An encrypted communication transmission behavior compliance intelligent research and early warning system

Abstract

The application relates to the technical field of encrypted communication and discloses an encrypted communication transmission behavior compliance intelligent research and early warning system, which comprises the following steps: receiving a bypass mirror message; identifying the bypass mirror message; analyzing the bypass mirror message; calculating a time sequence folding coefficient; generating an alarm category; generating a non-plaintext verification segment; and outputting a link compliance early warning signal. The encrypted communication transmission behavior compliance intelligent research and early warning system can separate collected structure deformation and real communication abnormalities through handshake anchoring time sequence folding coefficient calculation, reduce false positives and false negatives, make ordered judgments based on evidence reliability through hierarchical compliance research, improve the accuracy of research, process non-plaintext evidence, retain audit credentials while reducing the exposure of sensitive data, adapt to various encrypted communication compliance monitoring scenarios of bypass deployment, help improve the reliability and security of encrypted communication compliance research, reduce the invasiveness of the monitoring system to business, and meet the related requirements of compliance audit.

Description

Technical Field

[0001] This invention relates to the field of encrypted communication technology, and more specifically, to an intelligent assessment and early warning system for the compliance of encrypted communication transmission behavior. Background Technology

[0002] Currently, encrypted communication has become a common method for network data transmission. Encryption protocols such as Transport Layer Security (TLS), Chinese national cryptographic protocols, Internet Protocol Security (IPS), and Secure Shell are widely used in various business scenarios to ensure data transmission security. To conduct compliance monitoring without affecting business operations, most monitoring systems adopt a bypass mirroring deployment method. This method obtains mirrored traffic from the business link through an optical splitter. It does not require inline insertion into the business link, does not require modification of business configurations, and the deployment process has no impact on business operations, thus gaining widespread application.

[0003] Existing non-decryption monitoring solutions typically extract visible fields from the handshake phase for compliance comparison of protocol configurations. They also extract features such as packet length and time intervals from the ciphertext for behavioral analysis, thereby achieving compliance monitoring of encrypted communication. However, during bypass mirroring, in scenarios with multiple access points converging, bidirectional packets pass through different processing queues, causing distortions in packet timing and changes in the characteristics of the ciphertext rhythm. This affects the analysis results based on the ciphertext rhythm.

[0004] In existing technologies, most solutions fail to correct for temporal distortions caused by the acquisition structure, nor do they distinguish between distortions and genuine anomalies. This easily leads to misjudging rhythmic changes caused by acquisition distortions as abnormal behavior, and also makes it easy to miss genuine abnormal behavior due to acquisition distortions. Furthermore, existing solutions carry a large amount of sensitive business data when extracting audit evidence, posing a risk of privacy leaks. Some solutions use self-learning methods to update parameters, resulting in poor repeatability of output results and difficulty in meeting compliance audit requirements. Summary of the Invention

[0005] This invention provides an intelligent assessment and early warning system for compliance of encrypted communication transmission behavior, which solves the technical problems mentioned in the background.

[0006] This invention provides an intelligent assessment and early warning system for compliance of encrypted communication transmission behavior, comprising: The parameter acquisition module is used to receive bypass mirror messages and write hardware timestamps, communication quintuples, interface line speeds, preset port offsets, and message lengths into the bypass mirror messages. The message recognition module is used to identify the handshake protocol message in the bypass mirror message as a time anchor point and extract the transmission direction of the bypass mirror message after the time anchor point. The message parsing module is used to parse and extract the protocol configuration set, key cycle set, security credential set, and ciphertext metric set from the bypass mirror message; The timing folding coefficient calculation module is used to calculate the normalized time series by combining hardware timestamps, time anchors, interface line speeds, preset port offsets, and message lengths. It calculates the message interval based on the difference of the normalized time series, determines the direction switching weight based on the transmission direction of the message, and calculates the timing folding coefficient based on the change relationship between adjacent message intervals and the direction switching weight. The alarm category generation module is used to compare the time-series folding coefficient with a preset threshold to obtain the comparison result, and combine the comparison result, protocol configuration set, key cycle set, security credential set and ciphertext metric set to generate alarm categories. The non-plaintext verification fragment generation module is used to perform hash calculations on the communication quintuple and time anchor point inside the bypass mirror message to generate a session locator, and combine the alarm category, time anchor point and corresponding non-plaintext field digest to generate a non-plaintext verification fragment. The warning signal output module is used to concatenate alarm categories, session locators, and non-plaintext verification fragments to output link compliance warning signals.

[0007] The beneficial effects of this invention are as follows: By solidifying the structural information of the acquisition side during the acquisition phase, this invention can provide reliable basic data for subsequent timing correction; through the calculation of timing folding coefficients anchored by handshake, it can separate acquisition structure deformation from actual communication anomalies, reducing false alarms and missed alarms; through layered compliance assessment, it can make orderly judgments based on the reliability of evidence, improving the accuracy of the assessment; through non-plaintext evidence processing, it can reduce the exposure of sensitive data while retaining audit evidence; and through a fixed parameter output mechanism, it can ensure the objectivity and repeatability of the output results. This invention is adaptable to various bypass-deployed encrypted communication compliance monitoring scenarios, helping to improve the reliability and security of encrypted communication compliance assessment, while reducing the intrusiveness of the monitoring system to business operations, and meeting the relevant requirements of compliance auditing. Attached Figure Description

[0008] Figure 1 This is a schematic diagram of a module of an intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to the present invention; Figure 2 This is a UML diagram of an intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to the present invention. Detailed Implementation

[0009] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, features described in some examples may be combined in other examples.

[0010] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of the present invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in one or more embodiments of the present invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" indicate that the element or object preceding the term encompasses the elements or objects listed following the term and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0011] like Figures 1-2 As shown, a smart judgment and early warning system for compliance of encrypted communication transmission behavior includes: The parameter acquisition module is used to receive bypass mirror messages and write hardware timestamps, communication quintuples, interface line speeds, preset port offsets, and message lengths into the bypass mirror messages. The message recognition module is used to identify the handshake protocol message in the bypass mirror message as a time anchor point and extract the transmission direction of the bypass mirror message after the time anchor point. The message parsing module is used to parse and extract the protocol configuration set, key cycle set, security credential set, and ciphertext metric set from the bypass mirror message; The timing folding coefficient calculation module is used to calculate the normalized time series by combining hardware timestamps, time anchors, interface line speeds, preset port offsets, and message lengths. It calculates the message interval based on the difference of the normalized time series, determines the direction switching weight based on the transmission direction of the message, and calculates the timing folding coefficient based on the change relationship between adjacent message intervals and the direction switching weight. The alarm category generation module is used to compare the time-series folding coefficient with a preset threshold to obtain the comparison result, and combine the comparison result, protocol configuration set, key cycle set, security credential set and ciphertext metric set to generate alarm categories. The non-plaintext verification fragment generation module is used to perform hash calculations on the communication quintuple and time anchor point inside the bypass mirror message to generate a session locator, and combine the alarm category, time anchor point and corresponding non-plaintext field digest to generate a non-plaintext verification fragment. The warning signal output module is used to concatenate alarm categories, session locators, and non-plaintext verification fragments to output link compliance warning signals.

[0012] In one embodiment of the present invention, the parameter acquisition module is configured to perform: The bypass mirror message of the encrypted communication link is received through the optical port or the electrical port, and a hardware timestamp is written when the bypass mirror message enters the media access control receiving boundary. The hardware timestamp is generated before the bypass mirror message enters the shared buffer. Write the communication quintuple, Layer 2 direction, VLAN identifier, access point number, interface line speed, preset port offset, and message length into the bypass mirror message. The message length is the link layer receive length. The hardware timestamp, communication quintuple, interface line speed, preset port offset, message length, and access point number are encapsulated into an uncoverable acquisition header, and the bypass mirror message and acquisition header are sent into a read-only analysis queue. When both ends of the same physical link are mirrored, the message transmission direction is determined based on the access point number and the transmission direction corresponding to the communication quintuple, and is not determined based on the application layer content. Among these, the monitoring equipment does not enter the business link, does not inject probe messages into the business link, and does not decrypt transport layer security protocols, national cryptographic transport layer cryptographic protocols, secure shell protocols, encapsulated secure payload protocols, or application layer payloads.

[0013] It should be noted that the Media Access Control (MAC) receiving boundary is the frontmost hardware logic location in the FPGA or high-speed acquisition board for receiving network packets, and it is the first processing node after the packet enters the monitoring device.

[0014] The preset port offset is a clock offset value inherent to each interface at the hardware level. It is obtained through calibration before the device leaves the factory or during project deployment. The value ranges from -100 nanoseconds to 100 nanoseconds. After calibration, it is written to the hardware non-volatile register and read directly during subsequent acquisition.

[0015] Interface line speed is the physical transmission rate of the interface, measured in bits per second, and can be obtained by reading the hardware interface configuration register.

[0016] The link layer receive length is the actual number of bytes when the message is completely received at the link layer, excluding fields added or deleted during subsequent software processing. It can be obtained by statistically counting the number of bytes received by the message through hardware receive logic.

[0017] The acquisition header is an unoverwriteable data structure that encapsulates the hardware timestamp, communication quintuple, interface line speed, preset port offset, message length, and access point number. It is generated by the hardware receiving logic when the message is received and can only be read, not modified, during subsequent processing.

[0018] The read-only analysis queue is a message queue that can only be written to and cannot be modified or deleted. It is used to store the mirrored messages and acquisition headers to be analyzed. It is implemented by hardware logic. Write permissions are only open to the receiving logic, and other processing modules only have read permissions.

[0019] The shared buffer is a hardware buffer area in the monitoring device used to temporarily store received messages. It can be implemented through the block RAM inside the FPGA and is used to temporarily buffer received messages and acquisition headers.

[0020] Specifically, fixed port offset calibration needs to be completed in a standard environment. The calibration environment requires an ambient temperature of 25 degrees Celsius, an ambient humidity of 50%, and no strong external electromagnetic interference. The calibration steps first use a built-in high-precision standard clock source to send continuous test messages at 1-microsecond intervals. The length of the test messages covers the commonly used range of 64 bytes to 1500 bytes. Each access point receives these test messages sequentially, and the hardware records the reception time of each message. Then, the reception time is compared with the transmission time of the standard clock source to calculate the average time difference for each access point. After repeating the measurement multiple times, the average value is taken to obtain the preset port offset of that access point.

[0021] Specifically, the hardware implementation of the non-overwriteable acquisition head involves partitioning the FPGA's memory resources, creating a separate storage area for the acquisition head, and implementing a hardware-level write protection mechanism. Only the hardware receiving logic has write access to this area, while software modules and other hardware processing modules only have read access. When a message enters the Media Access Control (MAC) receiving boundary, the receiving logic writes the generated acquisition head to the corresponding storage address. After writing, this address is automatically marked as read-only, and no subsequent processing module can modify the content of this address.

[0022] Specifically, the hardware receiving logic extracts relevant fields as follows: After a packet enters the Media Access Control (MAC) receiving boundary, the hardware receiving logic first reads the unique number of the current access point, then parses the link layer header to extract the source MAC address, destination MAC address, and virtual LAN identifier (VLAN ID) if the packet carries a VLAN tag. Next, it parses the network layer header to extract the source Internet Protocol (IP) address and destination IP address, and then parses the transport layer header to extract the source port, destination port, and transport layer protocol number. These five fields together form the communication quintuple. The Layer 2 direction is determined based on the physical connection direction of the access point, marking the packet as an inbound packet entering the monitoring device from the service link. The entire process is completed within the hardware logic, taking no more than 100 nanoseconds, and will not affect the packet processing speed. For example, when a message enters access point 3, the receiving logic first reads the port number as 3, and then parses it to obtain the source media access control address as 001122334455, the destination media access control address as aabbccddeeff, the virtual LAN identifier as 100, the source internet protocol address as 192.168.1.100, the destination internet protocol address as 192.168.2.200, the source port as 443, the destination port as 51234, and the transport layer protocol number as 6, thus completing the extraction of all fields.

[0023] It should be noted that this embodiment writes a hardware timestamp at the Media Access Control (MAC) receive boundary, encapsulates an unalterable acquisition header, and determines the packet transmission direction through the access point number and the communication quintuple. It does not rely on application layer content. The monitoring device acquires mirrored traffic through an optical splitter, without interfering with the service link or injecting probe packets. The deployment process is seamless and unaffected by the service. This ensures that the acquired mirrored packets carry complete and tamper-proof acquisition-side structural information, providing reliable foundational data for the accurate calculation of subsequent timing folding coefficients, while avoiding interference with the service link and intrusion into service data.

[0024] In one embodiment of the present invention, the message identification module is configured to perform: Identify the handshake protocol messages within the bypass mirror message based on the port, protocol number, record layer type, handshake message type, and exchange type. The client greeting message or equivalent first handshake protocol message in the Transport Layer Security Protocol session or the Chinese Cryptographic Transport Layer Cryptography Protocol session is determined as the time anchor; the first security association initialization request message in the Internet Protocol Security Key Exchange session is determined as the time anchor; and the first key exchange message after the protocol version exchange in the Secure Shell Protocol session is determined as the time anchor. Record the time anchor point, time anchor point message length, time anchor point direction, and time anchor point access point, and extract the transmission direction of the bypass mirror message after the time anchor point; The twenty-four bypass mirror messages after the time anchor point are determined as the folding calculation window; if there are less than twenty-four bypass mirror messages within two seconds, all bypass mirror messages within two seconds are determined as the folding calculation window, and the missing interval is handled by using a fixed minimum positive time amount. Encrypted payloads for which no time anchor point is identified will not be included in the compliance assessment.

[0025] It should be noted that the time anchor point is the first handshake protocol message in the encrypted session that can be reliably identified and does not require decryption, serving as the benchmark for the entire session's timing analysis.

[0026] The folding calculation window is a set of messages used to calculate the timing folding coefficient after the time anchor point. By default, it contains 24 messages or all messages within 2 seconds. It prioritizes counting the number of messages after the anchor point. Once 24 messages are counted, the counting stops. If less than 24 messages are counted within 2 seconds, all messages within 2 seconds are used as the window content.

[0027] The minimum positive time value is fixed as a preset positive value used to handle missing intervals and avoid computational instability, preferably 1 nanosecond.

[0028] Security association initialization is the first request phase in an Internet Protocol Security Key Exchange session to establish an initial security association, serving as a time anchor for identifying this type of session.

[0029] Specifically, the hardware-level coarse classification is implemented using lookup tables and hardware registers within the FPGA. The transport layer protocol number, destination port number, and the first four bytes of the packet are taken as input. A pre-defined classification rule quickly determines the encryption protocol type to which the packet belongs. The classification rule first determines the transport layer protocol type; for TCP, it matches commonly used encryption protocol ports, and the same applies to UDP. Then, it reads the first four bytes of the packet to further confirm the protocol characteristics, distributing packets of different protocols to the corresponding hardware processing channels. In actual processing, 10G bandwidth traffic can be coarsely classified into coarse categories for a single packet within 1 microsecond, without causing processing delays.

[0030] Specifically, the detailed identification rules for handshake messages of different encryption protocols are as follows: For Transport Layer Security (TLS) sessions, the client greeting message serves as the anchor. The first byte of this message is the handshake type identifier. Unencrypted handshake fields, including the client random number, session identifier, and cipher suite list, are located in the first half of the handshake message and can be read directly without decryption. The client greeting message structure of TLS version 1.3 is compatible with earlier versions, with the unencrypted handshake fields remaining in the same position and also easily extracted. For the Chinese National Cryptography (CNLP) Transport Layer Cryptography (TLS) client greeting message, the version identifier is a specific value. Subsequent certificate messages will contain the signature certificate and encryption certificate sequentially, allowing identification based on the certificate order. For Internet Protocol Security (IPS) key exchange sessions, the first request message for security association initialization serves as the anchor. The exchange type identifier of this message is a specific value and can be directly identified. For Secure Shell (SSL) sessions, the first key exchange initialization message after protocol version exchange serves as the anchor. The type identifier of this message is a specific value and can be directly identified. For example, when a message from a Transport Layer Security Protocol version 1.3 enters, it is parsed to reveal that the Record Layer type is a handshake type. Then, the client's random number and cipher suite list are read. These fields are all unencrypted, thus completing the identification of the anchor point.

[0031] Specifically, the session locator is generated using the SHA256 hash algorithm. The input data consists of a communication quintuple and a timestamp of the time anchor. These data are concatenated into binary data in a fixed order, followed by hash calculation. The resulting 32-byte hash value is truncated to the first 16 bytes as the session locator. This method ensures that each encrypted session has a unique identifier, while also allowing the original communication address and time information to be reconstructed through the session locator, thus protecting business privacy.

[0032] It should be noted that this embodiment uses the visible handshake message of the encryption protocol as a stable anchor point for physical timing analysis, avoiding random drift caused by taking any traffic start point as the statistical start point. By setting a fixed-size folding calculation window, it ensures that the calculation of timing folding features has a unified benchmark and comparability. The system will ignore messages that have not been identified as time anchor points. These messages will not enter the subsequent analysis process, avoiding the processing of invalid traffic and ensuring that the system can handle high-bandwidth business traffic.

[0033] In one embodiment of the present invention, the message parsing module is configured to perform: Parse and extract the protocol configuration set, key cycle set, security credential set, and ciphertext metric set from the handshake protocol message, certificate digest, session identifier, and ciphertext metadata. Write the protocol version, cipher suite, key exchange group, signature algorithm, and hash algorithm into the protocol configuration set; Write the session identifier digest, pre-shared key identifier digest, security association proposal digest, security parameter index, random number length, random number digest, and renegotiation flag into the key cycle set; Write the certificate chain digest, subject digest, issuer digest, validity period boundary, algorithm identifier, and national cryptographic dual certificate role code into the security credential set; Write the ciphertext packet length sequence, ciphertext arrival interval sequence, and message transmission direction into the ciphertext metric set; Among them, the certificate body, session identifier and security parameter index adopt one-way digest or fixed-length truncated digest, the random number digest adopts one-way digest or fixed-length truncated digest, and the payload is not decrypted, restored or forwarded to the alarm category generation module; The session evidence vector is represented as: ,in, Representing a session The session evidence vector, Representing a session Protocol configuration set, Representing a session Key period set, Representing a session The set of security credentials, Representing a session The encrypted metric set.

[0034] It should be noted that the protocol configuration set is a collection of protocol versions, cipher suites, key exchange groups, signature algorithms, and hash algorithms, used to characterize the configuration strength of the encryption protocol.

[0035] The key lifecycle set is a collection containing a session identifier digest, a pre-shared key identifier digest, a security association proposal digest, a security parameter index, a random number length, a random number digest, and a renegotiation flag, used to characterize the lifecycle state of the key.

[0036] A security credential set is a collection that includes a certificate chain digest, a subject digest, an issuer digest, an expiration date boundary, an algorithm identifier, and a national cryptographic dual-certificate role code, used to characterize the legitimacy of the identities of the communicating parties.

[0037] The ciphertext metric set is a set that includes the ciphertext packet length sequence, the ciphertext arrival interval sequence, and the message transmission direction, and is used to characterize the rhythmic features of ciphertext transmission.

[0038] The session evidence vector is a vector composed of a protocol configuration set, a key cycle set, a security credential set, and a ciphertext metric set, and serves as input data for subsequent compliance assessment.

[0039] The role code for the dual certificates of the Chinese cryptographic standard is an encoding used to identify the roles of the signature certificate and the encryption certificate in the Chinese cryptographic transport layer cryptography protocol. The signature certificate is encoded as 1, and the encryption certificate is encoded as 2.

[0040] A one-way digest is a fixed-length data digest generated by a one-way hash function.

[0041] Fixed-length truncated digests truncate the digest generated by a one-way hash function into fixed-length data segments, reducing data storage while maintaining uniqueness.

[0042] Specifically, the one-way digest uniformly uses the SHA256 hash algorithm. After inputting the original data, a 32-byte hash value is generated. The fixed-length truncated digest then truncates this 32-byte hash value into the first 16 bytes, which ensures the uniqueness of the data and reduces storage usage.

[0043] Specifically, the compliance primitives (which map the fields extracted from the bypass mirror message, including the protocol configuration set, key cycle set, security credential set, and ciphertext metric set, to a unified integer code for rapid compliance comparison in the subsequent alarm category generation module) are mapped to different protocol fields using a unified integer code for easier comparison. In the protocol version field, Transport Layer Security (TLS) 1.0 is mapped to 1, TLS 1.1 to 2, TLS 1.2 to 3, TLS 1.3 to 4, the Chinese national cryptographic transport layer cipher protocol to 5, Internet Protocol Security (IPS) version 1 to 6, IPS version 2 to 7, and Secure Shell Protocol 2.0 to 8. In the cipher suite field, SM4-related suites are mapped to 1, AES256-related suites to 2, 3DES-related suites to 3, and weak RC4-related suites to 0. In the key exchange group field, the secp256r1 group is mapped to 1, the sm2p256v1 group is mapped to 2, and the 1024-bit RSA weak group is mapped to 0. In the signature algorithm field, SM3withSM2 is mapped to 1, SHA256withRSA is mapped to 2, and the MD5withRSA weak algorithm is mapped to 0. In the hash algorithm field, SM3 is mapped to 1, SHA256 is mapped to 2, and the MD5 weak algorithm is mapped to 0.

[0044] Specifically, primitive extraction for the Internet Protocol Secure Key Exchange (IPC) begins by extracting the security association proposal from the security association initialization message, including the encryption algorithm and authentication algorithm. Then, the security parameter index and random number length are extracted, a digest is calculated on the random number, and a renegotiation flag is extracted. Primitive extraction for the Secure Shell protocol involves extracting the encryption algorithm and authentication algorithm from the key exchange initialization message, performing a digest calculation on the session identifier, and extracting the renegotiation flag. After primitive extraction for different protocols, they are uniformly converted into standard primitive codes to ensure consistency in subsequent analysis processes. For example, for a secure Internet Protocol session, if the extracted security association proposal contains the encryption algorithm AES256, the authentication algorithm SHA256, the security parameter index a specific value, the random number length 32 bytes, the random number digest the result of hash calculation, and the renegotiation flag 0, then the primitive extraction for that protocol is complete. Similarly, for a Secure Shell protocol session, if the extracted encryption algorithm AES256, the authentication algorithm SHA256, the session identifier digest the result of hash calculation, and the renegotiation flag 0, then primitive extraction is also complete.

[0045] It should be noted that during the compliance assessment process, sufficient assessment information needs to be obtained without decryption. This embodiment transforms compliance requirements into technical primitives that are still visible in the encryption protocol. Only information from visible fields is extracted, and sensitive data is processed using digest methods. This allows for the assessment of protocol strength, national cryptographic standard compatibility, certificate identity, and key lifecycle without decrypting the ciphertext payload. Throughout the entire parsing process, the system does not decrypt any ciphertext payload; all extractions are only performed on visible handshake fields and ciphertext metadata, without accessing the plaintext content of the business data. In other words, all necessary information for compliance assessment can be extracted without decryption, while encapsulating sensitive data through digest methods reduces the intrusiveness of the monitoring system to business data and the associated security risks.

[0046] In one embodiment of the present invention, the time-series folding coefficient calculation module is configured to perform: For the same session After taking the time anchor point, the first To the The bypass mirror message, recorded as the first The hardware timestamp of each bypass mirror message is The hardware timestamp corresponding to the time anchor is , No. The message length of each bypass mirror message is , No. The access point number for each bypass mirror message is , No. One bypass mirror message access point number The corresponding interface line speed is , No. One bypass mirror message access point number The corresponding preset port offset is , No. The message transmission direction of each bypass mirror message is The minimum positive time quantity is fixed as .

[0047] The formula for calculating a normalized time series is as follows:

[0048] in, Indicates the first The normalization time of a bypass mirror message Indicates the first Hardware timestamp of a bypass mirror message This represents the hardware timestamp corresponding to the time anchor point. Indicates the first The length of each bypass mirror message, in bytes. Indicates the first The access point number of each bypass mirror message. Indicates the first One bypass mirror message access point number The corresponding interface line speed, in bits per second. Indicates the first A bypass mirror message at the access point number Serialization latency on Indicates the first One bypass mirror message access point number The corresponding preset port offset; The formula for calculating the message interval is as follows:

[0049] in, Indicates the first The bypass mirror message and the first The message interval between bypass mirror messages, Indicates the first The normalization time of a bypass mirror message Indicates the first The normalization time of a bypass mirror message This represents a fixed minimum positive time quantity. This indicates the sequence number of the bypass mirror message within the collapsed calculation window, with a value of [value missing]. to ; The formula for calculating the direction switching weight is as follows:

[0050] in, Indicates the first The bypass mirror message and the first The direction switching weight between bypass mirror messages Indicates the first The message transmission direction of each bypass mirror message. Indicates the first The message transmission direction of each bypass mirror message. In the The message transmission direction of the bypass mirror message is the same as that of the first... When the transmission directions of the bypass mirror messages are inconsistent, take In the The message transmission direction of the bypass mirror message is the same as that of the first... When the transmission directions of the bypass mirror messages are consistent, take ; The formula for calculating the interval folding ratio is as follows:

[0051] in, Indicates the first The interval folding ratio corresponding to each bypass mirror message Indicates the first The bypass mirror message and the first The message interval between bypass mirror messages, Indicates the first The bypass mirror message and the first The message interval between bypass mirror messages, This represents a fixed minimum positive time quantity. This indicates the sequence number of the bypass mirror message within the collapsed calculation window, with a value of [value missing]. to ; The formula for calculating the timing folding factor is as follows:

[0052] in, Representing a session The timing folding coefficient, Indicates the first The bypass mirror message and the first The direction switching weight between bypass mirror messages Indicates the first The interval folding ratio corresponding to each bypass mirror message Indicates the number of calculations within the collapsed calculation window. To the The weighted sum of the bypass mirror messages, Indicates the number of calculations within the collapsed calculation window. To the The weight and value of each bypass mirror message.

[0053] It should be noted that the normalized time series is the message time series after deducting the time anchor, serialization delay and preset port offset, representing the corrected relative time of the message.

[0054] The message interval is the difference between the normalization times of two adjacent messages. The larger of this difference and the fixed minimum positive time is taken to characterize the corrected time interval between adjacent messages.

[0055] The direction switching weight is a weighting coefficient used to amplify the interval change at the direction switching point. It is set to 1 when adjacent packets have the same direction and 2 when they do not.

[0056] The interval folding ratio is the relative change between the intervals of two adjacent messages, representing the degree of local temporal folding.

[0057] The temporal folding coefficient is a session-level temporal folding characteristic value. The larger the value, the more significant the impact of the bypass mirror acquisition structure on the ciphertext rhythm of the session.

[0058] Serialization latency is the time required for a message to be transmitted serially on the interface, representing the inherent transmission time of a message on the interface.

[0059] Specifically, network transmission uses a serial transmission mode, where each bit of the message needs to be transmitted sequentially on the link. A message of length L bytes contains a total of 8 x L bits, and the interface line speed is R bits per second. Therefore, the time required to transmit these bits is the product of the message length and eight bits, divided by the interface line speed. This time is the serialization delay. This delay is the inherent transmission time of the acquisition interface itself and is not part of the service communication time interval. Therefore, it needs to be subtracted when calculating the normalized time to obtain the true relative message time.

[0060] Specifically, the preferred fixed minimum positive time interval is 1 nanosecond, with a range of 0.1 nanoseconds to 10 nanoseconds. This value is determined based on the precision of the hardware timestamp. Currently, the minimum precision of the hardware timestamp is 1 nanosecond. Therefore, when the normalized time difference between two messages is less than 1 nanosecond, it indicates that the difference is a hardware precision error, not the actual time interval. Setting the message interval to 1 nanosecond in this case avoids zero or negative intervals, preventing instability in subsequent calculations.

[0061] Specifically, in a bypass mirror acquisition structure, when bidirectional packets enter the monitoring device from different access points, the location of the direction switch will experience greater timing distortion due to queue scheduling and buffering at different access points. Therefore, it is necessary to assign greater weight to the interval changes at these locations to highlight the distortion caused by the acquisition structure. This weight setting can better reflect the impact of the acquisition structure on timing and help subsequent analysis distinguish between distortion and real anomalies.

[0062] It should be noted that this embodiment first deducts basic acquisition delays such as serialization delay and fixed port offset, and then focuses on amplifying the second-order interval change at the bidirectional communication direction switching point to calculate features that accurately characterize the impact of the bypass mirror acquisition structure on the ciphertext rhythm of the encrypted session. The entire calculation process is completed locally on the monitoring device; all raw data is not sent to an external server, and all processing is completed internally. Quantifying the impact of the physical structure on encrypted behavioral evidence into a calculable coefficient solves the problem of distinguishing between acquisition structure deformation and real communication anomalies in traditional non-decryption detection.

[0063] In one embodiment of the present invention, the alarm category generation module is configured to perform: The time-series folding coefficient is compared with a preset threshold to obtain the comparison result, and alarm categories are generated according to protocol configuration, key period, ciphertext measurement and the order of collection folding. The protocol configuration is analyzed using the protocol configuration set and security credential set. If the protocol version, cipher suite, key exchange group, signature algorithm, hash algorithm, or national cryptographic dual certificate role code is not in the compliance whitelist, a protocol configuration violation is generated. Key cycle analysis is performed using a key cycle set. When duplicate objects appear within the same device fingerprint and the same peer range that exceed the renegotiation or reconstruction range, a key cycle anomaly is generated. Ciphertext measurement is performed using ciphertext metric sets and time-series folding coefficients. When there is no protocol configuration violation, no key cycle abnormality, and time-series folding coefficient less than a preset threshold, fixed-length ciphertext segments and cycle intervals are detected. If the cycle is not accompanied by a new time anchor or a legitimate renegotiation flag, the ciphertext generation behavior is abnormal. The timing folding coefficient and the acquisition head are used to judge the acquisition folding. When there is no protocol configuration violation, no key period abnormality, no ciphertext behavior abnormality and the timing folding coefficient is greater than or equal to the preset threshold, a bypass mirror timing folding abnormality is generated. Among them, no warning is generated when there is no violation of protocol configuration, abnormal key cycle, abnormal ciphertext behavior, or abnormal bypass mirror timing folding.

[0064] It should be noted that the preset threshold is a critical value used to determine whether the timing folding coefficient is significant. It is written during equipment factory calibration or project acceptance, with a preferred value of 0.3 and a range of 0.2 to 0.4.

[0065] The compliance whitelist is a list containing permitted protocol versions, cipher suites, key exchange groups, signature algorithms, hash algorithms, and national cryptographic dual certificate role codes, used to compare the compliance of sessions.

[0066] Device fingerprints are unique identifiers used to distinguish different communication devices.

[0067] The scope of renegotiation or reconstruction is the normal number of times and time range during which key renegotiation or security association reconstruction is allowed in an encrypted session. Under normal circumstances, the number of renegotiations between the same device peers shall not exceed 1 time within 24 hours.

[0068] Specifically, multiple normal encrypted sessions are collected, and the timing folding coefficient of each session is calculated. The value at the 99.9th percentile is used as the preset threshold. The threshold adjustment principle for different application scenarios is as follows: in a single optical port mirroring environment, the folding coefficient of normal sessions is relatively small, so the threshold is set to 0.2; in a 4-optical port aggregation environment, the threshold is set to 0.3; and in an 8-optical port aggregation environment, the threshold is set to 0.35. The threshold is adjusted according to the number of deployed access points to adapt to different deployment scenarios.

[0069] Specifically, the configuration rules and update mechanism for the compliance whitelist are as follows: The configuration rules require each entry in the whitelist to include the protocol version, cipher suite, key exchange group, signature algorithm, hash algorithm, and national cryptographic dual-certificate role code. A session is only deemed compliant if all fields match an entry in the whitelist. The update mechanism requires administrators to update the whitelist only through a dedicated, authenticated configuration interface. A complete operation log is recorded during the update process; automatic updates are not supported to prevent malicious tampering of the whitelist. For example, a compliance whitelist might only allow national cryptographic transport layer cipher protocols, only allow SM4-related cipher suites, only allow sm2p256v1 key exchange groups, only allow SM3withSM2 signature algorithms, only allow SM3 hash algorithms, and the national cryptographic dual-certificate role code must contain both 1 and 2. Only sessions meeting all these conditions will be deemed compliant.

[0070] Specifically, the device fingerprint generation method and its included feature fields use four fields from the TCP protocol: initial window size, initial time-to-live (TTL), maximum segment size, and timestamp option. These fields are concatenated and then hashed using SHA256. The result is the device fingerprint. This feature can uniquely identify a communication device; even if the device's Internet Protocol address changes, the same device can still be identified through its fingerprint. For example, if a device has a TCP initial window size of 65535, an initial TTL of 64, a maximum segment size of 1460, and the timestamp option is enabled, concatenating these fields and performing a hash calculation yields the device fingerprint.

[0071] Specifically, the criteria for defining the scope of renegotiation or reconstruction are as follows: within the same device fingerprint and the same peer, the number of key renegotiations or security association reconstructions should not exceed once within 24 hours. Exceeding this number is considered outside the normal range. This standard is determined based on the normal usage specifications of encryption protocols. A normal key update cycle is not shorter than 24 hours, and multiple renegotiations within a short period are abnormal behavior. For example, if a device and its peer have already completed one renegotiation within 24 hours, and then a second renegotiation occurs using the same session identifier, this is considered outside the normal renegotiation range.

[0072] It should be noted that this embodiment performs layered compliance assessment based on evidence reliability. The assessment proceeds sequentially according to the order of protocol configuration, key period, ciphertext measurement, and acquisition folding. Only when the sequential folding coefficient is less than a preset threshold is the ciphertext rhythm evidence considered reliable and an anomaly assessment of ciphertext behavior initiated. The order of layered assessment is determined by the reliability of the evidence. Fields related to protocol configuration and key period are visible during the handshake phase and are unaffected by acquisition folding; therefore, they can be assessed first. Fields related to ciphertext rhythm, however, are affected by acquisition folding, so the degree of folding must be assessed first before further analysis. This reduces false positives and false negatives caused by the bypass mirror acquisition structure, improving the accuracy and reliability of compliance assessment for encrypted communication transmission behavior.

[0073] In one embodiment of the present invention, the non-plaintext verification fragment generation module is configured to perform: Perform hash calculations on the communication quintuple and time anchor points within the bypass mirror message to generate a session locator; The event identifier is generated by performing a hash calculation on the monitoring device identifier, session locator, and time anchor. A non-plaintext verification fragment is generated by combining the alarm category, time anchor point, and corresponding non-plaintext field summary, and the non-plaintext verification fragment has no more than three fields; When the alarm category is protocol configuration violation, write the violation field name and violation value digest into the non-plaintext verification fragment; when the alarm category is key cycle anomaly, write the duplicate object type and duplicate range digest into the non-plaintext verification fragment; when the alarm category is ciphertext behavior anomaly, write the ciphertext metric fragment digest and time anchor distance into the non-plaintext verification fragment; when the alarm category is bypass mirror timing folding anomaly, write the folding coefficient range and access point digest into the non-plaintext verification fragment; when the alarm category is no warning, write the session locator and no anomaly flag into the non-plaintext verification fragment. Among them, the non-plaintext verification fragment does not contain business plaintext, key, complete certificate content or reversible user identifier; The formula for calculating the event identifier is as follows:

[0074] in, Indicates the event identifier, Represents hash calculation, Indicates the identification of the monitoring equipment. Indicates a session locator. This indicates the hardware timestamp corresponding to the time anchor point in the event identifier calculation, and In the normalized time series calculation The values ​​are consistent. This indicates a concatenation operation.

[0075] It should be noted that the session locator is a unique identifier generated by performing a hash calculation on the communication quintuple and the time anchor, and is used to locate a specific encrypted session.

[0076] The event identifier is a unique identifier generated by hashing the monitoring device identifier, session locator, and time anchor point, and is used to locate specific early warning events.

[0077] Non-plaintext verification fragments are evidence fragments containing a summary of non-plaintext fields related to the alarm category, with no more than three fields, used to provide audit credentials.

[0078] The folding coefficient range is a range of intervals that divide the time series folding coefficient into different levels, used to characterize the degree of folding.

[0079] The interface digest is a digest value generated by hashing the interface number and is used to identify the interface involved.

[0080] The monitoring equipment identifier is a characteristic value used to uniquely identify monitoring equipment and to distinguish different monitoring equipment.

[0081] Specifically, all hash calculations uniformly use the SHA256 algorithm. The input data is concatenated in a fixed order before hash calculation, and then the resulting 32-byte hash value is truncated to the first 16 bytes, ensuring uniqueness while reducing data length. The input for the session locator is the communication quintuple and the time anchor; the input for the event identifier is the monitoring device identifier, the session locator, and the time anchor; and the input for the access point digest is the access point number. All inputs follow the same hashing rules.

[0082] Specifically, the rule for generating non-plaintext field digests is to perform a SHA256 one-way hash calculation on each required field, then truncate it to 8 bytes. The length is limited to no more than 8 bytes for each field's digest, and the entire non-plaintext verification fragment cannot exceed 24 bytes because it contains a maximum of three fields. This rule ensures that all fields cannot be deciphered while limiting the data length. For example, in an alert for a protocol configuration violation, the non-plaintext verification fragment contains a digest of the violating protocol version and a digest of the violating cipher suite. Each field's digest is 8 bytes, totaling 16 bytes, which is within the 24-byte limit. All content is a digest, and the original field values ​​cannot be recovered.

[0083] Specifically, the folding coefficient range is divided into three intervals. The first interval is 0 to 0.2, which means no obvious folding and the collection structure has no significant impact on the evidence. The second interval is 0.2 to 0.3, which means slight folding and the evidence is basically reliable. The third interval is above 0.3, which means significant folding and the evidence is significantly affected by the collection structure.

[0084] It should be noted that this embodiment uses hash calculation to generate session locators and event identifiers, limiting non-plaintext verification fragments to no more than three fields and excluding any business plaintext, keys, complete certificate content, or reversible user identifiers. Different alarm types correspond to different non-plaintext verification fragment contents: alarms for protocol configuration violations include digests of the violating fields; alarms for abnormal key lifecycles include digests of duplicate objects; alarms for abnormal ciphertext behavior include digests of the ciphertext rhythm; and alarms for abnormal bypass folding include digests of the folded intervals. None of the content contains any original sensitive information. This approach compresses complex encrypted communication evidence into traceable, low-leakage technical fragments, satisfying the compliance audit's need for objective evidence while effectively reducing the security risks of the monitoring system itself.

[0085] In one embodiment of the present invention, the warning signal output module is configured to perform: By concatenating alarm categories, session locators, and non-plaintext verification fragments, a link compliance warning signal is generated. Write the link compliance warning signal to the local read-only alarm queue; Output link compliance warning signals through local alarm interface, log interface, status display interface or message interface; Among them, the alarm categories are one of the following: protocol configuration violation, key cycle abnormality, ciphertext behavior abnormality, bypass mirror timing folding abnormality, and no warning. The output content format of the link compliance warning signal is consistent. After the link compliance warning signal is output, no model update, parameter write-back, threshold self-learning, compliance whitelist update, device fingerprint database update, or historical model update is performed. The link compliance warning signal is represented as follows: ,in, Representing a session The link compliance warning signal Representing a session Alarm categories, Representing a session Session locator, Representing a session Non-plaintext verification fragment.

[0086] It should be noted that the link compliance warning signal is the final output signal composed of alarm category, session locator and non-plaintext verification fragment.

[0087] The local read-only alarm queue is an alarm queue that can only be written to but not modified or deleted. It is used to store generated warning signals and is implemented by hardware logic.

[0088] The output channels are interfaces used to output early warning signals, including local alarm interfaces, log interfaces, situation display interfaces, and message interfaces, which are used to output early warning signals to different systems.

[0089] Specifically, the local read-only alarm queue is implemented using the FPGA's internal block RAM. The storage area is hardware-level write-protected, meaning only the alarm generation module has write access, while other modules only have read access. The storage capacity is 10,000 alarms, with each alarm occupying 64 bytes, for a total storage size of 640KB. When the queue is full, new alarms overwrite the oldest, ensuring the queue does not overflow. This implementation guarantees that the alarm content is immutable; only the generation module can write, while other modules can only read.

[0090] Specifically, the different output channels use specific format specifications and transmission protocols. The local alarm interface uses a PCIe interface in binary format, with each alarm occupying 64 bytes. The transmission protocol is PCIe DMA transfer, enabling high-speed local transmission. The log interface uses the Syslog protocol in standard RFC5424 format, converting alarm content into Syslog messages and sending them to the log server. The status display interface uses a REST interface in JSON format, converting alarm content into JSON objects for front-end display. The message interface uses UDP messages, with each UDP message carrying one alarm in binary format, enabling fast network transmission.

[0091] Specifically, regarding the storage and retention period requirements for warning signals, locally stored warning signals are retained for 90 days. The system automatically cleans up alarm data older than 90 days daily to ensure that local storage is not filled up. Warning signals output to external systems are stored and managed by the external systems, and the monitoring device does not interfere with the storage policies of the external systems. In the local alarm database, each alarm has a timestamp, and a cleanup operation is performed once every morning to delete alarm data older than 90 days, ensuring sufficient local storage resources.

[0092] It should be noted that this system is deployed via bypass access. The monitoring device obtains mirrored traffic from the service link through an optical splitter, without needing to be interleaved into the service link or modify the service configuration. The deployment process is completely seamless and will not affect service operation or increase service latency. The system supports interfaces with different bandwidths, such as gigabit and 10-gigabit, to adapt to different service scenarios. After deployment, the system will automatically process the mirrored traffic and complete the compliance assessment of encrypted communication.

[0093] Specifically, the system's final output of the link compliance warning signal includes three parts: alarm category, session locator, and non-plaintext verification fragment. When a protocol configuration violation is detected, such as a business session using a non-compliant RC4 cipher suite, the system will output an alarm category for protocol configuration violation, the corresponding session locator, and a digest of the violating field. Administrators can use this information to locate the corresponding session without obtaining sensitive business data. When a key cycle anomaly is detected, such as a device renegotiating key twice with the peer within 24 hours, the system will output a key cycle anomaly alarm and a digest of the duplicate object, indicating to the administrator that the session has engaged in multiple renegotiatings within a short period. When an abnormal ciphertext behavior is detected, the system will output an alarm indicating an abnormal ciphertext rhythm, suggesting potential encryption attacks. When an abnormal bypass folding is detected, the system will output a corresponding alarm, indicating that the current acquisition structure affects evidence and requires adjustment of the deployment configuration to ensure the accuracy of subsequent analysis.

[0094] All output content will not contain plaintext business data, nor will it contain complete certificates or user identifiers, thus ensuring no leakage of business privacy. At the same time, the output format is uniform, supports multiple output interfaces, adapts to different management systems, facilitates subsequent auditing and review by administrators, and meets relevant compliance management requirements.

[0095] The content of this embodiment has been described above, but this embodiment is not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms based on the guidance of this embodiment, all of which are within the protection scope of this embodiment.

Claims

1. A smart judgment and early warning system for compliance of encrypted communication transmission behavior, characterized in that, include: The parameter acquisition module receives bypass mirror messages and writes hardware timestamps, communication quintuples, interface line speeds, preset port offsets, and message lengths into the bypass mirror messages. The message recognition module identifies the handshake protocol message in the bypass mirror message as a time anchor point and extracts the transmission direction of the bypass mirror message after the time anchor point. The message parsing module extracts the protocol configuration set, key cycle set, security credential set, and ciphertext metric set from the bypass mirror message; The timing folding coefficient calculation module calculates a normalized time series by combining hardware timestamps, time anchors, interface line speeds, preset port offsets, and message lengths. It calculates the message interval based on the difference of the normalized time series, determines the direction switching weight based on the transmission direction of the message, and calculates the timing folding coefficient based on the change relationship between adjacent message intervals and the direction switching weight. The alarm category generation module compares the time-series folding coefficient with a preset threshold to obtain the comparison result, and generates an alarm category by combining the comparison result, protocol configuration set, key cycle set, security credential set and ciphertext metric set. The non-plaintext verification fragment generation module performs hash calculations on the communication quintuple and time anchor point inside the bypass mirror message to generate a session locator, and combines the alarm category, time anchor point and corresponding non-plaintext field digest to generate a non-plaintext verification fragment. The warning signal output module concatenates and merges the alarm category, session locator, and non-plaintext verification fragments to output a link compliance warning signal.

2. The intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to claim 1, characterized in that, The parameter acquisition module is configured to execute: The bypass mirror message of the encrypted communication link is received through the optical port or the electrical port, and a hardware timestamp is written when the bypass mirror message enters the media access control receiving boundary. The hardware timestamp is generated before the bypass mirror message enters the shared buffer. Write the communication quintuple, Layer 2 direction, VLAN identifier, access point number, interface line speed, preset port offset, and message length into the bypass mirror message. The message length is the link layer receive length. The hardware timestamp, communication quintuple, interface line speed, preset port offset, message length, and access point number are encapsulated into an uncoverable acquisition header, and the bypass mirror message and acquisition header are sent into a read-only analysis queue. When both ends of the same physical link are mirrored, the message transmission direction is determined based on the access point number and the transmission direction corresponding to the communication quintuple, and is not determined based on the application layer content. Among these, the monitoring equipment does not enter the business link, does not inject probe messages into the business link, and does not decrypt transport layer security protocols, national cryptographic transport layer cryptographic protocols, secure shell protocols, encapsulated secure payload protocols, or application layer payloads.

3. The intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to claim 1, characterized in that, The message recognition module is configured to execute: Identify the handshake protocol messages within the bypass mirror message based on the port, protocol number, record layer type, handshake message type, and exchange type. The client greeting message or equivalent first handshake protocol message in the Transport Layer Security Protocol session or the Chinese Cryptographic Transport Layer Cryptography Protocol session is determined as the time anchor; the first security association initialization request message in the Internet Protocol Security Key Exchange session is determined as the time anchor; and the first key exchange message after the protocol version exchange in the Secure Shell Protocol session is determined as the time anchor. Record the time anchor point, time anchor point message length, time anchor point direction, and time anchor point access point, and extract the transmission direction of the bypass mirror message after the time anchor point; The twenty-four bypass mirror messages after the time anchor point are determined as the folding calculation window; if there are less than twenty-four bypass mirror messages within two seconds, all bypass mirror messages within two seconds are determined as the folding calculation window, and the missing interval is handled by using a fixed minimum positive time amount. Encrypted payloads for which no time anchor point is identified will not be included in the compliance assessment.

4. The intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to claim 1, characterized in that, The message parsing module is configured to execute: Parse and extract the protocol configuration set, key cycle set, security credential set, and ciphertext metric set from the handshake protocol message, certificate digest, session identifier, and ciphertext metadata. Write the protocol version, cipher suite, key exchange group, signature algorithm, and hash algorithm into the protocol configuration set; Write the session identifier digest, pre-shared key identifier digest, security association proposal digest, security parameter index, random number length, random number digest, and renegotiation flag into the key cycle set; Write the certificate chain digest, subject digest, issuer digest, validity period boundary, algorithm identifier, and national cryptographic dual certificate role code into the security credential set; Write the ciphertext packet length sequence, ciphertext arrival interval sequence, and message transmission direction into the ciphertext metric set; The certificate text, session identifier, and security parameter index use one-way digests or fixed-length truncated digests, the random number digest uses one-way digests or fixed-length truncated digests, and the payload is not decrypted, restored, or forwarded to the alarm category generation module.

5. The intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to claim 1, characterized in that, The time series folding coefficient calculation module is configured to perform: For the folded calculation window after the time anchor point within the same session, read the hardware timestamp, time anchor point, interface line speed, preset port offset, message length and message transmission direction of each bypass mirror message in sequence. The serialization delay is obtained by dividing the product of the message length and eight by the interface line speed. The normalized time series is obtained by subtracting the time anchor from the hardware timestamp, and then subtracting the serialization delay and the preset port offset. The difference between the current normalized time and the adjacent previous normalized time is used as the candidate interval, and the larger value between the candidate interval and the fixed minimum positive time is used as the message interval. When the transmission directions of adjacent bypass mirror messages are consistent, the direction switching right is reset to one; when the transmission directions of adjacent bypass mirror messages are inconsistent, the direction switching right is reset to two. The absolute value of the difference between adjacent message intervals is used as the numerator, and the sum of adjacent message intervals and the sum of the fixed minimum positive time are used as the denominator. The ratio of the numerator to the denominator is used to obtain the interval folding ratio. The weighted sum is obtained by multiplying the folding ratio of each interval by the direction switching weight, and the weighted sum is obtained by summing the direction switching weights. The time series folding coefficient is obtained by calculating the ratio of the weighted sum to the weighted sum.

6. The intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to claim 1, characterized in that, The alarm category generation module is configured to execute: The time-series folding coefficient is compared with a preset threshold to obtain the comparison result, and alarm categories are generated according to protocol configuration, key period, ciphertext measurement and the order of collection folding. The protocol configuration is analyzed using the protocol configuration set and security credential set. If the protocol version, cipher suite, key exchange group, signature algorithm, hash algorithm, or national cryptographic dual certificate role code is not in the compliance whitelist, a protocol configuration violation is generated. Key cycle analysis is performed using a key cycle set. When duplicate objects appear within the same device fingerprint and the same peer range that exceed the renegotiation or reconstruction range, a key cycle anomaly is generated. Ciphertext measurement is performed using ciphertext metric sets and time-series folding coefficients. When there is no protocol configuration violation, no key cycle abnormality, and time-series folding coefficient less than a preset threshold, fixed-length ciphertext segments and cycle intervals are detected. If the cycle is not accompanied by a new time anchor or a legitimate renegotiation flag, the ciphertext generation behavior is abnormal. The timing folding coefficient and the acquisition head are used to judge the acquisition folding. When there is no protocol configuration violation, no key period abnormality, no ciphertext behavior abnormality and the timing folding coefficient is greater than or equal to the preset threshold, a bypass mirror timing folding abnormality is generated. Among them, no warning is generated when there is no violation of protocol configuration, abnormal key cycle, abnormal ciphertext behavior, or abnormal bypass mirror timing folding.

7. The intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to claim 1, characterized in that, The non-plaintext verification fragment generation module is configured to execute: Perform hash calculations on the communication quintuple and time anchor points within the bypass mirror message to generate a session locator; The event identifier is generated by performing a hash calculation on the monitoring device identifier, session locator, and time anchor. A non-plaintext verification fragment is generated by combining the alarm category, time anchor point, and corresponding non-plaintext field summary, and the non-plaintext verification fragment has no more than three fields; When the alarm category is protocol configuration violation, write the violation field name and violation value digest into the non-plaintext verification fragment; when the alarm category is key cycle anomaly, write the duplicate object type and duplicate range digest into the non-plaintext verification fragment; when the alarm category is ciphertext behavior anomaly, write the ciphertext metric fragment digest and time anchor distance into the non-plaintext verification fragment; when the alarm category is bypass mirror timing folding anomaly, write the folding coefficient range and access point digest into the non-plaintext verification fragment; when the alarm category is no warning, write the session locator and no anomaly flag into the non-plaintext verification fragment. Among them, the non-plaintext verification fragment does not contain business plaintext, keys, complete certificate content, or reversible user identifiers.

8. The intelligent judgment and early warning system for compliance of encrypted communication transmission behavior according to claim 1, characterized in that, The warning signal output module is configured to execute: By concatenating alarm categories, session locators, and non-plaintext verification fragments, a link compliance warning signal is generated. Write the link compliance warning signal to the local read-only alarm queue; Output link compliance warning signals through local alarm interface, log interface, status display interface or message interface; The alarm categories include one of the following: protocol configuration violation, key cycle abnormality, ciphertext behavior abnormality, bypass mirror timing folding abnormality, and no warning. The output content format of the link compliance warning signal remains consistent. After the link compliance warning signal is output, no model update, parameter write-back, threshold self-learning, compliance whitelist update, device fingerprint database update, or historical model update is performed.

Images