Satellite link security detection method, device, equipment and medium based on GCN

Abstract

The present invention discloses a satellite link security detection method, device, equipment and medium based on GCN, which belongs to the field of satellite link security technology. The method includes: obtaining satellite link data in the current cycle; constructing a graph structure according to the satellite link data, and extracting node features and edge features corresponding to the graph structure; generating a node matrix and an adjacency matrix based on the one-to-one correspondence between node features and edge features; inputting the node matrix and the adjacency matrix into a pre-trained GCN model, and performing multi-layer convolution operations on the node matrix and the adjacency matrix using multiple convolution layers in the GCN model, so as to aggregate the node's own node features with the neighbor node features at each layer, and using the aggregated feature matrix in the current cycle and the aggregated feature matrix in the historical cycle to detect whether there are abnormalities in the satellite link. The present invention can identify the complex relationship between nodes and paths based on the node aggregation feature matrix, and effectively discover the abnormalities in the satellite link.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of satellite link security technology, and in particular to a GCN-based satellite link security detection method, device, equipment and medium. Background Art

[0002] The Turla incident revealed a sophisticated cyberattack method in which attackers took advantage of the wide-area coverage and high latency of satellite links to circumvent traditional network security detection methods by hijacking legitimate communication links and binding them to malicious servers. This attack utilized dynamic DNS services, IP address spoofing, and other means, making it difficult for traditional statistical and feature matching-based methods to detect and defend against. Summary of the invention

[0003] The embodiments of the present invention provide a GCN-based satellite link security detection method, device, equipment and medium, which can detect the security of the satellite link.

[0004] On the one hand, a satellite link security detection method based on GCN is provided, comprising:

[0005] Based on the set period, obtain the satellite link data in the current period;

[0006] Constructing a graph structure according to satellite link data in a current period, and extracting node features and edge features corresponding to the graph structure;

[0007] Generate a node matrix and an adjacency matrix based on the one-to-one correspondence between the node features and the edge features;

[0008] The node matrix and the adjacency matrix are input into the pre-trained GCN model, and the node matrix and the adjacency matrix are subjected to multi-layer convolution operations using multiple convolution layers in the GCN model, so as to aggregate the node features of the node itself with the neighbor node features at each layer to obtain the aggregated feature matrix in the current cycle, and the aggregated feature matrix in the current cycle and the aggregated feature matrix in the historical cycle are used to detect whether there is an abnormality in the satellite link.

[0009] On the other hand, a satellite link security detection device based on GCN is provided, comprising:

[0010] An acquisition unit, used for acquiring satellite link data in a current period based on a set period;

[0011] An extraction unit, used to construct a graph structure according to the satellite link data in the current cycle, and extract node features and edge features corresponding to the graph structure;

[0012] A generating unit, configured to generate a node matrix and an adjacency matrix based on the one-to-one correspondence between the node features and the edge features;

[0013] The detection unit is used to input the node matrix and the adjacency matrix into a pre-trained GCN model, and perform multi-layer convolution operations on the node matrix and the adjacency matrix using multiple convolution layers in the GCN model, so as to aggregate the node features of the node itself with the neighbor node features at each layer to obtain an aggregated feature matrix in a current cycle, and use the aggregated feature matrix in the current cycle and the aggregated feature matrix in the historical cycle to detect whether there is an abnormality in the satellite link.

[0014] On the other hand, a computer device is provided, comprising a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned GCN-based satellite link security detection method.

[0015] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned GCN-based satellite link security detection method are implemented.

[0016] On the other hand, a computer program product is provided, including a computer program, which implements the steps of the above-mentioned GCN-based satellite link security detection method when executed by a processor.

[0017] The embodiment of the present invention provides a satellite link security detection method, device, equipment and medium based on GCN, by constructing a graph structure according to satellite link data, extracting node features and edge features in the graph structure, and inputting the node matrix generated by the node features and the adjacency matrix generated by the edge features into the GCN model, so that the node matrix and the adjacency matrix can be subjected to multi-layer convolution operations using multiple convolution layers in the GCN model, so that the node features of the node itself and the neighbor node features are aggregated at each layer, and then the aggregate feature matrix is ​​used to detect whether there is an abnormality in the satellite link. It can be seen that this scheme can identify the complex relationship between nodes and paths based on the node aggregate feature matrix, and effectively discover the abnormalities in the satellite link. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of a satellite link security detection method based on GCN provided by an embodiment of the present invention;

[0020] Figure 2 It is a structural diagram of a satellite link security detection device based on GCN provided by one embodiment of the present invention;

[0021] Figure 3 It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0023] Attack organizations such as Tula use satellite links to attack, which is based on the wide coverage and high latency of satellite links to circumvent traditional security detection. In order to be able to perform security detection on satellite links, considering that satellite links are composed of multiple nodes, there are communication paths between nodes, and the attack organization also has an attack link when attacking, the present invention uses the graph structure formed by satellite link data to perform security detection on satellite links; considering that the nodes and edges in the graph structure have corresponding features, and there is also an association between the two nodes connected by the edge, the edge features and node features can be aggregated to fully understand the entire graph structure, thereby identifying the complex relationship between nodes and paths based on the aggregated features, and effectively discovering the anomalies in the satellite link.

[0024] The specific implementation of the above concept is described below.

[0025] Please refer to Figure 1 The embodiment of the present invention provides a satellite link security detection method based on GCN, including:

[0026] Step 100, based on a set period, obtaining satellite link data in a current period;

[0027] Step 102, constructing a graph structure according to the satellite link data in the current cycle, and extracting node features and edge features corresponding to the graph structure;

[0028] Step 104, generating a node matrix and an adjacency matrix based on the one-to-one correspondence between the node features and the edge features;

[0029] Step 106: Input the node matrix and the adjacency matrix into the pre-trained GCN model, and perform multi-layer convolution operations on the node matrix and the adjacency matrix using multiple convolution layers in the GCN model, so as to aggregate the node features of the node itself with the neighbor node features at each layer to obtain the aggregated feature matrix in the current cycle, and use the aggregated feature matrix in the current cycle and the aggregated feature matrix in the historical cycle to detect whether there is an abnormality in the satellite link.

[0030] In the embodiment of the present invention, a graph structure is constructed according to satellite link data, and node features and edge features in the graph structure are extracted, and the node matrix generated by the node features and the adjacency matrix generated by the edge features are input into the GCN model, so that the node matrix and the adjacency matrix can be subjected to multi-layer convolution operations using multiple convolution layers in the GCN model, so that the node features of the node itself and the neighbor node features are aggregated at each layer, and then the aggregate feature matrix is ​​used to detect whether there is an abnormality in the satellite link. It can be seen that this scheme can identify the complex relationship between nodes and paths based on the node aggregate feature matrix, and effectively discover the anomalies in the satellite link.

[0031] Described below Figure 1 How the various steps are performed.

[0032] First, step 100 "obtaining satellite link data in the current period based on a set period" and step 102 "constructing a graph structure according to the satellite link data in the current period, and extracting node features and edge features corresponding to the graph structure" are explained simultaneously.

[0033] The satellite communication system consists of two parts: satellites and ground stations. The satellite acts as a relay station in the air, and the ground station is the interface between the satellite and the ground public network. The satellite receives the signal sent by the ground station and forwards it to other satellites or ground stations, thereby realizing satellite communication. In order to use the graph structure to perform security detection on the satellite link, it is necessary to obtain the satellite link data and use the satellite link data to build the graph structure.

[0034] In the embodiment of the present invention, a period may be preset, and satellite link data may be acquired once according to the set period, so as to perform a safety detection on the satellite link using the satellite link data acquired in the current period. The size of the set period may be set according to the requirement of real-time detection, for example, the satellite link data may be acquired in real time to perform a real-time detection on the safety of the satellite link.

[0035] In the embodiment of the present invention, the satellite link data may include at least the following data:

[0036] DNS query and response records: Obtain DNS query records initiated by each node, which may include source IP, target domain name, TTL value, query time, and response time, etc. Nodes may include satellites and ground stations;

[0037] Communication path data: records the communication path data between nodes, which may include path delay, number of hops, packet loss rate, etc., to characterize the communication quality between nodes;

[0038] Node geolocation data: The physical location of each node can be obtained to help identify cross-region communication paths and physical connections between nodes.

[0039] In the embodiment of the present invention, since the amount of data in the satellite communication system is large, and the communication path data is not only the data between two directly connected nodes, but also the communication path data between two indirectly connected nodes through an intermediate node, in order to make the entire communication network clearer and identify the association between nodes and paths, it is necessary to construct a graph structure based on the satellite link data and extract the node features and edge features corresponding to the graph structure, which may specifically include:

[0040] Define nodes: at least define satellites and ground stations as nodes in the graph structure. Node features may include IP address, geographic location, DNS query frequency, TTL value, etc.

[0041] Define edge: The communication path directly connecting two nodes is defined as an edge. Edge characteristics can include path delay, number of hops, packet loss rate, etc.

[0042] The graph structure is constructed using nodes and edges: the graph structure is G = (V, E), where V represents the node set and E represents the edge set; each node v∈V has multiple node features, and each edge e∈E represents the edge feature connecting two nodes.

[0043] Then, for step 104, a node matrix and an adjacency matrix are generated based on the one-to-one correspondence between the node features and the edge features.

[0044] In the embodiment of the present invention, in order to facilitate the GCN model to perform feature aggregation, it is necessary to generate a node matrix based on node features and an adjacency matrix based on edge features.

[0045] First, the node characteristics may include at least one of the following first parameters: the node characteristics include at least one of the following first parameters: geographic location, TTL mean, and DNS query frequency;

[0046] Then, the method of generating the node matrix may include: standardizing the node features of each node to obtain the first parameter eigenvalue corresponding to each node; generating a node matrix of X rows and Y columns based on the first parameter eigenvalue corresponding to each node; wherein X is the number of nodes, Y is the number of first parameters included in the node features, and the element in the i-th row and j-th column of the node matrix is ​​the j-th first parameter eigenvalue corresponding to the i-th node.

[0047] Since there are non-numerical parameters in the first parameter, such as geographic location, it is necessary to quantify the features of the non-numerical parameters for subsequent calculations. Furthermore, in order to ensure that different parameters are on the same scale, each first parameter in the node feature needs to be standardized. The standardized processing method can be achieved by calculating the Z score.

[0048] Assuming that the number of nodes is 20 and the number of first parameters is 3, a node matrix with 20 rows and 3 columns can be formed.

[0049] Then, an adjacency matrix is ​​generated, which is a matrix of X rows and X columns; X is the number of nodes;

[0050] The element value of the element in the i-th row and j-th column of the adjacency matrix is ​​determined in the following way: if the i-th node is directly connected to the j-th node, the edge weight is calculated based on the edge feature of the edge between the i-th node and the j-th node, and the edge weight is used as the element value of the element; if the i-th node is not directly connected to the j-th node, the element value of the element is 0;

[0051] The edge weight changes dynamically according to the change of the corresponding edge feature.

[0052] Among them, each element in the adjacency matrix is ​​used to characterize the connection relationship between the corresponding two nodes. If the element value is not 0, it indicates that the corresponding two nodes are directly connected, and the larger the edge weight, the better the connection quality. Since the edge weight is calculated based on the corresponding edge feature, and in satellite communications, the edge feature corresponding to the satellite link is dynamically changing, the edge weight also changes dynamically with the change of the edge feature. Therefore, the adjacency matrix is ​​used to realize the aggregation of the node's own node features and neighbor node features, which can better characterize the node features in the satellite network, and then it can be more accurate when using the aggregated feature matrix to detect the security of the satellite link.

[0053] In one embodiment of the present invention, the edge feature includes at least one second parameter selected from the group consisting of: path delay, number of hops, and packet loss rate;

[0054] Then, the edge weight is calculated as follows: standardize the edge features corresponding to each edge to obtain the second parameter feature value corresponding to each edge; calculate the edge weight according to the preset logic based on the second parameter feature value corresponding to each edge; in the preset logic, the greater the path delay / number of hops / packet loss rate, the smaller the edge weight.

[0055] Similarly, if there are non-numerical parameters in the second parameter, the features of the non-numerical parameters also need to be quantized for subsequent calculations. In order to ensure that different parameters are on the same scale, each second parameter in the edge feature needs to be standardized. The standardized processing method can be achieved by calculating the Z score.

[0056] When the second parameter is path delay, the unit of the path delay may be milliseconds, and a lower path delay indicates better communication quality;

[0057] When the second parameter is the number of hops, the number of hops can affect the signal transmission efficiency and network congestion. Even if two nodes are directly connected, due to congestion in the directly connected communication path, they need to communicate through other nodes. Therefore, the fewer the number of hops, the better the network congestion.

[0058] When the second parameter is the packet loss rate, the packet loss rate can characterize the stability of the communication path. A higher packet loss rate indicates a worse stability of the communication path.

[0059] For example, when the second parameter includes the above-mentioned path delay, hop count and packet loss rate, the edge weight can be determined by the following preset logic:

[0060] Edge weight = 1 / (path delay + number of hops + packet loss rate × 100%).

[0061] It can be seen that the greater the path delay, the smaller the edge weight; the more hops, the smaller the edge weight; the greater the packet loss rate, the smaller the edge weight.

[0062] Finally, for step 106, the node matrix and the adjacency matrix are input into the pre-trained GCN model, and the node matrix and the adjacency matrix are subjected to multi-layer convolution operations using multiple convolution layers in the GCN model, so that the node's own node features and neighbor node features are aggregated at each layer to obtain the aggregated features in the current cycle, and the aggregated features in the current cycle and the aggregated features in the historical cycle are used to detect whether there are abnormalities in the satellite link.

[0063] In an embodiment of the present invention, a GCN (graph convolutional network) model includes multiple convolution layers, which are used to perform multi-layer convolution operations on the input node matrix and adjacency matrix to continuously update the node features. The update of the node features depends on the features of its neighboring nodes, and in the scenario of satellite link communication security, the edge features between the node and its neighboring nodes are equally important, because the edge features will directly affect the communication quality and security status between the nodes. Therefore, when updating the node features, the node's own node features are aggregated with the neighboring node features, and the edge features are considered during the aggregation.

[0064] In one implementation, l A convolutional layer aggregates the node's own node features with the neighbor node features in the following way:

[0065]

[0066] in, To input to l The node matrix of the convolutional layer, For l The node matrix output by the convolutional layer, σ is the activation function, A is the adjacency matrix, and D is the degree matrix calculated based on the adjacency matrix A; The weight matrix learned for the GCN model;

[0067] The node matrix output by the last convolutional layer is the aggregated feature matrix.

[0068] It can be seen that when there are multiple convolutional layers, the first convolutional layer updates the input node matrix according to the adjacency matrix, and outputs the updated node matrix. At this time, each node in the node matrix is ​​aggregated with its neighbor node features, and then input to the second convolutional layer for update again. Each node in the node matrix output by the second convolutional layer aggregates the neighbor node features again, and so on. The node matrix output by the last convolutional layer is an aggregated feature matrix output after multiple aggregations of neighbor node features. This aggregated feature matrix can more accurately characterize the characteristics of the entire graph structure, and based on this aggregated feature matrix, the complex relationship between nodes and paths can be identified.

[0069] In an embodiment of the present invention, the GCN model is obtained by pre-training, and the pre-training process is performed using a labeled data set. The labeled data set may include a node matrix and an adjacency matrix within a historical period. The labeled information may be a known community structure, constellation network, and other association relationships, so that the GCN model can learn a weight matrix during the pre-training process. The weight matrix can help the GCN model to effectively aggregate the node's own features and neighbor node features when performing graph convolution operations; in addition, through pre-training, the GCN model can effectively identify and process the node features and edge features of the graph structure, learn how to extract effective features from the graph structure, and use effective features to identify known relationships and known patterns in the graph structure, and then when detecting the satellite link, based on these known relationships and known patterns, determine whether there are changes in the relationships and patterns identified from the aggregated feature matrix in the current period, thereby determining whether there are abnormalities in the satellite link.

[0070] In one implementation, using the aggregate feature matrix in the current period and the aggregate feature matrix in the historical period to detect whether there is an abnormality in the satellite link may include:

[0071] Obtain the baseline value of the node feature of the previous period; the baseline value of the node feature of the previous period is determined by the change law formed by the aggregated feature matrix in multiple consecutive historical periods;

[0072] The baseline value of the node feature of the previous cycle is updated using the aggregate feature matrix in the current cycle to obtain the baseline value of the node feature of the current cycle;

[0073] The aggregate feature matrix in the current period is detected using the baseline value of the node feature in the current period to determine whether there is an abnormality in the satellite link.

[0074] More specifically, in the baseline values ​​of the node features, each first parameter has a corresponding baseline value.

[0075] When updating the baseline value, the following smoothing method can be used:

[0076]

[0077] Among them, EWMA t is the baseline value of the node feature in the current cycle, is the baseline value of the node feature in the previous period, α is the smoothing coefficient, and the smoothing coefficient is a positive number less than 1. t is the node feature in the current cycle.

[0078] The smoothing coefficient is used to characterize the sensitivity of the baseline value to the latest data changes. The larger the smoothing coefficient, the more sensitive the baseline value is to the latest data changes. Conversely, the smaller the smoothing coefficient, the less sensitive the baseline value is to the latest data changes. The smoothing coefficient can be a fixed value.

[0079] In this way, the baseline value of the node feature of the current period can be used to detect whether there is an abnormality in the satellite link. Among them, the detection results of the GCN model can locate the abnormal nodes and abnormal paths, so as to warn of the abnormality.

[0080] Please refer to Figure 2 The embodiment of the present invention provides a satellite link security detection device based on GCN, including:

[0081] The acquisition unit 200 is used to acquire satellite link data in a current period based on a set period;

[0082] An extraction unit 202, configured to construct a graph structure according to the satellite link data in the current cycle, and extract node features and edge features corresponding to the graph structure;

[0083] A generating unit 204, configured to generate a node matrix and an adjacency matrix based on the node features and the edge features in a one-to-one correspondence;

[0084] The detection unit 206 is used to input the node matrix and the adjacency matrix into the pre-trained GCN model, and use multiple convolution layers in the GCN model to perform multi-layer convolution operations on the node matrix and the adjacency matrix, so as to aggregate the node's own node features with the neighbor node features in each layer to obtain the aggregated feature matrix in the current cycle, and use the aggregated feature matrix in the current cycle and the aggregated feature matrix in the historical cycle to detect whether there is an abnormality in the satellite link.

[0085] In one embodiment of the present invention, the node characteristics include at least one first parameter as follows: geographic location, TTL mean, and DNS query frequency;

[0086] The node matrix is ​​generated in the following manner:

[0087] The node features of each node are standardized to obtain the first parameter feature value corresponding to each node;

[0088] A node matrix of X rows and Y columns is generated based on the first parameter eigenvalue corresponding to each node; wherein X is the number of nodes, Y is the number of first parameters included in the node feature, and the element in the i-th row and j-th column in the node matrix is ​​the j-th first parameter eigenvalue corresponding to the i-th node.

[0089] In one embodiment of the present invention, the adjacency matrix is ​​a matrix of X rows and X columns; X is the number of nodes;

[0090] The element value of the element in the i-th row and j-th column of the adjacency matrix is ​​determined in the following way: if the i-th node is directly connected to the j-th node, the edge weight is calculated based on the edge feature of the edge between the i-th node and the j-th node, and the edge weight is used as the element value of the element; if the i-th node is not directly connected to the j-th node, the element value of the element is 0;

[0091] The edge weight changes dynamically according to the change of the corresponding edge feature.

[0092] In one embodiment of the present invention, the edge feature includes at least one of the following second parameters: path delay, number of hops, and packet loss rate;

[0093] The edge weight is calculated as follows: the edge features corresponding to each edge are standardized to obtain the second parameter feature value corresponding to each edge; the edge weight is calculated according to a preset logic based on the second parameter feature value corresponding to each edge; in the preset logic, the greater the path delay / number of hops / packet loss rate, the smaller the edge weight.

[0094] In one embodiment of the present invention, l A convolutional layer aggregates the node's own node features with the neighbor node features in the following way:

[0095]

[0096] in, To input to l The node matrix of the convolutional layer, For l The node matrix output by the convolutional layer, σ is the activation function, A is the adjacency matrix, and D is the degree matrix calculated based on the adjacency matrix A; The weight matrix learned for the GCN model;

[0097] The node matrix output by the last convolutional layer is the aggregated feature matrix.

[0098] In one embodiment of the present invention, the detection unit is specifically used for:

[0099] Obtain the baseline value of the node feature of the previous period; the baseline value of the node feature of the previous period is determined by the change law formed by the aggregated feature matrix in multiple consecutive historical periods;

[0100] The baseline value of the node feature of the previous cycle is updated using the aggregate feature matrix in the current cycle to obtain the baseline value of the node feature of the current cycle;

[0101] The aggregate feature matrix in the current period is detected using the baseline value of the node feature in the current period to determine whether there is an abnormality in the satellite link.

[0102] It should be noted that: the satellite link security detection device based on GCN provided in the above embodiment is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the satellite link security detection device based on GCN provided in the above embodiment and the satellite link security detection method embodiment based on GCN belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0103] The embodiment of the present application also provides a computer device, please refer to Figure 3 The computer device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, at least one program, a code set or an instruction set is loaded and executed by the processor to implement the GCN-based satellite link security detection method provided in the above-mentioned method embodiments.

[0104] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the GCN-based satellite link security detection method provided in the above-mentioned method embodiments.

[0105] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes the GCN-based satellite link security detection method described in any of the above embodiments.

[0106] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0107] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly contributed to the prior art in the form of a software product, which can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application or certain parts of the embodiments.

[0108] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0109] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A satellite link security detection method based on GCN, characterized in that: include: Based on the set period, obtain the satellite link data in the current period; Constructing a graph structure according to satellite link data in a current period, and extracting node features and edge features corresponding to the graph structure; Generate a node matrix and an adjacency matrix based on the one-to-one correspondence between the node features and the edge features; The node matrix and the adjacency matrix are input into a pre-trained GCN model, and the node matrix and the adjacency matrix are subjected to multi-layer convolution operations using multiple convolution layers in the GCN model, so as to aggregate the node features of the node itself with the neighbor node features at each layer to obtain an aggregate feature matrix in a current cycle, and the aggregate feature matrix in the current cycle and the aggregate feature matrix in a historical cycle are used to detect whether there is an abnormality in the satellite link; The node characteristics include at least one first parameter as follows: geographic location, TTL mean, and DNS query frequency; The node matrix is ​​generated in a manner including: normalizing the node features of each node to obtain a first parameter eigenvalue corresponding to each node; generating a node matrix of X rows and Y columns based on the first parameter eigenvalue corresponding to each node; wherein X is the number of nodes, Y is the number of first parameters included in the node features, and the element in the i-th row and j-th column of the node matrix is ​​the j-th first parameter eigenvalue corresponding to the i-th node; The adjacency matrix is ​​a matrix of X rows and X columns; X is the number of nodes; the element value of the element in the i-th row and j-th column of the adjacency matrix is ​​determined in the following manner: if the i-th node is directly connected to the j-th node, the edge weight is calculated based on the edge feature of the edge between the i-th node and the j-th node, and the edge weight is used as the element value of the element; if the i-th node is not directly connected to the j-th node, the element value of the element is 0; the edge weight changes dynamically according to the change of the corresponding edge feature; The node's own node features and neighbor node features are aggregated at each layer, including: No. l A convolutional layer aggregates the node's own node features with the neighbor node features in the following way: in, For input to l The node matrix of the convolutional layer, For l The node matrix output by the convolutional layer, is the activation function, A is the adjacency matrix, and D is the degree matrix calculated based on the adjacency matrix A; The weight matrix learned for the GCN model; The node matrix output by the last convolutional layer is the aggregated feature matrix.

2. The method according to claim 1, characterized in that The edge characteristics include at least one of the following second parameters: path delay, hop count, and packet loss rate; The edge weight is calculated by: normalizing the edge feature corresponding to each edge to obtain the second parameter feature value corresponding to each edge; The edge weight is calculated based on the second parameter characteristic value corresponding to each edge according to the preset logic; in the preset logic, the greater the path delay / number of hops / packet loss rate, the smaller the edge weight.

3. The method according to any one of claims 1-2, characterized in that: The method of using the aggregate feature matrix in the current period and the aggregate feature matrix in the historical period to detect whether the satellite link is abnormal includes: Obtain the baseline value of the node feature of the previous period; the baseline value of the node feature of the previous period is determined by the change law formed by the aggregated feature matrix in multiple consecutive historical periods; The baseline value of the node feature of the previous cycle is updated using the aggregate feature matrix in the current cycle to obtain the baseline value of the node feature of the current cycle; The aggregate feature matrix in the current period is detected using the baseline value of the node feature in the current period to determine whether there is an abnormality in the satellite link.

4. A satellite link security detection device based on GCN, characterized in that: The device is used to execute the GCN-based satellite link security detection method as described in any one of claims 1 to 3 above, the device comprising: An acquisition unit, used for acquiring satellite link data in a current period based on a set period; An extraction unit, used to construct a graph structure according to the satellite link data in the current cycle, and extract node features and edge features corresponding to the graph structure; A generating unit, configured to generate a node matrix and an adjacency matrix based on the one-to-one correspondence between the node features and the edge features; The detection unit is used to input the node matrix and the adjacency matrix into a pre-trained GCN model, and perform multi-layer convolution operations on the node matrix and the adjacency matrix using multiple convolution layers in the GCN model, so as to aggregate the node features of the node itself with the neighbor node features at each layer to obtain an aggregated feature matrix in a current cycle, and use the aggregated feature matrix in the current cycle and the aggregated feature matrix in the historical cycle to detect whether there is an abnormality in the satellite link.

5. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any of the methods described in claims 1-3.

6. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 3 are implemented.

7. A computer program product, characterized in that The method comprises a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 3.

Images