A computer network security protection system

Abstract

The application discloses a computer network security protection system, comprising: a dynamic reputation evaluation module: generating a reputation score vector representing the risk degree of an IP address; an anti-reverse bloom filter module: performing a preliminary screening query; a traffic fingerprint pre-check module: only when it is judged that the characteristics meet the preset legal client traffic baseline, the destination IP address is transmitted to the anti-reverse bloom filter module for query; a multi-modal behavior analysis module: receiving network traffic marked as to be detected, and adopting an LSTM neural network optimized through adversarial training and a protocol state machine check module to process the network traffic in parallel, so as to respectively generate an LSTM anomaly probability value and a protocol violation flag bit; a weighted fusion decision module: calculating a final risk confidence, and triggering a network protection disposal operation when the final risk confidence exceeds a preset disposal threshold.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a computer network security protection system. Background Technology

[0002] In the wave of digitalization, computer networks have become an indispensable cornerstone of social operation, economic development, and personal life. However, the accompanying methods of cyberattacks are becoming increasingly complex and diverse, with security threats such as data breaches, malware intrusions, and cyber fraud emerging one after another, seriously endangering personal privacy, core corporate interests, and even national security and stability. Against this backdrop, building a comprehensive and efficient computer network security protection system is particularly urgent and necessary. Its purpose is to integrate various advanced security technologies and strategies to form a multi-layered, three-dimensional defense system, monitor in real time, accurately identify, and effectively block various cyber threats, and ensure the stable and reliable operation of the network environment. Its significance lies not only in providing individual users with a safe and trustworthy cyberspace and protecting their digital assets and privacy information, but also in helping enterprises improve their network security protection capabilities, reduce the risks of business interruption and data loss caused by cyberattacks, maintain normal business operations and market competitiveness, and, more importantly, in building a solid network security defense line at the national level, safeguarding the security of the country's critical information infrastructure, protecting national sovereignty, security, and development interests, and promoting the healthy and orderly development of the digital economy.

[0003] In existing technologies, double hash mapping functions are either fixed and publicly available or easily detectable. Attackers can use this as a source of information leakage by feeding a large number of probe IPs into the system and observing whether they are blocked. In an offline state, they can reverse-engineer which bits in the Bloom filter bit array are set to 1. Once the attacker has mastered the mapping relationship between the hash function and the bit array markings, they can construct a malicious IP address in batches. After hash calculation, this IP address can accurately avoid all bits marked as 1, thus penetrating the entire IP blacklist detection mechanism with an innocent identity. Therefore, a computer network security protection system is proposed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a computer network security protection system.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: A computer network security protection system includes: Dynamic reputation assessment module: Accesses external threat intelligence streams to obtain real-time correlation data of IP addresses, and uses a preset attenuation weighting algorithm to dynamically score the IP addresses, generating a reputation score vector that characterizes the risk level of the IP address; The anti-reverse Bloom filter module is communicatively connected to the dynamic reputation assessment module. The anti-reverse Bloom filter module receives the destination IP address of network traffic and calculates the index position of the destination IP address in the Bloom filter bit matrix based on the keyed hash function family bound to the current time window to perform high-speed initial screening query. The hash seed of the keyed hash function family is rotated between adjacent time windows. Traffic fingerprint pre-verification module: set before the anti-reverse Bloom filter module, used to extract the protocol header entropy value and TCP window scaling factor distribution characteristics of the network traffic, and only when the characteristics are determined to match the preset legal client traffic baseline, transmit the destination IP address to the anti-reverse Bloom filter module for querying; Multimodal behavior analysis module: Receives network traffic marked as to be detected, and processes the network traffic in parallel using an LSTM neural network optimized by adversarial training and a protocol state machine verification module to generate LSTM anomaly probability values ​​and protocol violation flag bits respectively; The weighted fusion decision module is used to perform weighted fusion calculation on the reputation score vector, the LSTM anomaly probability value, the protocol violation flag bit, and the behavior fingerprint closed loop hit flag according to the preset priority mapping rules to obtain the final risk confidence, and to trigger network protection handling operation when the final risk confidence exceeds the preset handling threshold.

[0006] The above technical solution further includes: Furthermore, the dynamic reputation assessment module includes a passive DNS resolution behavior analysis submodule. The passive DNS resolution behavior analysis submodule is used to query the historical domain name resolution records associated with an unseen target IP address and the frequency of ASN attribution changes in real time. When it is identified that the frequency of ASN attribution changes in the IP address segment where the target IP address is located exceeds a preset jump threshold within a preset observation period, the risk weight coefficient in the reputation score vector of the target IP address is increased.

[0007] Furthermore, the anti-reverse Bloom filter module is used to dynamically adjust the cache validity period of the destination IP address in the Bloom filter bit array according to the attribution type of the destination IP address. Specifically, for the destination IP address identified as belonging to the IP address range of a cloud computing service provider, the configured cache validity period is shorter than the cache validity period corresponding to the destination IP address belonging to the IP address range of a fixed Internet service provider.

[0008] Furthermore, the multimodal behavior analysis module includes an input feature implicit encoding submodule, an adversarial training generation submodule, a feature compression submodule, and a behavior entropy measurement submodule; The input feature implicit encoding submodule is used to encode and map the source IP address and destination IP address of the network traffic using the locality sensitive hash algorithm, so that multiple IP addresses with similar IP address prefixes are mapped to hash encoding buckets with similar values, thereby inhibiting attackers from reverse parsing the exact IP address encoding space through gradient back-reasoning. The input feature implicit encoding submodule is used to convert the original timestamp data of the network traffic into relative difference sequence data representing the arrival interval of adjacent data packets, and to perform logarithmic binning discretization on the numerical distribution of the relative difference sequence data to reduce the impact of adversarial perturbations caused by attackers fine-tuning the data packet sending interval on the classification boundary of the LSTM neural network. The input feature implicit encoding submodule is used to process the port number information of the network traffic and call the pre-trained protocol recognition model to map the discrete port number data into a low-dimensional dense embedding vector with protocol behavior semantic representation, so that malicious tampering of the port number can synchronously cause the distribution shift of the low-dimensional dense embedding vector in the protocol semantic feature space.

[0009] Furthermore, the adversarial training generation submodule is used to add small perturbations to the input encoding vector during the training phase of the LSTM neural network using the Fast Gradient Sign Method (FGSM) or Projected Gradient Descent (PGD) to generate adversarial sample sequences, and mix the adversarial sample sequences into the original training set to enhance the robustness of the LSTM neural network. Furthermore, the feature compression submodule is set at the front end of the output layer of the LSTM neural network, and is used to perform median smoothing filtering or numerical bit depth reduction operation on the input feature map to reduce the sensitivity of the output classification result to the fluctuation of the details of the input data.

[0010] Furthermore, the behavioral entropy measurement submodule is used to calculate the entropy value of the request Uniform Resource Identifier (URI) diversity, the packet length distribution entropy value, and the packet arrival interval chaos entropy value of a specific source IP address within a unit session window. When it is determined that the reputation score vector of the source IP address is in the medium risk range but the calculation result of the corresponding behavioral entropy measurement submodule exceeds the preset historical baseline upper limit threshold, TCP interception processing of the source IP address is triggered and the corresponding original payload sample data is persistently stored.

[0011] Furthermore, the multimodal behavior analysis module further includes a Transformer attention monitoring branch deployed in parallel with the LSTM neural network. The Transformer attention monitoring branch is only activated and runs when the anomaly probability confidence of the output of the LSTM neural network is within a preset fuzzy range. It is used to capture key mutation point features of network traffic sequences in the global temporal dependency dimension. The key mutation point features include, but are not limited to, the sudden appearance of Transmission Control Protocol Reset RST packets or payload distortion offsets.

[0012] Furthermore, the protocol state machine verification module includes a session state summary maintenance submodule. This submodule is used to temporarily maintain a protocol interaction state summary table for each TCP connection session in a relational database. The protocol interaction state summary table records the TCP three-way handshake flag sequence, the transmission control protocol sequence number change trajectory, and the evolution curve data of the TCP sliding window size. When a violation event is detected where the application layer payload data is carried without completing the three-way handshake or the sequence number and acknowledgment number deviate significantly from the trajectory, the protocol violation flag is unconditionally set to a valid state.

[0013] Furthermore, the weighted fusion decision module is internally configured with a priority mapping rule set for distinguishing processing priorities. This priority mapping rule set defines response concatenation relationships for different detection dimensions, and the response concatenation relationships are as follows: Prioritize the valid status of the closed-loop hit flag in the behavior fingerprint; The next step is to respond to the low reputation score state indicated in the reputation score vector; Finally, the initial hit status output by the anti-reverse Bloom filter module is responded to to realize the asynchronous convergence logic between emergency blocking caching based on specific behavioral fingerprints and long-term reputation observation based on IP address entities.

[0014] The present invention has the following beneficial effects: In this invention, a family of keyed hash functions bound to a time window is introduced into the anti-reverse Bloom filter module for index calculation, realizing the periodic dynamic change of the hash mapping relationship. The bypass IP address reversed by the attacker for the current time window will be completely invalidated in the next time window due to the change of hash seed. The attack behavior becomes a high-risk operation that exposes its malicious probe, fundamentally increasing the cost of anti-reverse. Attached Figure Description

[0015] Figure 1 This is a system block diagram of a computer network security protection system proposed in this invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Please see Figure 1 As shown, the present invention is a computer network security protection system, comprising: Dynamic reputation assessment module: Accesses external threat intelligence streams to obtain real-time correlation data of IP addresses, and uses a preset attenuation weighting algorithm to dynamically score the IP addresses, generating a reputation score vector that characterizes the risk level of the IP address; The anti-reverse Bloom filter module is communicatively connected to the dynamic reputation assessment module. The anti-reverse Bloom filter module receives the destination IP address of network traffic and calculates the index position of the destination IP address in the Bloom filter bit matrix based on the keyed hash function family bound to the current time window to perform high-speed initial screening query. The hash seed of the keyed hash function family is rotated between adjacent time windows. Traffic fingerprint pre-verification module: set before the anti-reverse Bloom filter module, used to extract the protocol header entropy value and TCP window scaling factor distribution characteristics of the network traffic, and only when the characteristics are determined to match the preset legal client traffic baseline, transmit the destination IP address to the anti-reverse Bloom filter module for querying; Multimodal behavior analysis module: Receives network traffic marked as to be detected, and processes the network traffic in parallel using an LSTM neural network optimized by adversarial training and a protocol state machine verification module to generate LSTM anomaly probability values ​​and protocol violation flag bits respectively; The weighted fusion decision module is used to perform weighted fusion calculation on the reputation score vector, the LSTM anomaly probability value, the protocol violation flag bit, and the behavior fingerprint closed loop hit flag according to the preset priority mapping rules to obtain the final risk confidence, and to trigger network protection handling operation when the final risk confidence exceeds the preset handling threshold. The weighted fusion decision module is further used to execute the following fusion determination logic: The value of the protocol violation flag is assigned a first preset weighting coefficient for weighting; The value of the behavioral fingerprint closed-loop hit flag is assigned a second preset weighting coefficient for weighting; The LSTM anomaly probability values ​​are weighted by a third preset weighting coefficient. The low credit indicator values ​​in the credit score vector are assigned a fourth preset weight coefficient for weighting, and the weighted results of the above items are summed to generate the final risk confidence level. The TCP interception or source IP address rate limiting operation is triggered for the target traffic data only if the calculated result of the final risk confidence is greater than the preset handling threshold constant.

[0018] In this embodiment: The dynamic reputation assessment module accesses the external threat intelligence stream to obtain real-time correlation data of IP addresses, and uses a preset attenuation weighting algorithm to perform dynamic reputation scoring on the IP addresses, generating a reputation score vector that characterizes the risk level of the IP addresses. The attenuation-weighted algorithm calculates the real-time risk contribution of the IP address using the following formula. ,in, This indicates the current dynamic reputation score of the IP address. Let represent the initial weight of the i-th threat intelligence event, and λ be a preset decay constant. Let be the time interval between the occurrence of the i-th threat intelligence event and the current time. Let be the severity index of the i-th threat intelligence incident, and η be the adjustment coefficient for passive DNS resolution behavior analysis. The volatility score is calculated based on the historical domain name resolution records associated with the IP address and the frequency of changes in the Autonomous System Number (ASN). The calculation of passive DNS resolution behavior analysis The logic includes: counting the number of different domain names associated with the IP address within a preset backtracking time window. and the corresponding number of ASN attribution changes and based on Perform calculations, where and This is a preset positive normalization constant; After receiving network traffic, the traffic fingerprint pre-verification module extracts the protocol header entropy value and the distribution characteristics of the transmission control protocol TCP window scaling factor of the network traffic, and compares the extracted features with the preset legal client traffic baseline. Only when the features are determined to match the legal client traffic baseline will the destination IP address of the network traffic be released to the subsequent processing stage. The operation of extracting the protocol header entropy value of the network traffic is specifically based on... Calculations are performed, in which, This represents a random variable in the protocol header field of the network traffic collected within a unit time window. For the random variable The probability of occurrence, when calculated When the value falls outside the preset entropy value envelope range of the legitimate client traffic baseline, it is determined that the network traffic does not conform to the legitimate client traffic baseline, and subsequent queries for the destination IP address are terminated. The anti-reverse Bloom filter module receives the destination IP address that has passed the pre-verification step of the traffic fingerprint, and calculates the index position of the destination IP address in the Bloom filter bit array based on the keyed hash function family bound to the current time window to perform a high-speed initial screening query. The hash seed used by the keyed hash function family is forcibly rotated between adjacent time windows. For network traffic marked as to be detected through the aforementioned steps, the multimodal behavior analysis module uses an LSTM neural network optimized by adversarial training and the protocol state machine verification module to process the network traffic in parallel, so as to independently generate LSTM anomaly probability values ​​representing the degree of behavior abnormality and protocol violation flag bits representing connection compliance. During adversarial training, LSTM neural networks optimize model parameters by solving the following maximization-minimization objective function. Where θ represents the model parameters of the LSTM neural network, δ represents the small adversarial perturbation added to the original input data X, and Δ represents the allowable space constraint of the adversarial perturbation. The prediction function output by the LSTM neural network. is the true label value, and L(·) is the loss function that measures the difference between the predicted result and the true label; The weighted fusion decision module calls the weighted fusion function to perform weighted fusion calculation on the reputation score vector, the LSTM anomaly probability value, the protocol violation flag bit, and the behavior fingerprint closed loop hit flag according to the preset priority mapping rules, so as to generate the final risk confidence. When the final risk confidence exceeds the preset handling threshold, the network protection handling operation for the network traffic is triggered. The formula used by the weighted fusion decision module to calculate using the weighted fusion function is as follows: ,in, The final risk confidence level, This is the binarized value of the protocol violation flag. This is the binarized value of the behavioral fingerprint loop closure hit flag. The LSTM anomaly probability value is... The normalized risk score is obtained by transforming the reputation score vector; The preset weighting coefficients are used, and they satisfy the following conditions: > > > This reflects the response cascading relationship defined by the priority mapping rule; The multimodal behavior analysis module further includes the following steps in feature encoding the network traffic: mapping the source IP address and destination IP address using a locality-sensitive hashing algorithm, so that addresses with similar IP address prefixes are mapped to neighbor hash buckets in a high-dimensional space; and processing the original timestamp data to convert it into a relative difference sequence representing the arrival interval of adjacent data packets. and the relative difference sequence Each element in the logarithmic binning discretization process is performed with a base-2 logarithmic value to obtain the logarithmically compressed time interval features.

[0019] In one embodiment, the dynamic reputation assessment module includes a passive DNS resolution behavior analysis submodule. The passive DNS resolution behavior analysis submodule is used to query the historical domain name resolution records associated with an unseen target IP address and the frequency of ASN attribution changes in real time. When it is identified that the frequency of ASN attribution changes in the IP address segment where the target IP address is located exceeds a preset jump threshold within a preset observation period, the risk weight coefficient in the reputation score vector of the target IP address is increased.

[0020] In one embodiment, the anti-reverse Bloom filter module is used to dynamically adjust its cache validity period in the Bloom filter bit array according to the attribution type of the destination IP address, wherein, for the destination IP address identified as belonging to the IP address range of a cloud computing service provider, the configured cache validity period is shorter than the cache validity period corresponding to the destination IP address belonging to the IP address range of a fixed Internet service provider.

[0021] In one embodiment, the multimodal behavior analysis module includes an input feature implicit encoding submodule, an adversarial training generation submodule, a feature compression submodule, and a behavior entropy measurement submodule. The input feature implicit encoding submodule is used to encode and map the source IP address and destination IP address of the network traffic using the locality sensitive hash algorithm, so that multiple IP addresses with similar IP address prefixes are mapped to hash encoding buckets with similar values, thereby inhibiting attackers from reverse parsing the exact IP address encoding space through gradient back-reasoning. The input feature implicit encoding submodule is used to convert the original timestamp data of the network traffic into relative difference sequence data representing the arrival interval of adjacent data packets, and to perform logarithmic binning discretization on the numerical distribution of the relative difference sequence data to reduce the impact of adversarial perturbations caused by attackers fine-tuning the data packet sending interval on the classification boundary of the LSTM neural network. The input feature implicit encoding submodule is used to process the port number information of the network traffic and call the pre-trained protocol recognition model to map the discrete port number data into a low-dimensional dense embedding vector with protocol behavior semantic representation, so that malicious tampering of the port number can synchronously cause the distribution shift of the low-dimensional dense embedding vector in the protocol semantic feature space.

[0022] In one embodiment, the adversarial training generation submodule is used to add small perturbations to the input encoding vector during the training phase of the LSTM neural network using the Fast Gradient Sign Method (FGSM) or Projected Gradient Descent (PGD) to generate an adversarial sample sequence, and mix the adversarial sample sequence into the original training set to enhance the robustness of the LSTM neural network. In one embodiment, the feature compression submodule is located at the front end of the output layer of the LSTM neural network and is used to perform median smoothing filtering or numerical bit depth reduction on the input feature map to reduce the sensitivity of the output classification result to fluctuations in the details of the input data.

[0023] In one embodiment, the behavioral entropy measurement submodule is used to calculate the entropy value of the diversity of request Uniform Resource Identifier (URI), the entropy value of the packet length distribution, and the entropy value of the chaotic degree of packet arrival interval presented by a specific source IP address within a unit session window. When it is determined that the reputation score vector of the source IP address is in the medium risk range but the calculation result of the corresponding behavioral entropy measurement submodule exceeds the preset historical baseline upper limit threshold, TCP interception processing of the source IP address is triggered and the corresponding original payload sample data is persistently stored.

[0024] In one embodiment, the multimodal behavior analysis module further includes a Transformer attention monitoring branch deployed in parallel with the LSTM neural network. The Transformer attention monitoring branch is activated only when the confidence level of the anomaly probability output by the LSTM neural network is within a preset fuzzy range. It is used to capture key mutation point features of network traffic sequences in the global temporal dependency dimension. The key mutation point features include, but are not limited to, the sudden appearance of Transmission Control Protocol Reset (RST) packets or payload distortion offsets.

[0025] In one embodiment, the protocol state machine verification module includes a session state summary maintenance submodule. The session state summary maintenance submodule is used to temporarily maintain a protocol interaction state summary table for each TCP connection session in a relational database. The protocol interaction state summary table records the TCP three-way handshake flag sequence, the transmission control protocol sequence number change trajectory, and the evolution curve data of the TCP sliding window size. When a violation event is detected in which the application layer payload data is carried without completing the three-way handshake or the sequence number acknowledgment number deviates significantly from the trajectory, the protocol violation flag is unconditionally set to a valid state.

[0026] In one embodiment, the weighted fusion decision module is internally configured with a priority mapping rule set for distinguishing processing priorities. The priority mapping rule set defines response concatenation relationships for different detection dimensions, and these response concatenation relationships are as follows: Prioritize the valid status of the closed-loop hit flag in the behavior fingerprint; The next step is to respond to the low reputation score state indicated in the reputation score vector; Finally, the initial hit status output by the anti-reverse Bloom filter module is responded to to realize the asynchronous convergence logic between emergency blocking caching based on specific behavioral fingerprints and long-term reputation observation based on IP address entities.

[0027] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A computer network security protection system, characterized in that, include: Dynamic reputation assessment module: Accesses external threat intelligence streams to obtain real-time correlation data of IP addresses, and uses a preset attenuation weighting algorithm to dynamically score the IP addresses, generating a reputation score vector that characterizes the risk level of the IP address; Anti-reverse Bloom filter module: Receives the destination IP address of network traffic and calculates the index position of the destination IP address in the Bloom filter bit matrix based on the keyed hash function family bound to the current time window to perform an initial screening query, wherein the hash seed of the keyed hash function family is rotated between adjacent time windows; Traffic fingerprint pre-verification module: set before the anti-reverse Bloom filter module, used to extract the protocol header entropy value and TCP window scaling factor distribution characteristics of the network traffic, and only when the characteristics are determined to match the preset legal client traffic baseline, transmit the destination IP address to the anti-reverse Bloom filter module for querying; Multimodal behavior analysis module: Receives network traffic marked as to be detected, and processes the network traffic in parallel using an LSTM neural network optimized by adversarial training and a protocol state machine verification module to generate LSTM anomaly probability values ​​and protocol violation flag bits respectively; The weighted fusion decision module is used to perform weighted fusion calculation on the reputation score vector, the LSTM anomaly probability value, the protocol violation flag bit, and the behavior fingerprint closed loop hit flag according to the preset priority mapping rules to obtain the final risk confidence, and to trigger network protection handling operation when the final risk confidence exceeds the preset handling threshold.

2. The computer network security protection system according to claim 1, characterized in that, The dynamic reputation assessment module includes a passive DNS resolution behavior analysis submodule. This submodule is used to query the historical domain name resolution records associated with an unseen target IP address and the frequency of ASN attribution changes in real time. When it is identified that the frequency of ASN attribution changes in the IP address segment where the target IP address is located exceeds a preset jump threshold within a preset observation period, the risk weight coefficient in the reputation score vector of the target IP address is increased.

3. The computer network security protection system according to claim 1, characterized in that, The anti-reverse Bloom filter module is used to dynamically adjust the cache validity period of the destination IP address in the Bloom filter matrix according to the attribution type of the destination IP address. Specifically, for the destination IP address identified as belonging to the IP address range of a cloud computing service provider, the configured cache validity period is shorter than the cache validity period corresponding to the destination IP address belonging to the IP address range of a fixed Internet service provider.

4. A computer network security protection system according to claim 1, characterized in that, The multimodal behavior analysis module includes an input feature implicit encoding submodule, an adversarial training generation submodule, a feature compression submodule, and a behavior entropy measurement submodule. The input feature implicit encoding submodule is used to encode and map the source IP address and destination IP address of the network traffic using the locality sensitive hash algorithm, so that multiple IP addresses with similar IP address prefixes are mapped to hash encoding buckets with similar values. The input feature implicit encoding submodule is used to convert the original timestamp data of the network traffic into relative differential sequence data representing the arrival interval of adjacent data packets, and to perform logarithmic binning discretization processing on the numerical distribution of the relative differential sequence data. The input feature implicit encoding submodule is used to process the port number information of the network traffic and call the pre-trained protocol recognition model to map the discrete port number data into a low-dimensional dense embedding vector with protocol behavior semantic representation.

5. A computer network security protection system according to claim 4, characterized in that, The adversarial training generation submodule is used to add small perturbations to the input encoding vector during the training phase of the LSTM neural network to generate adversarial sample sequences, and to mix the adversarial sample sequences into the original training set.

6. A computer network security protection system according to claim 5, characterized in that, The feature compression submodule is located at the front end of the output layer of the LSTM neural network and is used to perform median smoothing filtering or numerical bit depth reduction operations on the input feature map.

7. A computer network security protection system according to claim 6, characterized in that, The behavioral entropy measurement submodule is used to calculate the entropy value of the request Uniform Resource Identifier (URI) diversity, the packet length distribution entropy value, and the packet arrival interval chaos entropy value of a specific source IP address within a unit session window. When it is determined that the reputation score vector of the source IP address is in the medium risk range but the calculation result of the corresponding behavioral entropy measurement submodule exceeds the preset historical baseline upper limit threshold, TCP interception processing of the source IP address is triggered and the corresponding original payload sample data is persistently stored.

8. A computer network security protection system according to claim 7, characterized in that, The multimodal behavior analysis module further includes a Transformer attention monitoring branch deployed in parallel with the LSTM neural network. The Transformer attention monitoring branch is activated only when the confidence level of the anomaly probability output by the LSTM neural network is within a preset fuzzy range, and is used to capture key mutation point features of network traffic sequences in the global temporal dependency dimension.

9. A computer network security protection system according to claim 1, characterized in that, The protocol state machine verification module includes a session state summary maintenance submodule. This submodule is used to temporarily maintain a protocol interaction state summary table for each TCP connection session in a relational database. The protocol interaction state summary table records the TCP three-way handshake flag sequence, the transmission control protocol sequence number change trajectory, and the evolution curve data of the TCP sliding window size. When a violation event is detected where the application layer payload data is carried without completing the three-way handshake or the sequence number and acknowledgment number deviate significantly from the trajectory, the protocol violation flag is unconditionally set to a valid state.

10. A computer network security protection system according to claim 1, characterized in that, The weighted fusion decision module is internally configured with a priority mapping rule set for distinguishing processing priorities. This priority mapping rule set defines response concatenation relationships for different detection dimensions, and the response concatenation relationships are as follows: Prioritize the valid status of the closed-loop hit flag in the behavior fingerprint; The next step is to respond to the low reputation score state indicated in the reputation score vector; Finally, the initial screening hit status is output by the anti-reverse Bloom filter module.

Images