Satellite communication network abnormity detection method based on network control

Abstract

The invention discloses a satellite communication network abnormity detection method based on network control. A fuzzy C-means clustering algorithm is utilized to study normal audit data and an abnormity detection mechanism is established, so that a post analysis on an abnormal event is realized; a support vector data description single classifier is utilized to summarize a normal short sequence and an abnormal short sequence as well as a hidden Markov model is used to carry out abnormity detection on communication signalings of all earth stations in a whole time slot, so that real-time detection based on the communication signalings can be realized; and by utilizing the above-mentioned methods of the post analysis and the real-time detection, a satellite communication network abnormity detection prototype system based on network control is realized. According to the invention, the post analysis method is suitable for large-scale data as well as a declaration omission rate and a misdeclaration rate are low; and the real-time detection method has a good detection performance as well as signaling detection time is short and the reaction speed is fast; therefore, an on-line detection object can be realized and safety of a signaling system can be enhanced.

Description

technical field [0001] The invention belongs to satellite communication network abnormality detection technology, in particular to a satellite communication network abnormality detection method based on network control. Background technique [0002] With the continuous development of computer and communication technology, the use of unknown new methods to intrude on computers and networks is becoming more and more serious, which makes the status of anomaly detection more and more important. Anomaly detection is a branch of intrusion detection, which refers to any collection of activities that attempt to compromise the integrity, confidentiality, and availability of resources. The premise of anomaly detection is that the intruder's activities are different from those of normal subjects and can be distinguished from each other, and then this "different" and "mutual distinction" is used as the basis for judging whether it is an intrusion behavior. The general method is to esta...

AI Technical Summary

Problems solved by technology

However, this technology also has some disadvantages: the threshold is difficult to determine, too low or too high is prone to false alarms or missed alarms; it is difficult to detect attacks that use the sequence relationship of events

Attacks on abnormal behavior are difficult to detect with traditional detection methods

At present, the satellite network management has not proposed an effective anomaly detection mechanism and solution for this problem

Images