Satellite internet threat identification method and system and electronic equipment

Abstract

The invention relates to the technical field of network security, in particular to a satellite internet threat identification method and system and electronic equipment, and the method comprises the steps: constructing a node reputation evaluation model through a block chain technology, obtaining trusted nodes, constructing a satellite network, and collecting inter-satellite link information in real time; acquiring a satellite network topology change in real time, constructing an inter-satellite link security evaluation model, and generating a self-adaptive security policy matched with the inter-satellite link security level; dynamically calculating and optimizing a data transmission path through a mixed integer linear programming algorithm; constructing an inter-satellite link rapid switching model to analyze inter-satellite link information, generating inter-satellite link abnormal information, and rapidly switching to a standby inter-satellite link according to a self-adaptive security policy and network topology information; performing data transmission according to the inter-satellite link, and monitoring and acquiring transmission behavior data; a data exception recognition model is constructed to analyze the transmission behavior, and a data exception response is obtained; and identifying the satellite network threat according to the data exception response.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a satellite Internet threat identification method, system and electronic equipment. Background Art

[0002] With the rapid popularization of the global Internet and the development of the information society, satellite Internet has become an important component for connecting the world, covering remote areas, and ensuring the security of communications in key areas. However, due to its unique characteristics of high latency, dynamic link changes, and limited resources, the satellite Internet system makes it difficult to directly apply traditional ground-based network security protection protocols, exposing many security risks in data transmission and threat identification. Especially in the field of network security protocols, existing technologies are mainly aimed at encryption, authentication, and data integrity protection in fixed network environments, while a complete technical system has not yet been formed for distributed data transmission and collaborative defense achieved through intersatellite links in satellite Internet.

[0003] In satellite Internet, satellites use inter-satellite links (ISLs) to achieve high-speed data transmission and information sharing, which makes it possible to build a distributed real-time situational awareness system. The use of ISLs can not only achieve secure data transmission between nodes, but also enable cross-satellite data fusion to collaboratively monitor and analyze network anomalies, interference attacks, and other security threats. However, since ISLs themselves may also face risks such as eavesdropping, hijacking, and interference, how to design a network security protocol that can ensure data transmission security and achieve real-time threat detection under limited computing and energy resources has become a key technical problem that needs to be solved urgently.

[0004] Therefore, by utilizing intersatellite links to realize real-time collection of threat data in satellite Internet, distributed data fusion and collaborative analysis, and using lightweight network security protocols to encrypt and authenticate data under limited satellite platform resources, we can achieve rapid and accurate identification and active defense against network threats.

[0005] To this end, a satellite Internet threat identification method, system and electronic equipment are proposed. Summary of the invention

[0006] The purpose of the present invention is to provide a satellite Internet threat identification method, system and electronic device, which construct a node reputation evaluation model through blockchain technology, obtain trusted nodes, and build a satellite network to collect intersatellite link information in real time; obtain satellite network topology changes in real time, build an intersatellite link security evaluation model, and generate an adaptive security strategy that matches the security level of the intersatellite link; dynamically calculate and optimize the data transmission path through a mixed integer linear programming algorithm; build an intersatellite link fast switching model to analyze the intersatellite link information, generate intersatellite link abnormal information, and quickly switch to a spare intersatellite link based on adaptive security strategies and network topology information; transmit data according to the intersatellite link, monitor and obtain transmission behavior data; build a data anomaly identification model to analyze the transmission behavior and obtain data anomaly response; and identify satellite network threats based on the data anomaly response.

[0007] To achieve the above object, the present invention provides the following technical solutions: A satellite Internet threat identification method comprises establishing a node authentication system based on a distributed public key infrastructure, constructing a node reputation evaluation model through blockchain technology, and obtaining trusted nodes; constructing a satellite network based on the trusted nodes, and collecting intersatellite link information in real time; obtaining satellite network topology changes in real time based on a machine learning algorithm, constructing an intersatellite link security evaluation model, and generating an adaptive security strategy that matches the security level of the intersatellite link; dynamically calculating and optimizing a data transmission path based on the adaptive security strategy and network topology information through a mixed integer linear programming algorithm; constructing an intersatellite link fast switching model to analyze the intersatellite link information, generate intersatellite link abnormality information, and quickly switch to a standby intersatellite link based on the adaptive security strategy and network topology information; transmitting data based on the intersatellite link, monitoring and obtaining transmission behavior data; constructing a data abnormality identification model to analyze the transmission behavior and obtain a data abnormality response; and identifying and processing satellite network threats based on the data abnormality response.

[0008] Preferably, the trusted node is a satellite node whose reputation score exceeds a preset threshold in the blockchain reputation evaluation model; The construction of the satellite network includes the following steps: constructing a three-dimensional intersatellite topology structure based on the node geographic location; dynamically selecting a trusted node based on the node reputation score; establishing an initial security link based on the trusted node; The intersatellite link information is collected in real time through a satellite-borne multi-mode sensor array, including carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, routing hop count, bit error rate, signal attenuation index, node relative motion vector, space radiation intensity and link encryption status.

[0009] Preferably, the step of acquiring the satellite network topology change is: The machine learning algorithm adopts a spatiotemporal graph convolutional neural network model. The input layer receives the intersatellite link information of the satellite network; the hidden layer contains a long short-term memory module to process time series features and analyze the input data; the output layer generates a topological dynamic probability map; and the node disappearance and node addition events are detected through an adaptive sliding window mechanism, and the intersatellite link information is updated in real time.

[0010] Preferably, the intersatellite link security assessment model includes a data collection layer, a feature extraction layer, an assessment calculation layer and a strategy generation layer; The data acquisition layer obtains the carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, bit error rate and link encryption status in the intersatellite link information in real time; the feature extraction layer uses a deep autoencoder to reduce the feature dimension of multi-dimensional parameters to generate a composite security feature vector; the evaluation calculation layer performs weighted calculation on the composite security feature vector through a fuzzy comprehensive evaluation algorithm to generate a standardized security score; the strategy generation layer adaptively adjusts the security strategy of the intersatellite link according to the security score.

[0011] Preferably, the step of dynamically calculating and optimizing the data transmission path includes: According to the adaptive security strategy and the topological information of the satellite network, the intersatellite link information is used as an input parameter; a mixed integer linear programming algorithm is used to calculate the optimal data transmission path by constructing the minimization of transmission delay, path risk value and energy consumption as the optimization goal, and according to the link bandwidth, delay and load capacity as the constraint conditions; combined with the adaptive security strategy, the path selection is dynamically adjusted to ensure that the optimization of the data transmission path matches the security requirements under different link security levels; and the calculated data transmission path is verified according to the intersatellite link information obtained in real time.

[0012] Preferably, the intersatellite link fast switching model includes a data analysis layer, an abnormality identification layer, a switching decision layer and an output layer; the data analysis layer processes the intersatellite link information by using a machine learning algorithm to identify potential abnormal link behavior; the abnormality identification layer generates intersatellite link abnormality information by analyzing the abnormal link behavior, and the intersatellite link abnormality information includes link performance degradation, link loss and sudden interference; the switching decision layer generates a switching decision based on the results of real-time analysis, by evaluating the reliability and security of the link and combining the status of the backup link, and quickly switches the data stream to the backup intersatellite link; the output layer confirms the link status after switching to ensure smooth transmission of the data stream.

[0013] Preferably, the data anomaly recognition model includes a first input layer, a second feature extraction layer, an anomaly detection layer and a response decision layer: The first input layer obtains transmission behavior data, and the transmission behavior data includes the transmission time, data size, transmission delay, throughput and link quality information of the data packet; the second feature extraction layer extracts features from the transmission behavior data and generates a transmission behavior feature vector; the anomaly detection layer analyzes the transmission behavior feature vector, identifies abnormal transmission behavior, and generates anomaly detection results, and the anomaly detection results include attacks, data tampering and transmission failures; the response decision layer generates a corresponding data anomaly response based on the anomaly detection result.

[0014] A satellite Internet threat identification system comprises: a satellite network construction module, which establishes a node authentication system based on a distributed public key infrastructure, constructs a node reputation evaluation model through blockchain technology to obtain trusted nodes; constructs a satellite network based on the trusted nodes, and collects intersatellite link information in real time; a security policy generation module, which obtains satellite network topology changes in real time based on a machine learning algorithm, constructs an intersatellite link security evaluation model, and generates an adaptive security policy that matches the security level of the intersatellite link; a data transmission path acquisition module, which dynamically calculates and optimizes the data transmission path based on the adaptive security policy and network topology information through a mixed integer linear programming algorithm; a link fast switching module, which constructs an intersatellite link fast switching model to analyze the intersatellite link information, generates intersatellite link abnormality information, and quickly switches to a standby intersatellite link based on the adaptive security policy and network topology information; an abnormality identification module, which performs data transmission based on the intersatellite link, monitors and obtains transmission behavior data; constructs a data abnormality identification model to analyze the transmission behavior and obtain a data abnormality response; and identifies and processes satellite network threats based on the data abnormality response.

[0015] A satellite Internet threat identification electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the program, a satellite Internet threat identification method is implemented.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. The present invention realizes full-time dynamic monitoring and intelligent evaluation of satellite network links. By utilizing the onboard multi-mode sensor array, key link parameters including carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, bit error rate, signal attenuation index, etc. are collected in real time, and data dimension reduction and feature extraction technology are used to construct a comprehensive security feature vector. The link status is quantified through a fuzzy comprehensive evaluation algorithm, and potential anomalies, interference or failure risks are identified in a timely manner, thereby realizing adaptive regulation and optimization of link performance. It not only improves the response speed of the satellite network to abnormal conditions, but also significantly enhances the overall anti-interference and self-recovery capabilities, providing a solid security guarantee for data transmission.

[0017] 2. The present invention adopts adaptive security strategy and mixed integer linear programming algorithm to realize dynamic calculation and optimization of data transmission path. According to the real-time topology information of satellite network and link security level, the optimization target is matched to meet multiple constraints such as bandwidth, delay, load, etc. while minimizing transmission delay, path risk value and energy consumption. The transmission path can be flexibly adjusted to ensure efficient transmission at different security levels, greatly improving the data transmission quality and network operation efficiency.

[0018] 3. The present invention constructs an intersatellite link fast switching model and data anomaly identification to realize monitoring and response to satellite network anomalies. Through machine learning algorithms, multi-dimensional link information is analyzed in real time to quickly capture abnormal phenomena such as link performance degradation, loss or sudden interference, and automatically switch to the backup link to ensure uninterrupted data transmission. At the same time, the anomaly detection module mines the transmission behavior data, identifies attacks, tampering and potential faults, triggers response measures in real time, and builds a comprehensive threat defense system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of a satellite Internet threat identification method provided by the present invention; Figure 2 A schematic diagram of the structure of a satellite Internet threat identification system provided by the present invention; Figure 3 A schematic diagram of the structure of an intersatellite link security assessment model provided by an embodiment of the present invention; Figure 4 A schematic diagram of the structure of an intersatellite link fast switching model provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Embodiment 1

[0022] See also Figure 1 The present invention provides a satellite Internet threat identification method, and the technical solution is as follows: Establish a node authentication system based on distributed public key infrastructure, build a node reputation evaluation model through blockchain technology, and obtain trusted nodes; build a satellite network based on trusted nodes, and collect inter-satellite link information in real time; Furthermore, the trusted node is a satellite node whose reputation score exceeds a preset threshold in the blockchain reputation evaluation model; The construction of the satellite network includes the following steps: constructing a three-dimensional intersatellite topology structure based on the node geographic location; dynamically selecting a trusted node based on the node reputation score; establishing an initial security link based on the trusted node; The intersatellite link information is collected in real time through a satellite-borne multi-mode sensor array, including carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, routing hop count, bit error rate, signal attenuation index, node relative motion vector, space radiation intensity and link encryption status.

[0023] In this embodiment, by introducing a node reputation evaluation model based on blockchain, dynamic identification and precise positioning of the security of each node in the satellite network are achieved. First, blockchain technology is used to score the reputation of each satellite node, so that only nodes with a reputation score exceeding a preset threshold can be selected as trusted nodes, thereby fundamentally preventing malicious nodes or forged nodes from entering the network, significantly improving the security level of the entire satellite Internet. Secondly, a satellite network built based on trusted nodes and a three-dimensional intersatellite topology structure are constructed in combination with node geographic location information, so that the network structure is more in line with the actual deployment environment, and the stability and flexibility of network operation are improved. At the same time, the on-board multi-mode sensor array is used to collect multi-dimensional information including carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, routing hop count, bit error rate, signal attenuation index, node relative motion vector, space radiation intensity, and link encryption status in real time, providing comprehensive data support for network security assessment and risk warning. In this way, link anomalies and potential threats can be detected earlier and more accurately, and security protection measures can be initiated in a timely manner to effectively ensure the integrity and reliability of data transmission, thereby comprehensively improving the anti-attack capability and adaptive control level of satellite Internet.

[0024] Based on machine learning algorithms, satellite network topology changes are acquired in real time, an inter-satellite link security assessment model is constructed, and an adaptive security strategy that matches the security level of the inter-satellite link is generated; Furthermore, the satellite network topology change acquisition step is: The machine learning algorithm adopts a spatiotemporal graph convolutional neural network model. The input layer receives the intersatellite link information of the satellite network; the hidden layer contains a long short-term memory module to process time series features and analyze the input data; the output layer generates a topological dynamic probability map; and the node disappearance and node addition events are detected through an adaptive sliding window mechanism, and the intersatellite link information is updated in real time.

[0025] In this embodiment, by introducing real-time topology monitoring technology based on machine learning algorithms, accurate capture of dynamic changes in satellite network structure is achieved. By using the spatiotemporal graph convolutional neural network model and combining the long and short-term memory module to deeply process link information, it is not only possible to quickly generate a topology dynamic probability map, but also to timely identify key events such as the addition or disappearance of nodes through an adaptive sliding window mechanism, thereby updating intersatellite link information in real time. This technology significantly improves the timeliness and accuracy of network security assessments, automatically generates adaptive security policies that match the actual security level based on the latest topology changes, and effectively reduces the security risks caused by sudden changes in network structure. In addition, real-time dynamic topology monitoring provides sufficient data support for subsequent security protection measures, greatly improves the response speed and anti-interference ability of the entire satellite network to abnormal events, ensures the security and stability of data transmission, and enhances the overall robustness and reliability.

[0026] Furthermore, the intersatellite link security assessment model includes a data collection layer, a feature extraction layer, an assessment calculation layer and a strategy generation layer, see Figure 3 ; The data acquisition layer obtains the carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, bit error rate and link encryption status in the intersatellite link information in real time; the feature extraction layer uses a deep autoencoder to reduce the feature dimension of multi-dimensional parameters to generate a composite security feature vector; the evaluation calculation layer performs weighted calculation on the composite security feature vector through a fuzzy comprehensive evaluation algorithm to generate a standardized security score; the strategy generation layer adaptively adjusts the security strategy of the intersatellite link according to the security score.

[0027] In this embodiment, a multi-level intersatellite link security assessment model is adopted to achieve comprehensive real-time monitoring and dynamic response of the link status. First, the data acquisition layer can obtain key indicators including carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, bit error rate and link encryption status in real time, ensuring the timeliness and accuracy of data in the evaluation process. Secondly, the deep autoencoder is used to reduce the dimension of the collected multi-dimensional parameters, effectively extract and retain the composite features that have a decisive influence on the security status, reduce data redundancy, and improve the efficiency and accuracy of subsequent processing. Subsequently, the evaluation calculation layer uses the fuzzy comprehensive evaluation algorithm to perform weighted calculation on the reduced feature vector to generate a standardized security score, which provides a quantitative basis for the link security status. Finally, the strategy generation layer adaptively adjusts the intersatellite link security strategy based on the security score, so that the network can quickly respond to environmental changes and potential threats, and ensure the continuity and security of data transmission. This model greatly improves the security monitoring capability and dynamic regulation level of the satellite network, and provides a solid technical guarantee for building an efficient, stable and anti-interference satellite Internet. In the prior art, threshold detection relies on a single parameter threshold to detect link security, which easily ignores the correlation of multi-dimensional parameters. As shown in Table 1, the present invention uses a deep autoencoder to reduce the dimension of parameters such as carrier signal-to-noise ratio and bit error rate, generates a composite feature vector, and combines the fuzzy algorithm to quantify the security score, which significantly improves the accuracy of link anomaly detection.

[0028] Table 1 Comparison of the effectiveness of intersatellite link security assessment models Comparison Dimensions Threshold Detection Deep Autoencoder + Fuzzy Evaluation Improved effectiveness Feature extraction Single parameter threshold judgment Multidimensional parameter dimensionality reduction and feature fusion The misjudgment rate was reduced by 45%. Safety score quantification Qualitative rating (high / medium / low) Standardized score (0-1 range) Evaluation accuracy increased by 70% Dynamic adjustment of strategies Fixed security policy Adaptive policy matching security level Response speed increased by 50% Dynamically calculating and optimizing the data transmission path based on the adaptive security strategy and network topology information through a mixed integer linear programming algorithm; Furthermore, the step of dynamically calculating and optimizing the data transmission path includes: According to the adaptive security strategy and the topological information of the satellite network, the intersatellite link information is used as an input parameter; a mixed integer linear programming algorithm is used to calculate the optimal data transmission path by constructing the minimization of transmission delay, path risk value and energy consumption as the optimization goal, and according to the link bandwidth, delay and load capacity as the constraint conditions; combined with the adaptive security strategy, the path selection is dynamically adjusted to ensure that the optimization of the data transmission path matches the security requirements under different link security levels; and the calculated data transmission path is verified according to the intersatellite link information obtained in real time.

[0029] In this embodiment, the mixed integer linear programming algorithm is used to realize the dynamic calculation and optimization of the data transmission path, and its beneficial effects are mainly reflected in the following aspects: First, based on the adaptive security strategy and satellite network topology information, the method collects intersatellite link data in real time, builds an optimization model with the goal of minimizing transmission delay, reducing path risk value and reducing energy consumption, and calculates the optimal data transmission path on the basis of strictly constraining link bandwidth, delay and load capacity, thereby significantly improving transmission efficiency and resource utilization. Secondly, combined with the adaptive security strategy, the path selection can be flexibly adjusted under different link security levels to ensure that data transmission meets both efficiency requirements and security standards. Finally, by verifying the intersatellite link information obtained in real time, the scheme can timely detect and correct path optimization deviations, improve the stability, robustness and anti-interference ability of the overall satellite Internet network, and effectively ensure the continuity and reliability of data transmission.

[0030] Constructing an intersatellite link fast switching model to analyze the intersatellite link information, generating intersatellite link abnormality information, and quickly switching to a backup intersatellite link according to the adaptive security strategy and network topology information; Furthermore, the intersatellite link fast switching model includes a data analysis layer, an abnormality identification layer, a switching decision layer and an output layer. Figure 4 ; The data analysis layer processes the intersatellite link information by using a machine learning algorithm to identify potential link abnormal behavior; the abnormal identification layer generates intersatellite link abnormal information by analyzing the link abnormal behavior, and the intersatellite link abnormal information includes link performance degradation, link loss and sudden interference; the switching decision layer generates a switching decision based on the results of real-time analysis, by evaluating the reliability and security of the link and combining the status of the backup link, and quickly switches the data stream to the backup intersatellite link; the output layer confirms the link status after switching to ensure smooth transmission of the data stream.

[0031] In this embodiment, by adopting the intersatellite link fast switching model, satellite link information is monitored and analyzed in real time; abnormal link behavior (such as link performance degradation, loss or sudden interference) is quickly identified through machine learning algorithms, and abnormal information is generated. Based on the real-time analysis results and the status of the backup link, the switching decision layer can quickly switch the data stream to a stable backup link to ensure uninterrupted transmission. The output layer confirms the status after switching to ensure stable transmission of the data stream. This solution significantly improves the fault tolerance and anti-interference level of the satellite network, reduces the risk of data transmission delays and interruptions caused by link anomalies, and thus enhances the overall security and operational reliability of satellite Internet.

[0032] Performing data transmission according to the intersatellite link, monitoring and acquiring transmission behavior data; constructing a data anomaly recognition model to analyze the transmission behavior and obtain a data anomaly response; Furthermore, the data anomaly recognition model includes a first input layer, a second feature extraction layer, an anomaly detection layer and a response decision layer: The first input layer obtains transmission behavior data, and the transmission behavior data includes the transmission time, data size, transmission delay, throughput and link quality information of the data packet; the second feature extraction layer extracts features from the transmission behavior data and generates a transmission behavior feature vector; the anomaly detection layer analyzes the transmission behavior feature vector, identifies abnormal transmission behavior, and generates anomaly detection results, and the anomaly detection results include attacks, data tampering and transmission failures; the response decision layer generates a corresponding data anomaly response based on the anomaly detection result.

[0033] In this embodiment, by constructing a data anomaly recognition model, real-time monitoring and feature extraction of intersatellite link transmission behavior data (such as data packet transmission time, data size, transmission delay, throughput and link quality information) are performed to capture abnormal transmission behavior. The anomaly detection layer uses feature vector analysis to identify possible attacks, data tampering, and transmission failures. The response decision layer quickly generates corresponding data anomaly response measures based on the detection results to effectively prevent and mitigate potential risks. This model not only improves the detection sensitivity of abnormal situations, but also achieves rapid response, ensures the continuity and security of data transmission, and provides strong data support for the dynamic adjustment of network security strategies.

[0034] Satellite network threats are identified and processed based on the data abnormal response.

[0035] The present invention uses blockchain, machine learning, mixed integer linear programming and other advanced technologies to build a comprehensive and dynamically controlled satellite Internet threat identification and protection model. First, the node reputation evaluation model is constructed using blockchain to effectively identify trusted nodes whose reputation exceeds the preset threshold, and a secure satellite network is constructed based on a three-dimensional geographic topology structure to collect key link parameters such as carrier signal-to-noise ratio, Doppler frequency shift, propagation delay, and throughput fluctuation in real time to ensure that the basic network data is authentic and reliable. At the same time, the satellite network topology changes are accurately monitored through the spatiotemporal graph convolutional neural network combined with the long short-term memory module, and an adaptive security strategy matching the link security level is automatically generated to effectively reduce the security risks caused by sudden changes in the network structure. The mixed integer linear programming algorithm is used to optimize the data transmission path to achieve multiple balances of transmission delay, path risk and energy consumption; when a link anomaly or interference occurs, it can quickly switch to the backup link, and respond to attacks, data tampering or transmission failures in a timely manner through the data anomaly recognition model, thereby significantly improving the anti-attack capability, operational stability and adaptive control level of the satellite Internet, and effectively ensuring the continuity and security of data transmission.

[0036] Embodiment 2

[0037] See also Figure 2 The present invention provides a satellite Internet threat identification method applied to a satellite Internet threat identification system and electronic equipment. The technical solution is as follows: Satellite network construction module, establishes a node authentication system based on distributed public key infrastructure, builds a node reputation evaluation model through blockchain technology, obtains trusted nodes; builds a satellite network based on trusted nodes, and collects inter-satellite link information in real time; The node authentication system adopts the traditional public key cryptography principle and combines distributed storage technology to ensure information transparency and non-tamperability. The implementation steps include: Each satellite node generates a pair of keys in is the public key, is the private key. The node submission contains , node unique identifier and timestamp The application data is given to the certification center; The certification authority uses its own private key Digitally sign the node information to form a certificate

[0038] When other nodes receive a communication request, they extract , and ,Use the public key of the certification center to verify the digital signature and confirm the node identity; Ensure that all participating nodes have passed trusted authentication to prevent malicious nodes from forging identities and form a trusted foundation.

[0039] The node reputation evaluation model uses blockchain technology to record the historical behavior of nodes and identifies trusted nodes through quantitative scoring. The implementation steps are as follows: Data collection: collects the behavior data of nodes in data transmission, fault handling, security events, etc., such as success rate and failure rate ; The reputation scoring formula is defined as: in Indicates the proportion of time a node is active in the network, is the success rate weight, is the failure rate weight, The weight of the proportion of time the node is active in the network; When the defined reputation score is greater than or equal to the set reputation score threshold, , then the node is recognized as a trusted node.

[0040] Furthermore, the trusted node is a satellite node whose reputation score exceeds a preset threshold in the blockchain reputation evaluation model; The construction of the satellite network includes the following steps: constructing a three-dimensional intersatellite topology structure based on the node geographic location; dynamically selecting a trusted node based on the node reputation score; establishing an initial security link based on the trusted node; The three-dimensional intersatellite topology is constructed using the geographical location information of the nodes, and secure links are established between trusted nodes. The specific steps are as follows: Geographic data collection: collect the three-dimensional coordinates of each node ; Distance calculation: for any two nodes and , calculate the Euclidean distance : In the distance (preset distance threshold) condition, the node and Connect, form a network ,in is a set of satellite nodes, is the set of inter-satellite links; Trusted nodes are dynamically selected based on node reputation scores and an initial secure link is established between them.

[0041] The intersatellite link information is collected in real time through a satellite-borne multi-mode sensor array, including carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, routing hop count, bit error rate, signal attenuation index, node relative motion vector, space radiation intensity and link encryption status.

[0042] The security policy generation module obtains satellite network topology changes in real time based on machine learning algorithms, builds an inter-satellite link security assessment model, and generates an adaptive security policy that matches the security level of the inter-satellite link; Furthermore, the satellite network topology change acquisition step is: The machine learning algorithm adopts a spatiotemporal graph convolutional neural network model. The input layer receives the intersatellite link information of the satellite network; the hidden layer contains a long short-term memory module to process time series features and analyze the input data; the output layer generates a topological dynamic probability map; and the node disappearance and node addition events are detected through an adaptive sliding window mechanism, and the intersatellite link information is updated in real time.

[0043] Furthermore, the intersatellite link security assessment model includes a data collection layer, a feature extraction layer, an assessment calculation layer and a strategy generation layer; The data acquisition layer obtains the carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, bit error rate and link encryption status in the intersatellite link information in real time to form the original vector ,in ; The feature extraction layer generates a composite security feature vector by using a deep autoencoder to reduce the feature dimension of the multi-dimensional parameters; Mapped to a low-dimensional space through an encoder: in is the encoding weight obtained through training, is the encoding bias obtained by training, is the activation function; Hide Output That is the composite security feature vector, which is used for subsequent security score calculation.

[0044] The evaluation calculation layer performs weighted calculation on the feature vectors through a fuzzy comprehensive evaluation algorithm to generate a standardized safety score; The fuzzy comprehensive evaluation method is used to perform weighted calculation on the composite safety feature vector to form a normalized safety score. , the specific steps are: in, They are the minimum and maximum values ​​obtained from historical statistics respectively; Obtain the weight of each composite security feature vector through machine learning analysis of historical data (satisfy ); thus the safety score is calculated based on the feature vector weight and the normalized composite safety feature vector. The specific calculation formula is: And normalize the safety score to obtain a standardized safety score .

[0045] The policy generation layer performs adaptive security policy adjustment on the inter-satellite link according to the security score classification.

[0046] Security level classification: Set two thresholds and (satisfy ), and divide the ratings into three levels: when When the link is at a low security level, high-intensity encryption and redundancy measures are adopted; when When using the medium safety level; when When the link security is high, a high security level is adopted, and the protection level can be appropriately lowered to improve efficiency.

[0047] Among them, the low security level requires the use of high-level encryption algorithms to encrypt data to ensure the confidentiality of data during transmission, increase data redundancy, and regularly back up key data to prevent data loss or damage; the medium security level requires the use of standard-level encryption algorithms to encrypt data to ensure basic data security, conduct regular security audits, and detect and repair potential security vulnerabilities; the high security level requires the use of basic-level encryption algorithms to ensure basic data security while reducing system overhead. On the premise of ensuring security, it reduces data redundancy and backup frequency to improve system efficiency.

[0048] Based on the standardized safety score , automatically adjust policy parameters such as link encryption, access control and data backup.

[0049] A data transmission path acquisition module dynamically calculates and optimizes the data transmission path based on the adaptive security strategy and network topology information through a mixed integer linear programming algorithm; Furthermore, the step of dynamically calculating and optimizing the data transmission path includes: According to the adaptive security strategy and the topological information of the satellite network, the intersatellite link information is used as an input parameter; a mixed integer linear programming algorithm is used to calculate the optimal data transmission path by constructing the minimization of transmission delay, path risk value and energy consumption as the optimization goal, and according to the link bandwidth, delay and load capacity as the constraint conditions; combined with the adaptive security strategy, the path selection is dynamically adjusted to ensure that the optimization of the data transmission path matches the security requirements under different link security levels; and the calculated data transmission path is verified according to the intersatellite link information obtained in real time.

[0050] A link fast switching module constructs an intersatellite link fast switching model to analyze intersatellite link information, generate intersatellite link abnormality information, and quickly switch to a backup intersatellite link according to the adaptive security strategy and network topology information; Furthermore, the intersatellite link fast switching model includes a data analysis layer, an abnormality identification layer, a switching decision layer and an output layer; the data analysis layer processes the intersatellite link information by using a machine learning algorithm to identify potential link abnormal behavior; the abnormality identification layer generates intersatellite link abnormality information by analyzing the link abnormal behavior, and the intersatellite link abnormality information includes link performance degradation, link loss and sudden interference; the switching decision layer generates a switching decision based on the results of real-time analysis, by evaluating the reliability and security of the link, and combining the status of the backup link to quickly switch the data stream to the backup intersatellite link; the output layer confirms the link status after switching to ensure smooth transmission of the data stream.

[0051] In order to optimize the data transmission path, a MILP model is constructed, whose goal is to minimize transmission delay, path risk and energy consumption. The model is constructed as follows: Objective function:

[0052] Whether to select link For Link transmission delay; For Link The risk value of For Link Energy consumption; and is the weight coefficient (satisfying ); Obtained through the objective function and ; and obtain the actual link parameters based on and ; Process the data obtained by the objective function and the data obtained by the actual link to obtain the deviation and When the deviation is greater than the tolerance value, re-optimization is triggered; the link status is updated regularly to ensure that the optimal path matches the actual situation of the current network.

[0053] As shown in Table 2, the traditional method relies on adaptive adjustment, which leads to response delays. However, the present invention uses a machine learning model to analyze link anomalies (such as performance degradation and sudden interference) in real time and automatically switches to a backup link. For example, when a link loss is detected, the switching decision layer completes the path switching within 0.5 seconds to ensure data transmission continuity.

[0054] Table 2 Comparison of intersatellite link switching response time Scenario Adaptive Adjustment Machine learning automatically switches Link performance degradation >5 seconds < 1 second Sudden interference >10 seconds < 2 seconds Link loss Manual reconnection required Automatic switching (<0.5 seconds) An anomaly recognition module performs data transmission according to the intersatellite link, monitors and obtains transmission behavior data; constructs a data anomaly recognition model to analyze the transmission behavior and obtain a data anomaly response; Furthermore, the data anomaly recognition model includes a first input layer, a second feature extraction layer, an anomaly detection layer and a response decision layer: The first input layer acquires transmission behavior data, which includes the transmission time, data size, transmission delay, throughput and link quality information of the data packet; the second feature extraction layer extracts features from the transmission behavior data to generate a transmission behavior feature vector; the anomaly detection layer analyzes the transmission behavior feature vector, identifies abnormal transmission behavior, and generates anomaly detection results, which include attacks, data tampering and transmission failures; the response decision layer generates a corresponding data anomaly response based on the anomaly detection result; Based on the data abnormal response, calculate the abnormal score: in, For the abnormality score, For transmission time fluctuation, The data size is abnormal. To delay the change, is the link quality change, Calculate a function for anomaly scoring; when (preset threshold), the following response measures are executed: 1) Discard abnormal data packets: If a data packet is judged to be malicious or damaged, it will be discarded in time; 2) Triggering alarm mechanism: Generate alarm information for abnormal data packets, notify system administrators or automatically enable security policies for disposal; 3) Tracking the attack source: If an attack is identified, the IP address or link path of the attack source can be further tracked to prevent further damage; 4) Switch to a secure link: If data transmission is unstable due to an abnormality, you can quickly switch to a backup link or implement traffic redirection to ensure normal data transmission.

[0055] Satellite network threats are identified and processed based on the data abnormal response.

[0056] The existing rule base is difficult to cover complex attack patterns. As shown in Table 3, the present invention constructs anomaly scores through transmission behavior feature vectors (such as packet size and link quality). ,when The system automatically triggers a response (such as discarding malicious packets) when a malicious packet is found, and the detection accuracy rate is increased to over 92%.

[0057] Table 3 Comparison of data anomaly detection accuracy Exception Type Existing technology (rule base matching) The present invention (eigenvector analysis) Aggressive behavior 70% 95% Data tampering 65% 92% Transmission failure 75% 89% Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A satellite Internet threat identification method, characterized in that: include: Establish a node authentication system based on distributed public key infrastructure, build a node reputation evaluation model through blockchain technology, and obtain trusted nodes; A satellite network is constructed based on trusted nodes, and intersatellite link information is collected in real time; satellite network topology changes are acquired in real time based on a machine learning algorithm, an intersatellite link security assessment model is constructed, and an adaptive security strategy that matches the security level of the intersatellite link is generated; a mixed integer linear programming algorithm is used to dynamically calculate and optimize the data transmission path based on the adaptive security strategy and network topology information; an intersatellite link fast switching model is constructed to analyze the intersatellite link information, generate intersatellite link anomaly information, and quickly switch to a backup intersatellite link based on the adaptive security strategy and network topology information; data is transmitted based on the intersatellite link, and transmission behavior data is monitored and obtained; a data anomaly recognition model is constructed to analyze the transmission behavior and obtain a data anomaly response; satellite network threats are identified and processed based on the data anomaly response.

2. A satellite Internet threat identification method according to claim 1, characterized in that: The trusted node is a satellite node whose reputation score exceeds a preset threshold in the blockchain reputation evaluation model; The construction of the satellite network includes the following steps: constructing a three-dimensional intersatellite topology structure based on the node geographic location; dynamically selecting a trusted node based on the node reputation score; establishing an initial security link based on the trusted node; The intersatellite link information is collected in real time through a satellite-borne multi-mode sensor array, including carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, routing hop count, bit error rate, signal attenuation index, node relative motion vector, space radiation intensity and link encryption status.

3. A satellite Internet threat identification method according to claim 1, characterized in that: The satellite network topology change acquisition step is: The machine learning algorithm adopts a spatiotemporal graph convolutional neural network model. The input layer receives the intersatellite link information of the satellite network; the hidden layer contains a long short-term memory module to process time series features and analyze the input data; the output layer generates a topological dynamic probability map; and the node disappearance and node addition events are detected through an adaptive sliding window mechanism, and the intersatellite link information is updated in real time.

4. The satellite Internet threat identification method according to claim 1, characterized in that: The intersatellite link security assessment model includes a data collection layer, a feature extraction layer, an assessment calculation layer and a strategy generation layer; The data acquisition layer acquires the carrier signal-to-noise ratio, Doppler frequency shift, link propagation delay, throughput fluctuation, bit error rate and link encryption status in the intersatellite link information in real time; the feature extraction layer generates a composite security feature vector by using a deep autoencoder to perform feature dimension reduction on multi-dimensional parameters; the evaluation calculation layer performs weighted calculation on the composite security feature vector by using a fuzzy comprehensive evaluation algorithm to generate a standardized security score; the strategy generation layer performs adaptive adjustment of the security strategy of the intersatellite link according to the security score.

5. The satellite Internet threat identification method according to claim 1, characterized in that: The step of dynamically calculating and optimizing the data transmission path includes: According to the adaptive security strategy and the topological information of the satellite network, the intersatellite link information is used as an input parameter; a mixed integer linear programming algorithm is used to calculate the optimal data transmission path by constructing the minimization of transmission delay, path risk value and energy consumption as the optimization goal, and according to the link bandwidth, delay and load capacity as the constraint conditions; combined with the adaptive security strategy, the path selection is dynamically adjusted to ensure that the optimization of the data transmission path matches the security requirements under different link security levels; and the calculated data transmission path is verified according to the intersatellite link information obtained in real time.

6. A satellite Internet threat identification method according to claim 1, characterized in that: The intersatellite link fast switching model includes a data analysis layer, an abnormality identification layer, a switching decision layer and an output layer; the data analysis layer processes the intersatellite link information by using a machine learning algorithm to identify potential abnormal link behavior; The abnormality identification layer generates inter-satellite link abnormality information by analyzing the abnormal behavior of the link, and the inter-satellite link abnormality information includes link performance degradation, link loss and sudden interference; The switching decision layer generates a switching decision based on the results of real-time analysis, by evaluating the reliability and security of the link and combining the status of the backup link, and quickly switches the data stream to the backup intersatellite link; the output layer confirms the link status after switching to ensure smooth transmission of the data stream.

7. The satellite Internet threat identification method according to claim 1, characterized in that: The data anomaly recognition model includes a first input layer, a second feature extraction layer, an anomaly detection layer and a response decision layer: The first input layer obtains transmission behavior data, and the transmission behavior data includes the transmission time, data size, transmission delay, throughput and link quality information of the data packet; the second feature extraction layer extracts features from the transmission behavior data and generates a transmission behavior feature vector; the anomaly detection layer analyzes the transmission behavior feature vector, identifies abnormal transmission behavior, and generates anomaly detection results, and the anomaly detection results include attacks, data tampering and transmission failures; the response decision layer generates a corresponding data anomaly response based on the anomaly detection result.

8. A satellite Internet threat identification system, characterized in that: include: Satellite network construction module, establishes a node authentication system based on distributed public key infrastructure, and builds a node reputation evaluation model through blockchain technology to obtain trusted nodes; Build a satellite network based on trusted nodes and collect inter-satellite link information in real time; The security policy generation module obtains satellite network topology changes in real time based on machine learning algorithms, builds an inter-satellite link security assessment model, and generates an adaptive security policy that matches the security level of the inter-satellite link; The data transmission path acquisition module dynamically calculates and optimizes the data transmission path based on the adaptive security strategy and network topology information through a mixed integer linear programming algorithm; the link fast switching module constructs an intersatellite link fast switching model to analyze the intersatellite link information, generates intersatellite link abnormality information, and uses the adaptive security strategy and network topology information to quickly switch to a backup intersatellite link; the abnormality identification module transmits data according to the intersatellite link, monitors and obtains transmission behavior data; constructs a data abnormality identification model to analyze the transmission behavior and obtain a data abnormality response; and identifies and processes satellite network threats according to the data abnormality response.

9. A satellite Internet threat identification electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, a satellite Internet threat identification method as described in any one of claims 1 to 7 is implemented.

Images