A hybrid network security communication early warning method

Abstract

This invention discloses a hybrid network security communication early warning method, specifically relating to the field of network communication technology. It involves detecting cross-network domain switching of the transmission five-tuple of encrypted communication connections, collecting network flow records before and after migration, and initial handshake missing markers. Run-length encoding is performed on the pre-migration and post-migration network flow records, and a dynamic time warping algorithm is used to obtain temporally continuous session pairs. When the initial handshake is missing, an implicit connection identifier continuation feature is generated based on the overlapping segments of the burst interval run-length sequence and the short header length stable segments. Abnormal events are mapped to a unified run-length position to form a cross-domain risk context chain, and continuous secure communication early warning records are output when the abnormal events satisfy the progressive order.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and more specifically, to a hybrid network security communication early warning method. Background Technology

[0002] In existing hybrid network communication environments, encrypted communication connections of the same terminal may migrate between different access networks, different egress networks, or different virtual networks. Some encrypted transmission protocols allow communication connections to continue transmitting services after changes in source address, destination address, or port. At the same time, connection identification information may be updated, and some connection states are also encapsulated in encrypted control information.

[0003] Existing security monitoring methods typically identify communication connections based on the transmission 5-tuple, handshake information during the connection establishment phase, or session state stored within a single network domain. When a communication connection enters a new network domain, subsequent monitoring nodes may not have obtained the complete state of the communication connection establishment phase, making it difficult to determine the correspondence between network flows before and after migration. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a hybrid network security communication early warning method to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A hybrid network security communication early warning method includes the following steps:

[0007] S1. When the transmission quintuple of the encrypted communication connection is detected to switch from the first network domain to the second network domain, collect the network flow record before migration, the network flow record after migration, and the initial handshake missing marker.

[0008] S2. Perform run-length encoding on the network flow records before and after migration to obtain the directional packet long run-length sequence and the burst interval run-length sequence.

[0009] S3. The dynamic time warping algorithm is used to align the long run sequence of the direction packet, and candidates with time reversal in the alignment path are filtered out to obtain time-continuous session pairs.

[0010] S4. When the missing initial handshake marker for the sequential continuous session pair is marked as missing, calculate the variable point overlapping segment and short header length stable segment of the burst interval run sequence to generate implicit connection identifier continuation feature.

[0011] S5. Map the implicit connection identifier continuation feature to the abnormal event queue in the network flow record before migration to form a cross-domain risk context chain.

[0012] S6. When the abnormal events of the network flow records after migration in the cross-domain risk context chain satisfy the progressive order of the abnormal events of the network flow records before migration, output continuous security communication warning records.

[0013] In a preferred embodiment, S1 specifically refers to:

[0014] Using the transmission quintuple of the encrypted communication connection as the comparison object, a transmission quintuple change record is generated according to the network domain identifier and the message arrival time.

[0015] When the transmission quintuple change record indicates that the transmission quintuple has switched from the first network domain to the second network domain, the message direction, message length, message arrival time, short header length and abnormal event queue in the first network domain and the second network domain respectively are extracted to generate network flow records before migration and network flow records after migration. When the network flow record after migration does not contain the initial handshake message of the encrypted communication connection, an initial handshake missing flag is generated.

[0016] In a preferred embodiment, S2 specifically refers to:

[0017] Arrange the network flow records before migration and the network flow records after migration according to the message arrival time;

[0018] Adjacent messages with the same message direction and message length falling within the same preset length range are merged into a directional packet long run. The message direction, preset length range, start and end message arrival time, and short header length sequence of the directional packet long run are recorded.

[0019] The run interval is formed by the difference between the arrival time of the previous end message and the arrival time of the next start message of the adjacent directional packet long run. Run intervals that fall continuously into the same preset interval range are merged into burst interval runs, resulting in directional packet long run sequences and burst interval run sequences.

[0020] In a preferred embodiment, S3 specifically refers to:

[0021] Using the long run sequence of directional packets corresponding to the network flow records before migration and the long run sequence of directional packets corresponding to the network flow records after migration as input, the run-length matching cost is constructed according to the consistency of message direction and the proximity of preset length intervals.

[0022] A dynamic time warping algorithm is used to generate candidate alignment paths along the run-length sequence.

[0023] When the arrival times of the start and end packets of the long run corresponding to the network flow record after migration are reversed relative to the arrival times of the start and end packets of the long run corresponding to the network flow record before migration in the candidate alignment path, the candidate alignment path is filtered out as a candidate with time reversal, and a time-continuous session pair is obtained.

[0024] In a preferred embodiment, S4 specifically refers to:

[0025] When the missing initial handshake for a sequential session pair is marked as missing, the run interval run sequence corresponding to the network flow record before migration and the run interval run sequence corresponding to the network flow record after migration within the sequential session pair are accumulated and change point detected respectively to obtain the run interval change point position.

[0026] Project the run-interval change point position to the unified run-interval position using the candidate alignment path corresponding to the time-series continuous session pair, and take the segments with adjacent unified run-interval positions and the same change direction as the change point overlap segment.

[0027] Within the overlapping segment of the variable point, read the short header length sequence of the long run record of the direction packet, and take the segment where the short header length continuously maintains the same value as the stable segment of the short header length to generate the implicit connection identifier continuation feature.

[0028] In a preferred embodiment, S5 specifically refers to:

[0029] Using the unified run-length order corresponding to the implicit connection identifier continuation feature as the mapping benchmark, the same position of the abnormal event queue in the network flow record before migration and the abnormal event queue in the network flow record after migration on the unified run-length order are determined respectively.

[0030] Anomalies whose occupancy positions fall within the variable point overlap segment and whose corresponding short header length is a stable segment are marked as cross-domain related events. Cross-domain related events are connected according to message arrival time to form a cross-domain risk context chain.

[0031] In a preferred embodiment, S6 specifically refers to:

[0032] Traverse the cross-domain associated events in the cross-domain risk context chain and determine whether the cross-domain associated event originates from a pre-migration network flow record or a post-migration network flow record based on the message arrival time.

[0033] When a cross-domain association event originating from a pre-migration network flow record is earlier than a cross-domain association event originating from a post-migration network flow record, and the cross-domain association events maintain an increasing order in the unified run-length order and point from the first network domain to the second network domain, the cross-domain risk context chain is determined to satisfy the progressive order.

[0034] Generate continuous secure communication early warning records that include transmission 5-tuple change records, initial handshake missing markers, implicit connection identifier continuation features, and cross-domain risk context chains.

[0035] The technical effects and advantages of the hybrid network security communication early warning method of the present invention are as follows:

[0036] By performing run-length encoding on network flow records before and after the cross-network domain migration of encrypted communication connections, and reconstructing the temporal correspondence between communication behaviors before and after the migration using directional packet long run-length sequences and burst interval run-length sequences, even when the transmission quintuple changes and the initial handshake state is missing after the migration, it is still possible to filter out erroneous candidates with time reversal and obtain session association results with temporal continuity. By combining the consistency of burst interval changes and the stability of short header lengths to generate implicit connection identifier continuation features, abnormal events before and after the migration are mapped to a unified run-length bit order and form a cross-domain risk context chain. This avoids session fragmentation, duplicate attribution of abnormal events, or omissions caused by relying solely on the transmission quintuple or a single network domain session state. It enables abnormal communication behaviors before and after the cross-network domain migration to be continuously connected according to the time and risk development order, providing complete data basis for the continuous identification and security early warning of encrypted communication connections. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of a hybrid network security communication early warning method according to the present invention. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0039] Example

[0040] Figure 1 This invention provides a hybrid network security communication early warning method, which includes the following steps:

[0041] S1. When the transmission quintuple of the encrypted communication connection is detected to switch from the first network domain to the second network domain, collect the network flow record before migration, the network flow record after migration, and the initial handshake missing marker.

[0042] S2. Perform run-length encoding on the network flow records before and after migration to obtain the directional packet long run-length sequence and the burst interval run-length sequence.

[0043] S3. The dynamic time warping algorithm is used to align the long run sequence of the direction packet, and candidates with time reversal in the alignment path are filtered out to obtain time-continuous session pairs.

[0044] S4. When the missing initial handshake marker for the sequential continuous session pair is marked as missing, calculate the variable point overlapping segment and short header length stable segment of the burst interval run sequence to generate implicit connection identifier continuation feature.

[0045] S5. Map the implicit connection identifier continuation feature to the abnormal event queue in the network flow record before migration to form a cross-domain risk context chain.

[0046] S6. When the abnormal events of the network flow records after migration in the cross-domain risk context chain satisfy the progressive order of the abnormal events of the network flow records before migration, output continuous security communication warning records.

[0047] S1. When the transmission quintuple of the encrypted communication connection is detected to switch from the first network domain to the second network domain, collect the network flow records before the migration, the network flow records after the migration, and the initial handshake missing flag, including:

[0048] Using the transmission quintuple of the encrypted communication connection as the comparison object, a transmission quintuple change record is generated according to the network domain identifier and the message arrival time.

[0049] Specifically, an encrypted communication connection represents a communication process in which the payload content is encrypted while retaining observable transmission header fields; the transmission quintuple consists of the source address, destination address, source port, destination port, and transport layer protocol identifier; the network domain identifier indicates the logical network range to which the message belongs when it enters the collection range; and the message arrival time indicates the timestamp formed when the message is recorded. When using the transmission quintuple of an encrypted communication connection as the comparison object, the message records within the same candidate range of encrypted communication connections are sorted in ascending order according to the message arrival time, and then the network domain identifier, transmission quintuple, and message arrival time are written to each message record. The same candidate range of encrypted communication connections is formed by message records with the same destination address, the same destination port, the same transport layer protocol identifier, and the difference in arrival time between adjacent messages not exceeding the preset session interval. The preset session interval is determined based on the distribution of the difference in arrival time between adjacent messages in the historical message records to be processed. For example, the 95th percentile value of the difference in arrival time between adjacent messages in the historical message records can be taken as the preset session interval.

[0050] The transmission 5-tuple change record is formed by comparing adjacent message records. The comparison includes whether the network domain identifier has changed, whether the source address has changed, whether the destination address has changed, whether the source port has changed, whether the destination port has changed, and whether the transport layer protocol identifier remains the same. The transmission 5-tuple change record includes at least the transmission 5-tuple before the change, the transmission 5-tuple after the change, the network domain identifier before the change, the network domain identifier after the change, the arrival time of the last message before the change, and the arrival time of the first message after the change. When the network domain identifier changes from the first network domain to the second network domain, and the transmission 5-tuple before the change and the transmission 5-tuple after the change differ in at least one of the source address, destination address, source port, and destination port, while the transport layer protocol identifier remains the same, the transmission 5-tuple change record indicates that the transmission 5-tuple has switched from the first network domain to the second network domain. The first network domain and the second network domain are used to distinguish the logical network range to which the encrypted communication connection belongs before and after the migration. The first network domain and the second network domain can correspond to different access networks, different egress networks, or different virtual network ranges.

[0051] When the transmission quintuple change record indicates that the transmission quintuple has switched from the first network domain to the second network domain, the message direction, message length, message arrival time, short header length and abnormal event queue in the first network domain and the second network domain are extracted respectively to generate network flow record before migration and network flow record after migration. When the network flow record after migration does not contain the initial handshake message of the encrypted communication connection, an initial handshake missing flag is generated.

[0052] Specifically, the transmission quintuple change record indicates that when the transmission quintuple switches from the first network domain to the second network domain, message records belonging to the first network domain before the arrival time of the last message before the change are included in the pre-migration extraction range, and message records belonging to the second network domain after the arrival time of the first message after the change are included in the post-migration extraction range. The boundaries of both the pre-migration and post-migration extraction ranges are determined according to the continuity of message arrival time. The boundary determination method is to continuously read message records in the ascending order of message arrival time, and stop including them in the corresponding extraction range when the difference between the arrival times of adjacent messages exceeds a preset session interval. For each message record in the pre-migration extraction range, message direction, message length, message arrival time, short header length, and abnormal event queue are extracted to generate the pre-migration network flow record. For each message record in the post-migration extraction range, message direction, message length, message arrival time, short header length, and abnormal event queue are extracted to generate the post-migration network flow record.

[0053] The message direction is determined by the sending and receiving sides of the message relative to the same encrypted communication connection candidate range. The message direction can be recorded as from the initiating side to the responding side or from the responding side to the initiating side. The message length is the number of bytes recorded when the message enters the collection range, and the message arrival time uses the timestamp in the message record. The short header length is the length of the short header bytes that are located before the encrypted payload in the encrypted communication connection and can be directly parsed from the message byte boundary. The short header length is determined by reading the message first byte type bit, the visible connection identifier length field, or the already recorded short header boundary information. When the short header boundary cannot be directly parsed, the short header length is recorded as a null value. The null value maintains the original message position in the network flow record before migration and the network flow record after migration.

[0054] The abnormal event queue is a set of event entries arranged according to message arrival time. Each event entry includes at least the message arrival time, the network domain identifier to which the event belongs, and the event type. The event type is obtained by executing preset secure communication rules on the message records during the collection phase. The preset secure communication rules include rules for abnormal changes in message direction, rules for sudden changes in message length, rules for abnormal access to the destination port, and rules for changes in the short header length. The length range and time interval range in the preset secure communication rules are determined based on the distribution of message records of historical encrypted communication connections within the same network domain. For example, the quartile range of the message length can be used as a reference for the normal length range, and the set of message records that exceed the reference for the normal length range will generate event entries corresponding to sudden changes in message length. The abnormal event queue does not change the order of message records in the network flow records before and after migration.

[0055] The initial handshake message represents an early message that appears during the establishment phase of an encrypted communication connection and is used to negotiate connection parameters or key materials. When determining whether the migrated network flow record contains the initial handshake message of the encrypted communication connection, the visible fields in the message header are read in the order of message arrival time in the migrated network flow record, and it is checked whether the visible fields in the message header contain at least one resolvable content among the initial handshake type identifier, initial connection identifier length information, or handshake phase length information. If any message record in the migrated network flow record satisfies at least one resolvable content, the migrated network flow record contains the initial handshake message of the encrypted communication connection. If no message record in the migrated network flow record satisfies at least one resolvable content, the migrated network flow record does not contain the initial handshake message of the encrypted communication connection.

[0056] When the migrated network flow record does not contain the initial handshake message for the encrypted communication connection, an initial handshake missing flag is generated. The initial handshake missing flag can be stored as a Boolean value, an enumerated value, or a text value. For example, the initial handshake missing flag can be set to "missing". The initial handshake missing flag is bound to the migrated network flow record. The data association method of the initial handshake missing flag is as follows: the initial handshake missing flag references the changed transmission quintuple, the changed network domain identifier, and the changed start message arrival time in the transmission quintuple change record, so that the initial handshake missing flag and the migrated network flow record maintain the same time range and the same network domain range.

[0057] S2. Perform run-length encoding on the network flow records before and after migration to obtain the directional packet long run-length sequence and the burst interval run-length sequence, including:

[0058] Arrange the network flow records before migration and the network flow records after migration according to the message arrival time;

[0059] Specifically, the pre-migration network flow records are processed independently to form pre-migration ordered message records, and the post-migration network flow records are processed independently to form post-migration ordered message records. Each record item in the pre-migration ordered message records retains the message direction, message length, message arrival time, short header length, and exception event queue. Each record item in the post-migration ordered message records retains the message direction, message length, message arrival time, short header length, and exception event queue. The arrangement process is based on the message arrival time from earliest to latest. When record items with the same message arrival time are encountered, they are arranged according to the original writing order formed during the acquisition phase, so that the pre-migration and post-migration network flow records maintain a monotonic time order before entering run-length encoding. After the arrangement is completed, the pre-migration and post-migration ordered message records do not change the original values ​​of message direction, message length, short header length, and exception event queue; only the reading order of the record items during processing is changed.

[0060] Adjacent messages with the same message direction and message length falling within the same preset length range are merged into a directional packet long run. The message direction, preset length range, start and end message arrival time, and short header length sequence of the directional packet long run are recorded.

[0061] Specifically, the preset length interval is used to discretize the length of continuous messages into comparable length states. To enable comparison of the directional packet long run sequence corresponding to the network flow records before and after migration on the same scale, the message lengths of historical encrypted communication connections in the first and second network domains are merged to generate the same preset length interval. The process of determining the preset length interval is as follows: read the message records of historical encrypted communication connections in the first and second network domains, remove records with null or unparseable message lengths, sort them according to message length from smallest to largest, and divide the message length distribution into multiple continuous closed-open intervals according to the quantile boundaries. The last interval is set as a closed interval containing the maximum message length. For example, the 25th, 50th, and 75th percentile values ​​of the historical message length distribution can be used as quantile boundaries to form short-length intervals, medium-low-length intervals, medium-high-length intervals, and long-length intervals. When using quantile boundaries to divide the preset length intervals, each preset length interval covers at least one historical message length value to avoid the preset length interval being an empty interval. When multiple quantile boundary values ​​are the same, the same quantile boundaries are merged, and the preset length intervals are re-formed according to the merged quantile boundaries.

[0062] When generating a directional packet long run, the process starts reading from the first record in the pre-migration message order record. The message direction and length of the current record are read, and the preset length interval into which the current record's message length falls is determined. If the next record is adjacent to the current record, and its message direction is the same as the current record, and its message length falls within the same preset length interval as the current record, then the next record is merged into the current directional packet long run. If the message direction of the next record is different from the current directional packet long run, or if the preset length interval into which the next record falls is different from the preset length interval of the current directional packet long run, then the current directional packet long run ends, and a new directional packet long run is generated starting from the next record. If the next record does not exist, the current directional packet long run ends, and no new directional packet long run is generated. After migration, the message records are generated in the same way to form a directional packet long run. The directional packet long run represents a continuous message segment with the same message direction and message length within the same preset length range. The data items of the directional packet long run include message direction, preset length range, start message arrival time, end message arrival time, and short header length sequence.

[0063] The short header length sequence is formed synchronously during the generation of directional packet long runs. Each record entry merged into the same directional packet long run is arranged according to its message arrival time, and the short header length of each record entry is read sequentially and written into the short header length sequence in the reading order. If the short header length is null, the null value is written into the short header length sequence according to the position of the corresponding record entry in the directional packet long run. A one-to-one correspondence is maintained between the short header length sequence and the directional packet long run; each message record in the directional packet long run corresponds to a position in the short header length sequence. The starting message arrival time is the earliest message arrival time in the directional packet long run, and the ending message arrival time is the latest message arrival time in the directional packet long run. After multiple directional packet long runs are arranged from earliest to latest according to their starting message arrival times, a directional packet long run sequence corresponding to the network flow record before migration and a directional packet long run sequence corresponding to the network flow record after migration are formed.

[0064] The run interval is formed by the difference between the arrival time of the previous end message and the arrival time of the next start message of the adjacent directional packet long run. Run intervals that fall continuously into the same preset interval range are merged into burst interval runs, resulting in directional packet long run sequences and burst interval run sequences.

[0065] Specifically, adjacent directional packet long runs are read according to the order in the directional packet long run sequence. The difference between the arrival time of the start message of the subsequent directional packet long run and the arrival time of the end message of the preceding directional packet long run is used as the run interval. The data format of the run interval includes the position of the preceding directional packet long run in the directional packet long run sequence, the position of the subsequent directional packet long run in the directional packet long run sequence, the arrival time of the end message of the preceding directional packet long run, the arrival time of the start message of the subsequent directional packet long run, and the time difference. When the arrival time of the end message of a run is equal to the arrival time of the start message of the next-direction long run, the time difference of the run interval is recorded as 0. When the arrival time of the end message of the previous-direction long run is later than the arrival time of the start message of the next-direction long run, the negative value of the time difference is retained, and the run interval is written into the preset negative interval interval. The preset negative interval interval serves as the abnormal time sequence interval in the preset interval interval. When a single-direction long run sequence contains only one-direction long run, no run interval is generated, and the sudden interval run sequence is recorded as an empty sequence.

[0066] The preset interval is used to discretize the run interval into comparable burst interval states. To enable the burst interval run sequence corresponding to the network flow record before migration and the burst interval run sequence corresponding to the network flow record after migration to be compared on the same scale, the time difference between adjacent directional packet length runs of historical encrypted communication connections in the first and second network domains is merged to generate the same set of preset intervals. The process of determining the preset interval is as follows: historical encrypted communication connections are run-coded according to the directional packet length run generation method, then the time difference between historical adjacent directional packet length runs is calculated, unresolved time differences are eliminated, and the time differences are sorted from smallest to largest. Multiple continuous closed and open intervals are divided according to the quantile boundaries of the time difference distribution, and the last interval is set as the closed interval containing the largest time difference. For example, the 20th percentile, 50th percentile, and 80th percentile values ​​of the historical time difference distribution can be used to form short interval intervals, medium-short interval intervals, medium-long interval intervals, and long interval intervals. The preset negative interval is used for run intervals where the receiving time difference is less than 0, while the short interval, medium-short interval, medium-long interval, and long interval are used for run intervals where the receiving time difference is not less than 0.

[0067] When generating a burst interval run, the run intervals are read sequentially according to their position in the long run sequence of the directional packet, and the preset interval range into which each run interval falls is determined. If the current run interval is consecutive to the next run interval, and the preset interval range into which the current run interval falls is the same as that into the next run interval, the next run interval is merged into the current burst interval run. If the preset interval range into which the next run interval falls is different from the preset interval range corresponding to the current burst interval run, the current burst interval run ends, and a new burst interval run is generated starting from the next run interval. If the next run interval does not exist, the current burst interval run ends and no new burst interval run is generated. The data items of the burst interval run include the preset interval range, the starting run interval position, the ending run interval position, the arrival time of the end packet of the previous direction packet length run corresponding to the starting run interval, and the arrival time of the start packet of the next direction packet length run corresponding to the ending run interval. After multiple burst interval runs are arranged in ascending order of starting run interval position, they form the burst interval run sequence corresponding to the network flow record before migration and the burst interval run sequence corresponding to the network flow record after migration.

[0068] S3. A dynamic time warping algorithm is used to align the long run sequence of the directional packet, filtering out candidates with time reversal in the alignment path, resulting in temporally continuous session pairs, including:

[0069] Using the long run sequence of directional packets corresponding to the network flow records before migration and the long run sequence of directional packets corresponding to the network flow records after migration as input, the run-length matching cost is constructed according to the consistency of message direction and the proximity of preset length intervals.

[0070] Specifically, check whether the long run sequence of the directional packet corresponding to the network flow record before migration and the long run sequence of the directional packet corresponding to the network flow record after migration both contain long run sequences of the directional packet; when either long run sequence of the directional packet is empty, no candidate alignment path is generated and no temporally continuous session pair is formed; when both long run sequences of the directional packet contain long run sequences of the directional packet, continue to construct the run matching cost.

[0071] When constructing the run-length matching cost, any run-length in the direction packet long run sequence corresponding to the network flow record before migration is taken as the run-length to be matched before migration, and any run-length in the direction packet long run sequence corresponding to the network flow record after migration is taken as the run-length to be matched after migration. Packet direction consistency is obtained by comparing the packet directions of the run-length to be matched before migration and the run-length to be matched after migration. If the two packet directions are the same, the packet direction consistency is recorded as a matching state; if the two packet directions are different, the packet direction consistency is recorded as a mismatch state. A preset length range is used. Proximity is obtained by comparing the preset length interval of the packet length run in the direction to be matched before migration and the preset length interval of the packet length run in the direction to be matched after migration. The preset length interval is generated by the same group of sub-boundaries, and the preset length interval has a fixed arrangement order according to the message length from small to large. If the fixed arrangement order of two preset length intervals is the same, the proximity of the preset length interval is recorded as same position proximity. If the fixed arrangement order of two preset length intervals is adjacent, the proximity of the preset length interval is recorded as adjacent proximity. If the fixed arrangement order of two preset length intervals is more than 1 fixed arrangement order, the proximity of the preset length interval is recorded as non-proximity.

[0072] Run-length matching cost is used to characterize the difference in observable transmission behavior between the run-length packets in the direction to be matched before and after migration. The run-length matching cost is generated hierarchically based on message direction consistency and preset length interval proximity. When message direction consistency is matched and preset length interval proximity is adjacent, the run-length matching cost is at the lowest level. When message direction consistency is matched and preset length interval proximity is adjacent, the run-length matching cost is at the middle level. When message direction consistency is matched and preset length interval proximity is non-adjacent, the run-length matching cost is at a higher level. When message direction consistency is unmatched, the run-length matching cost is at the highest level. Each level can be stored using incremental values. For example, the lowest level can be set to 0, the middle level to 1, the higher level to 2, and the highest level to 4. The incremental values ​​are set based on the fact that the importance of the same message direction before and after the migration of the same encrypted communication connection is higher than the importance of adjacent preset length intervals, and different message directions indicate a weaker correspondence in transmission behavior. The run length combination of the directional packet long run sequence corresponding to the network flow record before migration and the directional packet long run sequence corresponding to the network flow record after migration is traversed in the above manner to form a run length matching cost table.

[0073] A dynamic time warping algorithm is used to generate candidate alignment paths along the run-length sequence.

[0074] Specifically, the run-length matching cost table is used as input, and the algorithm is recursively processed according to the order of the long run length sequences of the directional packets corresponding to the network flow records before and after migration. The starting point of the dynamic time warping algorithm is the matching position formed by the first long run length of the long run length sequence of the directional packets corresponding to the network flow records before and after migration, and the ending point is the matching position formed by the last long run length of the long run length sequence of the directional packets corresponding to the network flow records before and after migration. Each recursion of the dynamic time warping algorithm allows the algorithm to advance along the long run length sequence of the directional packets corresponding to the network flow records before and after migration, or simultaneously along two long run length sequences, so that the candidate alignment path can cover one-to-many, many-to-one, and one-to-one run length correspondences.

[0075] The candidate alignment path is formed by connecting multiple matching positions in a recursive order according to the dynamic time warping algorithm. Each matching position records the position of the run length of the corresponding direction packet in the network flow record before migration, the position of the run length of the corresponding direction packet in the network flow record after migration, the run matching cost of the matching position, the start and end arrival times of the run length of the corresponding direction packet in the network flow record before migration, and the start and end arrival times of the run length of the corresponding direction packet in the network flow record after migration. The candidate alignment path is selected as follows: when backtracking from the end point to the start point, each matching position selects the previous matching position with the minimum cumulative run matching cost. When multiple previous matching positions have the same cumulative run matching cost, the previous matching position formed by advancing along two direction packet long run lengths simultaneously is selected first, then the previous matching position formed by advancing along the direction packet long run length of the network flow record after migration is selected, and finally the previous matching position formed by advancing along the direction packet long run length of the network flow record before migration is selected.

[0076] When the arrival times of the start and end packets of the long run of the network flow record in the direction after migration are reversed relative to the arrival times of the long run of the network flow record in the direction before migration, the candidate alignment path is filtered out as a candidate with reversed alignment path, and a time-continuous session pair is obtained.

[0077] Specifically, after generating the candidate alignment path, timing inversion is checked according to the matching positions in the candidate alignment path. The determination of timing inversion is based on the time relationship between the start and end arrival times of the packet-length run corresponding to the migrated network flow record in the direction of the original network flow record and the start and end arrival times of the packet-length run corresponding to the original network flow record in the direction of the original network flow record. If any matching position in the candidate alignment path satisfies the condition that the start arrival time of the packet-length run corresponding to the migrated network flow record in the direction of the original network flow record is earlier than the start arrival time of the packet-length run corresponding to the original network flow record in the direction of the original network flow record, or the end arrival time of the packet-length run corresponding to the migrated network flow record in the direction of the original network flow record is earlier than the end arrival time of the packet-length run corresponding to the original network flow record in the direction of the original network flow record, then it is determined that there is a timing inversion between the start and end arrival times of the packet-length run corresponding to the original network flow record in the candidate alignment path and the start and end arrival times of the packet-length run corresponding to the original network flow record in the direction of the original network flow record.

[0078] When a candidate alignment path is time-reversed, the candidate alignment path is filtered out as a candidate for alignment path with time reversal, and the candidate alignment path is no longer written into the time-continuous session pair; when no candidate alignment path is time-reversed, the candidate alignment path, the network flow record before migration, the network flow record after migration, the long run sequence of the direction packet corresponding to the network flow record before migration, the long run sequence of the direction packet corresponding to the network flow record after migration, the burst interval run sequence of the network flow record before migration, the burst interval run sequence of the network flow record after migration, and the initial handshake missing flag are all written into the time-continuous session pair.

[0079] S4. When the initial handshake for a sequential session pair is marked as missing, calculate the variable point overlap segment and the short header length stable segment of the burst interval run sequence, and generate implicit connection identifier continuation features, including:

[0080] When the missing initial handshake for a sequential session pair is marked as missing, the run interval run sequence corresponding to the network flow record before migration and the run interval run sequence corresponding to the network flow record after migration within the sequential session pair are accumulated and change point detected respectively to obtain the run interval change point position.

[0081] Specifically, when the initial handshake missing flag for a time-series continuous session pair is missing, the burst interval run sequence corresponding to the pre-migration network flow record and the burst interval run sequence corresponding to the post-migration network flow record stored within the time-series continuous session pair are read; when the initial handshake missing flag is not missing, implicit connection identifier continuation feature generation is not performed; when the burst interval run sequence is an empty sequence, the run interval change point position corresponding to the burst interval run sequence is recorded as an empty set; when the burst interval run sequence is not an empty sequence, it is expanded into run intervals according to the start run interval position and end run interval position in the burst interval run sequence. The interval state sequence is expanded by writing the fixed position of the preset interval interval corresponding to each burst interval run into each run interval position covered from the start run interval position to the end run interval position, so that each run interval position corresponds to a preset interval interval fixed position. The preset interval interval fixed position is set in ascending order of preset negative interval interval, short interval interval, medium-short interval interval, medium-long interval interval and long interval interval. For example, the preset negative interval interval corresponds to 0, the short interval interval corresponds to 1, the medium-short interval interval corresponds to 2, the medium-long interval interval corresponds to 3, and the long interval interval corresponds to 4.

[0082] When accumulating and detecting change points in the run-interval state sequence, the baseline center value and baseline discrete value of the run-interval state sequence are calculated. The baseline center value can be determined by the median of the run-interval state sequence, and the baseline discrete value can be determined by the median absolute deviation between the fixed arrangement position of each preset interval in the run-interval state sequence and the baseline center value. When the baseline discrete value is 0, it is set to 1. The fixed arrangement position of each preset interval is read according to the run-interval position order, the normalized deviation of the fixed arrangement position of the preset interval relative to the baseline center value is calculated, and positive cumulative sum and negative cumulative sum are formed respectively. The cumulative sum; the forward cumulative sum is used to record continuous deviations in the run interval from a shorter state to a longer state, and the reverse cumulative sum is used to record continuous deviations in the run interval from a longer state to a shorter state; the change point determination threshold is determined based on the run interval state sequence of historical encrypted communication connections in the first network domain and the second network domain. The determination process is to perform the same run interval state sequence expansion and cumulative sum calculation on the historical encrypted communication connections, and to statistically analyze the quantile boundaries of the historical forward cumulative sum peak and the historical reverse cumulative sum peak. For example, the 90th percentile of the combined distribution of the historical forward cumulative sum peak and the historical reverse cumulative sum peak can be taken as the change point determination threshold.

[0083] When the forward cumulative sum reaches the change point determination threshold, the run interval position that reaches the change point determination threshold is recorded as the run interval change point position, and the change direction corresponding to the run interval change point position is recorded as the forward change direction; when the reverse cumulative sum reaches the change point determination threshold, the run interval position that reaches the change point determination threshold is recorded as the run interval change point position, and the change direction corresponding to the run interval change point position is recorded as the reverse change direction; after the run interval change point position is recorded, the corresponding forward or reverse cumulative sum is cleared to zero, and the next run interval position is read; the burst interval run sequence corresponding to the network flow record before migration is obtained by cumulative sum and change point detection to obtain the set of run interval change point positions before migration, and the burst interval run sequence corresponding to the network flow record after migration is obtained by cumulative sum and change point detection to obtain the set of run interval change point positions after migration; each run interval change point position in the set of run interval change point positions before migration and the set of run interval change point positions after migration contains the run interval position, change direction, and the preset interval range of the corresponding burst interval run.

[0084] Project the run-interval change point position to the unified run-interval position using the candidate alignment path corresponding to the time-series continuous session pair, and take the segments with adjacent unified run-interval positions and the same change direction as the change point overlap segment.

[0085] Specifically, when projecting the run-length interval change point position to the unified run-length order for the candidate alignment path corresponding to the temporally consecutive session pair, a unified run-length order is assigned to each matching position in the candidate alignment path according to the order of the candidate alignment path. The unified run-length order represents the common arrangement position formed by the directional packet length run of the pre-migration network flow record and the directional packet length run of the post-migration network flow record in the candidate alignment path. When the pre-migration run-length interval change point position is located between two adjacent directional packet length runs of the pre-migration network flow record, the matching position in the candidate alignment path that contains the directional packet length run of the previous pre-migration network flow record and the matching position that contains the directional packet length run of the next pre-migration network flow record are searched, and the later unified run-length order of the two matching positions is taken as the unified run-length order of the pre-migration run-length interval change point position. The post-migration run-length interval change point position is projected to the unified run-length order in the same way. After the projection is completed, both the pre-migration run-length interval change point position and the post-migration run-length interval change point position have a unified run-length order and a change direction.

[0086] When determining the overlapping segment of the variable points, read the variable point position of the pre-migration run interval after projection and the variable point position of the post-migration run interval after projection. If the unified run order of the variable point position of the pre-migration run interval after projection is the same as or differs by one unified run order from the unified run order of the variable point position of the post-migration run interval after projection, and the change direction of the variable point position of the pre-migration run interval after projection is consistent with the change direction of the variable point position of the post-migration run interval after projection, then the unified run order range covered by the two unified run interval variable point positions is determined as the overlapping segment of the variable points. When multiple adjacent overlapping segments of the variable points have continuous or overlapping unified run order ranges, the multiple adjacent overlapping segments of the variable points are merged into one overlapping segment of the variable points. The data items of the overlapping segment of the variable points include the starting unified run order, the ending unified run order, the change direction, the variable point position of the pre-migration run interval, and the variable point position of the post-migration run interval.

[0087] Within the overlapping segment of the variable point, read the short header length sequence of the long run record of the direction packet, and take the segment where the short header length continuously maintains the same value as the stable segment of the short header length to generate the implicit connection identifier continuation feature.

[0088] Specifically, when reading the short header length sequence of the directional packet long run record within the overlapping segment, the corresponding matching position is obtained from the candidate alignment path based on the start and end unified run sequence of the overlapping segment. Then, the short header length sequence of the directional packet long run corresponding to the network flow record before migration and the short header length sequence of the directional packet long run corresponding to the network flow record after migration are read from each matching position. Positions with null short header lengths do not participate in the continuity judgment of the same value, but null positions are retained in the short header length sequence. Non-null short header lengths are read in the order of message arrival time. If the continuously read short header lengths maintain the same value, and the continuous reading range covers at least two message positions, then the continuous reading range is determined as the short header length stable segment. The data items of the short header length stable segment include the short header length value, the start unified run sequence, the end unified run sequence, the corresponding directional packet long run position, and the range of message positions covered.

[0089] When generating implicit connection identifier continuation features, the data items of the overlapping segments and the data items of the short header length stable segments within the same overlapping segment are bound to form implicit connection identifier continuation features. Implicit connection identifier continuation features include at least the starting unified run-length order, the ending unified run-length order, the direction of change, the value of the short header length, the position of the changing segment before migration, the position of the changing segment after migration, and the candidate alignment path corresponding to the temporally consecutive session pair. If there is no short header length stable segment within the overlapping segment, implicit connection identifier continuation features are not generated.

[0090] S5. Map the implicit connection identifier continuation feature to the abnormal event queue in the network flow record before migration to form a cross-domain risk context chain, including:

[0091] Using the unified run-length order corresponding to the implicit connection identifier continuation feature as the mapping benchmark, the same position of the abnormal event queue in the network flow record before migration and the abnormal event queue in the network flow record after migration on the unified run-length order are determined respectively.

[0092] Specifically, the unified run-length order is derived from the common arrangement position in the candidate alignment paths corresponding to the temporally consecutive session pairs, allocated according to the order of the candidate alignment paths; the implicit connection identifier continuation feature includes at least the starting unified run-length order, the ending unified run-length order, the direction of change, the short header length value, the run-length interval change point position before migration, the run-length interval change point position after migration, and the candidate alignment paths corresponding to the temporally consecutive session pairs; before performing the same-order mapping, the starting unified run-length order and the ending unified run-length order in the implicit connection identifier continuation feature are read, and all unified run-length orders between the starting unified run-length order and the ending unified run-length order are determined as the mappable range; when the implicit connection identifier continuation feature is empty, no cross-domain risk context chain is generated; when the abnormal event queue in the network flow record before migration is empty and the abnormal event queue in the network flow record after migration is empty, no cross-domain risk context chain is generated.

[0093] When determining the position of the abnormal event queue in the pre-migration network flow record in the same order on the unified run-length order, the abnormal event queue in the pre-migration network flow record is read in order of the arrival time of the event occurrence message from earliest to latest. Each abnormal event includes the arrival time of the event occurrence message, the network domain identifier to which the event belongs, and the event type. For each abnormal event in the pre-migration network flow record, the queue is searched in the long run-length order of the corresponding direction packet in the pre-migration network flow record, where the arrival time of the start message is no later than the arrival time of the event occurrence message and the arrival time of the end message is no earlier than the arrival time of the event occurrence message. The time-direction packet length run is determined, and the found direction packet length run is identified as the direction packet length run to which the abnormal event belongs. If the arrival time of the event message is within the run interval between adjacent direction packet length runs, the latter direction packet length run is identified as the direction packet length run to which the abnormal event belongs. If the arrival time of the event message is earlier than the arrival time of the first start message in the direction packet length run sequence, or the arrival time of the event message is later than the arrival time of the last end message in the direction packet length run sequence, the abnormal event is recorded as an unmapped event and is not included in the cross-domain association event labeling.

[0094] After obtaining the run-length packet of the direction to which the abnormal event belongs in the pre-migration network flow record, the matching position containing the run-length packet of the direction to which the abnormal event belongs in the pre-migration network flow record is searched in the candidate alignment path corresponding to the temporally consecutive session pair. When searching for matching positions in the candidate alignment path corresponding to the temporally consecutive session pair, only matching positions where the unified run-length order falls within the mappable range are selected, and the unified run-length order corresponding to the matching position is taken as the same position of the abnormal event in the pre-migration network flow record in the unified run-length order. If multiple matching positions contain the run-length packet of the same abnormal event, then among the matching positions where the unified run-length order falls within the mappable range, the matching position of the midpoint between the starting unified run-length order and the ending unified run-length order, which are closest to the implicit connection identifier continuation feature, is selected. The location is determined, and the unified run-length bit order corresponding to the selected matching location is used as the same bit order position. The abnormal event queue in the migrated network flow record is processed in the same way: the direction packet length run of the abnormal event in the migrated network flow record is determined according to the arrival time of the event occurrence packet of the abnormal event in the migrated network flow record. Then, the matching location containing the direction packet length run of the abnormal event in the migrated network flow record is searched in the candidate alignment path corresponding to the time-series continuous session pair. Finally, the unified run-length bit order corresponding to the matching location is used as the same bit order position of the abnormal event in the migrated network flow record in the unified run-length bit order. After the processing is completed, the abnormal event queue in the network flow record before migration and the abnormal event queue in the network flow record after migration both form an abnormal event set with the same bit order position.

[0095] When determining whether the same position falls within a variable point coincident segment, the variable point coincident segment data item bound to the implicit join identifier continuation feature is read. This data item includes the starting unified run order, ending unified run order, change direction, run interval variable point position before migration, and run interval variable point position after migration. If the same position of an abnormal event is greater than or equal to the starting unified run order of the variable point coincident segment, and the same position of the abnormal event is less than or equal to the ending unified run order of the variable point coincident segment, then the same position is determined to fall within the variable point coincident segment. When determining whether the same position corresponds to a short header length stable segment, the short header length stable segment data item bound to the implicit join identifier continuation feature is read. This data item includes the short header length value, starting unified run order, ending unified run order, change direction, run interval variable point position before migration, and run interval variable point position after migration. The system retrieves the run order, end unified run order, corresponding direction packet length run position, and covered message position range. When the synquence position of an abnormal event is greater than or equal to the start unified run order of the short header length stable segment, and the synquence position of the abnormal event is less than or equal to the end unified run order of the short header length stable segment, the synquence position corresponds to the short header length stable segment. When the short header length stable segment includes the covered message position range, the message position corresponding to the abnormal event is also read. When the message position corresponding to the abnormal event falls within the covered message position range, the determination result of the short header length stable segment corresponding to the abnormal event is retained. When the message position corresponding to the abnormal event does not fall within the covered message position range, the determination result of the short header length stable segment corresponding to the abnormal event is cancelled.

[0096] Anomalies in which the same position falls into the variable point overlap segment and the corresponding short header length stable segment are marked as cross-domain related events. Cross-domain related events are connected according to the message arrival time to form a cross-domain risk context chain.

[0097] Specifically, when an anomaly event whose synchronous position falls within the overlapping segment of the change point and corresponds to a stable segment of short header length is marked as a cross-domain associated event, anomalies in both the pre-migration and post-migration network flow records that simultaneously meet both conditions are written into the cross-domain associated event set. The data items for cross-domain associated events include the arrival time of the event message, the network domain identifier to which the event belongs, the event type, the synchronous position, the corresponding overlapping segment of the change point, the corresponding stable segment of short header length, the short header length value, and the implicit connection identifier continuation characteristic. If an anomaly event only satisfies the condition of its synchronous position falling within the change point... If there are overlapping segments, or if only the same segment with a short header length is satisfied, the abnormal event will not be written into the cross-domain association event set. If the same abnormal event corresponds to multiple implicit connection identifier continuation features, they will be sorted according to the absolute value of the difference between the starting unified run order and the same position of the abnormal event, and the implicit connection identifier continuation feature with the smallest absolute difference will be selected as the data item of the cross-domain association event. If the absolute values ​​of the difference are the same, the implicit connection identifier continuation feature with a shorter range of unified run order will be selected as the data item of the cross-domain association event.

[0098] When forming a cross-domain risk context chain, the set of cross-domain related events is sorted from earliest to latest according to message arrival time. Cross-domain related events with the same message arrival time are sorted from smallest to largest according to their phenotypic position; cross-domain related events with the same message arrival time and phenotypic position are sorted according to the order from the first network domain to the second network domain corresponding to the network domain identifier of the event. After sorting, a chain connection relationship is established between adjacent cross-domain related events. The data items of the chain connection relationship include the previous cross-domain related event, the next cross-domain related event, the phenotypic position of the previous cross-domain related event, the phenotypic position of the next cross-domain related event, the network domain identifier of the previous cross-domain related event, the network domain identifier of the next cross-domain related event, and the message arrival time difference between adjacent events; the data items of the cross-domain risk context chain include the set of cross-domain related events, the chain connection relationship, the implicit connection identifier continuation feature, the change point overlapping segment, the short header length stable segment, the network flow record before migration, and the network flow record after migration.

[0099] S6. When the abnormal events in the network flow records after migration and the abnormal events in the network flow records before migration in the cross-domain risk context chain satisfy a progressive order, output continuous security communication warning records, including:

[0100] Traverse the cross-domain associated events in the cross-domain risk context chain and determine whether the cross-domain associated event originates from a pre-migration network flow record or a post-migration network flow record based on the message arrival time.

[0101] Specifically, cross-domain associated events are read according to the message arrival time sorting results already formed in the cross-domain risk context chain; each cross-domain associated event includes at least the event occurrence message arrival time, the network domain identifier to which the event belongs, the event type, the same order position, the corresponding strain point overlap segment, the corresponding short header length stable segment, the short header length value, and the implicit connection identifier continuation feature; if the network domain identifier to which the cross-domain associated event belongs is equal to the first network domain, and the event occurrence message arrival time of the cross-domain associated event falls within the start message arrival time to end message arrival time of the network flow record before migration. If the cross-domain associated event is determined to originate from the pre-migration network flow record, and the network domain identifier of the cross-domain associated event is equal to the second network domain, and the arrival time of the event occurrence message of the cross-domain associated event falls between the start message arrival time and the end message arrival time of the post-migration network flow record, then the cross-domain associated event is determined to originate from the post-migration network flow record. If the cross-domain associated event cannot satisfy the determination conditions of originating from both the pre-migration and post-migration network flow records, then the cross-domain associated event is recorded as an event with an undetermined source, and events with an undetermined source do not participate in the progressive order determination.

[0102] When a cross-domain association event originating from a pre-migration network flow record is earlier than a cross-domain association event originating from a post-migration network flow record, and the cross-domain association events maintain an increasing order in the unified run-length order and point from the first network domain to the second network domain, the cross-domain risk context chain is determined to satisfy the progressive order.

[0103] Specifically, cross-domain related events from pre-migration network flow records and cross-domain related events from post-migration network flow records are read, and comparable event pairs are formed according to message arrival time. A comparable event pair consists of one cross-domain related event from pre-migration network flow records and one cross-domain related event from post-migration network flow records. If the arrival time of the event occurrence message of the cross-domain related event from pre-migration network flow records is earlier than the arrival time of the event occurrence message of the cross-domain related event from post-migration network flow records, then the comparable event pair satisfies the time sequence condition. If the octet position of the cross-domain related event from pre-migration network flow records is lower than the octet position of the cross-domain related event from post-migration network flow records, then the comparable event pair satisfies the uniform run-length order increment condition. If the network domain identifier of the cross-domain related event from pre-migration network flow records is the first network domain, and the network domain identifier of the cross-domain related event from post-migration network flow records is the second network domain, then the comparable event pair satisfies the network domain pointing condition.

[0104] The method for determining the progressive order of cross-domain risk context chains is as follows: At least one comparable event pair in the cross-domain risk context chain simultaneously satisfies the time sequence condition, the uniform run-length order increment condition, and the network domain pointing condition, and both cross-domain related events in the comparable event pair correspond to the same implicit connection identifier continuation feature. If multiple comparable event pairs exist, they are sorted from earliest to latest according to the arrival time of event occurrence packets from the pre-migration network flow records, and then from earliest to latest according to the arrival time of event occurrence packets from the post-migration network flow records. The comparable event pair that is ranked first and simultaneously satisfies the time sequence condition, the uniform run-length order increment condition, and the network domain pointing condition is selected as the progressive order event pair. If no progressive order event pair exists in the cross-domain risk context chain, continuous secure communication warning records are not generated.

[0105] Generate continuous secure communication early warning records that include transmission 5-tuple change records, initial handshake missing markers, implicit connection identifier continuation features, and cross-domain risk context chains;

[0106] Specifically, when generating continuous secure communication early warning records, the system reads the progressive sequence event pairs, transmission 5-tuple change records, initial handshake missing flag, implicit connection identifier continuation characteristics, and cross-domain risk context chain, and writes them into the continuous secure communication early warning records according to a preset field structure. The continuous secure communication early warning records must include at least the transmission 5-tuple before the change, the transmission 5-tuple after the change, the network domain identifier before the change, the network domain identifier after the change, the arrival time of the last message before the change, the arrival time of the first message after the change, the initial handshake missing flag, the implicit connection identifier continuation characteristics, the cross-domain risk context chain, the progressive sequence event pairs, cross-domain related events derived from the network flow records before migration, and cross-domain related events derived from the network flow records after migration. The unified run-length order increment range and message arrival time range are defined. The unified run-length order increment range is formed by the same position of two cross-domain related events in the progressive order event pair, and the message arrival time range is formed by the arrival time of the event occurrence messages of two cross-domain related events in the progressive order event pair. After the continuous secure communication early warning record is generated, the continuous secure communication early warning record is written into the early warning record set according to the end time of the message arrival time range. When there are already continuous secure communication early warning records with the same transmission 5-tuple change record, the same initial handshake missing marker, the same implicit connection identifier continuation feature, and the same cross-domain risk context chain in the early warning record set, the continuous secure communication early warning record with the larger message arrival time range is retained.

[0107] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A hybrid network security communication early warning method, characterized in that, Includes the following steps: S1. When the transmission quintuple of the encrypted communication connection is detected to switch from the first network domain to the second network domain, collect the network flow record before migration, the network flow record after migration, and the initial handshake missing marker. S2. Perform run-length encoding on the network flow records before and after migration to obtain the directional packet long run-length sequence and the burst interval run-length sequence. S3. The dynamic time warping algorithm is used to align the long run sequence of the direction packet, and candidates with time reversal in the alignment path are filtered out to obtain time-continuous session pairs. S4. When the missing initial handshake marker for the sequential continuous session pair is marked as missing, calculate the variable point overlapping segment and short header length stable segment of the burst interval run sequence to generate implicit connection identifier continuation feature. S5. Map the implicit connection identifier continuation feature to the abnormal event queue in the network flow record before migration to form a cross-domain risk context chain. S6. When the abnormal events of the network flow records after migration in the cross-domain risk context chain satisfy the progressive order of the abnormal events of the network flow records before migration, output continuous security communication warning records.

2. The hybrid network security communication early warning method of claim 1, wherein, S1, specifically: Using the transmission quintuple of the encrypted communication connection as the comparison object, a transmission quintuple change record is generated according to the network domain identifier and the message arrival time. When the transmission quintuple change record indicates that the transmission quintuple has switched from the first network domain to the second network domain, the message direction, message length, message arrival time, short header length and abnormal event queue in the first network domain and the second network domain respectively are extracted to generate network flow records before migration and network flow records after migration. When the network flow record after migration does not contain the initial handshake message of the encrypted communication connection, an initial handshake missing flag is generated.

3. The hybrid network security communication early warning method according to claim 2, characterized in that, S2, specifically: Arrange the network flow records before migration and the network flow records after migration according to the message arrival time; Adjacent messages with the same message direction and message length falling within the same preset length range are merged into a directional packet long run. The message direction, preset length range, start and end message arrival time, and short header length sequence of the directional packet long run are recorded. The run interval is formed by the difference between the arrival time of the previous end message and the arrival time of the next start message of the adjacent directional packet long run. Run intervals that fall continuously into the same preset interval range are merged into burst interval runs, resulting in directional packet long run sequences and burst interval run sequences.

4. The hybrid network security communication early warning method according to claim 3, characterized in that, S3, specifically: Using the long run sequence of directional packets corresponding to the network flow records before migration and the long run sequence of directional packets corresponding to the network flow records after migration as input, the run-length matching cost is constructed according to the consistency of message direction and the proximity of preset length intervals. A dynamic time warping algorithm is used to generate candidate alignment paths along the run-length sequence. When the arrival times of the start and end packets of the long run corresponding to the network flow record after migration are reversed relative to the arrival times of the start and end packets of the long run corresponding to the network flow record before migration in the candidate alignment path, the candidate alignment path is filtered out as a candidate with time reversal, and a time-continuous session pair is obtained.

5. The hybrid network security communication early warning method according to claim 4, characterized in that, S4, specifically: When the missing initial handshake for a sequential session pair is marked as missing, the run interval run sequence corresponding to the network flow record before migration and the run interval run sequence corresponding to the network flow record after migration within the sequential session pair are accumulated and change point detected respectively to obtain the run interval change point position. Project the run-interval change point position to the unified run-interval position using the candidate alignment path corresponding to the time-series continuous session pair, and take the segments with adjacent unified run-interval positions and the same change direction as the change point overlap segment. Within the overlapping segment of the variable point, read the short header length sequence of the long run record of the direction packet, and take the segment where the short header length continuously maintains the same value as the stable segment of the short header length to generate the implicit connection identifier continuation feature.

6. The hybrid network security communication early warning method according to claim 5, characterized in that, S5, specifically: Using the unified run-length order corresponding to the implicit connection identifier continuation feature as the mapping benchmark, the same position of the abnormal event queue in the network flow record before migration and the abnormal event queue in the network flow record after migration on the unified run-length order are determined respectively. Anomalies whose occupancy positions fall within the variable point overlap segment and whose corresponding short header length is a stable segment are marked as cross-domain related events. Cross-domain related events are connected according to message arrival time to form a cross-domain risk context chain.

7. The hybrid network security communication early warning method according to claim 6, characterized in that, S6, specifically: Traverse the cross-domain associated events in the cross-domain risk context chain and determine whether the cross-domain associated event originates from a pre-migration network flow record or a post-migration network flow record based on the message arrival time. When a cross-domain association event originating from a pre-migration network flow record is earlier than a cross-domain association event originating from a post-migration network flow record, and the cross-domain association events maintain an increasing order in the unified run-length order and point from the first network domain to the second network domain, the cross-domain risk context chain is determined to satisfy the progressive order. Generate continuous secure communication early warning records that include transmission 5-tuple change records, initial handshake missing markers, implicit connection identifier continuation features, and cross-domain risk context chains.

Images