Mining method and device for satellite internet node risk association analysis

Abstract

The invention relates to the technical field of satellite network security, and discloses a satellite internet node risk association analysis-oriented mining method and device, and the method comprises the steps: S1, obtaining an access record of a satellite internet node; s2, scanning an access record to obtain an access operation attribute set, selecting a plurality of attributes from the access operation attribute set as particles of a particle swarm optimization algorithm, performing search calculation on the particles through the particle swarm optimization algorithm to obtain the particles with the maximum fitness value, and taking the positions of the particles as optimal threshold values; s3, performing descending sorting on the access operation attributes with the attribute frequency greater than or equal to the optimal threshold in the access operation attribute set according to the attribute frequency, constructing a frequent pattern tree by the access operations in the access operation attribute set according to the sorting sequence, and obtaining the frequent access operations through a confidence coefficient formula after obtaining all the frequent access operations by utilizing the constructed frequent pattern tree. And determining a risk association rule between the access operations. According to the method, the satellite internet node risk association analysis efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of satellite network security, and in particular to a mining method and device for satellite Internet node risk association analysis. Background Art

[0002] Satellite Internet refers to an Internet broadband service model that uses satellites as a means of access. It belongs to the information infrastructure of the new infrastructure. The ground network relies on base station communication, while satellite Internet accesses the Internet based on satellite communication technology, which is similar to moving the ground base station into space. Each satellite is a mobile base station. According to the different orbits of communication satellites, satellite Internet can be divided into high orbit and low orbit.

[0003] Currently, the world is accelerating the deployment of satellite Internet. Due to the scarcity of satellite orbital resources and spectrum, countries have already begun to competitively launch satellites to gain first-mover advantage. In 2024, the Falcon 9 rocket will complete at least 150 launch missions, and the total number of Starlink satellites will reach 42,000 by 2027. China has submitted a low-orbit constellation and spectrum application to the ITU for a total of 13,000 satellites. According to the plan, the number of low-orbit satellites launched by China will reach more than 3,900 in 2027 and will exceed 6,000 in 2030.

[0004] Satellite Internet node risk correlation analysis refers to the process of identifying and evaluating the security risks faced by each node in the satellite Internet system (including the satellite itself, ground stations, user terminals, etc.). These risks may come from technical defects, network attacks, data leakage, identity impersonation, denial of service attacks, etc., and these risk factors may be interrelated and jointly affect the security and stability of the entire satellite network.

[0005] Among the existing satellite network risk analysis technologies, association rule mining algorithms can be roughly divided into search algorithms, hierarchical algorithms, data set partitioning algorithms, sampling algorithms, etc. However, their common problems are that the algorithm efficiency is low and they occupy a lot of memory. Summary of the invention

[0006] In order to overcome or alleviate one or more of the above technical problems, the purpose of the present invention is to provide a mining method and device for satellite Internet node risk association analysis to improve the efficiency of satellite Internet node risk association analysis.

[0007] The present invention provides the following technical solutions:

[0008] In a first aspect, the present invention provides a mining method for satellite Internet node risk association analysis, comprising the following steps:

[0009] S1: Obtain access records of satellite Internet nodes, and encode each attribute value of access operations in the access records;

[0010] S2: Scan the access records to obtain an access operation attribute set, select several attributes from the access operation attribute set as particles of the particle swarm optimization algorithm, search and calculate the particles through the particle swarm optimization algorithm, obtain the particle with the largest fitness value, and use its position as the optimal threshold;

[0011] S3: Sort the access operation attributes in the access operation attribute set whose attribute frequency is greater than or equal to the optimal threshold in descending order according to the attribute frequency. Construct a frequent pattern tree of the access operations in the access operation attribute set according to the sorting order. After obtaining all frequent access operations using the constructed frequent pattern tree, determine the risk association rules between the access operations through the confidence formula.

[0012] According to some embodiments, step S2 comprises:

[0013] S21: Scan the access records to obtain an access operation attribute set, count the number of occurrences of each access operation attribute in the access operation attribute set to obtain a frequency, delete access operations whose frequency is less than an optimal threshold, and arrange the access operations in the current access operation attribute set in descending order of frequency;

[0014] S22: Obtain N / 2 access operation attributes above and below the optimal threshold, and randomly select N / 20 from the obtained access operation attributes as particles of the particle swarm optimization algorithm, where N is the preset maximum number of iterations;

[0015] S23: Calculate the fitness value of the particle, which is expressed as:

[0016] F(x)=aSupport(x)+b / H(x) (1)

[0017] H(x)=-p(x)log2p(x) (2)

[0018] Among them, F(x) represents the fitness value of particle x, Support(x) represents the support of particle x, H(x) represents information entropy, and a and b are weight parameters;

[0019] S24: The current particle is updated according to the step size, and the fitness value of the updated particle is calculated; the update formula of the current particle is:

[0020] V i =V i +c1×rand()×(pbest i -x i )+c2×rand()×(gbest i-x i ) (3)

[0021] x i =x i +V i (4)

[0022] Among them, V i represents the step size of particle i, c1 and c2 both represent learning factors, rand() represents the random function used to generate random numbers between (0, 1), and x i represents the position of particle i, pbest i 、gbest i They represent the best position encountered by particle i and the best position encountered by other particles except particle i respectively;

[0023] S25: Determine whether the current number of iterations reaches the preset maximum number of iterations. If so, terminate the iteration and obtain the particle with the largest fitness value, and use its position as the optimal threshold; otherwise, return to execute S23.

[0024] According to some embodiments, step S3 comprises the following steps:

[0025] S31: traverse the access operation attribute set to generate a frequent access operation attribute set, delete the access operations whose frequency is less than the optimal threshold in the frequent access operation attribute set, and sort the access operations in the current frequent access operation attribute set in descending order according to the frequency;

[0026] S32: Create a root node with a flag of NULL, and for each access operation in the access operation attribute set, add a node to the tree according to the sorted order to form a frequent pattern tree, where NULL represents empty;

[0027] S33: Obtain conditional pattern base from the frequent pattern tree;

[0028] S34: constructing a corresponding conditional frequent pattern tree using the obtained conditional pattern base;

[0029] S35: Repeatedly mine frequent patterns for each newly constructed conditional frequent pattern tree until all frequent access operation attributes are obtained, the frequent pattern tree is empty, or the frequent pattern tree contains only a single path, and then calculate the confidence between the access operation attributes through the confidence formula to determine the association rules between the access operation attributes.

[0030] According to some implementations, in step S32, in the frequent pattern tree, all attributes in each access operation in the access operation attribute set form a path from the root node to the leaf node.

[0031] According to some embodiments, if the attributes of greater than or equal to 2 access operation attributes have the same first m elements after being sorted in descending order of frequency, they share the nodes represented by the first m elements in the frequent pattern tree, where the count of each node in the frequent pattern tree is the number of access operation attribute sets whose paths pass through the node.

[0032] According to some implementations, when inserting an access operation attribute into a frequent pattern tree, if a node corresponding to the access operation attribute does not exist in the tree, a branch is created.

[0033] According to some implementations, determining the risk association rule between access operation attributes through a confidence formula includes:

[0034] The confidence between access operation attributes is calculated by the confidence formula, where the confidence formula is expressed as:

[0035]

[0036] in, I1 and I2 both represent access operation attributes in access operation attribute set I; represents the probability of access operation attribute I2 occurring when access operation attribute I1 occurs; ∪ represents a union; support(I1∪I2) and support(I1) represent the support of the union of access operation attributes I1 and I2 and the support of access operation attribute I1, respectively;

[0037] judge Is it greater than the preset minimum confidence level? If so, output the risk association rule between projects I1 and I2, that is, the probability of project I2 occurring when project I1 occurs.

[0038] In a second aspect, the present invention provides a mining device for satellite Internet node risk association analysis, which includes:

[0039] An acquisition module, used to acquire access records of satellite Internet nodes and encode each attribute value of access operations in the access records;

[0040] An optimization module is used to scan the access records to obtain an access operation attribute set, select several attributes from the access operation attribute set as particles of a particle swarm optimization algorithm, search and calculate the particles through the particle swarm optimization algorithm, obtain the particle with the largest fitness value, and use its position as the optimal threshold;

[0041] A frequent pattern tree module is constructed to sort the access operation attributes in the access operation attribute set whose attribute frequency is greater than or equal to the optimal threshold in descending order according to the attribute frequency. A frequent pattern tree is constructed based on the sorting order of the access operations in the access operation attribute set. After obtaining all frequent access operations using the constructed frequent pattern tree, the risk association rules between the access operations are determined through the confidence formula.

[0042] In the third aspect, the present invention provides a mining device for satellite Internet node risk association analysis, which includes: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the mining device for satellite Internet node risk association analysis executes the above-mentioned mining method for satellite Internet node risk association analysis.

[0043] In a fourth aspect, the present invention provides a computer-readable storage medium having instructions stored thereon, wherein when the instructions are executed by a processor, the above-mentioned mining method for risk association analysis of satellite Internet nodes is implemented.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] The present invention proposes a mining method and device for satellite Internet node risk association analysis, which combines a particle swarm optimization algorithm and a frequent pattern tree and applies them to node risk association analysis in satellite Internet, thereby realizing a new risk association analysis mining method. This method can more quickly determine the association rules between different risk nodes, while saving time, thereby improving the mining efficiency of risk association analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A flowchart of a mining method for satellite Internet node risk association analysis provided in an embodiment of the present invention.

[0047] Figure 2 A line graph comparing the effectiveness results of risk association analysis of Example 1 provided by the present invention and traditional algorithms Aprior and FP-growth. DETAILED DESCRIPTION

[0048] The present invention is described in detail below in conjunction with the embodiments and drawings, but it should be understood that the embodiments and drawings are only used to exemplify the present invention and do not constitute any limitation on the protection scope of the present invention. All reasonable changes and combinations within the scope of the inventive concept of the present invention fall within the protection scope of the present invention.

[0049] The present invention will be further described below in conjunction with the accompanying drawings.

[0050] Example 1

[0051] This embodiment provides a mining method for satellite Internet node risk association analysis, including the following steps:

[0052] S1: Obtain access records of satellite Internet nodes, and encode each attribute value of access operations in the access records;

[0053] S2: Scan the access records to obtain an access operation attribute set, select several attributes from the access operation attribute set as particles of the particle swarm optimization algorithm, search and calculate the particles through the particle swarm optimization algorithm, obtain the particle with the largest fitness value, and use its position as the optimal threshold;

[0054] S3: Sort the access operation attributes in the access operation attribute set whose attribute frequency is greater than or equal to the optimal threshold in descending order according to the attribute frequency. Construct a frequent pattern tree of the access operations in the access operation attribute set according to the sorting order. After obtaining all frequent access operations using the constructed frequent pattern tree, determine the risk association rules between the access operations through the confidence formula.

[0055] The mining method for satellite Internet node risk association analysis provided in this example includes step S2:

[0056] S21: Scan the access records to obtain an access operation attribute set, count the number of occurrences of each access operation attribute in the access operation attribute set to obtain a frequency, delete access operations whose frequency is less than an optimal threshold, and arrange the access operations in the current access operation attribute set in descending order of frequency;

[0057] S22: Obtain N / 2 access operation attributes above and below the optimal threshold, and randomly select N / 20 from the obtained access operation attributes as particles of the particle swarm optimization algorithm, where N is the preset maximum number of iterations;

[0058] S23: Calculate the fitness value of the particle;

[0059] S24: The current particle is updated according to the step size, and the fitness value of the updated particle is calculated;

[0060] S25: Determine whether the current number of iterations reaches the preset maximum number of iterations. If so, terminate the iteration and obtain the particle with the largest fitness value, and use its position as the optimal threshold; otherwise, return to execute S23.

[0061] In this example, after determining the particles of the particle swarm optimization algorithm, we must first initialize them, that is, the particle swarm randomly sets the position and step size in the feasible solution space (where the step size refers to taking a particle every few items). Each particle is a feasible solution to the optimization target problem. Each particle will move in the feasible solution space, and the particle's step size will determine the direction and distance of its next movement. The particles will iteratively approach the current optimal particle until the optimal solution. During the iteration process, each particle will approach two optimal solutions: pbest i 、gbest i , where pbest i 、gbest i They represent the best position encountered by particle i and the best position encountered by other particles except particle i, respectively.

[0062] In the mining method for satellite Internet node risk association analysis described in this example, the fitness value in step S23 is expressed as:

[0063] F(x)=aSupport(x)+b / H(x) (1)

[0064] H(x)=-p(x)log2p(x) (2)

[0065] Among them, F(x) represents the fitness value of particle x, Support(x) represents the support of particle x, H(x) represents information entropy, and a and b are weight parameters.

[0066] In the mining method for satellite Internet node risk association analysis described in this example, in step S24, the update formula of the current particle is:

[0067] V i =V i +c1×rand()×(pbest i -x i )+c2×rand()×(gbest i -x i ) (3)

[0068] x i =x i +V i (4)

[0069] Among them, V i represents the step size of particle i, c1 and c2 both represent learning factors, rand() represents the random function used to generate random numbers between (0, 1), and x i represents the position of particle i, pbest i 、gbest iThey represent the best position encountered by particle i and the best position encountered by other particles except particle i, respectively.

[0070] In the mining method for satellite Internet node risk association analysis described in this example, step S3 includes the following steps:

[0071] S31: traverse the access operation attribute set to generate a frequent access operation attribute set, delete the access operations whose frequency is less than the optimal threshold in the frequent access operation attribute set, and sort the access operations in the current frequent access operation attribute set in descending order according to the frequency;

[0072] S32: Create a root node with a flag of NULL, and for each access operation in the access operation attribute set, add a node to the tree according to the sorted order to form a frequent pattern tree, where NULL represents empty;

[0073] S33: Obtain conditional pattern base from the frequent pattern tree;

[0074] S34: constructing a corresponding conditional frequent pattern tree using the obtained conditional pattern base;

[0075] S35: Repeatedly mine frequent patterns for each newly constructed conditional frequent pattern tree until all frequent access operation attributes are obtained, the frequent pattern tree is empty, or the frequent pattern tree contains only a single path, and then calculate the confidence between the access operation attributes through the confidence formula to determine the association rules between the access operation attributes.

[0076] In the mining method for satellite Internet node risk association analysis described in this example, in step S32, in the frequent pattern tree, all attributes in each access operation in the access operation attribute set form a path from the root node to the leaf node.

[0077] In the mining method for satellite Internet node risk association analysis described in this example, if the attributes in more than or equal to 2 access operation attributes have the same first m elements after being sorted in descending order of frequency, then they share the nodes represented by the first m elements in the frequent pattern tree, where the count of each node in the frequent pattern tree is the number of access operation attribute sets whose paths pass through the node.

[0078] The mining method for satellite Internet node risk association analysis described in this example creates a branch when inserting an access operation attribute into a frequent pattern tree if a node corresponding to the access operation attribute does not exist in the tree.

[0079] The mining method for satellite Internet node risk association analysis described in this example, wherein the risk association rules between access operation attributes are determined by the confidence formula include:

[0080] The confidence between access operation attributes is calculated by the confidence formula, where the confidence formula is expressed as:

[0081]

[0082] in, I1 and I2 both represent access operation attributes in access operation attribute set I; represents the probability of access operation attribute I2 occurring when access operation attribute I1 occurs; ∪ represents a union; support(I1∪I2) and support(I1) represent the support of the union of access operation attributes I1 and I2 and the support of access operation attribute I1, respectively;

[0083] judge Is it greater than the preset minimum confidence level? If so, output the risk association rule between projects I1 and I2, that is, the probability of project I2 occurring when project I1 occurs.

[0084] Example 2

[0085] This example provides a mining device for satellite Internet node risk association analysis, including:

[0086] An acquisition module, used to acquire access records of satellite Internet nodes and encode each attribute value of access operations in the access records;

[0087] An optimization module is used to scan the access records to obtain an access operation attribute set, select several attributes from the access operation attribute set as particles of a particle swarm optimization algorithm, search and calculate the particles through the particle swarm optimization algorithm, obtain the particle with the largest fitness value, and use its position as the optimal threshold;

[0088] A frequent pattern tree module is constructed to sort the access operation attributes in the access operation attribute set whose attribute frequency is greater than or equal to the optimal threshold in descending order according to the attribute frequency. A frequent pattern tree is constructed based on the sorting order of the access operations in the access operation attribute set. After obtaining all frequent access operations using the constructed frequent pattern tree, the risk association rules between the access operations are determined through the confidence formula.

[0089] This example provides a mining device for satellite Internet node risk association analysis, including: a memory and at least one processor, wherein the memory stores instructions; the at least one processor calls the instructions in the memory so that the mining device for satellite Internet node risk association analysis executes the above-mentioned mining method for satellite Internet node risk association analysis.

[0090] This example provides a computer-readable storage medium having instructions stored thereon, wherein when the instructions are executed by a processor, the above-mentioned mining method for risk association analysis of satellite Internet nodes is implemented.

[0091] Example 3

[0092] In this embodiment, the mining method provided in Embodiment 1 is compared with the traditional algorithms Aprior and FP-growth. It can be seen that the mining method proposed in Embodiment 1 improves the effectiveness of risk association analysis by 30%, thereby improving the quality and correctness of the algorithm.

[0093] Table 1 Comparison of effectiveness results of risk association analysis between Example 1 and traditional algorithms Aprior and FP-growth

[0094]

[0095] Table 1 compares the algorithm proposed in Example 1 with the traditional algorithms Aprior and FP-growth in terms of algorithm efficiency, and compares the association rule mining results of the three algorithms at different support levels, i.e., the data volume. As the minimum support count increases, the running time of the three algorithms decreases. When the data volume is not large enough, the Aprior algorithm has fewer scans and is more efficient than the FP-growth algorithm. When the data volume is large, the advantages of the FP-growth algorithm will be revealed, but the efficiency of these two algorithms is not as good as that of Example 1 ( Figure 2 The PSOFP-growth algorithm proposed in the paper is high.

[0096] The above embodiments are only preferred implementations of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A mining method for satellite Internet node risk association analysis, characterized in that: The following steps are involved: S1: Obtaining the access record of the satellite Internet node, and encoding each attribute value of the access operation in the access record; S2: Scan the access records to obtain an access operation attribute set, select several attributes from the access operation attribute set as particles of the particle swarm optimization algorithm, search and calculate the particles through the particle swarm optimization algorithm, obtain the particle with the largest fitness value, and use its position as the optimal threshold; S3: Sort the access operation attributes in the access operation attribute set whose attribute frequency is greater than or equal to the optimal threshold in descending order according to the attribute frequency. Construct a frequent pattern tree of the access operations in the access operation attribute set according to the sorting order. After obtaining all frequent access operations using the constructed frequent pattern tree, determine the risk association rules between the access operations through the confidence formula.

2. The mining method for satellite Internet node risk association analysis according to claim 1, characterized in that: Step S2 includes: S21: Scan the access records to obtain an access operation attribute set, count the number of occurrences of each access operation attribute in the access operation attribute set to obtain a frequency, delete access operations whose frequency is less than an optimal threshold, and arrange the access operations in the current access operation attribute set in descending order of frequency; S22: Obtain N / 2 access operation attributes above and below the optimal threshold, and randomly select N / 20 from the obtained access operation attributes as particles of the particle swarm optimization algorithm, where N is the preset maximum number of iterations; S23: Calculate the fitness value of the particle, which is expressed as: F(x)=aSupport(x)+b / H(x) (1) H(x)=-p(x)log2p(x) (2) Among them, F(x) represents the fitness value of particle x, Support(x) represents the support of particle x, H(x) represents information entropy, and a and b are weight parameters; S24: The current particle is updated according to the step size, and the fitness value of the updated particle is calculated; the update formula of the current particle is: V i =V i +c1×rand()×(pbest i -x i )+c2×rand()×(gbest i -x i ) (3) x i =x i +V i (4) Among them, V i represents the step size of particle i, c1 and c2 both represent learning factors, rand() represents the random function used to generate random numbers between (0, 1), and x i represents the position of particle i, pbest i 、gbest i They represent the best position encountered by particle i and the best position encountered by other particles except particle i respectively; S25: Determine whether the current number of iterations reaches the preset maximum number of iterations. If so, terminate the iteration and obtain the particle with the largest fitness value, and use its position as the optimal threshold; otherwise, return to execute S23.

3. The mining method for satellite Internet node risk association analysis according to claim 1 is characterized in that: Step S3 includes the following steps: S31: traverse the access operation attribute set to generate a frequent access operation attribute set, delete the access operations whose frequency is less than the optimal threshold in the frequent access operation attribute set, and sort the access operations in the current frequent access operation attribute set in descending order according to the frequency; S32: Create a root node with a flag of NULL, and for each access operation in the access operation attribute set, add a node to the tree according to the sorted order to form a frequent pattern tree, where NULL represents empty; S33: Obtain conditional pattern base from the frequent pattern tree; S34: constructing a corresponding conditional frequent pattern tree using the obtained conditional pattern base; S35: Repeatedly mine frequent patterns for each newly constructed conditional frequent pattern tree until all frequent access operation attributes are obtained, the frequent pattern tree is empty, or the frequent pattern tree contains only a single path, and then calculate the confidence between the access operation attributes through the confidence formula to determine the association rules between the access operation attributes.

4. The mining method for satellite Internet node risk association analysis according to claim 3 is characterized in that: Step S32: In the frequent pattern tree, all attributes of each access operation in the access operation attribute set form a path from the root node to the leaf node.

5. The mining method for satellite Internet node risk association analysis according to claim 4 is characterized in that: If the attributes in two or more access operation attributes have the same first m elements after being sorted in descending order of frequency, they share the nodes represented by the first m elements in the frequent pattern tree, where the count of each node in the frequent pattern tree is the number of access operation attribute sets whose paths pass through the node.

6. The method for mining satellite Internet node risk association analysis according to claim 5, characterized in that: When inserting an access operation attribute into a frequent pattern tree, if the node corresponding to the access operation attribute does not exist in the tree, a branch is created.

7. The mining method for satellite Internet node risk association analysis according to claim 3 is characterized in that: Determining the risk association rules between access operation attributes through the confidence formula includes: The confidence between access operation attributes is calculated by the confidence formula, where the confidence formula is expressed as: in, I1 and I2 both represent access operation attributes in access operation attribute set I; represents the probability of access operation attribute I2 occurring when access operation attribute I1 occurs; ∪ represents a union; support(I1∪I2) and support(I1) represent the support of the union of access operation attributes I1 and I2 and the support of access operation attribute I1, respectively; judge Is it greater than the preset minimum confidence level? If so, output the risk association rule between projects I1 and I2, that is, the probability of project I2 occurring when project I1 occurs.

8. A mining device for satellite Internet node risk association analysis, characterized in that: include: An acquisition module, used to acquire access records of satellite Internet nodes and encode each attribute value of access operations in the access records; An optimization module is used to scan the access records to obtain an access operation attribute set, select several attributes from the access operation attribute set as particles of a particle swarm optimization algorithm, search and calculate the particles through the particle swarm optimization algorithm, obtain the particle with the largest fitness value, and use its position as the optimal threshold; A frequent pattern tree module is constructed to sort the access operation attributes in the access operation attribute set whose attribute frequency is greater than or equal to the optimal threshold in descending order according to the attribute frequency. A frequent pattern tree is constructed based on the sorting order of the access operations in the access operation attribute set. After obtaining all frequent access operations using the constructed frequent pattern tree, the risk association rules between the access operations are determined through the confidence formula.

9. A mining device for satellite Internet node risk association analysis, characterized in that: include: A memory and at least one processor, wherein instructions are stored in the memory; The at least one processor calls the instructions in the memory so that the mining device for satellite Internet node risk association analysis executes the mining method for satellite Internet node risk association analysis as described in any one of claims 1-7.

10. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instruction is executed by the processor, a mining method for satellite Internet node risk association analysis as described in any one of claims 1-7 is implemented.

Images