A lightweight satellite safety system and satellite safety response method

Abstract

The present invention provides a lightweight satellite security system and a satellite security response method, which relate to the field of satellite communication security technology. The system includes: a data acquisition and edge processing layer, which is deployed on the underlying physical node and is used to collect key data related to satellite security on the physical node; a multi-dimensional coupling analysis layer, which is deployed on the centralized device of the middle layer and is used to perform multi-dimensional coupling analysis on the key data sent by multiple physical nodes, and use the coupling results to identify abnormal behaviors in the satellite communication system; a threat response and collaborative defense layer, which is deployed on the upper central management device and is used to perform threat response to the identified abnormal behaviors. This solution can reduce the amount of data transmission, improve the effectiveness of identifying abnormal behaviors of the satellite communication system, and quickly respond to threats to ensure the security of the satellite communication system when the satellite communication environment resources are limited.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of satellite communication security technology, and in particular to a lightweight satellite security system and a satellite security response method. Background Art

[0002] With the increasing security threats in satellite communication environments, traditional network security solutions that deploy intrusion detection systems (IDS) for full-flow detection are unable to adapt to resource-constrained satellite communication environments. Summary of the invention

[0003] The embodiments of the present invention provide a lightweight satellite safety system and a satellite safety response method.

[0004] In a first aspect, an embodiment of the present invention provides a lightweight satellite safety system, including:

[0005] The data collection and edge processing layer is deployed on the underlying physical nodes, and is used to collect key data related to satellite safety on the physical nodes and send the key data to the multi-dimensional coupling analysis layer; the physical nodes include at least satellites;

[0006] The multi-dimensional coupling analysis layer is deployed on the centralized device of the middle layer, and is used to receive key data sent from multiple physical nodes, and perform multi-dimensional coupling analysis on the key data, and use the coupling results to identify abnormal behaviors in the satellite communication system; the centralized device and the physical nodes are connected via satellite links;

[0007] The threat response and collaborative defense layer is deployed on the upper-level central management device to respond to threats to identified abnormal behaviors.

[0008] In a second aspect, an embodiment of the present invention further provides a satellite safety response method based on any of the above-mentioned lightweight satellite safety systems, including:

[0009] Using the data collection and edge processing layer deployed on the underlying physical nodes, key data related to satellite safety on the physical nodes are collected and sent to the multi-dimensional coupling analysis layer;

[0010] Utilize the multi-dimensional coupling analysis layer deployed on the centralized equipment in the middle layer to conduct multi-dimensional coupling analysis on key data, use the coupling results to identify abnormal behaviors in the satellite communication system, and send the identified abnormal behaviors to the threat response and collaborative defense layer;

[0011] Utilize the threat response and collaborative defense layer deployed on the upper-level central management device to respond to threats to identified abnormal behaviors.

[0012] The embodiment of the present invention provides a lightweight satellite security system and a satellite security response method, which collects key data related to satellite security on the physical node by deploying a data collection and edge processing layer on a physical node, especially on a satellite. Since the amount of key data is much smaller than the amount of full traffic, only a small amount of key data is sent to the multi-dimensional coupling analysis layer deployed on the centralized device of the middle layer, and the multi-dimensional coupling analysis layer performs multi-dimensional coupling analysis on the key data to effectively identify abnormal behaviors in the satellite communication system. It can be seen that this scheme provides a lightweight satellite security system, which can reduce the amount of data transmission when the satellite communication environment resources are limited, improve the effectiveness of identifying abnormal behaviors of the satellite communication system, and quickly respond to threats to ensure the security of the satellite communication system. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0014] Figure 1 This is a diagram of a lightweight satellite security system architecture provided by an embodiment of the present invention;

[0015] Figure 2 The present invention provides a flow chart of a satellite safety response method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0017] As mentioned earlier, due to the limited resources in the satellite communication environment, if IDS is deployed on the satellite for full-flow detection, it will not only destroy the physical structure of the satellite, but also consume a large amount of satellite resources, which is very costly.

[0018] Based on this, the inventive concept of an embodiment of the present invention is to provide a lightweight satellite security system, deploy a data collection and edge processing layer on the satellite to collect key data related to satellite security on the satellite. The screening process requires less satellite computing resources and only sends a small amount of key data, occupying only a small amount of satellite link communication resources. The multi-dimensional coupling analysis layer deployed on the centralized device then performs a multi-dimensional coupling analysis on the key data to identify abnormal behavior in the satellite communication system, and finally implements threat response based on the threat response to the collaborative defense layer.

[0019] The specific implementation of the above concept is described below.

[0020] Please refer to Figure 1 , an embodiment of the present invention provides a lightweight satellite safety system, including:

[0021] The data collection and edge processing layer 100 is deployed on the underlying physical nodes, and is used to collect key data related to satellite safety on the physical nodes, and send the key data to the multi-dimensional coupling analysis layer; the physical nodes include at least satellites;

[0022] The multi-dimensional coupling analysis layer 102 is deployed on the centralized device of the middle layer, and is used to receive key data sent from multiple physical nodes, and perform multi-dimensional coupling analysis on the key data, and use the coupling results to identify abnormal behaviors in the satellite communication system; the centralized device and the physical nodes are connected via satellite links;

[0023] The threat response and collaborative defense layer 104 is deployed on the upper-layer central management device and is used to respond to threats to identified abnormal behaviors.

[0024] In the embodiment of the present invention, by deploying a data collection and edge processing layer on a physical node, especially on a satellite, to collect key data related to satellite security on the physical node, since the amount of key data is much smaller than the amount of full traffic, only a small amount of key data is sent to the multi-dimensional coupling analysis layer deployed on the centralized device of the middle layer, and the multi-dimensional coupling analysis layer performs multi-dimensional coupling analysis on the key data to effectively identify abnormal behaviors in the satellite communication system. It can be seen that this scheme provides a lightweight satellite security system that can reduce the amount of data transmission when the satellite communication environment resources are limited, improve the effectiveness of identifying abnormal behaviors of the satellite communication system, and quickly respond to threats to ensure the security of the satellite communication system.

[0025] Described below Figure 1 The implementation of each layer is shown.

[0026] First, focus on the data collection and edge processing layer.

[0027] In the embodiment of the present invention, the data collection and edge processing layer is deployed on a physical node, and the physical node includes at least a satellite. In addition, since the satellite communication system communicates with ground terminal equipment, gateway equipment, etc. in addition to satellites, the physical node may also include: at least one of a ground terminal equipment and a gateway equipment.

[0028] Considering that the satellite operating system is different from the ground terminal equipment operating system, and the physical structure of the satellite is inconvenient to be disclosed, if software is installed on the satellite or full-flow equipment is added, it is necessary to adapt to the physical structure and hardware architecture of the satellite. Therefore, in order to be able to quickly deploy the data acquisition and edge processing layer on the satellite, in one embodiment of the present invention, the data acquisition and edge processing layer is deployed on the physical node using a lightweight agent. Specifically, by developing a lightweight agent program, it is deployed on the physical node in the form of a plug-in. This method does not require changing the physical structure of the satellite, and the collection of key data can be achieved through a plug-in.

[0029] Since the data volume of full-flow detection is very large, the transmission and processing costs are high, and the resource utilization rate is low, therefore, in an embodiment of the present invention, a non-full-flow method is adopted, and the data collection and edge processing layer collects key data related to satellite safety on the physical node, and only needs to transmit the key data to the multi-dimensional coupling analysis layer, thereby reducing the data transmission volume.

[0030] Considering that a DNS (Domain Name System) traffic query is required during satellite communication, it is possible to consider using DNS traffic data to detect abnormal behavior. In one embodiment of the present invention, the key data is DNS traffic data.

[0031] It can be seen that the data collection and edge processing layer, as the basic layer of the entire security system, only performs data collection and lightweight computing, and is responsible for collecting key security-related data from the source and providing data input for in-depth analysis at the upper layer.

[0032] It should be noted that the data collection and edge processing layer can also use local threat intelligence for real-time comparison to quickly discover known threats.

[0033] Then, the layers are analyzed for multi-dimensional coupling.

[0034] In an embodiment of the present invention, the multi-dimensional coupling analysis layer is deployed on a centralized device of the middle layer, and the centralized device is connected to multiple physical nodes via a satellite link. In one implementation, the centralized device is a central server or a data center. Optionally, the centralized device may also be a gateway device.

[0035] As the core layer of data analysis, the multi-dimensional coupling analysis layer is responsible for in-depth mining of the diversity of key data, discovering potential security threats and abnormal behaviors through multi-dimensional coupling analysis, and providing data support for threat response at the upper layer.

[0036] Specifically, the multi-dimensional coupling analysis layer is used to parse DNS traffic data into feature data of multiple dimensions, and use the feature data of multiple dimensions to determine whether there is abnormal behavior in the satellite communication system; the dimensions include: at least one of: time dimension, location dimension, traffic dimension, domain name dimension, response dimension, behavior dimension, security dimension and network layer dimension.

[0037] Among them, the time dimension may include query timestamp, query frequency, query interval, peak and off-peak query time, etc.; the location dimension may include the geographical location and area code of the satellite IP; the traffic dimension may include the traffic request size and traffic response size, etc.; the domain name dimension may include the query domain name, domain name length, domain name character pattern, etc.; the response dimension may include the domain name survival time, etc.; the behavior dimension may include query mode, cache status, etc.; the security dimension may include DNS security extension status, etc.; the network layer dimension may include source and destination ports, TCP flags, etc.

[0038] After the DNS traffic data is parsed into feature data of multiple dimensions, when using the feature data of multiple dimensions to determine whether there is abnormal behavior in the satellite communication system, the abnormality identification can be performed separately from a single dimension, or the abnormality identification can be performed comprehensively from multiple dimensions. The single-dimensional and multi-dimensional abnormality identification methods are described below.

[0039] First, single-dimensional identification method

[0040] In the single-dimensional identification method, specifically, for each dimension, the following can be performed: dynamically adjusting the baseline value of the dimension using the characteristic data of the dimension, and determining whether the characteristic data of the dimension is abnormal using the adjusted baseline value of the dimension; if abnormal, determining that abnormal behavior exists.

[0041] Each physical node has a corresponding baseline value in different dimensions. The baseline range corresponding to the baseline value is the normal range of the feature data of the corresponding dimension. If it exceeds the baseline range, it indicates an abnormality. Therefore, the baseline value can be used to detect anomalies in the feature data of the corresponding dimension.

[0042] In an embodiment of the present invention, considering that the satellite network is highly dynamic, the network status, traffic pattern, query frequency, survival time, etc. in the satellite link may change frequently. Such frequent changes may be caused by satellite orbit adjustment, location change of ground terminal equipment, switching of different services, etc. In this way, in order to cope with the frequently changing satellite communication environment, the baseline value changes dynamically. Specifically, the baseline value of the dimension in the current collection cycle can be determined based on the feature data of the dimension in the current collection cycle and the baseline value in the previous collection cycle, so that the latest collected feature data has a greater impact on the adjustment result of the baseline value, and the impact of historical data gradually decreases, thereby improving the effectiveness of abnormal behavior detection.

[0043] In one implementation, the following formula may be used to determine the adjusted baseline value of the dimension:

[0044]

[0045] Among them, EWMA t is the baseline value of the dimension in the current collection cycle. is the baseline value of the dimension in the previous collection cycle, α is the smoothing coefficient, and the smoothing coefficient is a positive number less than 1. t It is the feature data of this dimension in the current collection cycle.

[0046] The baseline value is smoothed using a smoothing coefficient so that the baseline value obtained after smoothing can give the latest data a greater weight to smooth the time series data, reduce the impact of short-term fluctuations, and timely reflect the changing trend of the data, so that the adjusted baseline value is more in line with the state of the satellite communication environment in the current collection period, making the detection result more accurate.

[0047] In the embodiment of the present invention, if it is determined that abnormal behavior exists in any one dimension, it is determined that abnormal behavior exists in the satellite communication system.

[0048] Second, multi-dimensional identification method

[0049] In the multi-dimensional identification method, since there is a certain correlation between feature data of different dimensions, in the embodiment of the present invention, the feature data can be combined by using a preset feature combination rule to generate a new composite feature that is helpful for attack detection. Specifically, feature data of multiple dimensions can be combined according to the preset feature combination rule, and the new data obtained by the feature combination can be combined with the machine learning model to identify whether there is abnormal behavior in the satellite communication system.

[0050] In one implementation, the preset feature combination rules may include arithmetic rules and / or logical rules. The arithmetic rules are defined based on the correlation between multiple dimensions and are used to form new dimensional features that can reflect system behavior through calculations; the logical rules are defined based on security policies and are used to form new dimensional features that can reflect high-risk states.

[0051] For example, before the feature combination, the multiple dimensions are: DNS query times X1, abnormal DNS query times X2, malicious domain name matching times X3, threat intelligence activity X4. Using arithmetic rules to perform operations can form the following new dimensional features: query anomaly ratio X2 / X1, threat weighted ratio X3×X4. Using logical rules, the following new dimensional features can be formed: risk rating, based on the relationship between the query anomaly ratio and the first threshold and the relationship between the threat weighted ratio and the second threshold, determine the corresponding risk rating, such as low, medium, and high risk rating.

[0052] It can be seen that by using the preset feature combination rules, new dimensional features can be formed for feature data of multiple dimensions. Since the new dimensional features can better reflect system behavior and high-risk status, in one implementation method, the new dimensional features can be directly used as the input of the machine learning model to use the machine learning model to identify whether there is abnormal behavior in the satellite communication system. In addition, other implementation methods can also be used, such as adding these new dimensional features that can reflect system behavior and high-risk status to the initial feature data of multiple dimensions, so as to input the feature data with the added new dimensional features into the machine learning model.

[0053] The above two identification methods can effectively identify whether there is abnormal behavior in the satellite communication system.

[0054] Finally, there is the threat response and collaborative defense layer.

[0055] In the embodiment of the present invention, the threat response and collaborative defense layer is deployed on the upper central management device as the execution layer of security protection, which is used to quickly respond to the identified abnormal behavior. The central management device can be a central management system, a gateway, a ground terminal device, etc.

[0056] Threat response measures corresponding to abnormal behaviors are predefined in the central management device, such as blocking malicious connections, updating firewall rules, etc. When abnormal behaviors are identified, threat response measures corresponding to the abnormal behaviors can be used to respond to the threats.

[0057] Furthermore, the threat response and collaborative defense layer is also used to realize linkage defense based on the collaborative mechanism between physical nodes. Specifically, a communication protocol between physical nodes can be established to realize the sharing of threat intelligence and threat response strategies.

[0058] In one embodiment of the present invention, the system may also include a continuous feedback and optimization layer, which is deployed on the upper-level central management device as an optimization layer of the system, and is used to obtain feedback data on threat response effects, and use the feedback data to optimize threat response measures, thereby continuously improving the system's security protection capabilities and ensuring that the system can adapt to the ever-changing threat environment.

[0059] In one embodiment of the present invention, the system may also include a global security monitoring platform, which is deployed on the top-level monitoring device as the top level of the system, and is used to display the network security status of the satellite communication system in real time and provide decision support for the network security status, thereby enabling global security monitoring and security management, and providing guidance and support for the entire satellite security system.

[0060] The embodiment of the present invention, through the bottom-up and layer-by-layer security protection concept, obtains key data related to satellite security at the bottom source, ensures data quality and timeliness of acquisition, uses the middle layer to conduct in-depth analysis of key data to identify abnormal behavior, uses the upper layer to quickly execute threat response to abnormal behavior, and uses the top layer to fully grasp the network security status to provide support for decision-making. This layered architecture not only clarifies the responsibilities and relationships of each layer, but also ensures the scalability and flexibility of the system. It can reduce the amount of data transmission under the condition of limited satellite communication environment resources, improve the effectiveness of identifying abnormal behavior of the satellite communication system, quickly implement threat response, and ensure the security of the satellite communication system.

[0061] Based on the above lightweight satellite safety system, please refer to Figure 2 The present invention also provides a satellite safety response method, which is implemented using the above-mentioned satellite safety system. The method may include:

[0062] Step 200, using the data collection and edge processing layer deployed on the underlying physical nodes, collect key data related to satellite safety on the physical nodes, and send the key data to the multi-dimensional coupling analysis layer;

[0063] Step 202, using the multi-dimensional coupling analysis layer deployed on the centralized device of the middle layer, multi-dimensional coupling analysis is performed on the key data, and the coupling results are used to identify abnormal behaviors in the satellite communication system, and the identified abnormal behaviors are sent to the threat response and collaborative defense layer;

[0064] Step 204, utilizing the threat response and collaborative defense layer deployed on the upper-level central management device to perform threat response to the identified abnormal behavior.

[0065] In one embodiment of the present invention, the key data is domain name system DNS traffic data;

[0066] The multi-dimensional coupling analysis of key data includes: parsing DNS traffic data into feature data of multiple dimensions, and using the feature data of multiple dimensions to determine whether there is abnormal behavior in the satellite communication system; the dimensions include: at least one of: time dimension, location dimension, traffic dimension, domain name dimension, response dimension, behavior dimension, security dimension and network layer dimension.

[0067] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0068] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A lightweight satellite security system, characterized in that: include: The data collection and edge processing layer is deployed on the underlying physical nodes, and is used to collect key data related to satellite safety on the physical nodes and send the key data to the multi-dimensional coupling analysis layer; the physical nodes include at least satellites; The multi-dimensional coupling analysis layer is deployed on the centralized device of the middle layer, and is used to receive key data sent from multiple physical nodes, and perform multi-dimensional coupling analysis on the key data, and use the coupling results to identify abnormal behaviors in the satellite communication system; The centralized device and the physical node are connected via a satellite link; The threat response and collaborative defense layer is deployed on the upper-layer central management device to respond to threats to identified abnormal behaviors; The data collection and edge processing layer is deployed on the physical node in a lightweight proxy manner; The key data is domain name system DNS traffic data; The multi-dimensional coupling analysis layer is specifically used to parse the DNS traffic data into feature data of multiple dimensions, and use the feature data of multiple dimensions to determine whether there is abnormal behavior in the satellite communication system; The dimension includes: at least one of a time dimension, a location dimension, a traffic dimension, a domain name dimension, a response dimension, a behavior dimension, a security dimension, and a network layer dimension; The method of using the characteristic data of multiple dimensions to determine whether there is abnormal behavior in the satellite communication system includes: for each dimension, dynamically adjusting the baseline value of the dimension using the characteristic data of the dimension, and determining whether the characteristic data of the dimension is abnormal using the adjusted baseline value of the dimension, and if abnormal, determining that there is abnormal behavior; Use the following formula to determine the adjusted baseline value for this dimension: Among them, EWMA t is the baseline value of the dimension in the current collection period, EWMA t−1 is the baseline value of the dimension in the previous collection cycle. is the smoothing coefficient, which is a positive number less than 1. t It is the characteristic data of this dimension in the current collection cycle; or, The method of using feature data of multiple dimensions to determine whether there is abnormal behavior in the satellite communication system includes: combining the feature data of multiple dimensions according to preset feature combination rules, and using new data obtained by the feature combination in combination with a machine learning model to identify whether there is abnormal behavior in the satellite communication system; the preset feature combination rules include arithmetic rules and / or logical rules, the arithmetic rules are defined based on the correlation between multiple dimensions, and are used to form new dimensional features that can reflect system behavior through calculation; the logical rules are defined based on security policies, and are used to form new dimensional features that can reflect high-risk states.

2. The lightweight satellite security system according to claim 1, characterized in that: The system also includes a continuous feedback and optimization layer, which is deployed on the upper-level central management device and is used to obtain feedback data on threat response effects and optimize threat response measures using the feedback data.

3. The lightweight satellite safety system according to claim 1, characterized in that: The threat response and collaborative defense layer is also used to achieve joint defense based on the collaborative mechanism between physical nodes.

4. The lightweight satellite safety system according to claim 1, characterized in that: The system further comprises: The global security monitoring platform is deployed on the top-level monitoring equipment to display the network security status of the satellite communication system in real time and provide decision support for the network security status.

5. A satellite safety response method based on the lightweight satellite safety system according to any one of claims 1 to 4, characterized in that: include: Using the data collection and edge processing layer deployed on the underlying physical nodes, key data related to satellite safety on the physical nodes are collected and sent to the multi-dimensional coupling analysis layer; Utilize the multi-dimensional coupling analysis layer deployed on the centralized equipment in the middle layer to conduct multi-dimensional coupling analysis on key data, use the coupling results to identify abnormal behaviors in the satellite communication system, and send the identified abnormal behaviors to the threat response and collaborative defense layer; Utilize the threat response and collaborative defense layer deployed on the upper-level central management device to respond to threats to identified abnormal behaviors.

6. The method according to claim 5, characterized in that The key data is domain name system DNS traffic data; The multi-dimensional coupling analysis of key data includes: parsing DNS traffic data into feature data of multiple dimensions, and using the feature data of multiple dimensions to determine whether there is abnormal behavior in the satellite communication system; the dimensions include: at least one of: time dimension, location dimension, traffic dimension, domain name dimension, response dimension, behavior dimension, security dimension and network layer dimension.

Images