset value, which is recorded as the total positive residual CX; and calculate the absolute difference between the risk value at the start position and the risk value at the end position of the evaluation window, which is recorded as DW; set the effective threshold as DM, where DM=max[5, 0.1×(RE-RS)]; If the slope of the change trend line is negative and DW>DM, calculate CX / DW, which is recorded as the positive residual ratio RP; otherwise, calculate CX / (RE-RS), which is recorded as the positive residual ratio RP; Set the rebound score as G2, if RP≤5%, let G2=1; if 5%<RP≤20%, let G2=0.5; if 20%<RP, let G2=0; Obtain the number of risk values not greater than 1.1×RS in the evaluation window, which is recorded as M1; and calculate M1 / M0, which is recorded as the pullback score G3, where M0 is the total number of risk values in the evaluation window; Calculate 0.35×G1+0.35×G2+0.3×G3, which is recorded as the final stability score G0; and calculate the stability adjustment coefficient FG, where FG=max[0.3, min(1.5, 1.8-1.5×G0)]; Calculate CT×FK×FG, which is recorded as ZT0; if ZT0<DT, set ZT0=DT; if ZT0>MT, set ZT0=MT, otherwise ZT0 is not adjusted; after completion, the obtained ZT0 is recorded as the final cooling duration of the cooling start point RS, where MT is the set upper limit of the cooling duration.

10. The port area dynamic risk level adaptive encrypted communication switching system based on deep learning according to claim 9, characterized in that, The encryption switching module is configured with an encryption switching strategy, and the encryption switching strategy includes: Record the duration of the cooling timer triggered from the cooling start point as the elapsed cooling duration; if the mark of the cooling start point RS is not canceled during the cooling timing process, and the elapsed cooling duration reaches the final cooling duration, trigger encryption downgrade; Then downgrade the encryption level of the communication behavior of the first port area to the encryption level corresponding to the risk level of RS, and cancel the mark of the cooling start point RS.

Images