GNSS timing signal anomaly detection method, device and equipment based on and storage medium

Abstract

Embodiments of the present disclosure provide a GNSS timing signal anomaly detection method, device, equipment and storage medium, which are applied to the field of electromagnetic interference research. The method comprises: generating a timing information dataset based on GNSS timing signal analysis data; performing anomaly detection processing on the timing information dataset to generate an anomaly detection processing result; and generating a corresponding treatment suggestion based on the anomaly detection processing result according to a pre-constructed risk assessment model. In this way, the efficiency and quality of the adaptive and grid-based defense of the GNSS host device group can be improved, and the needs of the intensive operation and maintenance of the industry host device operators can be met.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of electromagnetic interference research, in particular to the technical field of GNSS time signal anomaly detection method, device and equipment based on GNSS time signal and storage medium. BACKGROUND

[0002] With the large-scale deployment of modules using 5G, IOT and other technologies and the increasing number of attacks on GNSS time signals, the existing signal quality evaluation algorithm, i.e. the GNSS time signal anomaly distortion model and signal quality evaluation algorithm on the special receiver or GNSS time module, cannot effectively meet the high-concurrency multipath interference and signal deception in a wide range of large number of time equipment scenarios, and cannot realize time mutual checking and synchronization between multiple host devices. The existing technology still has a lot of room for improvement in large-scale high-concurrency time safety operation scenarios. There are new deception methods that cannot be effectively detected, cannot be adaptively corrected through group checking, reduce the overall automatic operation efficiency of the system, and the GNSS time information data of the group equipment is not effectively fused. SUMMARY

[0003] The present disclosure provides a GNSS time signal anomaly detection method, device, equipment and storage medium.

[0004] According to a first aspect of the present disclosure, a GNSS time signal anomaly detection method is provided.

[0005] The method comprises:

[0006] generating a time information dataset based on GNSS time signal analysis data;

[0007] performing anomaly detection processing on the time information dataset to generate an anomaly detection processing result;

[0008] generating a corresponding disposal suggestion based on the anomaly detection processing result.

[0009] Further, before performing anomaly detection processing on the time information dataset, the method comprises:

[0010] cleaning and performing security checking on the time information dataset.

[0011] Further, the anomaly detection processing on the time information dataset comprises:

[0012] judging whether the GNSS time information analysis signal is abnormal based on the time of the externally hung independent clock signal as a reference; if abnormal, generating GNSS threat intelligence data.

[0013] Further, the abnormality detection processing on the timing information dataset further includes:

[0014] According to the received GNSS threat intelligence data, it is judged whether the GNSS timing signal received in the corresponding period is an interference or fraud signal.

[0015] Further, generating the corresponding disposal suggestion based on the abnormality detection processing result specifically includes:

[0016] Determining the disposal suggestion corresponding to the abnormality detection result based on the mapping relationship;

[0017] The mapping relationship is a processing rule pre-stored in the policy library.

[0018] Further, generating the corresponding disposal suggestion based on the abnormality detection processing result further includes:

[0019] Determining the current device type according to one or more dimensions of the asset importance level, the exposure risk coefficient, the vulnerability risk, and the security policy coverage of the current device.

[0020] According to the current device type, the corresponding mapping relationship is obtained.

[0021] According to a second aspect of the present disclosure, a GNSS timing signal abnormality detection device is provided. The device includes:

[0022] A dataset generation module for generating a timing information dataset based on GNSS timing signal analysis data;

[0023] An abnormality detection module for performing abnormality detection processing on the timing information dataset to generate an abnormality detection processing result;

[0024] A disposal suggestion generation module for generating a corresponding disposal suggestion based on the abnormality detection processing result.

[0025] According to a third aspect of the present disclosure, an electronic device is provided. The electronic device includes a memory and a processor, the memory having a computer program stored thereon, and the processor executing the program to implement the method as described above.

[0026] According to a fourth aspect of the present disclosure, a computer readable storage medium is provided, having a computer program stored thereon, the program being executed by a processor to implement the method according to the first aspect of the present disclosure.

[0027] The present disclosure solves the current situation that the existing GNSS timing signal quality evaluation algorithm is individually defended and lacks group collaborative defense by reasonably gathering and utilizing prior information and other detection algorithms, deeply fusing, comparing and analyzing GNSS timing signal analysis data through the embedded timing information anomaly detection module arranged on individual devices and distributed multiple devices respectively, improving the efficiency and quality of group adaptive and grid defense of GNSS host devices, and meeting the needs of intensive operation and maintenance of industry host device operators.

[0028] It should be understood that the content described in the summary section is not intended to limit or define the key or important features of the embodiments of the present disclosure, nor to limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0029] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent by describing in detail the following embodiments with reference to the attached drawings. The attached drawings are intended to better understand the present disclosure and do not limit the present disclosure. In the drawings, the same or similar elements are denoted by the same or similar reference numerals, and:

[0030] Figure 1 A flowchart of a GNSS timing signal anomaly detection method according to an embodiment of the present disclosure is shown;

[0031] Figure 2 A block diagram of a GNSS timing signal anomaly detection device according to an embodiment of the present disclosure is shown;

[0032] Figure 3 A block diagram of an exemplary treatment recommendation generation process capable of implementing embodiments of the present disclosure is shown;

[0033] Figure 4 A block diagram of an electronic device for implementing a GNSS timing signal anomaly detection method according to an embodiment of the present disclosure is shown;

[0034] Figure 5 A block diagram of exemplary individual devices and distributed multiple devices capable of implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0035] In order to make the objects, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be described clearly and completely below with reference to the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present disclosure.

[0036] In addition, the term "and / or" used herein is only to describe an associated relationship of associated objects, which means that there can be three relationships, for example, A and / or B can represent three cases of A alone, A and B together, and B alone. In addition, the character " / " herein generally represents an "or" relationship between the front and rear associated objects.

[0037] The present disclosure solves the current situation of individual defense and lack of group cooperative defense of existing GNSS timing signal quality evaluation algorithms by setting embedded timing information anomaly detection modules on individual devices and distributed complex devices, reasonably gathering and utilizing prior information and other detection algorithms, deeply fusing, comparing and analyzing GNSS timing signal analysis data, improving the efficiency and quality of group adaptive and grid defense of GNSS host devices, and meeting the needs of intensive operation and maintenance of industry host device operators.

[0038] Figure 1 A flowchart of a GNSS timing signal anomaly detection method according to an embodiment of the present disclosure is shown.

[0039] The satellite navigation system GNSS is composed of three parts. The space segment is composed of satellites or spacecraft (SV) for transmitting navigation messages containing satellite orbits, positions, and transmission times; the control segment is the ground monitoring station and the master control center for tracking satellite signals, collecting pseudorange measurement data and atmospheric model data, providing navigation information updates, atmospheric information and correction information, and controlling satellites; and the user segment is the GNSS receiver.

[0040] In practical applications, the function of positioning, velocity measurement and timing is mainly realized by receiving the signals broadcast by GNSS satellites. The GNSS timing signal detection of the present disclosure is mainly for detecting the GNSS timing signal received by the ground receiving segment.

[0041] S1: generating timing information data set based on GNSS timing signal analysis data.

[0042] Based on the received GNSS signal (which may contain spoofing and jamming signals), the present disclosure uses a timing signal analysis unit and a quality evaluation and verification unit in the device to sequentially perform timing signal analysis and quality evaluation and verification to generate information after analysis and verification.

[0043] In some embodiments, the GNSS time signal anomaly detection method of the present disclosure collects the parsed and verified GNSS time signal parsing information, and collects and aggregates based on the SOC platform issuing strategy and threat intelligence data to complete the collection and aggregation of data. Specifically, data collection is performed in a TCP / IP manner, and GNSS time information parsing data of local devices, external independent clock synchronization crystal unit data, and broadcast GNSS threat intelligence data of regional and frequency band range groups of devices are accessed periodically or in real time. Data aggregation, i.e., data cleaning, is performed by classifying, identifying, cleaning, converting, and storing each raw data collected according to technical specifications, index models, and data identifiers.

[0044] It should be noted that the technical specifications are specified in national standards, industry standards, enterprise standards, etc., such as "Information Security Technology - Telecom and Internet Big Data Security Management and Control Classification and Grading Implementation Guide", "China Mobile Big Data Security Management and Control Classification and Grading Implementation Guide", etc. The index model is a customized strategy according to the user's required security scene, i.e., a security consultant / evaluator and a user unit analyze the security scene and security demand, confirm whether to directly use an industry baseline (such as the telecom industry, the power industry), or superimpose the actual demand of the security scene, and finalize and output the data classification and grading, and the data label scheme.

[0045] In some embodiments, the classification and grading of data can be performed by first classifying the user identity related data, the user service data, and the user service derived data, and grading each type of item, i.e., the first level is the low sensitive level, the second level is the relatively sensitive level, the third level is the sensitive level, and the fourth level is the extremely sensitive level.

[0046] Because the base station devices produced by various manufacturers have different data formats for GNSS time signal parsing data, the data formats of the parsed data of different batches of base station devices of various manufacturers need to be aggregated and converted to the same format. By aggregating the raw data of the GNSS time signal parsing data of each device, the purpose of pre-processing the data is achieved, and the same format of GNSS time signal parsing data is obtained, so that the same format of GNSS time information data set is obtained, which is convenient for the management and detection of the data set in the later stage.

[0047] S2: performing anomaly detection processing on the time information data set to generate an anomaly detection processing result.

[0048] The GNSS time signal anomaly detection method of the present disclosure needs to perform security verification on the GNSS time information before performing anomaly detection processing on the time information data set, that is, to perform secondary verification on the collected and aggregated data set, to search for the problems of incomplete, inaccurate, and untimely data of each GNSS time information, and to feed back the data collection and aggregation unit for data completion or secondary data analysis. Based on the data set after security verification, the time signal analysis data, the independent clock signal (obtained from the device external independent clock synchronization crystal unit data), the GNSS threat intelligence data (through the GNSS device SOC platform and the GNSS signal threat intelligence platform), the device SOC security log, and the distributed multiple device synchronous clock signal are compared to determine the abnormal data. If the data is abnormal, it is determined whether the abnormal data is a fraudulent or interfered time signal analysis.

[0049] Specifically, taking the external independent clock signal as the reference, if the data obtained by GNSS time signal analysis and evaluation is different from the reference, that is, the GNSS time signal is abnormal.

[0050] Further, if the GNSS time information is different from the crystal oscillator circuit and the distributed multiple device synchronous clock signal, and the device SOC security log detects an anomaly, that is, the time signal of a single device may be inaccurate. In this security scenario, the device is suspended from synchronizing with other devices in the back end, and it is not desirable that the threat spreads and the incorrect time signal pollutes other devices, forming threat intelligence data of the device, and transmitting the threat intelligence data to the GNSS threat intelligence platform through the device SOC platform.

[0051] If the data obtained by GNSS time signal analysis and evaluation of the device is the same as the reference, and the device SOC security log does not have an anomaly, but is different from the distributed multiple device synchronous clock signal, that is, the distributed multiple device synchronous clock signal is abnormal. The SOC platform of the device transmits this abnormal information to the GNSS signal threat intelligence platform for platform processing.

[0052] S3: generating corresponding disposal suggestions based on the anomaly detection processing result.

[0053] In some embodiments, the mapping relationship is determined according to a pre-constructed risk assessment model. Through dimensions such as asset importance level, exposure risk coefficient, vulnerability risk, and security policy coverage, a risk assessment model based on single asset, business system cabinet, network space, and other multi-dimensional risk assessment models is constructed (i.e., forming a policy library that can be used in different scenarios). By determining the device type, the risk assessment level in each application scenario is determined, and the mapping relationship corresponding to different device types is determined. Further, a risk assessment model based on individual device multi-time synchronization unit and a risk assessment model based on distributed complex device matrix are constructed to realize the security risk value assessment of the current device and the pre-judgment of the future security risk of the current device. Forming a disposal suggestion, i.e., forming a comprehensive assessment of event alarm information and disposal suggestion, and sending it to the SOC platform to apply for clock resynchronization, device data isolation, security device response, security emergency service, threat intelligence broadcast, and other emergency disposal actions.

[0054] In some embodiments, if the GNSS timing information and the crystal oscillator circuit, the distributed complex device synchronization clock signal are not the same, and the device SOC security log detects an anomaly, i.e., the timing signal of a single device may not be accurate, in this security scenario, if the timing signal analysis data of the single device is not accurate in the area, according to the risk assessment model level, the device is requested to resynchronize the clock, isolate the device data, broadcast the threat intelligence, and other emergency disposal actions, and the event alarm information is sent to the device SOC platform.

[0055] It should be noted that the security assessment model policy library can be compared according to the data characteristic value and the matching model to confirm the corresponding risk level, and the policy library is matched and mapped through the edge computing node to output the disposal suggestion and alarm to the SOC platform to request emergency response disposal.

[0056] As Figure 3 shown is a detailed process of generating a disposal suggestion by a device in the GNSS timing signal anomaly detection method.

[0057] In some embodiments, the emergency response disposal method is realized through the following steps:

[0058] (1) Determine whether the current device is affected by threat intelligence data to make the timing information inaccurate or a new threat has occurred by data comparison to determine whether the attack behavior is successful.

[0059] (2) If it is affected by threat intelligence data to make the timing information inaccurate, the alarm information is converged to find the source, and whether to start the emergency response is further determined; if not, the threat intelligence library mechanism is optimized;

[0060] If the attack is successful, further determine whether to start the emergency plan and then carry out emergency response; if not, optimize the mechanism of the strategy library.

[0061] (3) Based on the content of the user request, determine the disposal method of the emergency response;

[0062] For example, based on the user request, adopt a temporary rectification plan to close the risk loop,

[0063] Or based on the user request, carry out emergency disposal actions such as security device linkage, port blocking, and data isolation.

[0064] (4) Based on the follow-up rectification loop result, determine whether the current emergency disposal action ensures normal online of the business.

[0065] If the result is yes, generate a threat analysis report and send a threat intelligence warning to the GNSS threat intelligence platform;

[0066] If not, report the request to the back-end and wait for the emergency response support team of the second and third line security service personnel to carry out on-site maintenance;

[0067] Finally, achieve the purpose of not affecting the normal online of the business.

[0068] It should be noted that the GNSS timing signal anomaly detection device will burn in data verification comparison algorithm, analysis and evaluation model and emergency response joint debugging script before the device is shipped, and the security analysis rules and security scenario strategies can be updated and iterated regularly in the later maintenance of the device. Also, when there are more threats, the second and third line service personnel can update and iterate the strategy library of the device.

[0069] In some embodiments, when the following multiple or any of the following situations occur,

[0070] High concurrency, multiple devices in a certain area report errors to the back-end;

[0071] A certain device platform receives an attack, the timing signal analysis data of the device platform is not accurate, and the access policy of the firewall of the device may have problems;

[0072] The geographical location of the device base station is poor, and the communication shows characteristics such as unstable GNSS timing signal, low signal strength, high packet loss rate, and high noise ratio; and the location where the base station device is built also determines the good or bad of its geographical conditions;

[0073] The device can select a repair script according to the disposal rule in the strategy library to perform self-maintenance and self-adaptation or notify the second and third line service personnel to arrive near the base station for maintenance.

[0074] Taking the case that the device may receive an attack, the data of a certain port of the device is found to be contaminated through data verification comparison, the safe device is requested to perform micro-isolation processing on the port and the data, and the clock is requested to be resynchronized when returning the message; if the resynchronization is successful, the data is refreshed and overwritten, the port is opened, and the service is returned to the normal online state, and the event log is uploaded. If the resynchronization is not successful, threat alert intelligence data is generated and sent to the SOC platform, and policy distribution or manual emergency response work order is requested. Manual + tool disposal is carried out by the operation and maintenance department or a third party, manual research and judgment is carried out, the intrusion path or damage chain is analyzed, full scan is carried out, part of the service is blocked, and the port parameter and policy group are modified. Finally, the service is completed online, a security event report and a threat analysis report are generated, and a threat warning notice is pushed.

[0075] Taking the case that a certain port receives multi-source timing data interference, the GNSS timing analysis unit alarms, and the comparison unit receives a warning intelligence that more than half of the devices in the region have received multi-source timing data interference. Multi-source timing data and multiple unit alarm information have formed a flood attack. After analysis and evaluation module disc, the single unit device cannot cope with the large flow flood attack, and an emergency response work order is directly generated, requesting the back-end second and third line manual emergency security service intervention. The operation and maintenance department entrusts the operator anti-DDOS attack service team to carry out near-source flow cleaning, and pays attention to the running state of the GNSS timing analysis unit system. After 20 minutes, the flow flood peak passes, the GNSS timing analysis unit system flood attack disposal ends, and the system returns to normal online. The operation and maintenance department and the operator anti-DDOS attack service team compile a security event report and a threat analysis report, and update the security automation response script, and issue the updated policy library.

[0076] It should be noted that the so-called asset importance level is determined according to the basic network attribute and responsibility attribute of the IT asset itself; the vulnerability risk is determined according to the vulnerability of the device itself, the level of the vulnerability, the number of times of the vulnerability, the basic score of the vulnerability, and the current state of the device, so as to determine the vulnerability risk level; the exposure risk coefficient is determined according to the size of the exposure surface of the device, so as to determine the exposure risk of the device in single machine, region and large network, and thus the risk level in each region; the security policy coverage rate is determined according to whether there is a firewall or other network security management device for filtering access in the device, and the defense strength of the network security management device is determined, so as to determine the risk level in this dimension. The risk levels in each dimension are considered comprehensively by setting different weights in different scenes and the like, to determine the device in the current situation of timing signal analysis information error, other device pollution of the device leading to inaccurate timing information, and the risk level of the device, and further determine the type of the device.

[0077] In some embodiments, only the time signal parsing information error in the individual device is taken as a low-risk level result; the device time signal parsing error that may affect the time information of other devices in the region is taken as a medium-risk level; and the device time signal parsing error that may affect the normal service online and may affect the time information of each device in the large network is taken as a high-risk level.

[0078] As shown in Figure 5 , the individual device comprises a time signal parsing module, a quality assessment verification module, an externally-mounted independent synchronous crystal oscillator module, a GNSS time signal anomaly detection module and a SOC platform.

[0079] The externally-mounted independent synchronous crystal oscillator module is configured to provide a basic clock signal for the system.

[0080] The time signal parsing module is configured to perform preliminary parsing on the received time signal.

[0081] The quality assessment verification module is configured to perform quality assessment on the parsed time signal and perform preliminary verification.

[0082] The GNSS time signal anomaly detection module comprises a data set generation submodule, an anomaly detection submodule and a treatment suggestion generation submodule.

[0083] The data set generation submodule is configured to collect and aggregate the parsing and prior information of the existing integrated or independent time signal prevention and control unit module, the SOC platform issued strategy and threat intelligence;

[0084] The anomaly detection submodule is configured to implement data security verification, data comparison and multi-dimensional analysis and evaluation on abnormal data.

[0085] Firstly, the collected data is subjected to secondary verification to search for problems such as incomplete, inaccurate and untimely data, and feedback is given to the data collection and aggregation unit to perform data re-completion or data secondary parsing;

[0086] Secondly, the GNSS time signal parsing and evaluation data are compared with the device independent synchronous crystal oscillator clock information, the device SOC security log and the distributed complex device synchronous clock signal to determine the abnormal GNSS time signal parsing data;

[0087] Thirdly, a risk assessment model based on the individual device multi-time synchronization unit and a risk assessment model based on the distributed complex device matrix are constructed to realize the safety risk value assessment of the current device and realize the prediction of the future safety risk of the current device.

[0088] The treatment suggestion submodule is configured to form the event alarm information and the treatment suggestion of the comprehensive assessment. The alarm information and the treatment suggestion are sent to the SOC platform to apply for clock resynchronization, device data isolation, safe device response, safe emergency service, threat intelligence broadcast, and other emergency treatment actions.

[0089] It should be noted that the time signal analysis module, the quality assessment verification module, and the GNSS time signal anomaly detection module can be the same module, which realizes signal analysis and anomaly detection functions.

[0090] The GNSS time signal anomaly detection module uses an embedded bypass big data calculation comparison unit algorithm, reasonably converges and utilizes prior information of an independent time signal prevention and control unit module, and uses a redundant calculation processing mode of multi-parameter solving and multi-strategy comparison to deeply integrate, compare, and analyze GNSS time signals, overcome the difficulties of high recognition difficulty of spoofing signals and large deviation of interference signals, improve the recognition rate of noise signals, and timely take technical and management measures to ensure that the GNSS system efficiently and accurately identifies interference signals and spoofing signals.

[0091] The GNSS device SOC platform is configured to communicate with the GNSS time signal anomaly detection module and the GNSS signal threat intelligence platform, and exchange data with other devices.

[0092] In some embodiments, the GNSS time signal anomaly detection module can be arranged in the interior of each individual device. Embedding the GNSS time signal anomaly detection module in each individual device is beneficial to the anti-interference and anti-spoofing of the device itself, and further improves the accuracy of the time signal data.

[0093] In some embodiments, one or more GNSS time signal anomaly detection modules can also be arranged in each distributed complex device. For example, one GNSS time signal anomaly detection module is arranged in a distributed complex device in a certain area, and the distributed complex device includes four individual devices, namely A1, A2, A3, and A4. The GNSS time signal anomaly detection module is arranged in device A4. When device A4 detects that the GNSS time signal analysis data received by the current device is abnormal through the GNSS time signal anomaly detection module embedded in the device, the SOC platform of device A4 sends alarm information and threat intelligence to the SOC platforms of devices A1, A2, and A3, so that the alarm information can be used by devices A1, A2, and A3 to apply for clock resynchronization. When devices A1, A2, A3, and A4 perform time synchronization between devices, it is found that the time signal analysis data received by one of the devices is incorrect, and device A4 provides the correct time to the device with incorrect data and synchronizes the time.

[0094] It should be noted that in a distributed plurality of devices in a certain area, a GNSS timing signal anomaly detection module is arranged in device A4, and A4 device can also analyze the GNSS timing signals received by A1, A2 and A3 devices and its own received GNSS timing signals. If an anomaly is found, threat intelligence data is sent to the GNSS signal threat intelligence platform, and alarm information is sent to each device. If no anomaly is found, the analyzed GNSS timing signal is synchronized to A1, A2 and A3 devices by device A4.

[0095] The GNSS timing signal anomaly detection module is arranged in an individual device and / or a distributed plurality of devices, and is used for detecting whether the GNSS timing signal is abnormal. Embedding a GNSS timing signal anomaly detection module in each individual device is beneficial to the anti-interference and anti-fraud of the device itself, and further improves the accuracy of the timing data. Arranging one or more GNSS timing signal anomaly detection modules in each distributed plurality of devices reduces the labor cost while ensuring the accuracy of the timing signal.

[0096] It should be noted that for the above-mentioned method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the present disclosure is not limited by the described action sequence, because according to the present disclosure, certain steps can be performed in other order or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.

[0097] The above is the introduction of the method embodiment, and the following will further illustrate the scheme of the present disclosure through the device embodiment.

[0098] Figure 2 A block diagram of a GNSS timing signal anomaly detection device 200 according to an embodiment of the present disclosure is shown.

[0099] As shown in Figure 2 , the device 200 includes:

[0100] The data set generation module 210 is configured to generate a timing information data set based on GNSS timing signal analysis data;

[0101] The anomaly detection module 220 is configured to perform anomaly detection processing on the timing information data set;

[0102] The treatment suggestion generation module 230 is configured to generate a corresponding treatment suggestion for the anomaly detection processing result according to a pre-constructed risk assessment model.

[0103] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described modules can refer to the corresponding process in the foregoing method embodiments, and will not be described here again.

[0104] According to embodiments of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0105] Figure 4 A schematic block diagram of an electronic device 400 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present disclosure described and / or claimed in this document.

[0106] The device 400 includes a computing unit 401 that can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 402 or a computer program loaded into a random access memory (RAM) 403 from a storage unit 408. Various programs and data required for the operation of the device 400 can also be stored in the RAM 403. The computing unit 401, the ROM 402, and the RAM 403 are connected to each other through a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0107] Various components in the device 400 are connected to the I / O interface 405, including: an input unit 406, such as a keyboard, a mouse, etc.; an output unit 407, such as various types of displays, speakers, etc.; a storage unit 408, such as a magnetic disk, an optical disk, etc.; and a communication unit 409, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 409 allows the device 400 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunications networks.

[0108] The computing unit 401 can be various general and / or special purpose processing components with processing and computing capabilities. Some examples of the computing unit 401 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 401 performs various methods and processes described above, such as the GNSS timing signal anomaly detection method. For example, in some embodiments, the GNSS timing signal anomaly detection method can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 408. In some embodiments, part or all of the computer program can be loaded and / or installed onto the device 400 via the ROM 402 and / or the communication unit 409. When the computer program is loaded onto the RAM 403 and executed by the computing unit 401, one or more steps of the GNSS timing signal anomaly detection method described above can be performed. Alternatively, in other embodiments, the computing unit 401 can be configured to perform the GNSS timing signal anomaly detection method by other any appropriate means, such as by means of firmware.

[0109] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0110] Program code for carrying out methods of the present disclosure can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / acts specified in the flowcharts and / or block diagrams. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0111] In the context of this disclosure, a machine-readable medium can be a tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0112] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0113] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0114] The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0115] It should be understood that the various forms of flow shown above can be used to reorder, add, or delete steps. For example, the steps recited in the present disclosure can be performed in parallel, in series, or in a different order, without limitation herein, so long as the desired results of the technology disclosed in the present disclosure are achieved.

[0116] The specific implementation described above does not constitute a limitation on the protection scope of the present disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for detecting abnormal GNSS time signal, characterized in that, The method comprises: generating a timing information dataset based on GNSS timing signal analysis data; cleaning and performing security verification on the timing information dataset; based on the dataset after security verification, comprehensively comparing GNSS timing signal analysis data with externally mounted independent clock signals, GNSS threat intelligence data, device SOC security logs, and distributed complex device synchronous clock signals, determining abnormal data, and judging whether the abnormal data is obtained by fraudulent or interfered timing signal analysis, and generating an abnormal detection processing result; wherein the GNSS threat intelligence data is obtained by interaction between a GNSS device SOC platform and a GNSS signal threat intelligence platform; generating a corresponding treatment suggestion based on the abnormal detection processing result.

2. The method of claim 1, wherein, The method of generating a corresponding treatment suggestion based on the abnormal detection processing result specifically comprises: determining the treatment suggestion corresponding to the abnormal detection result based on a mapping relationship; wherein the mapping relationship is a processing rule pre-stored in a policy library.

3. The method of claim 2, wherein, The method of generating a corresponding treatment suggestion based on the abnormal detection processing result further comprises: determining the current device type according to one or more dimensions of the asset importance level, exposure risk coefficient, vulnerability risk, and security policy coverage of the current device; obtaining the corresponding mapping relationship according to the current device type.

4. A GNSS time signal anomaly detection apparatus characterized by comprising: The device comprises: a dataset generation module for generating a timing information dataset based on GNSS timing signal analysis data; an abnormal detection module for cleaning and performing security verification on the timing information dataset; based on the dataset after security verification, comprehensively comparing GNSS timing signal analysis data with externally mounted independent clock signals, GNSS threat intelligence data, device SOC security logs, and distributed complex device synchronous clock signals, determining abnormal data, and judging whether the abnormal data is obtained by fraudulent or interfered timing signal analysis, and generating an abnormal detection processing result; wherein the GNSS threat intelligence data is obtained by interaction between a GNSS device SOC platform and a GNSS signal threat intelligence platform; a treatment suggestion generation module for generating a corresponding treatment suggestion based on the abnormal detection processing result.

5. An electronic device, comprising: comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of any one of claims 1-3.

6. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to enable the computer to execute the method of any one of claims 1-3.

Images