A network time service verification method and device, electronic equipment and storage medium

Abstract

This application discloses a network time synchronization verification method, apparatus, electronic device, and computer-readable storage medium. The method includes: sending probe packets to a time synchronization server at a first preset time interval to obtain a round-trip delay sequence within a preset time window; extracting statistical features from the round-trip delay sequence and constructing a network path fingerprint based on the statistical features; obtaining a time offset change when a time synchronization jump or time synchronization request is detected; calculating the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline; performing consistency matching between the time offset change and the fingerprint deviation, and determining the reliability of the time offset change based on the consistency matching result. This application can distinguish between interpretable offsets caused by normal network fluctuations and uninterpretable offsets caused by link manipulation when a time synchronization jump occurs in the network time synchronization.

Description

Technical Field

[0001] This application relates to the field of vehicle network interaction technology, and more specifically, to a network time synchronization verification method, apparatus, electronic device, and computer-readable storage medium. Background Technology

[0002] In-vehicle systems typically obtain external time via cellular networks or Network Time Protocol (NTP). However, network time synchronization is susceptible to factors such as link state fluctuations, asymmetric latency, and intermediate device scheduling, leading to decreased time synchronization accuracy. Furthermore, network links are vulnerable to security attacks such as man-in-the-middle manipulation, fake base station spoofing, or replay attacks, which could cause the system time to be updated incorrectly.

[0003] In related technologies, network time synchronization reliability assessment methods rely on protocol-layer encryption, digital certificates, or request-response consistency checks. These methods can ensure that time synchronization messages have not been tampered with, but they are difficult to identify scenarios where legitimate messages are manipulated along the transmission path, such as attackers controlling latency to cause significant time synchronization offsets.

[0004] Therefore, how to distinguish between interpretable offsets caused by normal network fluctuations and uninterpretable offsets caused by link manipulation when time jumps occur in network time synchronization is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a network time synchronization verification method, apparatus, electronic device, and computer-readable storage medium, which can distinguish between interpretable offsets caused by normal network fluctuations and uninterpretable offsets caused by link manipulation when time jumps occur in network time synchronization.

[0006] To achieve the above objectives, this application provides a network time synchronization verification method, comprising: Send probe packets to the time synchronization server at the first preset time interval to obtain the round-trip delay sequence within the preset time window; Statistical features are extracted from the round-trip delay sequence, and a network path fingerprint is constructed based on the statistical features; When a time synchronization jump or time synchronization request is detected, the change in time offset is obtained; Calculate the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline; The time offset change is matched with the fingerprint deviation, and the credibility of the time offset change is determined based on the matching result.

[0007] Optionally, the statistical features include any one or a combination of any of the following: quantile features, jitter features, asymmetric estimation features, and maximum gap features. The quantile features are used to describe the distribution of round-trip delays within the preset time window. The jitter features are used to describe the temporal fluctuation of round-trip delays within the preset time window. The asymmetric estimation features are used to describe the delay difference between uplink and downlink paths within the preset time window. The maximum gap features are used to describe the maximum gap between adjacent delays in the round-trip delay sequence.

[0008] Optionally, before calculating the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline, the method further includes: When the absolute value of the time offset change is greater than a preset threshold, a probe packet is sent to the time synchronization server at a second preset time interval within a preset burst measurement time window to obtain the current round-trip delay sequence. Extract current statistical features from the current round-trip delay sequence, and construct the current network path fingerprint based on the current statistical features.

[0009] Optionally, calculating the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline includes: The Mahalanobis distance between the current network path fingerprint and the fingerprint baseline is calculated based on the fingerprint covariance matrix as the fingerprint deviation.

[0010] Optionally, the step of calculating the Mahalanobis distance between the current network path fingerprint and the fingerprint baseline based on the fingerprint covariance matrix as the fingerprint deviation includes: Update the fingerprint baseline based on the current network path fingerprint; Update the fingerprint covariance matrix based on the difference between the current network path fingerprint and the updated fingerprint baseline; The Mahalanobis distance between the current network path fingerprint and the updated fingerprint baseline is calculated based on the updated fingerprint covariance matrix as the fingerprint deviation.

[0011] Optionally, matching the time offset change with the fingerprint deviation includes: The time offset change is normalized based on the quantile characteristics of the round-trip delay sequence to obtain the normalized time offset change. Anomaly scores are calculated based on the normalized time offset change and the fingerprint deviation; wherein... , For the aforementioned anomaly score, The normalized time offset change is... The fingerprint deviation, This refers to the fingerprint deviation scale parameter; The abnormal scores are mapped to confidence levels, and these confidence levels are used as the consistency matching results; wherein... , The confidence level is... For the rating scale parameters.

[0012] Optionally, the step of determining the reliability of the time offset change based on the consistency matching result includes: When the confidence level is greater than or equal to the first confidence threshold, the change in time offset is determined to be reliable. When the confidence level is less than the second confidence threshold, the change in time offset is determined to be unreliable; wherein the second confidence threshold is less than the first confidence threshold.

[0013] To achieve the above objectives, this application provides a network time synchronization verification device, comprising: The first sending module is used to send probe packets to the timing server at a first preset time interval to obtain the round-trip delay sequence within a preset time window. The first construction module is used to extract statistical features from the round-trip delay sequence and construct a network path fingerprint based on the statistical features; The acquisition module is used to acquire the change in time offset when a time synchronization jump or time synchronization request is detected. The calculation module is used to calculate the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline; The determination module is used to perform consistency matching between the time offset change and the fingerprint deviation, and to determine the credibility of the time offset change based on the consistency matching result.

[0014] To achieve the above objectives, this application provides an electronic device, comprising: Memory, used to store computer programs; A processor is used to implement the steps of the network time synchronization verification method described above when executing the computer program.

[0015] To achieve the above objectives, this application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network time synchronization verification method described above.

[0016] The network timing verification method provided in this application matches the change in time offset during network timing with the fingerprint deviation of the actively measured network path fingerprint relative to the fingerprint baseline. This allows the method to determine whether the time offset is accompanied by a corresponding change in the network path fingerprint. If the change in time offset is large while the fingerprint deviation is small, it indicates that the time jump lacks an explanation based on the statistical characteristics of the network path and is considered an unreliable offset. Conversely, if both change synchronously, it indicates that the time jump can be explained by changes in the network path and has high reliability. Therefore, this application establishes a binding relationship between time offset and path change by actively measuring the statistical characteristics of the network path, thereby achieving a reliable determination of the change in time offset and effectively distinguishing between explainable offsets caused by network fluctuations and unexplainable offsets caused by link manipulation. This application also discloses a network timing verification device, an electronic device, and a computer-readable storage medium, which can achieve the same technical effects.

[0017] It should be understood that the above general description and the following detailed description are merely exemplary and do not limit this application. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. The drawings are used to provide a further understanding of this disclosure and constitute a part of the specification. They are used together with the following detailed description to explain this disclosure, but do not constitute a limitation of this disclosure. In the drawings: Figure 1 This is a flowchart illustrating a network time synchronization verification method according to an exemplary embodiment; Figure 2 This is a schematic diagram illustrating the interaction between an in-vehicle terminal and a timing server according to an exemplary embodiment; Figure 3 A flowchart illustrating another network time synchronization verification method according to an exemplary embodiment; Figure 4 This is a structural diagram illustrating a network time synchronization verification device according to an exemplary embodiment; Figure 5 This is a structural diagram of an electronic device according to an exemplary embodiment. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0020] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0021] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0022] This application discloses a network time synchronization verification method that can distinguish between interpretable offsets caused by normal network fluctuations and uninterpretable offsets caused by link manipulation when a time jump occurs in network time synchronization.

[0023] See Figure 1 A flowchart illustrating a network time synchronization verification method according to an exemplary embodiment is shown below. Figure 1 As shown, it includes: S101: Send probe packets to the time synchronization server according to the first preset time interval to obtain the round-trip delay sequence within the preset time window; The first preset time interval refers to the time difference between two adjacent probe packet transmissions, for example, 5 seconds. The preset time window refers to the time interval used to collect the round-trip delay sequence, for example, 60 seconds. Round-trip delay refers to the time elapsed from sending a probe packet to receiving the corresponding response packet. A probe packet is a data packet actively sent by the verification system to measure the network path status, and usually contains random numbers to prevent replay attacks. A time synchronization server refers to a server that provides time synchronization services, such as a Network Time Protocol (NTP) server.

[0024] In this embodiment, the execution entity is the vehicle. In this step, the vehicle's verification system continuously sends probe packets to the timing server at a set first preset time interval, for example, once every 5 seconds. The system records the sending timestamp of each probe packet and the receiving timestamp when a response packet is received, calculating the difference between the two to obtain the round-trip time (RTD). Within a preset time window, for example, within the past 60 seconds, the system accumulates multiple RTD measurements, forming an ordered RTD sequence.

[0025] In practice, probe packets are sent within the measurement period, and the sending time is recorded. With the time of reception And calculate the RTT (Round-Trip Time) samples, the calculation formula is: ,in, The nth transmission time (s, converted from local monotonic timing) is given. The nth reception time (s, converted from local monotonic timing) is given. Let n be the nth RTT sample (s), where n is the probe sequence index (dimensionless). The response side must echo the same random number challenge value (dimensionless or byte string) carried in the nth probe packet. Used for freshness verification. To avoid the system wall clock affecting measurements during time setting / transition periods, and Prioritize using the local monotonic clock to record and convert data to seconds; RTT calculation depends only on the time difference. For example... Figure 2 As shown, the system carries a random number in the challenge packet. And require the response to carry the same Missing or mismatched responses are discarded. This mechanism is used to reduce the contamination of the measurement sequence by replay attacks.

[0026] This step establishes a network path measurement channel independent of the timing protocol through periodic active probing, providing the raw data foundation for subsequent path fingerprint construction. Using a sequence within a preset time window, rather than a single measurement, can suppress the interference of occasional network jitter on subsequent judgments.

[0027] S102: Extract statistical features from the round-trip delay sequence and construct a network path fingerprint based on the statistical features; Among them, statistical features refer to quantitative indicators that can characterize the distribution pattern and temporal characteristics of round-trip delay sequences. Network path fingerprints are vectors composed of the above statistical features, used to uniquely represent the statistical behavior of network paths over a period of time.

[0028] In this step, statistical analysis is performed on the round-trip delay sequence, and preset statistical features are extracted from the sequence. Multiple statistical features are combined into a multi-dimensional vector, i.e., the network path fingerprint, according to a preset order.

[0029] As a feasible implementation method, the statistical features include any one or a combination of several of the following: quantile features, jitter features, asymmetric estimation features, and maximum gap features. The quantile features are used to describe the distribution position of round-trip delays within the preset time window. The jitter features are used to describe the temporal fluctuation of round-trip delays within the preset time window. The asymmetric estimation features are used to describe the delay difference between uplink and downlink paths within the preset time window. The maximum gap features are used to describe the maximum gap between adjacent delays in the round-trip delay sequence.

[0030] In practice, K RTT samples are collected within a preset time window W. The quantile characteristic is calculated using the following formula: ,in, Let p be the p-quantile delay (s), where p is the quantile parameter (dimensionless, taking values ​​of 0.1, 0.5, 0.9, etc.), and n is the RTT sample index (dimensionless), taking values ​​from 1 to K. p) is the quantile statistical function, which is applied to the sample set. Find the p-quantile.

[0031] The formula for calculating jitter characteristics is: , ,in, For jitter (s) The average RTT (s) is given.

[0032] When the system can distinguish between uplink and downlink detection, the asymmetric estimation feature A is calculated using the following formula: , This is the uplink delay estimate (s). Let A be the downlink latency estimate (s). If the system cannot distinguish between uplink and downlink latency, then set A=0 and mark this dimension as unavailable in the fingerprint configuration.

[0033] To identify morphological anomalies such as fixed delay steps or bimodal distributions, the system sorts the RTT samples to obtain... And calculate the maximum gap characteristic G, the calculation formula is: , The nth value (s) of the RTT samples sorted from smallest to largest.

[0034] Furthermore, the system constructs a network path fingerprint F, defined as: F consists of multiple components measured in seconds. , , The delays (s) are for the 10th percentile, 50th percentile, and 90th percentile, respectively.

[0035] S103: When a time synchronization jump or time synchronization request is detected, obtain the time offset change; Time jump refers to an abnormal difference between the system's local time and the time provided by the time synchronization server, typically manifested as a sudden jump rather than a continuous change. A time synchronization request is a system-initiated time synchronization operation, such as scheduled time synchronization or power-on time synchronization. Time offset change refers to the change in the difference between the local time and the reference time before and after time synchronization.

[0036] In this step, when a change in local time is detected, or when a time synchronization request is actively initiated, the change in time offset is obtained.

[0037] S104: Calculate the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline; Here, the fingerprint baseline refers to the reference fingerprint vector maintained by the system under normal network conditions, representing the stable statistical characteristics of the network path. Fingerprint deviation refers to the degree of difference between the current fingerprint and the fingerprint baseline; a larger value indicates that the current network path state deviates further from the normal state.

[0038] In this step, the current network path fingerprint is compared with the fingerprint baseline maintained by the system, and the deviation between the two is calculated. This deviation can be calculated using Euclidean distance, Mahalanobis distance, or other metrics that can measure the difference between multidimensional vectors.

[0039] As a feasible implementation method, the calculation of the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline includes: calculating the Mahalanobis distance between the current network path fingerprint and the fingerprint baseline based on the fingerprint covariance matrix as the fingerprint deviation.

[0040] The fingerprint covariance matrix refers to the covariance matrix among the statistical features of a fingerprint, used to describe the correlation between fingerprint features and the fluctuation scale of each feature. Mahalanobis distance is a distance metric that considers feature correlation and scale differences.

[0041] In practice, the system maintains the fingerprint baseline. and its corresponding covariance matrix When the current network path fingerprint is obtained Then, calculate and Mahalanobis distance between The formula for calculating fingerprint deviation is as follows: , It is a dimensionless, non-negative value.

[0042] In a preferred embodiment, the step of calculating the Mahalanobis distance between the current network path fingerprint and the fingerprint baseline as the fingerprint deviation based on the fingerprint covariance matrix includes: updating the fingerprint baseline based on the current network path fingerprint; updating the fingerprint covariance matrix based on the difference between the current network path fingerprint and the updated fingerprint baseline; and calculating the Mahalanobis distance between the current network path fingerprint and the updated fingerprint baseline as the fingerprint deviation based on the updated fingerprint covariance matrix.

[0043] It should be noted that the fingerprint baseline is established through learning during normal system operation. Initially, the fingerprint baseline can be initialized using measurement data from several time windows; during operation, the system continuously updates the fingerprint baseline to adapt to the slow changes in the network environment.

[0044] In practical implementation, baseline fingerprint With covariance The updated formula is: , ,in, The smoothing coefficient is dimensionless. To avoid "baseline poisoning" during abnormal periods, the system employs a gated update strategy: updates are only performed when the previous round of assessment was deemed reliable and the system is not currently in a burst measurement mode. and Freeze baseline parameters in unreliable or unobservable states.

[0045] As a preferred embodiment, before calculating the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline, the method further includes: when the absolute value of the time offset change is greater than a preset threshold, sending a probe packet to the timing server at a second preset time interval within a preset burst measurement time window to obtain the current round-trip delay sequence; extracting current statistical features from the current round-trip delay sequence, and constructing the current network path fingerprint based on the current statistical features.

[0046] Here, the preset threshold value refers to the threshold amount of time offset change that triggers a burst challenge measurement, such as 0.1 seconds or 0.5 seconds. The burst measurement time window refers to a short time interval used for performing high-density probing, its length being less than the preset time window in S101, such as 1 second or 2 seconds. The second preset time interval refers to the transmission interval between adjacent probe packets in burst measurement mode, its value being less than the first preset time interval in S101, such as 0.1 seconds. The current round-trip delay sequence refers to the high-density delay data sequence acquired within the burst measurement time window.

[0047] In practical implementation, when acquiring the change in time offset Then, first calculate its absolute value. and the preset threshold value Compare. If This indicates a small time offset, and the system directly uses the fingerprint data periodically maintained in S101 for subsequent judgments. If This indicates a significant time offset, potentially suggesting an anomaly. The system triggers a burst challenge measurement to obtain more confident evidence. Specifically, within the burst measurement time window, the system continuously sends B probe packets at a second preset time interval, where B is the number of burst probe packets, such as 10 or 20. The system records the round-trip time delay of each probe packet, forming a high-density current round-trip time delay sequence, and extracts statistical features from it according to the method in S102 to construct the current network path fingerprint.

[0048] It should be noted that the current fingerprint obtained from the burst challenge measurement is used to replace or supplement the fingerprint periodically maintained in S101 to more accurately reflect the network path state at the current moment. Because burst measurements have a shorter time window and higher detection density, they are more effective at capturing instantaneous network changes.

[0049] As can be seen, this implementation method, by setting a threshold triggering mechanism, only initiates high-density detection when a large time offset is detected. This ensures the accuracy of judgment under abnormal conditions while avoiding excessive consumption of network resources under normal conditions. The high-density time delay sequence obtained from burst measurements can effectively improve the statistical significance of fingerprint features, thereby enhancing the confidence of subsequent consistency judgments.

[0050] S105: Perform consistency matching between the time offset change and the fingerprint deviation, and determine the credibility of the time offset change based on the consistency matching result.

[0051] Consistency matching refers to the process of jointly evaluating the change in time offset and the fingerprint deviation to determine whether the two have a synchronous change relationship. Credibility determination refers to the conclusion regarding the reliability of the output time offset change, such as whether it is reliable, unreliable, or pending verification.

[0052] In this step, consistency matching is performed on the change in time offset and the fingerprint deviation. The consistency matching logic is as follows: if the change in time offset is large but the fingerprint deviation is small, it means that the time jump lacks the support of network path statistical features and is judged as unreliable; if the fingerprint deviation and the change in time offset change synchronously (i.e., both are large or both are small), it means that the time jump can be explained by the change in network path and is judged as reliable.

[0053] The network timing verification method provided in this application matches the change in time offset during network timing with the fingerprint deviation of the actively measured network path fingerprint relative to the fingerprint baseline. This allows for the determination of whether the time offset is accompanied by a corresponding change in the network path fingerprint. If the change in time offset is large while the fingerprint deviation is small, it indicates that the time jump lacks an explanation based on network path statistical characteristics and is considered an unreliable offset. Conversely, if both change synchronously, it indicates that the time jump can be explained by network path changes and has high reliability. Therefore, this application establishes a binding relationship between time offset and path changes by actively measuring the statistical characteristics of the network path, thereby enabling the determination of the reliability of the time offset change and effectively distinguishing between explainable offsets caused by network fluctuations and unexplainable offsets caused by link manipulation.

[0054] This application discloses a network time synchronization verification method. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution. Specifically: See Figure 3 A flowchart illustrating another network time synchronization verification method according to an exemplary embodiment is shown below. Figure 3 As shown, it includes: S201: Send probe packets to the time synchronization server according to the first preset time interval to obtain the round-trip delay sequence within the preset time window; S202: Extract statistical features from the round-trip delay sequence and construct a network path fingerprint based on the statistical features; S203: When a time synchronization jump or time synchronization request is detected, obtain the time offset change; S204: Calculate the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline; S205: Normalize the time offset change based on the quantile characteristics of the round-trip delay sequence to obtain the normalized time offset change. In this step, the time offset variation is normalized based on the quantile characteristics of the round-trip delay sequence, for example, using the 90th quantile, which physically means that 90% of all measured values ​​are less than this value. The normalization formula is: Where u is the normalized time offset change. This represents the change in time offset. To prevent extremely small positive numbers (s) from being divided by zero.

[0055] It should be noted that the choice of quantile feature is not limited to the 90th quantile; other quantiles such as the 95th, 99th, or median can also be used. The advantage of choosing a higher quantile (such as the 90th or 95th quantile) is that it can reflect the upper limit of the steady-state delay of the network path and is not sensitive to normal small delay fluctuations, thus making the normalized offset more reflective of significant temporal anomalies.

[0056] S206: Calculate the anomaly score based on the normalized time offset change and the fingerprint deviation; in, , For outlier ratings (dimensionless, non-negative). This represents the normalized change in time offset. The fingerprint deviation, This is a dimensionless parameter representing the fingerprint offset scale. Its physical meaning is: a normalized time offset... This serves as the baseline score, which is then multiplied by an exponential decay factor for fingerprint deviation. When the network path is stable When the value is relatively small, the exponential factor is close to 1, and M is close to u, then... The larger the value, the higher the score, indicating greater suspicion. This applies when the network path changes significantly. When the index is large, the exponential factor becomes very small, thus significantly reducing M, making the system more inclined to believe that even if there is a large time offset, it may be an interpretable phenomenon caused by path changes.

[0057] S207: Map the abnormal scores to confidence levels; The confidence level is a dimensionless numerical value ranging from 0 to 1, used to visually represent the reliability of changes in time offset. A confidence level closer to 1 indicates greater reliability, while a confidence level closer to 0 indicates greater skepticism.

[0058] in, , The confidence level is dimensionless and ranges from 0 to 1. Here, C represents the rating scale parameter (dimensionless). The mapping function is exponentially decaying, characterized by the following: when M = 0, C = exp(0) = 1, indicating complete confidence; as M increases, C monotonically decreases and approaches 0, indicating a gradual decrease in confidence. Rating scale parameter Used to control the decay rate: The larger the value, the slower the decay, and the higher the confidence level for the same M value; The smaller the value, the faster the decay, and the lower the confidence level corresponding to the same M value.

[0059] S208: Determine the credibility of the time offset change based on the confidence level.

[0060] As a feasible implementation, the step of determining the credibility of the time offset change based on the confidence level includes: determining the time offset change to be credible when the confidence level is greater than or equal to a first confidence level threshold; and determining the time offset change to be unreliable when the confidence level is less than a second confidence level threshold; wherein the second confidence level threshold is less than the first confidence level threshold.

[0061] In practical implementation, when C is greater than or equal to When C is at the first confidence threshold, the system considers the jump interpretable and allows time synchronization. (Second confidence threshold) and When C is within the range of (the first confidence threshold), the system adopts a delayed activation strategy and continues to observe subsequent fingerprints. When C is less than... When the second confidence threshold is reached, the system determines the jump to be unreliable and refuses to synchronize the time, while simultaneously triggering an alarm. .

[0062] This embodiment normalizes the time offset variation to eliminate the impact of absolute latency differences under different network environments on the judgment results, enabling the judgment logic to be uniformly applied to various network conditions. Based on this, an exponential decay anomaly scoring and confidence mapping mechanism are used to quantitatively assess the reliability of the time offset variation.

[0063] The following describes a network time synchronization verification device provided in the embodiments of this application. The network time synchronization verification device described below and the network time synchronization verification method described above can be referred to each other.

[0064] See Figure 4 A structural diagram of a network time synchronization verification device is shown according to an exemplary embodiment, as follows: Figure 4 As shown, it includes: The first sending module 100 is used to send probe packets to the timing server according to a first preset time interval and obtain the round-trip delay sequence within a preset time window. The first construction module 200 is used to extract statistical features from the round-trip delay sequence and construct a network path fingerprint based on the statistical features; The acquisition module 300 is used to acquire the change in time offset when a time synchronization jump or time synchronization request is detected. The calculation module 400 is used to calculate the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline; The determination module 500 is used to perform consistency matching between the time offset change and the fingerprint deviation, and to determine the credibility of the time offset change based on the consistency matching result.

[0065] The network timing verification device provided in this application matches the change in time offset during network timing with the fingerprint deviation of the actively measured network path fingerprint relative to the fingerprint baseline. This allows it to determine whether the time offset is accompanied by a corresponding change in the network path fingerprint. If the change in time offset is large while the fingerprint deviation is small, it indicates that the time jump lacks explanation from the statistical characteristics of the network path and is considered an unreliable offset. Conversely, if both change synchronously, it indicates that the time jump can be explained by changes in the network path and has high reliability. Therefore, this application establishes a binding relationship between time offset and path change by actively measuring the statistical characteristics of the network path, thereby achieving a reliable determination of the change in time offset and effectively distinguishing between explainable offsets caused by network fluctuations and unexplainable offsets caused by link manipulation.

[0066] Based on the above embodiments, as a preferred implementation, the statistical features include any one or a combination of any of the following: quantile features, jitter features, asymmetric estimation features, and maximum gap features. The quantile features are used to describe the distribution position of round-trip delays within the preset time window. The jitter features are used to describe the temporal fluctuation degree of round-trip delays within the preset time window. The asymmetric estimation features are used to describe the delay difference between uplink and downlink paths within the preset time window. The maximum gap features are used to describe the maximum gap between adjacent delays in the round-trip delay sequence.

[0067] Based on the above embodiments, as a preferred embodiment, it further includes: The second sending module is used to send a probe packet to the time synchronization server within a preset burst measurement time window at a second preset time interval when the absolute value of the time offset change is greater than a preset threshold value, so as to obtain the current round-trip delay sequence. The second construction module is used to extract current statistical features from the current round-trip delay sequence and construct the current network path fingerprint based on the current statistical features.

[0068] Based on the above embodiments, as a preferred implementation, the calculation module 400 is specifically used to: calculate the Mahalanobis distance between the current network path fingerprint and the fingerprint baseline as the fingerprint deviation based on the fingerprint covariance matrix.

[0069] Based on the above embodiments, as a preferred implementation, the calculation module 400 is specifically used for: updating the fingerprint baseline based on the current network path fingerprint; updating the fingerprint covariance matrix based on the difference between the current network path fingerprint and the updated fingerprint baseline; and calculating the Mahalanobis distance between the current network path fingerprint and the updated fingerprint baseline as the fingerprint deviation based on the updated fingerprint covariance matrix.

[0070] Based on the above embodiments, as a preferred embodiment, the determination module 500 includes: The normalization unit is used to normalize the time offset change based on the quantile characteristics of the round-trip delay sequence to obtain the normalized time offset change. The calculation unit is used to calculate anomaly scores based on the normalized time offset change and the fingerprint deviation; wherein, , For the aforementioned anomaly score, The normalized time offset change is... The fingerprint deviation, This refers to the fingerprint deviation scale parameter; A mapping unit is used to map the anomaly score to a confidence level, and to use the confidence level as a consistency matching result; wherein... , The confidence level is... For the rating scale parameters.

[0071] Based on the above embodiments, as a preferred embodiment, the determination module 500 further includes: The determination unit is configured to determine that the time offset change is reliable when the confidence level is greater than or equal to a first confidence level threshold; and to determine that the time offset change is unreliable when the confidence level is less than a second confidence level threshold; wherein the second confidence level threshold is less than the first confidence level threshold.

[0072] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0073] Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiments of this application, the embodiments of this application also provide an electronic device. Figure 5 This is a structural diagram of an electronic device according to an exemplary embodiment, such as... Figure 5 As shown, the electronic device includes: Communication interface 1 enables information exchange with other devices, such as network devices; Processor 2 is connected to communication interface 1 to enable information exchange with other devices. When running a computer program, it executes the network time synchronization verification method provided by one or more of the above-mentioned technical solutions. The computer program is stored in memory 3.

[0074] Of course, in practical applications, the various components in an electronic device are coupled together through bus system 4. It can be understood that bus system 4 is used to achieve communication and connection between these components. In addition to the data bus, bus system 4 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 5 The general will label all buses as Bus System 4.

[0075] The memory 3 in this embodiment is used to store various types of data to support the operation of the electronic device. Examples of such data include any computer program used to operate on the electronic device.

[0076] It is understood that memory 3 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 3 described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0077] The methods disclosed in the embodiments of this application can be applied to processor 2, or implemented by processor 2. Processor 2 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 2 or by instructions in the form of software. The processor 2 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 2 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 3. Processor 2 reads the program in memory 3 and completes the steps of the aforementioned method in combination with its hardware.

[0078] When processor 2 executes the program, it implements the corresponding processes in the various methods of the embodiments of this application. For the sake of brevity, these will not be described in detail here.

[0079] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 3 that stores a computer program, which can be executed by a processor 2 to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0080] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0081] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause an electronic device (which may be a personal computer, server, network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0082] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A network time synchronization verification method, characterized in that, include: Send probe packets to the time synchronization server at the first preset time interval to obtain the round-trip delay sequence within the preset time window; Statistical features are extracted from the round-trip delay sequence, and a network path fingerprint is constructed based on the statistical features; When a time synchronization jump or time synchronization request is detected, the change in time offset is obtained; Calculate the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline; The time offset change is matched with the fingerprint deviation, and the credibility of the time offset change is determined based on the matching result.

2. The network time synchronization verification method according to claim 1, characterized in that, The statistical features include any one or a combination of any of the following: quantile features, jitter features, asymmetric estimation features, and maximum gap features. The quantile features are used to describe the distribution of round-trip delays within the preset time window. The jitter features are used to describe the temporal fluctuation of round-trip delays within the preset time window. The asymmetric estimation features are used to describe the delay difference between uplink and downlink paths within the preset time window. The maximum gap features are used to describe the maximum gap between adjacent delays in the round-trip delay sequence.

3. The network time synchronization verification method according to claim 1, characterized in that, Before calculating the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline, the method further includes: When the absolute value of the time offset change is greater than a preset threshold, a probe packet is sent to the time synchronization server at a second preset time interval within a preset burst measurement time window to obtain the current round-trip delay sequence. Extract current statistical features from the current round-trip delay sequence, and construct the current network path fingerprint based on the current statistical features.

4. The network time synchronization verification method according to claim 1, characterized in that, The calculation of the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline includes: The Mahalanobis distance between the current network path fingerprint and the fingerprint baseline is calculated based on the fingerprint covariance matrix as the fingerprint deviation.

5. The network time synchronization verification method according to claim 4, characterized in that, The calculation of the Mahalanobis distance between the current network path fingerprint and the fingerprint baseline, based on the fingerprint covariance matrix, as the fingerprint deviation includes: Update the fingerprint baseline based on the current network path fingerprint; Update the fingerprint covariance matrix based on the difference between the current network path fingerprint and the updated fingerprint baseline; The Mahalanobis distance between the current network path fingerprint and the updated fingerprint baseline is calculated based on the updated fingerprint covariance matrix as the fingerprint deviation.

6. The network time synchronization verification method according to claim 1, characterized in that, Matching the time offset change with the fingerprint deviation includes: The time offset change is normalized based on the quantile characteristics of the round-trip delay sequence to obtain the normalized time offset change. Anomaly scores are calculated based on the normalized time offset change and the fingerprint deviation; wherein... , For the aforementioned anomaly score, The normalized time offset change is... The fingerprint deviation, This refers to the fingerprint deviation scale parameter; The abnormal scores are mapped to confidence levels, and these confidence levels are used as the consistency matching results; wherein... , The confidence level is... For the rating scale parameters.

7. The network time synchronization verification method according to claim 6, characterized in that, The step of determining the reliability of the time offset change based on the consistency matching result includes: When the confidence level is greater than or equal to the first confidence threshold, the change in time offset is determined to be reliable. When the confidence level is less than the second confidence threshold, the change in time offset is determined to be unreliable; wherein the second confidence threshold is less than the first confidence threshold.

8. A network time synchronization verification device, characterized in that, include: The first sending module is used to send probe packets to the timing server at a first preset time interval to obtain the round-trip delay sequence within a preset time window. The first construction module is used to extract statistical features from the round-trip delay sequence and construct a network path fingerprint based on the statistical features; The acquisition module is used to acquire the change in time offset when a time synchronization jump or time synchronization request is detected. The calculation module is used to calculate the fingerprint deviation of the current network path fingerprint relative to the fingerprint baseline; The determination module is used to perform consistency matching between the time offset change and the fingerprint deviation, and to determine the credibility of the time offset change based on the consistency matching result.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the network time synchronization verification method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, implements the steps of the network time synchronization verification method as described in any one of claims 1 to 7.

Images