Satellite abnormal command detection method and device, satellite, and storage medium

Abstract

The present invention discloses a satellite abnormal instruction detection method and device, a satellite, and a storage medium. The method comprises: searching a state dictionary to determine whether there is a mapping relationship between a current state, an instruction to be executed, and a pre-state, wherein the state dictionary includes a plurality of pre-execution states, a mapping relationship between an instruction and a post-execution state, and the pre-state is the state after the satellite executes the instruction to be executed; if there is no mapping relationship in the state dictionary, an abnormal work log is sent to a server to make the server judge the safety of the instruction to be executed according to the abnormal work log, and / or the abnormal work log is input into an instruction prediction model to judge the safety of the instruction to be executed; if there is a mapping relationship in the state dictionary, or the instruction to be executed is a safe instruction, the instruction to be executed is executed. The present invention can improve the adaptability, flexibility, and real-time performance of instruction detection, and reduce the amount of calculation and cost.

Description

Technical Field

[0001] The present invention belongs to the field of satellite communication technology, and in particular relates to a satellite abnormal instruction detection method and device, a satellite, and a storage medium. Background Art

[0002] As satellite technology becomes more complex, satellites may face multiple state transitions when executing commands. When a satellite receives a command, it is necessary to effectively judge whether the command will cause the satellite to enter an unpredicted state, to avoid the command causing the satellite to enter an undefined state, and to prevent potential system failures and safety hazards such as equipment failures and functional failures. There are two popular satellite command detection methods: finite state machines and intelligent monitoring architectures.

[0003] Finite State Machine (FSM) is a mathematical model used to describe the transition relationship between different states of a system. It consists of a set of finite states, transition rules, and input events. In satellite abnormal command detection, FSM is used to define all states that the satellite may enter at different stages of operation, as well as the set of instructions allowed to be executed in these states. This ensures that during operation, every instruction received by the satellite can be constrained within a known safe state range, thereby preventing instructions from putting the satellite in an unpredictable or unsafe state. However, this method usually relies on pre-defined states and state transition rules and cannot adapt to dynamically changing environments.

[0004] The intelligent monitoring architecture achieves efficient and accurate detection and defense of satellite commands by combining key technologies such as satellite status prediction, command execution risk assessment, rejection of abnormal command execution, and ground feedback updates. However, since it requires a large number of preset parameters and a complex model architecture, this method has a large computational overhead and is costly.

[0005] Therefore, current satellite command detection methods either have poor adaptability and cannot process unknown commands, or have high computational overhead and high cost. Summary of the invention

[0006] The embodiments of the present invention provide a satellite abnormal command detection method and device, a satellite, and a storage medium, which can solve the problems that the current satellite command detection methods either have poor adaptability and cannot process unknown commands; or have large calculation overhead and high cost.

[0007] In a first aspect, an embodiment of the present invention provides a method for detecting abnormal satellite instructions, the method comprising:

[0008] Searching the state dictionary to determine whether there is a mapping relationship between the current state, the instruction to be executed, and the pre-state, wherein the state dictionary includes a plurality of known mapping relationships between pre-execution states, instructions, and post-execution states, and the pre-state is the state of the satellite after executing the instruction to be executed;

[0009] If there is no mapping relationship in the state dictionary, an abnormal work log is sent to the server to allow the server to determine the safety of the instruction to be executed based on the abnormal work log, and / or the abnormal work log is input into the instruction prediction model to determine the safety of the instruction to be executed;

[0010] If there is a mapping relationship in the state dictionary, or the instruction to be executed is a safe instruction, the instruction to be executed is executed.

[0011] In a second aspect, an embodiment of the present invention provides a satellite abnormal instruction detection device, the device comprising:

[0012] The instruction initial detection unit is used to search the state dictionary to determine whether there is a mapping relationship between the current state, the instruction to be executed and the pre-state, wherein the state dictionary includes a plurality of known mapping relationships between the pre-execution state, the instruction and the post-execution state, and the pre-state is the state of the satellite after executing the instruction to be executed;

[0013] The transceiver unit and / or the instruction depth detection unit, the transceiver unit is used to send an abnormal work log to the server if there is no mapping relationship in the state dictionary so that the server can judge the safety of the instruction to be executed according to the abnormal work log; the instruction depth detection unit is used to input the abnormal work log into the instruction prediction model to judge the safety of the instruction to be executed if there is no mapping relationship in the state dictionary;

[0014] The execution unit is used to execute the instruction to be executed if there is a mapping relationship in the state dictionary or the instruction to be executed is a safe instruction.

[0015] In a third aspect, an embodiment of the present invention provides a satellite, comprising a processor and a memory, wherein the memory is used to store computer programs; the processor can be used to execute the computer program (instructions) stored in the memory to implement the method of the first aspect above.

[0016] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed, the method of the first aspect described above can be implemented.

[0017] Compared with the prior art, the embodiments of the present invention have the following beneficial effects: according to the method provided by the present invention, the safety of the instructions can be automatically preliminarily judged by detecting instructions through a complete status dictionary; when an unknown instruction not in the status dictionary appears, the abnormal work log is transmitted to the server and / or the instruction prediction model for judgment instead of directly refusing to execute the instruction, thereby realizing real-time and dynamic detection of the instruction; and the server and the instruction prediction model are only required to perform detection when an unknown instruction appears. Compared with each instruction being detected by the server, the probability of data transmission errors can be reduced, and compared with each instruction being detected by the model, the amount of calculation can be reduced and the cost can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of a satellite abnormal command detection method provided by an embodiment of the present invention;

[0019] Figure 2 A schematic diagram of a state transition diagram provided by an embodiment of the present invention;

[0020] Figure 3 A flowchart of a possible implementation of a satellite abnormal instruction detection method provided by an embodiment of the present invention;

[0021] Figure 4 A flowchart of a possible implementation of another satellite abnormal instruction detection method provided by an embodiment of the present invention;

[0022] Figure 5 A flowchart of a possible implementation of another satellite abnormal instruction detection method provided by an embodiment of the present invention;

[0023] Figure 6 A flowchart of a possible implementation of another satellite abnormal instruction detection method provided by an embodiment of the present invention;

[0024] Figure 7 A schematic diagram of the structure of a satellite abnormal command detection device provided by an embodiment of the present invention;

[0025] Figure 8 A schematic diagram of the structure of a satellite provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present invention. However, it should be clear to those skilled in the art that the present invention may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present invention.

[0027] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0028] It should also be understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0029] As used in the present specification and the appended claims, the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" may be interpreted as meaning "upon determination" or "in response to determining" or "upon detection of [described condition or event]" or "in response to detecting [described condition or event]", depending on the context.

[0030] In addition, in the description of the present specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0031] References to "one embodiment" or "some embodiments" etc. described in the present specification mean that one or more embodiments of the present invention include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0032] Among the currently popular satellite command detection methods, satellite command detection mainly relies on finite state machine models and static monitoring methods. Although these methods can ensure the safe operation of satellites to a certain extent, they still have some obvious shortcomings. Since traditional finite state machine-based methods mainly rely on pre-defined static state definitions and instruction sets, and often rely on post-analysis or regular inspections when identifying abnormal states; this results in this method being unable to handle sudden abnormal situations in real time and having poor flexibility and adaptability, and unable to adapt to the increasing satellite mission requirements and complex operating environments. In addition, the pre-defined instruction sets often cannot cover the possible states and operating conditions of all satellite subsystems, resulting in this traditional method being unable to make a comprehensive assessment of the satellite's status.

[0033] Although the other intelligent monitoring architecture has greatly improved its performance in terms of intelligence, adaptability, and comprehensiveness, it requires intelligent identification of each instruction, which results in a large amount of computation and high cost.

[0034] In view of this, the present invention provides a method for detecting abnormal satellite instructions, which first detects instructions through an expandable state dictionary. When the state dictionary cannot detect, the instruction prediction model or the server is used for detection, and the instruction is executed only after it is detected to be safe. In this way, the potential risks of the instruction can be evaluated in real time before the instruction is executed, ensuring that the satellite is always in a safe state. Since the instruction prediction model and the server are used as supplements to the state dictionary, the state dictionary is checked for omissions and deficiencies; therefore, the satellite can identify unknown instructions and improve its own flexibility, adaptability and comprehensiveness of instruction detection. At the same time, the state dictionary is used for detection first, and the instruction prediction model and the server are started only when an unknown instruction is encountered, which can reduce the calculation amount and cost of the model.

[0035] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0036] Figure 1 The flowchart of the implementation of a satellite abnormal command detection method provided by an embodiment of the present invention is shown. As an example but not a limitation, the method can be applied to a command detection system including a satellite and a server. The method can include steps S101-S106, and each step is described below.

[0037] S101, the satellite searches the state dictionary to determine whether there is a mapping relationship between the current state, the instruction to be executed and the pre-state.

[0038] In a possible implementation, the satellite may include multiple sensors, and the satellite may integrate multiple real-time status data collected by the sensors, and perform noise elimination on the data. The status data after noise elimination is then compared with the preset thresholds of status data corresponding to different states stored in the status dictionary to obtain and update the current state in real time.

[0039] In one example, the preset threshold may be set in advance by a user.

[0040] For example, the preset thresholds of the temperature, pressure and other status data corresponding to the state "working" can be set to 50°C-100°C and 100 kilopascals (kpa)-500 kilopascals (kpa) respectively according to empirical values.

[0041] Exemplarily, the pre-state may be the state of the satellite after executing the instruction to be executed. Before searching, the satellite may pre-judge the state after executing the instruction to be executed.

[0042] In a possible implementation, the state dictionary may store a plurality of known mapping relationships between pre-execution state-instruction-post-execution state.

[0043] For example, see Figure 2 , the state dictionary can store mapping relationships between multiple states such as sleep, working, starting, and standby. A set of mapping relationships can be: the state before execution is "sleep", the command is "start", and the state after execution is "working". This means that when the satellite is in "sleep", if it receives and executes the "start" command, the state will be changed to "working".

[0044] For example, the state dictionary may be established by experts such as system engineers for the satellite and its application loads before step S101 is executed.

[0045] Specifically, the detailed status information of each subsystem and load on the satellite can be listed, such as the system's operating temperature and the number of parallel tasks in normal working state, standby state, and fault state; and the changes in status information when executing different instructions in different states can be considered to create a state dictionary. For example, for each pre-execution state, all possible instructions that may be received are listed, and the state changes caused by the execution of each instruction are clarified, thereby forming multiple sets of mapping relationships from pre-execution state, instructions to post-execution state. The state dictionary can ensure that the satellite has a comprehensive understanding of the impact of instructions.

[0046] Alternatively, see Figure 2 ,The mapping relationship in the state dictionary can be stored in a visual form of state transition diagram so that users can understand and maintain it.

[0047] In one example, if there is no mapping relationship between the current state, the instruction to be executed, and the pre-state in the state dictionary, steps S102-S103 and / or step S104 may be performed.

[0048] For example, during the period when the command prediction model and the server determine the safety of the command to be executed, the satellite refuses to execute the command to be executed to protect the safety of the satellite. This behavior can be called the satellite's rejection mechanism. The rejection mechanism can prevent the occurrence of abnormal conditions. At the same time, feeding back abnormal information to the server or processing it through the command prediction model can improve the efficiency of command detection.

[0049] In another example, if the state dictionary contains a mapping relationship between the current state, the instruction to be executed, and the pre-state, then the instruction to be executed is a safe instruction, and step S105 can be performed.

[0050] S102, the satellite sends an abnormal work log to the server.

[0051] Accordingly, the server receives the abnormal work log.

[0052] Exemplarily, the abnormal work log may include instructions to be executed, and status data related to the current status and the pre-status.

[0053] Optionally, the satellite and the server may communicate with each other via an asymmetric encryption algorithm or a symmetric encryption algorithm.

[0054] S103, the server determines the safety of the instruction to be executed according to the abnormal work log.

[0055] In a possible implementation, the server can display the abnormal work log to ground staff / experts and other users, and then the user determines whether the instruction to be executed is safe and enters his / her judgment result in the server. The server sends the user's judgment result to the satellite, and the satellite receives the judgment result of the server accordingly.

[0056] Exemplarily, the service end may be a ground service end, such as equipment used by staff living on the ground; or it may be a spacecraft, such as equipment used by astronauts.

[0057] Optionally, the server may also analyze the pre-state corresponding to the instruction to be executed based on the state change model and historical data, and evaluate the security of the instruction to be executed by evaluating the risk and impact of the pre-state.

[0058] In an example, if the judgment result received from the server is that the instruction to be executed is a safe instruction, step S105 may be performed.

[0059] For example, the satellite can update the command execution strategy based on the feedback from the server to adapt to the new operating environment and status requirements.

[0060] In another example, if the judgment result received from the server is that the instruction to be executed is a dangerous instruction, step S106 may be performed.

[0061] S104, the satellite inputs the abnormal work log into the trained instruction prediction model to determine the safety of the instructions to be executed.

[0062] Exemplarily, the instruction prediction model can be a long short-term memory network prediction model. The instruction prediction model can combine the historical abnormal work log and the status data of the current state of the satellite to accurately evaluate various complex states and effectively avoid potential risks. At the same time, the instruction prediction model can effectively utilize the data from various data sources in the satellite and eliminate the data island effect by combining historical data to detect the instructions to be executed.

[0063] For example, the command prediction model may be stored in the satellite.

[0064] In an example, if the judgment result output by the instruction prediction model is that the instruction to be executed is a safe instruction, step S105 can be performed.

[0065] In another example, if the judgment result output by the instruction prediction model is that the instruction to be executed is a dangerous instruction, step S106 can be performed.

[0066] S105, the satellite executes the instruction to be executed.

[0067] In one example, before executing the pending instruction, the satellite may first check whether its real-time status data exceeds the preset threshold of each type of data corresponding to the current status. If any type of data exceeds the preset threshold, step S106 may be performed to stop executing the instruction, record and send an error report to the server. If all data do not exceed the preset threshold, the pending instruction may continue to be executed.

[0068] For example, after determining that the instruction to be executed is a safe instruction, the satellite can also update the state dictionary according to the abnormal work log corresponding to the instruction to be executed. This enables the satellite to autonomously update the operation rules according to environmental changes and mission requirements, thereby improving the satellite's adaptability and operational efficiency.

[0069] In one example, similarly, when executing the pending instruction, the satellite can check whether its real-time state data exceeds the preset threshold of each type of data corresponding to the pre-state. If any type of data exceeds the preset threshold, step S106 can be performed to stop executing the instruction, record and send an error report to the server. If all data do not exceed the preset threshold, the pending instruction can continue to be executed.

[0070] This can further protect the security of the satellite and resist the influence of malicious instructions.

[0071] S106: The satellite refuses to execute the pending instruction.

[0072] Exemplarily, the satellite may send an error report to the server while refusing to execute the pending instruction.

[0073] Optionally, the satellite may also store dangerous commands to be executed in a dangerous instruction library, and directly refuse to execute the instruction when detecting that the instruction to be executed is an instruction in the dangerous instruction library.

[0074] According to the method provided by the present invention, the safety of the instruction can be automatically judged preliminarily through the complete state dictionary detection instruction; when an unknown instruction not in the state dictionary appears, the abnormal work log is transmitted to the server and / or the instruction prediction model for judgment instead of directly refusing to execute the instruction, so that the real-time and dynamic detection of the instruction can be realized; and only when an unknown instruction appears, the server and the instruction prediction model are required to detect, which can reduce the probability of data transmission errors compared to each instruction being detected by the server, and can reduce the amount of calculation and cost compared to each instruction being detected by the model. Furthermore, the satellite's state data is self-checked in real time before and during the execution of the instruction, which can improve the safety performance of the satellite.

[0075] In some embodiments, the instruction prediction model provided by the present invention can be a learning architecture constructed by using a deep reinforcement learning (DRL) algorithm through an integrated machine learning module in the satellite and combined with a deep Q network to train using the satellite's historical abnormal work log. This training method enables the instruction prediction model to learn the satellite's optimal instruction execution strategy under different states and optimize the decision-making process; and because the training samples used by the instruction prediction model on each satellite are its own historical data, this makes the instruction prediction model more targeted and more accurate.

[0076] For example, deep reinforcement learning is a type of algorithm that combines deep learning and reinforcement learning, which can handle complex, high-dimensional decision-making problems. In reinforcement learning, the model can continuously explore in an uncertain environment through interaction with the environment, and learn how to choose the best behavior strategy based on reward signals. The goal of reinforcement learning is to find a strategy that maximizes the cumulative reward so that the model can make the best decision in different states.

[0077] For example, the deep Q network is a commonly used deep reinforcement learning algorithm. The core idea is to use a deep neural network to approximate the Q-value function. The Q-value function is used in reinforcement learning to evaluate the cumulative reward that can be obtained after taking a certain action in a certain state. Through the Q-value function, the model can choose the behavior that is most beneficial to its long-term benefits. Approximating the Q-value function through a deep neural network can effectively process continuous state space and high-dimensional data. In this process, the model continuously optimizes its strategy through continuous interaction with the environment, and improves training stability through the experience replay mechanism.

[0078] Figure 3 The flowchart of the implementation of a satellite abnormal command detection method provided by an embodiment of the present invention is shown. As an example but not a limitation, the method can be a specific possible implementation of the above-mentioned satellite abnormal command detection and defense method, which is applied to a satellite. The detection method may include steps S301-S307, and each step is described below.

[0079] S301, searching the state dictionary to determine whether there is a mapping relationship between the current state, the instruction to be executed, and the pre-state.

[0080] In one example, if there is no mapping relationship between the current state, the instruction to be executed, and the pre-state in the state dictionary, the instruction to be executed is considered to be an abnormal instruction, and step S302 can be performed.

[0081] In another example, if the state dictionary contains a mapping relationship between the current state, the instruction to be executed, and the pre-state, step S307 may be performed.

[0082] S302: Determine whether the accumulated number of abnormal work logs is less than a minimum number threshold of training samples.

[0083] In one example, the instruction prediction model needs to accumulate a certain number of samples before training begins, and after multiple rounds of training, the prediction accuracy of the trained instruction prediction model can meet the requirements (i.e., greater than or equal to the acceptance threshold). Therefore, when the number of abnormal work logs (i.e., the number of samples) is less than the minimum number threshold of training samples, the server can first detect the instructions to be executed and proceed to step S305.

[0084] In another example, if the accumulated number of samples is sufficient, that is, the accumulated number of daily work logs is greater than or equal to the minimum number threshold of training samples, step S303 may be performed.

[0085] For example, see Figure 4 After the accumulated number of daily work logs is not less than the minimum number threshold of training samples, step S303 can be directly performed without further judgment.

[0086] S303, determining whether the prediction accuracy of the instruction prediction model is less than an acceptance threshold.

[0087] Exemplarily, an instruction prediction model whose prediction accuracy is greater than or equal to an acceptance threshold may be regarded as a trained instruction prediction model.

[0088] In one example, if the accuracy of the instruction prediction model is less than the acceptance threshold, it means that the model is not well trained, and then step S305 and step S304 can be performed in sequence.

[0089] For example, the server can first determine the security of the instruction to be executed, then add the judgment result of the server and the abnormal work log of the instruction to be executed to the sample set, and input the samples in the sample set into the instruction prediction model for incremental learning.

[0090] In another example, if the prediction accuracy of the instruction prediction model is greater than or equal to the acceptance threshold, step S304 may be performed.

[0091] Exemplarily, after the prediction accuracy of the instruction prediction model is greater than the receiving threshold, in order to ensure the accuracy of instruction detection, step S303 may be performed each time an abnormal instruction is detected, that is, the following is performed: Figure 4 You can also ignore the above steps S302, S303 and directly execute step S304, that is, execute as Figure 5 The process shown in the figure can also be executed regularly or irregularly as shown in the figure. Figure 4 The process shown checks the prediction accuracy of the instruction prediction model. When the prediction accuracy does not meet the requirements, the model is trained again; or when the newly added abnormal work log exceeds the training interval threshold, the model is trained again according to the newly added abnormal work log.

[0092] By regularly allowing the command prediction model to conduct dynamic learning and regularly checking the prediction accuracy of the command prediction model, the command prediction model can be continuously optimized, the detection performance of the command prediction model can be improved, and it can be ensured that the command prediction model can always reflect the latest operating conditions and safety standards, thereby improving the accuracy and safety of satellite execution of commands.

[0093] S304, inputting the abnormal work log into the trained instruction prediction model to determine the safety of the instructions to be executed.

[0094] S305, sending the abnormal work log to the server so that the server can determine the safety of the to-be-executed instruction according to the abnormal work log.

[0095] S306, refusing to execute the pending instruction.

[0096] S307, executing the pending instruction.

[0097] Exemplarily, the contents of steps S304-S307 may be the same as the above-mentioned steps S102-S106. For details, please refer to the description of steps S102-S106, which will not be repeated here.

[0098] According to the method provided by the present invention, the safety of the instructions can be automatically judged preliminarily by detecting the instructions through a complete status dictionary; when an unknown instruction not in the status dictionary appears, the abnormal work log is transmitted to the server and / or the instruction prediction model for judgment instead of directly refusing to execute the instruction, thereby realizing real-time and dynamic detection of the instructions; and the server and the instruction prediction model are only required to perform detection when an unknown instruction appears. Compared with each instruction being detected by the server, the probability of data transmission errors can be reduced, and compared with each instruction being detected by the model, the amount of calculation can be reduced and the cost can be reduced.

[0099] Figure 6 The flowchart of the implementation of a satellite abnormal command detection method provided by an embodiment of the present invention is shown. As an example but not a limitation, the method can be another specific possible implementation of the above-mentioned satellite abnormal command detection method, which is applied to a satellite. The detection method may include steps S601-S606, and each step is described below.

[0100] S601, searching the state dictionary to determine whether there is a mapping relationship between the current state, the instruction to be executed, and the pre-state.

[0101] For example, after the instruction prediction model is trained, when receiving an instruction to be executed, the instruction can be executed according to the situation described in the above step S303. Figure 4 or Figure 5 You can also follow Figure 6 The method shown executes steps S601 and S602 simultaneously, and synchronously detects the instructions to be executed through the state dictionary and the instruction prediction model, thereby ensuring the safety performance of the satellite.

[0102] S602, input the instruction to be executed, the current state and the pre-state into the instruction prediction model to determine the safety of the instruction to be executed.

[0103] S603, determining whether the output results of the instruction prediction model and the state dictionary are consistent.

[0104] In one example, if the output results of the two are inconsistent, step S604 can be performed to mark the instruction to be executed as "suspicious" and automatically request manual verification.

[0105] In another example, if the output results of the two are consistent and both determine that the instruction to be executed is a safe instruction, step S605 can be performed.

[0106] In another example, if the output results of the two are consistent and both determine that the instruction to be executed is a dangerous instruction, step S606 can be performed.

[0107] S604, sending the abnormal work log to the server so that the server can determine the safety of the instruction to be executed according to the abnormal work log.

[0108] S605, executing the pending instruction.

[0109] S606: Refuse to execute the pending instruction.

[0110] Exemplarily, the contents of steps S604-S606 may be the same as the above-mentioned steps S102-S103, S105, and S106. For details, please refer to the description of steps S102-S103, S105, and S106, which will not be repeated here.

[0111] According to the method provided by the present invention, the safety of the instructions can be automatically judged preliminarily by detecting the instructions through a complete status dictionary; when an unknown instruction not in the status dictionary appears, the abnormal work log is transmitted to the server and / or the instruction prediction model for judgment instead of directly refusing to execute the instruction, thereby realizing real-time and dynamic detection of the instructions; and the server and the instruction prediction model are only required to perform detection when an unknown instruction appears. Compared with each instruction being detected by the server, the probability of data transmission errors can be reduced, and compared with each instruction being detected by the model, the amount of calculation can be reduced and the cost can be reduced.

[0112] Figure 7 The structure diagram of a satellite abnormal command detection device provided by an embodiment of the present invention is shown. As an example but not a limitation, the device 700 may include a command initial detection unit 710, a transceiver unit 720 and / or a command depth detection unit 730, and an execution unit 740.

[0113] Exemplarily, the instruction initial detection unit 710 is used to look up the state dictionary to determine whether there is a mapping relationship between the current state, the instruction to be executed and the pre-state, wherein the state dictionary includes multiple known mapping relationships between pre-execution states, instructions and post-execution states, and the pre-state is the state of the satellite after executing the instruction to be executed; the transceiver unit 720 is used to send an abnormal work log to the server if there is no mapping relationship in the state dictionary, so that the server can judge the safety of the instruction to be executed based on the abnormal work log; the instruction depth detection unit 730 is used to input the abnormal work log into the instruction prediction model to judge the safety of the instruction to be executed if there is no mapping relationship in the state dictionary; the execution unit 740 is used to execute the instruction to be executed if there is a mapping relationship in the state dictionary, or the instruction to be executed is a safe instruction.

[0114] Figure 8FIG. 1 is a schematic diagram of the structure of a satellite provided by an embodiment of the present invention. Figure 8 The satellite 800 shown may include: at least one processor 810 ( Figure 8 Only one processor is shown in the figure), a memory 820, and a computer program 830 stored in the memory 820 and executable on the at least one processor 810, wherein the processor 810 implements the steps of any of the above-mentioned method embodiments when executing the computer program 830.

[0115] The satellite 800 may be a processing device capable of implementing the above method, and the embodiment of the present invention does not impose any limitation on the specific type of the satellite.

[0116] Those skilled in the art will understand that Figure 8 The satellite 800 is merely an example and does not constitute a limitation on the satellite, and may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the satellite 800 may also include an input and output interface.

[0117] The processor 810 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASTC), field programmable gate arrays (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0118] The memory 820 may be an internal storage unit in some embodiments, such as a hard disk or a memory. The memory 820 may also be an external storage device in other embodiments, such as a plug-in hard disk, a smart memory card (SmartMemory Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Further, the memory 820 may also include both an internal storage unit and an external storage device. The memory 820 is used to store an operating system, an application program, a boot loader (Boot Loader), data, and other programs, such as the program code of the computer program, etc. The memory 820 may also be used to temporarily store data that has been output or is to be output.

[0119] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0120] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0121] An embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0122] An embodiment of the present invention provides a computer program product. When the computer program product runs on a satellite, the satellite can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0123] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0124] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0125] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

Claims

1. A satellite abnormal command detection method, characterized in that: Applied to a satellite, the method comprises: Searching a state dictionary to determine whether there is a mapping relationship between a current state, a to-be-executed instruction, and a pre-state, wherein the state dictionary includes a plurality of known mapping relationships between pre-execution states, instructions, and post-execution states, and the pre-state is a state of the satellite after executing the to-be-executed instruction; If the mapping relationship does not exist in the state dictionary, sending an abnormal work log to the server so that the server determines the safety of the instruction to be executed according to the abnormal work log, and inputting the abnormal work log into the instruction prediction model to determine the safety of the instruction to be executed; If the mapping relationship exists in the state dictionary, or the instruction to be executed is a safe instruction, executing the instruction to be executed; The sending of the abnormal work log to the server so that the server determines the safety of the instruction to be executed according to the abnormal work log, and inputting the abnormal work log into the instruction prediction model to determine the safety of the instruction to be executed, includes: If the number of accumulated abnormal work logs is less than the minimum number threshold of training samples, the abnormal work logs are sent to the server, and the abnormal work logs and the judgment results of the server are saved in the sample set, wherein the instruction prediction model starts training after the number of accumulated abnormal work logs is equal to the minimum number threshold of training samples; If the number of the accumulated abnormal work logs is not less than the minimum number threshold of the training samples, and the prediction accuracy of the instruction prediction model is less than the acceptance threshold, the abnormal work logs are sent to the server, and the abnormal work logs and the judgment results of the server are input into the instruction prediction model to continue training; If the number of the accumulated abnormal work logs is not less than the minimum number threshold of the training samples, and the prediction accuracy of the instruction prediction model is not less than the acceptance threshold, the abnormal work logs are input into the instruction prediction model to determine the safety of the instructions to be executed, wherein the prediction accuracy of the trained instruction prediction model is not less than the acceptance threshold.

2. The method according to claim 1, characterized in that After the prediction accuracy of the instruction prediction model is not less than the acceptance threshold, and while the state dictionary is searched to determine whether there is a mapping relationship between the current state, the instruction to be executed, and the pre-state, the method further includes: Inputting the abnormal work log into the trained instruction prediction model to determine the safety of the to-be-executed instruction; Determining whether the state dictionary is consistent with an output result of the trained instruction prediction model; If the state dictionary is inconsistent with the output result of the trained instruction prediction model, the abnormal work log is sent to the server so that the server determines the safety of the to-be-executed instruction according to the abnormal work log.

3. The method according to claim 1, characterized in that After the prediction accuracy of the instruction prediction model is not less than the acceptance threshold, the method further includes: Regularly or irregularly checking the prediction accuracy of the trained instruction prediction model; If the prediction accuracy of the instruction prediction model is less than the acceptance threshold, the instruction prediction model is trained according to the historical abnormal work log.

4. The method according to claim 1, characterized in that: After the prediction accuracy of the instruction prediction model is not less than the acceptance threshold, the method further includes: If the newly added abnormal work log exceeds the training interval threshold, the instruction prediction model is trained according to the newly added abnormal work log.

5. The method according to claim 1, characterized in that When executing the to-be-executed instruction, the method further includes: Determine in real time whether the state data of the satellite exceeds a preset threshold of the pre-state; If the status data exceeds the preset threshold, the execution of the pending instruction is stopped and an error report is sent to the server.

6. The method according to claim 1, characterized in that If the mapping relationship does not exist in the state dictionary and the instruction to be executed is a safe instruction, the method further includes: The status dictionary is updated according to the abnormal work log.

7. A satellite abnormal command detection device, characterized in that: include: An instruction initial detection unit, the instruction initial detection unit is used to search the state dictionary to determine whether there is a mapping relationship between the current state, the instruction to be executed and the pre-state, wherein the state dictionary includes a plurality of known mapping relationships between pre-execution states, instructions and post-execution states, and the pre-state is the state of the satellite after executing the instruction to be executed; A transceiver unit and an instruction depth detection unit, wherein the transceiver unit is used to send an abnormal work log to a server to enable the server to judge the safety of the instruction to be executed according to the abnormal work log if the mapping relationship does not exist in the state dictionary; the instruction depth detection unit is used to input the abnormal work log into an instruction prediction model to judge the safety of the instruction to be executed if the mapping relationship does not exist in the state dictionary; an execution unit, the execution unit being configured to execute the instruction to be executed if the mapping relationship exists in the state dictionary or the instruction to be executed is a safe instruction; The transceiver unit and the instruction depth detection unit are specifically used for: If the number of accumulated abnormal work logs is less than the minimum number threshold of training samples, the transceiver unit sends the abnormal work log to the server, and saves the abnormal work log and the judgment result of the server into a sample set, wherein the instruction prediction model starts training after the number of accumulated abnormal work logs is equal to the minimum number threshold of training samples; If the number of the accumulated abnormal work logs is not less than the minimum number threshold of the training samples, and the prediction accuracy of the instruction prediction model is less than the acceptance threshold, the transceiver unit sends the abnormal work log to the server, and the instruction depth detection unit inputs the abnormal work log and the judgment result of the server into the instruction prediction model to continue training; If the number of the accumulated abnormal work logs is not less than the minimum number threshold of the training samples, and the prediction accuracy of the instruction prediction model is not less than the acceptance threshold, the instruction depth detection unit inputs the abnormal work logs into the instruction prediction model to determine the safety of the instructions to be executed, wherein the prediction accuracy of the trained instruction prediction model is not less than the acceptance threshold.

8. A satellite, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory, wherein the processor implements the method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed, the method according to any one of claims 1 to 6 is implemented.

Images