Intrusion detection and response method and system for satellite internet range

Abstract

The present invention provides an intrusion detection and response method and system for a satellite Internet target range, which relates to the technical field of network security technology, including multi-dimensional real-time collection of network traffic in the satellite Internet target range, adaptive multi-scale feature extraction, construction of a network behavior baseline model, positioning and identifying abnormal traffic, deployment of anomaly detection nodes based on edge computing, initial screening at the orbital end, multi-angle correlation, and output of abnormal event reports; activating distributed intelligent honeypots, inducing deep interaction, maximizing the amount of information collected, obtaining multi-modal data, and generating multi-dimensional attack feature vectors and behavior sequences; integrating historical defense experience data, using a method combining reinforcement learning and genetic algorithms, coordinating defense strategies, generating defense processes, recording through blockchain, and feeding back to the network behavior baseline model.

Description

Technical Field

[0001] The present invention relates to the technical field of network security technology, and in particular to an intrusion detection and response method and system for a satellite Internet target range. Background Art

[0002] With the rapid development and widespread application of satellite Internet technology, its security issues have become increasingly prominent. Traditional ground network security protection methods are difficult to fully adapt to the special network environment of satellite Internet, so there is an urgent need for special security protection technology for satellite Internet.

[0003] At present, the main security threats facing satellite Internet include but are not limited to: signal interference and deception, data interception and tampering, distributed denial of service attacks, malware infection, etc. These threats may lead to serious consequences such as communication interruption, data leakage, system paralysis, etc., posing a major risk to the normal operation of satellite Internet and user privacy; existing intrusion detection technologies are mainly designed for ground wired networks, and it is difficult to effectively deal with the dynamic topology and large-scale distributed characteristics of satellite Internet. In addition, most of the current network security test ranges simulate the ground network environment and lack consideration of the unique properties of satellite Internet. In terms of emergency response, the distributed characteristics of satellite Internet and the difficulty of remote operation bring huge challenges to the rapid positioning and handling of security incidents.

[0004] To sum up, there is an urgent need for an intrusion detection and response method specifically for the satellite Internet environment, which can simulate the unique properties of the satellite Internet in a dedicated target range environment, accurately detect various potential threats, and quickly make effective responses. The present invention can solve the problems in the prior art. Summary of the invention

[0005] The embodiments of the present invention provide an intrusion detection and response method and system for a satellite Internet target range, which can solve the problems in the prior art.

[0006] According to a first aspect of the embodiments of the present invention,

[0007] Provided is an intrusion detection and response method for a satellite Internet range, comprising:

[0008] The network traffic of the satellite Internet target range is collected in real time from multiple dimensions. Through the combination of quantum-inspired deep packet inspection technology and adaptive multi-scale feature extraction algorithm, a baseline model of network behavior is constructed. By integrating satellite orbit positioning data and dynamic topology information of inter-satellite links, abnormal traffic is located and identified. Anomaly detection nodes based on edge computing are deployed, and preliminary screening is performed at the orbital end. The preliminary screening results are transmitted to the ground-based deep analysis center. Through graph knowledge reasoning and combined with the historical attack pattern library, multi-angle correlation is performed to output abnormal event reports.

[0009] Based on the abnormal event report, the distributed intelligent honeypot is activated to induce deep interaction of potential intrusion behaviors. The response strategy of the distributed intelligent honeypot is dynamically adjusted according to the interaction of potential intrusion behaviors by using a self-organizing map network combined with a fuzzy reasoning algorithm to maximize the amount of information collected and obtain multimodal data. The multimodal data is input into a pre-built attack intention reasoning model to generate a multi-dimensional attack feature vector and behavior sequence;

[0010] Based on attack feature vectors and behavior sequences, historical defense experience data is integrated, combined with real-time satellite network dynamic topology changes and business traffic forecasts, and a combination of reinforcement learning and genetic algorithms is used to adaptively generate multi-level and multi-time collaborative defense strategies. Based on the collaborative defense strategy, a defense process is generated that includes dynamically adjusting network traffic paths, optimizing computing resource allocation, and updating encryption strategies. The defense process and corresponding defense results are recorded through blockchain and fed back to the network behavior baseline model. Through transfer learning and the construction of an attack and defense knowledge graph, subsequent security situations are responded to.

[0011] In an optional embodiment,

[0012] Through quantum-inspired deep packet inspection technology combined with adaptive multi-scale feature extraction algorithm, a network behavior baseline model is constructed, including:

[0013] Mapping network data packets to quantum state space through quantum bit encoding, encoding multiple data packets simultaneously based on the superposition property of quantum bits to obtain an initial quantum state; transforming the initial quantum state through quantum gate operation to construct a multi-bit entangled state, determining the correlation between data packets, and obtaining a correlated quantum state; constructing a quantum circuit-based perceptron unit based on the correlated quantum state, mapping the quantum state corresponding to the input data packet to a high-dimensional space through quantum gate operation to obtain a high-dimensional quantum state;

[0014] A quantum convolution operation is introduced into the high-dimensional quantum state, and a convolution transformation is performed through a quantum convolution circuit to obtain a quantum convolution state, and a dimension reduction and feature aggregation are performed on the quantum convolution state through a quantum pooling circuit to obtain a quantum pooling state, a quantum classification circuit is constructed, and the quantum pooling state is input into the quantum classification circuit for classification to obtain a quantum feature vector; statistics are performed on the quantum feature vector to determine the distribution of different length intervals to obtain a length distribution feature; a data packet load part is extracted, and load distribution characteristics of different protocols and applications are analyzed to obtain a load distribution feature; based on the length distribution feature and the load distribution feature, a segmentation granularity and a step size are adaptively selected to obtain an adaptive segmentation strategy;

[0015] Based on the adaptive segmentation strategy, a multi-scale convolutional neural network is constructed, and the segmented data blocks are scanned based on convolution kernels of different scales to obtain a multi-scale convolutional network; in the multi-scale convolutional network, convolution kernels of different scales are used to construct multiple parallel convolution branches to obtain parallel convolution branches; cross-layer connections are introduced between different layers of the parallel convolution branches, and the feature maps of the low layer are fused with the feature maps of the high layer to obtain cross-layer fusion features, and the importance of features of different scales is adaptively adjusted in combination with the attention mechanism to obtain attention weighted features; the attention weighted features are adaptively weighted fused through the feature fusion layer to obtain fusion features, and residual connections are introduced between different layers of the fusion features to add the input features and the output features element by element to obtain residual fusion features;

[0016] A density clustering algorithm is used to cluster normal behaviors according to the local density of the residual fusion features to obtain behavior clusters, and statistical features of the behavior clusters are extracted to build a baseline model of normal behaviors.

[0017] In an optional embodiment,

[0018] Also includes:

[0019] Based on the baseline model, a behavior baseline is determined, an abnormal point far from the behavior baseline is identified by an abnormality detection algorithm, an abnormal behavior sample is obtained, the abnormal behavior sample is stored in an abnormal behavior library, and an initial abnormal behavior library is established;

[0020] The continuous data packets are divided into behavior sequences according to the time window, and the key features of each data packet are extracted to form the feature representation of the behavior sequence, and the behavior sequence features are obtained;

[0021] The abnormal behavior samples in the abnormal behavior library are combined with normal behavior samples to construct a training data set, and the behavior sequence features in the training data set are modeled using a long short-term memory network. A gating mechanism and a memory unit are introduced to capture the long-distance dependency in the sequence to obtain a sequence model; a self-attention mechanism is introduced into the sequence model to assign different importances to different time steps in the behavior sequence to obtain an attention sequence representation, and the attention sequence representation is mapped to a low-dimensional embedding space to obtain a behavior vector;

[0022] By cluster analysis and anomaly detection, typical behavior patterns are identified in the embedding space of the behavior vector, a behavior template library is constructed, and a behavior template is obtained. The behavior vector corresponding to the abnormal behavior sample in the abnormal behavior library is added to the behavior template to form a comprehensive behavior template including normal and abnormal behaviors;

[0023] Regularly collect new network behavior data, perform incremental training on the behavior baseline, the abnormal behavior library and the comprehensive behavior template to obtain an updated model, locally adjust the updated model using the new behavior data to obtain a fine-tuning model, and add the newly identified unknown behaviors in the fine-tuning model to the abnormal behavior library and the comprehensive behavior template to obtain a dynamically updated model;

[0024] A teacher model is constructed based on the dynamic update model, and a student model is constructed based on the simplified teacher model to obtain a knowledge distillation model pair. The distillation loss function is determined, and the distillation student model is obtained by minimizing the distillation loss. The final lightweight anomaly detection model is obtained through model pruning and quantization.

[0025] In an optional embodiment,

[0026] Based on the abnormal event report, the distributed intelligent honeypot is activated to induce deep interaction of potential intrusion behaviors. The self-organizing map network is combined with the fuzzy reasoning algorithm to dynamically adjust the response strategy of the distributed intelligent honeypot according to the interaction of potential intrusion behaviors, maximize the amount of information collection, obtain multimodal data, input the multimodal data into the pre-built attack intention reasoning model, and generate multi-dimensional attack feature vectors and behavior sequences including:

[0027] Receive abnormal event reports, activate distributed intelligent honeypots, and induce potential intrusion behaviors to interact deeply;

[0028] Based on the multi-source heterogeneous honeypot data in the distributed intelligent honeypot, multi-source heterogeneous features are obtained through parsing and feature extraction, wherein the multi-source heterogeneous honeypot data includes network traffic data, system log data and malicious sample files;

[0029] The multi-source heterogeneous features are fused and converted into numerical vectors, and the numerical vectors are normalized and preprocessed to generate preprocessed feature vectors;

[0030] By determining the number of nodes in the input layer and the two-dimensional planar array structure of the competition layer, a self-organizing map network is constructed, the competition layer neurons and the corresponding weight matrix are initialized, and the learning rate and neighborhood radius are set; the self-organizing map network is trained using the preprocessed feature vector, the winning neuron is determined by calculating the Euclidean distance between the input sample and the competition layer neuron, and the weights of the winning neuron and the neurons in the corresponding neighborhood are updated;

[0031] Perform unified distance matrix visualization analysis on the trained self-organizing map network, identify attack behavior clusters, perform real-time mapping and clustering judgment on new attack behavior samples, determine the fuzzy set of attack type and interaction intensity, construct a membership function based on the membership distribution of the fuzzy set, and convert the attack type and interaction intensity into fuzzy language values ​​based on the membership function;

[0032] Collect attack handling experience, use fuzzy language values ​​to represent rule antecedents, determine rule consequences based on the language variables corresponding to the predefined response strategy, form fuzzy rules in the form of IF-THEN, build a fuzzy rule base, calculate the trigger strength of each fuzzy rule, and use the Mamdani reasoning method to synthesize the output of the trigger rules to obtain the fuzzy set of response actions;

[0033] The center of gravity method is used to defuzzify the response action fuzzy set to obtain the response control quantity. The response strategy of the distributed intelligent honeypot is dynamically adjusted according to the response control quantity, including adjusting the interaction delay time, limiting the service openness and adjusting the honeypot resource allocation, and implementing corresponding response measures.

[0034] Continuously monitor attacker behaviors and distributed intelligent honeypot interactions, obtain multimodal data, input the multimodal data into a pre-built attack intent reasoning model, and generate multi-dimensional attack feature vectors and behavior sequences.

[0035] In an optional embodiment,

[0036] The self-organizing map network comprises:

[0037] Based on the number of dimensions corresponding to the preprocessed feature vector, the number of input layer nodes of the self-organizing map network is determined, and according to the number of input layer nodes, the two-dimensional plane array structure of the competition layer is determined to form a rectangular grid neuron array; the weight of each neuron in the competition layer is initialized, and a random number with the same dimension as the number of input layer nodes is generated for each neuron as an initial weight to form a weight matrix;

[0038] Based on the preset grid size of the competition layer, set the initial neighborhood radius and the initial learning rate;

[0039] The preprocessed feature vectors matching the number of nodes in the input layer are used as input vectors, and the Euclidean distance between each input vector and each neuron in the competition layer is calculated, including calculating the difference between the input vector and the weight vector of each neuron, and calculating the sum of the squares and the square root of the difference;

[0040] Based on the calculated Euclidean distance, the neuron with the smallest distance to the input vector is determined as the winning neuron; according to the initial learning rate, the weight of the winning neuron is updated to make the corresponding weight vector closer to the current input vector;

[0041] Determine the neighborhood range of the winning neuron based on the initial neighborhood radius, determine the influence area centered on the winning neuron, update the weights of all neurons in the neighborhood range, move the neurons in the neighborhood in the direction of the input vector, determine the adjustment direction, and determine the adjustment amplitude based on the distance from the winning neuron according to the preset inverse proportional norm;

[0042] Repeat processing all input vectors to complete a training cycle, reducing the initial learning rate and initial neighborhood radius;

[0043] Repeat multiple training cycles until the preset number of iterations is reached to generate the optimal self-organizing map network.

[0044] In an optional embodiment,

[0045] Using a combination of reinforcement learning and genetic algorithms, a multi-level and multi-time collaborative defense strategy is adaptively generated, including:

[0046] Construct a reinforcement learning environment, taking the satellite network security status and attack characteristics as the state space and the defense behavior as the action space;

[0047] Initialize the parameters of the deep reinforcement learning model, including the weights of the policy network and the value network; use the deep reinforcement learning model to interact with the environment to generate an initial defense strategy set; encode the initial defense strategy set into chromosomes to form the initial population of the genetic algorithm;

[0048] Based on the effectiveness and resource consumption of the defense strategy, the fitness value of each chromosome in the initial population is calculated, and the fitness values ​​are sorted from high to low. Based on the preset number of preferred individuals, excellent individuals are selected, and a first-generation chromosome is generated through a crossover operation. Based on the first-generation chromosome, a random mutation operation is performed to generate a second-generation chromosome. The first-generation chromosome and the second-generation chromosome are decoded to form a new defense strategy set, and the strategy network of the deep reinforcement learning model is updated based on the new defense strategy set.

[0049] Repeat the iteration until the preset number of iterations is reached to obtain the final defense strategy;

[0050] The final defense strategy is layered according to the physical layer, link layer, network layer and application layer of the satellite network, and the layered strategy is determined. The future of each layered strategy is divided into three time scales: short-term, medium-term and long-term, and the layered scale defense plan is determined accordingly;

[0051] By building inter-layer collaboration and time-sequence collaboration, a coordination mechanism for each layer of defense plans is established. At the same time, the execution order and priority of the defense plans corresponding to each time scale are determined to build a multi-level and multi-time-sequence collaborative defense strategy.

[0052] According to a second aspect of the embodiments of the present invention,

[0053] Provided is an intrusion detection and response system for a satellite Internet range, comprising:

[0054] The first unit is used to collect network traffic in the satellite Internet target range in real time from multiple dimensions. It builds a network behavior baseline model through quantum-inspired deep packet inspection technology combined with an adaptive multi-scale feature extraction algorithm. It locates and identifies abnormal traffic by integrating satellite orbit positioning data and inter-satellite link dynamic topology information, deploys anomaly detection nodes based on edge computing, performs preliminary screening at the orbital end, and transmits the preliminary screening results to the ground-based deep analysis center. Through graph knowledge reasoning and combined with the historical attack pattern library, it performs multi-angle correlation and outputs abnormal event reports.

[0055] The second unit is used to activate the distributed intelligent honeypot based on the abnormal event report, induce the potential intrusion behavior to interact deeply, use the self-organizing map network combined with the fuzzy reasoning algorithm, dynamically adjust the response strategy of the distributed intelligent honeypot according to the interaction of the potential intrusion behavior, maximize the amount of information collection, obtain multimodal data, input the multimodal data into the pre-built attack intention reasoning model, and generate a multi-dimensional attack feature vector and behavior sequence;

[0056] The third unit is used to integrate historical defense experience data based on attack feature vectors and behavior sequences, combined with real-time satellite network dynamic topology changes and business traffic forecasts, and use a combination of reinforcement learning and genetic algorithms to adaptively generate multi-level and multi-time collaborative defense strategies. Based on the collaborative defense strategy, a defense process is generated that includes dynamically adjusting network traffic paths, optimizing computing resource allocation, and updating encryption strategies. The defense process and corresponding defense results are recorded through blockchain and fed back to the network behavior baseline model. Through transfer learning and the construction of an attack and defense knowledge graph, subsequent security situations are responded to.

[0057] According to a third aspect of the embodiments of the present invention,

[0058] An electronic device is provided, comprising:

[0059] processor;

[0060] a memory for storing processor-executable instructions;

[0061] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0062] According to a fourth aspect of the embodiments of the present invention,

[0063] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0064] In the embodiments of the present invention, network traffic data is collected from multiple angles, thereby improving the monitoring accuracy of network activities in a satellite Internet environment; quantum-inspired technology is used to enhance the efficiency and accuracy of deep packet detection, thereby improving the accuracy of abnormal traffic identification; adaptive algorithms are used to extract features from different scales to build a more comprehensive network behavior baseline model, further improving the effectiveness of anomaly detection; combining satellite orbit positioning and dynamic topology information of intersatellite links, the source of abnormal traffic can be more accurately located; anomaly detection nodes are deployed on the orbital side, and preliminary screening is performed through edge computing to reduce the burden on the ground analysis center and speed up the detection response time; the response strategy of the honeypot is adaptively adjusted to ensure continuous and effective guidance and capture of potential intrusion behaviors; and the details of attack behaviors are increased through deep interaction and dynamic adjustment of strategies. Capture maximizes the collection of multimodal data; the generation of multi-dimensional attack feature vectors and behavior sequences makes the reasoning of attack intentions more comprehensive and accurate, and improves the pertinence of defense strategies; distributed deployment increases the induction range and capture efficiency, and improves the overall system's detection and analysis capabilities for complex intrusion behaviors; by dynamically adjusting network traffic paths, optimizing computing resource allocation, and updating encryption strategies, the network's defense efficiency is improved to ensure the network's robustness under attack; blockchain technology is used to record the defense process and results to ensure that data cannot be tampered with, increase security and traceability; the defense results are fed back to the network behavior baseline model, the baseline model is continuously optimized, and the accuracy of future defense strategies is improved; through transfer learning and the construction of attack and defense knowledge graphs, historical defense experience is accumulated to improve the intelligence level of subsequent security situation awareness and response. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 A schematic diagram of a flow chart of an intrusion detection and response method for a satellite Internet target range according to an embodiment of the present invention;

[0066] Figure 2 It is a structural schematic diagram of the intrusion detection and response system of the satellite Internet target range according to an embodiment of the present invention. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0069] Figure 1 FIG. 1 is a flow chart of an intrusion detection and response method for a satellite Internet target range according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0070] S101. Collect network traffic in the satellite Internet target range in real time from multiple dimensions. Use quantum-inspired deep packet inspection technology combined with an adaptive multi-scale feature extraction algorithm to build a baseline model of network behavior. By integrating satellite orbit positioning data and inter-satellite link dynamic topology information, locate and identify abnormal traffic. Deploy anomaly detection nodes based on edge computing, perform preliminary screening at the orbital end, and transmit the preliminary screening results to the ground-based deep analysis center. Through graph knowledge reasoning and combined with the historical attack pattern library, perform multi-angle correlation and output abnormal event reports.

[0071] Multiple collection points are deployed in the satellite Internet range to capture network traffic in all directions. The collection dimensions include but are not limited to: packet header information, load content, timestamp, traffic size, protocol type, etc. High-performance network cards and distributed storage systems are used to ensure real-time data collection and storage.

[0072] Using quantum computing concepts such as superposition and entanglement, a new deep packet inspection algorithm is designed. The algorithm can consider multiple feature dimensions at the same time to improve detection efficiency and accuracy. By simulating the behavior of quantum bits, parallel processing and fast matching of data packets can be achieved.

[0073] Design a feature extraction algorithm that can automatically adjust according to different network environments and traffic characteristics. The algorithm can extract features at different time scales (such as milliseconds, seconds, minutes, hours) and spatial scales (such as packets, flows, sessions, hosts). Through dynamic weight adjustment, the expressiveness of features is optimized.

[0074] Based on historical normal traffic data, a Gaussian mixture model is used to build a baseline model of network behavior. This model can describe the statistical characteristics and patterns of normal network behavior. The model is updated regularly to adapt to changes in the network environment.

[0075] Obtain real-time satellite orbit positioning data and intersatellite link topology information from the satellite management system. This information is aligned and correlated with network traffic data in time and space to form a comprehensive data view. This helps to more accurately locate and track the source and propagation path of abnormal traffic.

[0076] Using the constructed baseline model, real-time network traffic is scored. The degree of deviation of each data flow from the baseline model is calculated. Combined with satellite orbit and link information, abnormal traffic exceeding the threshold is accurately located, including the satellite nodes and ground stations involved.

[0077] Lightweight anomaly detection modules are deployed on satellites to perform preliminary screening on the orbit side using edge computing technology. These modules run simplified anomaly detection algorithms that can quickly identify obvious abnormal patterns and reduce the amount of data that needs to be transmitted to the ground.

[0078] The initial screening results of the edge nodes, including the detected abnormal features, timestamps, satellite IDs involved and other information, are transmitted to the ground-based in-depth analysis center through a secure channel. Data compression and encryption technology are used to ensure transmission efficiency and security.

[0079] A high-performance computing cluster is deployed in the ground analysis center to receive and process the initial screening data from all satellites. More complex analysis algorithms, such as deep learning models and time series anomaly detection, are run to conduct in-depth analysis and verification of the initial screening results.

[0080] Build a knowledge graph that includes network security knowledge, attack patterns, vulnerability information, etc. Use graph algorithms and reasoning engines to match and associate detected anomalies with known attack patterns to infer possible attack types and severity.

[0081] Maintain an updated library of historical attack patterns. Use pattern matching algorithms, such as sequence alignment or graph matching, to compare currently detected anomalies with historical attack patterns to identify similar attack behaviors and features.

[0082] Comprehensively consider traffic characteristics, satellite orbit information, knowledge graph reasoning results and historical pattern matching results, and conduct correlation analysis on abnormal events from multiple dimensions. Use data fusion techniques such as Bayesian network or decision tree integration to obtain more comprehensive abnormality assessment results.

[0083] Automatically generate detailed abnormal event reports based on the results of multi-angle correlation analysis. The report content includes abnormal description, impact range, possible attack types, severity assessment, recommended response measures, etc. Use natural language generation technology to ensure that the report is clear and easy to understand.

[0084] For example, suppose a suspicious DDoS attack attempt is detected in a satellite Internet system. The processing process is as follows: Multiple traffic collection points capture a large number of short-term and high-frequency connection requests from the same IP address segment. The quantum-inspired deep packet inspection algorithm quickly analyzes the characteristics of these requests and finds that they have similar load patterns. The adaptive feature extraction algorithm analyzes these connection requests at different time scales and finds that they show obvious periodicity and burstiness. Compared with the baseline model of normal network behavior, it is found that the pattern of these connection requests deviates significantly from normal behavior. Combined with satellite orbit data, the abnormal traffic is located mainly in several satellites covering a specific geographical area. The system marks the traffic of these satellites as highly suspicious and accurately locates the approximate location where these requests are initiated on the ground. The edge computing node on the satellite detects the abnormal traffic pattern and triggers a preliminary alarm. The preliminary screening results are securely transmitted to the ground analysis center, including a feature summary of the abnormal traffic and relevant satellite information. The deep learning model at the ground center analyzes this data and confirms that it meets the characteristics of a DDoS attack. The knowledge graph reasoning system matches this pattern with known DDoS attack techniques and infers the possible attack tools used. Comparing with the historical attack pattern library, it was found that a similar attack pattern had appeared half a year ago. Multi-angle correlation analysis combined all the information and concluded that this was most likely an organized DDoS attack attempt targeting a specific geographic area. The system generated a detailed abnormal event report, including attack characteristics, potential impact, possible attacker information, and recommended defense measures. The report was immediately sent to the network security team for further processing and response.

[0085] In this embodiment, network traffic data is collected from multiple angles to improve the monitoring accuracy of network activities in a satellite Internet environment; quantum-inspired technology is used to enhance the efficiency and accuracy of deep packet inspection, thereby improving the accuracy of abnormal traffic identification; adaptive algorithms are used to extract features from different scales to build a more comprehensive network behavior baseline model, further improving the effectiveness of anomaly detection; combined with satellite orbit positioning and dynamic topology information of intersatellite links, the source of abnormal traffic can be located more accurately; anomaly detection nodes are deployed on the orbital side, and preliminary screening is performed through edge computing to reduce the burden on the ground analysis center and speed up the detection response time; a knowledge base of historical attack patterns combined with graph reasoning technology can achieve multi-angle correlation analysis, which helps to output more valuable abnormal event reports.

[0086] In an optional embodiment, constructing a network behavior baseline model by combining quantum-inspired deep packet inspection technology with an adaptive multi-scale feature extraction algorithm includes:

[0087] Mapping network data packets to quantum state space through quantum bit encoding, encoding multiple data packets simultaneously based on the superposition property of quantum bits to obtain an initial quantum state; transforming the initial quantum state through quantum gate operation to construct a multi-bit entangled state, determining the correlation between data packets, and obtaining a correlated quantum state; constructing a quantum circuit-based perceptron unit based on the correlated quantum state, mapping the quantum state corresponding to the input data packet to a high-dimensional space through quantum gate operation to obtain a high-dimensional quantum state;

[0088] A quantum convolution operation is introduced into the high-dimensional quantum state, and a convolution transformation is performed through a quantum convolution circuit to obtain a quantum convolution state, and a dimension reduction and feature aggregation are performed on the quantum convolution state through a quantum pooling circuit to obtain a quantum pooling state, a quantum classification circuit is constructed, and the quantum pooling state is input into the quantum classification circuit for classification to obtain a quantum feature vector; statistics are performed on the quantum feature vector to determine the distribution of different length intervals to obtain a length distribution feature; a data packet load part is extracted, and load distribution characteristics of different protocols and applications are analyzed to obtain a load distribution feature; based on the length distribution feature and the load distribution feature, a segmentation granularity and a step size are adaptively selected to obtain an adaptive segmentation strategy;

[0089] Based on the adaptive segmentation strategy, a multi-scale convolutional neural network is constructed, and the segmented data blocks are scanned based on convolution kernels of different scales to obtain a multi-scale convolutional network; in the multi-scale convolutional network, convolution kernels of different scales are used to construct multiple parallel convolution branches to obtain parallel convolution branches; cross-layer connections are introduced between different layers of the parallel convolution branches, and the feature maps of the low layer are fused with the feature maps of the high layer to obtain cross-layer fusion features, and the importance of features of different scales is adaptively adjusted in combination with the attention mechanism to obtain attention weighted features; the attention weighted features are adaptively weighted fused through the feature fusion layer to obtain fusion features, and residual connections are introduced between different layers of the fusion features to add the input features and the output features element by element to obtain residual fusion features;

[0090] A density clustering algorithm is used to cluster normal behaviors according to the local density of the residual fusion features to obtain behavior clusters, and statistical features of the behavior clusters are extracted to build a baseline model of normal behaviors.

[0091] Map the various attributes of network packets (such as IP address, port number, protocol type, etc.) to quantum bits. Each attribute may require multiple quantum bits to represent. For example, amplitude encoding or phase encoding methods can be used to convert classical information into quantum states. Utilize the superposition property of quantum bits to encode multiple packets at the same time. This can be achieved by creating a large quantum register, where each packet occupies a subset of the register. This allows the information of multiple packets to be represented in one quantum state. Combine the encoded multiple packets into a complete quantum state that contains the information of all packets to be analyzed. This initial quantum state will serve as the input for subsequent quantum operations.

[0092] Design a series of quantum gate operations to transform the initial quantum state. This includes a combination of single-bit gates (such as Hadamard gates, phase gates) and multi-bit gates (such as CNOT gates), with the goal of processing and converting information in the quantum state. Through a specific sequence of quantum gates, entanglement is created between quantum bits representing different data packets. This can be achieved by applying control gates or other quantum circuits that can generate entanglement. Using the constructed entangled state, the correlation between data packets is analyzed. The information in the entangled state can reflect the relationship between data packets, such as time correlation or protocol dependency. The determined correlation information is integrated into the quantum state to obtain a comprehensive quantum state containing the content of the data packets and the correlation information between them. This correlated quantum state will be used in the subsequent feature extraction and classification process.

[0093] Design a quantum circuit as a quantum version of the perceptron unit. This circuit should be able to accept the associated quantum state as input and process it through a series of quantum gate operations. In the quantum perceptron unit, the input quantum state is mapped to a higher-dimensional Hilbert space through a carefully designed sequence of quantum gates. This step is equivalent to the feature space transformation in classical machine learning. After completing the high-dimensional space mapping, a quantum state representing the data features in a higher-dimensional space is obtained. This high-dimensional quantum state contains the nonlinear transformation results of the original data.

[0094] Design quantum convolution circuits to simulate the operation of classical convolutional neural networks. This may involve designing special sequences of quantum gates to achieve an effect similar to the scanning of the convolution kernel. Input the high-dimensional quantum state into the quantum convolution circuit and perform a convolution operation. This step aims to extract local features in the quantum state. After the quantum convolution operation is completed, a new quantum state is obtained, called the quantum convolution state. This state encodes the features of the original data after the convolution process. Build quantum circuits to simulate classical pooling operations. This may include designing quantum versions of maximum pooling or average pooling operations. Input the quantum convolution state into the quantum pooling circuit for dimensionality reduction. This step aims to reduce the dimensionality of the features and aggregate important information. After the quantum pooling operation is completed, a reduced-dimensional quantum state is obtained, called the quantum pooling state. This state contains the feature information after dimensionality reduction and aggregation.

[0095] Design a quantum circuit to perform the classification task. This circuit should be able to take the quantum pooling state as input and output quantum states representing different categories. Input the quantum pooling state into the quantum classification circuit, process it through a series of quantum gate operations, and finally obtain the quantum state representing the classification result. Measure the quantum state of the classification result, convert the quantum information into classical information, and obtain a classical feature vector. This vector encodes the classification characteristics of the data packet.

[0096] Perform statistical analysis on quantum feature vectors and calculate the distribution of different length intervals. This may include calculating the frequency or probability distribution of each length interval. Analyze the payload of the data packet, consider the characteristics of different protocols and applications, and extract the distribution characteristics of the payload. This may involve statistical analysis of the payload content and structure. Based on the length distribution characteristics and load distribution characteristics, design an algorithm to dynamically select the granularity and step size of data segmentation. This algorithm should be able to adaptively adjust the segmentation parameters according to the characteristics of the data. Based on the adaptive segmentation strategy, design a multi-scale convolutional neural network structure. This network should contain multiple layers using convolution kernels of different scales. Use convolution kernels of different scales to scan the segmented data blocks and extract multi-scale features. Each scale of convolution kernel focuses on data patterns of different sizes.

[0097] In a multi-scale convolutional network, multiple parallel convolutional branches are designed, each using convolution kernels of different scales. These parallel branches process the input data simultaneously. Cross-layer connections are added between different layers of the parallel convolutional branches. These connections fuse the feature maps of the lower layers with the feature maps of the higher layers to capture multi-scale information. Design a mechanism to fuse the feature maps of the lower and higher layers. This may involve concatenation, weighted summation, or other fusion methods of feature maps. Introduce an attention mechanism to assign importance weights to features of different scales. This mechanism should be able to dynamically adjust the importance of features of each scale based on the current input data. Use the weights calculated by the attention mechanism to weight features of different scales. This step emphasizes the features that are more important to the current input.

[0098] Construct a feature fusion layer to integrate the attention-weighted multi-scale features. This layer should be able to adaptively adjust the fusion weights of different features. Through the feature fusion layer, features at multiple scales are integrated into a unified feature representation, called fused features. Add residual connections between different layers of fused features. These connections add the input features to the output features at the element level. Through residual connections, the original feature information is combined with the transformed feature information to obtain the final residual fused features.

[0099] Select a suitable density clustering algorithm and use the residual fusion features as input to cluster normal network behaviors. Through density clustering, similar normal behavior patterns are organized into different clusters. Each cluster represents a typical normal network behavior pattern. Perform statistical analysis on each behavior cluster to extract statistical features that can describe the characteristics of the cluster. This may include information such as the center, distribution, and density of the cluster. Based on the extracted statistical features, build a baseline model of normal network behavior. This model should be able to describe the characteristics and boundaries of various normal behaviors.

[0100] For example, suppose we are analyzing HTTP traffic in a network to detect potential abnormal behavior. The process is as follows: Encode the various fields of the HTTP request (such as method, URL, header) into quantum bits. Encode multiple HTTP requests at the same time to form an initial quantum state. Through quantum gate operations, create entangled states that represent the relationship between different HTTP requests. For example, it may be found that some requests always appear in pairs. Construct a quantum perceptron to map the quantum state of HTTP requests to a high-dimensional space, which may reveal nonlinear relationships between requests. Apply quantum convolution operations, which may detect specific request sequence patterns, such as repeated login attempts. Through quantum pooling, aggregate and simplify the detected pattern information. Use a quantum classification circuit to classify the processed quantum state as normal or suspicious, and obtain a quantum feature vector. Analyze the length distribution and load characteristics of HTTP requests, which may find that normal requests are usually within a specific length range. Based on the analysis results, formulate an adaptive segmentation strategy, which may decide to use finer-grained segmentation for longer requests. Construct a multi-scale convolutional network to scan HTTP requests using convolution kernels of different sizes to capture patterns of different scales. Adding cross-layer connections and attention mechanisms to the network may pay special attention to the features of URL and header fields. Fusion of multi-scale features and retention of original request information through residual connections to obtain a comprehensive request representation. Clustering of normal HTTP request behaviors using a density clustering algorithm may form clusters representing different types of normal access patterns. Based on the clustering results, a baseline model describing normal HTTP request behaviors is constructed, including typical request length, frequency, order, and other features.

[0101] In this embodiment, the superposition and entanglement of quantum bits are used to improve the parallel processing capability of data packets, and the speed and accuracy of data packet correlation identification are accelerated; the introduction of quantum convolution and quantum pooling operations can efficiently perform feature extraction and dimensionality reduction, and improve the processing efficiency of complex data structures; a convolutional network is constructed based on an adaptive segmentation strategy and a multi-scale convolution kernel, which enhances the ability to extract features of different scales and adapts to different types of data packets; the combination of parallel convolution branches and cross-layer connections enhances the feature extraction capability of the network, and at the same time, combined with the attention mechanism, the importance of different features can be dynamically adjusted, thereby improving the accuracy and robustness of the model; the residual connection is used to reduce the gradient vanishing problem, optimize the feature fusion process, and improve the feature expression capability; local density clustering based on residual fusion features can more accurately construct a baseline model of normal behavior and enhance the ability to detect abnormal behavior.

[0102] In an optional embodiment, it also includes:

[0103] Based on the baseline model, a behavior baseline is determined, an abnormal point far from the behavior baseline is identified by an abnormality detection algorithm, an abnormal behavior sample is obtained, the abnormal behavior sample is stored in an abnormal behavior library, and an initial abnormal behavior library is established;

[0104] The continuous data packets are divided into behavior sequences according to the time window, and the key features of each data packet are extracted to form the feature representation of the behavior sequence, and the behavior sequence features are obtained;

[0105] The abnormal behavior samples in the abnormal behavior library are combined with normal behavior samples to construct a training data set, and the behavior sequence features in the training data set are modeled using a long short-term memory network. A gating mechanism and a memory unit are introduced to capture the long-distance dependency in the sequence to obtain a sequence model; a self-attention mechanism is introduced into the sequence model to assign different importances to different time steps in the behavior sequence to obtain an attention sequence representation, and the attention sequence representation is mapped to a low-dimensional embedding space to obtain a behavior vector;

[0106] By cluster analysis and anomaly detection, typical behavior patterns are identified in the embedding space of the behavior vector, a behavior template library is constructed, and a behavior template is obtained. The behavior vector corresponding to the abnormal behavior sample in the abnormal behavior library is added to the behavior template to form a comprehensive behavior template including normal and abnormal behaviors;

[0107] Regularly collect new network behavior data, perform incremental training on the behavior baseline, the abnormal behavior library and the comprehensive behavior template to obtain an updated model, locally adjust the updated model using the new behavior data to obtain a fine-tuning model, and add the newly identified unknown behaviors in the fine-tuning model to the abnormal behavior library and the comprehensive behavior template to obtain a dynamically updated model;

[0108] A teacher model is constructed based on the dynamic update model, and a student model is constructed based on the simplified teacher model to obtain a knowledge distillation model pair. The distillation loss function is determined, and the distillation student model is obtained by minimizing the distillation loss. The final lightweight anomaly detection model is obtained through model pruning and quantization.

[0109] Determine the behavior baseline based on the previously constructed baseline model. This baseline represents the normal behavior pattern in the network. Use anomaly detection algorithms, such as Isolation Forest or Local Anomaly Factor, to identify data points that are far away from this behavior baseline. Points far away from the baseline are considered potential abnormal behaviors. Collect these identified abnormal behavior samples and store them in a dedicated abnormal behavior library. This library becomes the initial abnormal behavior knowledge base, providing basic data for subsequent analysis and learning.

[0110] Start processing continuous network packets. Divide these packets into multiple behavior sequences according to predefined time windows, such as 5 minutes or 10 minutes. For each packet in each sequence, extract key features, such as source IP, destination IP, port number, protocol type, packet size, etc. The key features are combined to form a feature representation of each behavior sequence. Convert the original packet stream into a series of structured feature sequences to prepare for subsequent deep learning modeling.

[0111] Combine the samples in the abnormal behavior library with the normal behavior samples to build a comprehensive training data set. The training data set contains normal and abnormal behavior sequences. Use the long short-term memory (LSTM) network to model these behavior sequence features. The special structure of the long short-term memory network, including input gates, forget gates, and output gates, enables it to effectively capture long-distance dependencies in the sequence. Through this process, a model that can understand and predict complex network behavior sequences is obtained.

[0112] In order to further improve the performance of the model, a self-attention mechanism is introduced on the basis of the long short-term memory network. It allows the model to dynamically decide which parts of the sequence should be paid attention to when processing the sequence. Specifically, the model calculates the importance weight of each time step in the sequence, and then weighted sums the output of the long short-term memory network according to these weights. An attention-weighted sequence representation is obtained. A fully connected layer is used to map this high-dimensional attention sequence representation to a low-dimensional embedding space to obtain a compact behavior vector.

[0113] Cluster analysis and anomaly detection can be performed in the embedding space. We use clustering algorithms such as K-means or DBSCAN to identify typical behavior patterns and form a behavior template library. At the same time, the behavior vectors corresponding to the samples in the abnormal behavior library are also added to this template library. In this way, a comprehensive behavior template containing normal and abnormal behaviors is obtained.

[0114] In order to keep the model up to date, new network behavior data is collected regularly. Using the new data, incremental training is performed on the behavior baseline, abnormal behavior library, and comprehensive behavior template. This process does not require retraining the entire model, but rather makes local adjustments based on the original model. For newly identified unknown behaviors, they are added to the abnormal behavior library and comprehensive behavior template. In this way, a model that can be dynamically updated over time is obtained, always maintaining sensitivity to the latest network behaviors.

[0115] To improve efficiency in practical applications, we perform model compression. First, the dynamically updated model is used as the "teacher model", and then a "student model" with a simpler structure is constructed. Through the method of knowledge distillation, we transfer the knowledge of the teacher model to the student model. Specifically, a distillation loss function is defined, which measures the difference between the output of the student model and the output of the teacher model. By minimizing this loss function, the student model gradually learns the knowledge of the teacher model. Finally, the student model is further pruned and quantized to remove unnecessary parameters and reduce the precision of the remaining parameters, resulting in a lightweight but still efficient anomaly detection model.

[0116] In this embodiment, anomalies are effectively identified based on the behavior baseline, and an abnormal behavior library is constructed to improve the accuracy and comprehensiveness of anomaly detection; long-distance dependencies in sequences are captured through long short-term memory networks to enhance the analysis capabilities of complex behavior sequences; a self-attention mechanism is introduced to dynamically adjust the importance of different time steps, thereby improving the ability to capture and represent key behavior features; a behavior template library is generated through clustering and anomaly detection, and is dynamically updated to ensure that the model is adaptable to newly emerging abnormal behaviors; the behavior baseline and abnormal behavior library are regularly updated, and incremental training and local adjustments are performed to ensure that the model always maintains the latest detection capabilities; the model is simplified and trimmed and quantized through knowledge distillation technology, ultimately obtaining an efficient and lightweight anomaly detection model, which improves the application effect of the model in resource-constrained environments.

[0117] S102. Based on the abnormal event report, the distributed intelligent honeypot is activated to induce the potential intrusion behavior to interact deeply. The response strategy of the distributed intelligent honeypot is dynamically adjusted according to the interaction of the potential intrusion behavior by using the self-organizing map network combined with the fuzzy reasoning algorithm to maximize the amount of information collected and obtain multimodal data. The multimodal data is input into the pre-built attack intention reasoning model to generate a multi-dimensional attack feature vector and behavior sequence;

[0118] The distributed intelligent honeypot dynamically simulates the complex topology and communication protocols of the satellite network, including the quantum key distribution process of the intersatellite laser communication link. A reconfigurable software-defined radio device array is deployed in the honeypot to accurately simulate the Doppler effect, delay jitter, link interruption and other characteristics of the satellite communication link. At the same time, a virtualized satellite payload environment is constructed, including a telemetry and remote control system and an onboard data processing unit, to induce intrusion behavior to interact deeply.

[0119] When an abnormal event is detected, the distributed intelligent honeypot is triggered to induce potential intruders to further interact and attract more attack behaviors; through in-depth interaction with intrusion behaviors, the honeypot system dynamically adjusts the response strategy, adapts to different attack modes, and maximizes the collected intrusion behavior data; combined with the self-organizing map network and fuzzy reasoning algorithm, the response of the honeypot is adjusted in real time according to the intruder's behavior pattern to ensure the effectiveness of information collection; multimodal data including network traffic, attack methods and communication content are obtained from the interaction to form a multidimensional data set; the collected multimodal data is input into the pre-built attack intention reasoning model to generate a multi-dimensional attack feature vector, and the behavior sequence is extracted to help understand the attack intention and steps.

[0120] In this embodiment, the response strategy of the honeypot is adaptively adjusted to ensure continuous and effective guidance and capture of potential intrusion behaviors; through deep interaction and dynamic adjustment of strategies, the capture of details of attack behaviors is increased, and the collection of multimodal data is maximized; the generation of multi-dimensional attack feature vectors and behavior sequences makes the reasoning of attack intentions more comprehensive and accurate, and improves the targeted nature of defense strategies; distributed deployment increases the induction range and capture efficiency, and improves the overall system's detection and analysis capabilities for complex intrusion behaviors.

[0121] In an optional embodiment, based on the abnormal event report, the distributed intelligent honeypot is activated to induce deep interaction of potential intrusion behaviors, and the response strategy of the distributed intelligent honeypot is dynamically adjusted according to the interaction of potential intrusion behaviors by using a self-organizing map network combined with a fuzzy reasoning algorithm to maximize the amount of information collected, obtain multimodal data, and input the multimodal data into a pre-built attack intention reasoning model to generate a multi-dimensional attack feature vector and behavior sequence including:

[0122] Receive abnormal event reports, activate distributed intelligent honeypots, and induce potential intrusion behaviors to interact deeply;

[0123] Based on the multi-source heterogeneous honeypot data in the distributed intelligent honeypot, multi-source heterogeneous features are obtained through parsing and feature extraction, wherein the multi-source heterogeneous honeypot data includes network traffic data, system log data and malicious sample files;

[0124] The multi-source heterogeneous features are fused and converted into numerical vectors, and the numerical vectors are normalized and preprocessed to generate preprocessed feature vectors;

[0125] By determining the number of nodes in the input layer and the two-dimensional planar array structure of the competition layer, a self-organizing map network is constructed, the competition layer neurons and the corresponding weight matrix are initialized, and the learning rate and neighborhood radius are set; the self-organizing map network is trained using the preprocessed feature vector, the winning neuron is determined by calculating the Euclidean distance between the input sample and the competition layer neuron, and the weights of the winning neuron and the neurons in the corresponding neighborhood are updated;

[0126] Perform unified distance matrix visualization analysis on the trained self-organizing map network, identify attack behavior clusters, perform real-time mapping and clustering judgment on new attack behavior samples, determine the fuzzy set of attack type and interaction intensity, construct a membership function based on the membership distribution of the fuzzy set, and convert the attack type and interaction intensity into fuzzy language values ​​based on the membership function;

[0127] Collect attack handling experience, use fuzzy language values ​​to represent rule antecedents, determine rule consequences based on the language variables corresponding to the predefined response strategy, form fuzzy rules in the form of IF-THEN, build a fuzzy rule base, calculate the trigger strength of each fuzzy rule, and use the Mamdani reasoning method to synthesize the output of the trigger rules to obtain the fuzzy set of response actions;

[0128] The center of gravity method is used to defuzzify the response action fuzzy set to obtain the response control quantity. The response strategy of the distributed intelligent honeypot is dynamically adjusted according to the response control quantity, including adjusting the interaction delay time, limiting the service openness and adjusting the honeypot resource allocation, and implementing corresponding response measures.

[0129] Continuously monitor attacker behaviors and distributed intelligent honeypot interactions, obtain multimodal data, input the multimodal data into a pre-built attack intent reasoning model, and generate multi-dimensional attack feature vectors and behavior sequences.

[0130] After receiving the abnormal event report, the system activates the distributed intelligent honeypots. These honeypots are designed to be attractive targets, attracting potential attackers to interact with them in depth. Honeypots simulate various services and vulnerabilities of real systems, guiding attackers to show more attack behaviors and techniques.

[0131] Collect multi-source heterogeneous honeypot data from distributed intelligent honeypots. These data include network traffic data (such as TCP / IP packets), system log data (such as login attempts, command execution records), and malicious sample files (such as malware, scripts). These data are parsed and feature extracted to obtain multi-source heterogeneous features. For example, extract features such as source IP, destination port, and protocol type from network traffic; extract features such as user operations and resource access patterns from system logs; and extract features such as file types and API call sequences from malicious samples.

[0132] The extracted multi-source heterogeneous features are fused and converted into numerical vectors. For categorical features, one-hot encoding is used to convert them into numerical values; for text features, the bag-of-words model or TF-IDF is used to convert them into numerical values. The converted numerical vectors are normalized so that all feature values ​​fall within the same range, usually [0, 1] or [-1, 1]. This step obtains the preprocessed feature vector.

[0133] Construct a self-organizing map network. First, determine the number of input layer nodes, which is the same as the dimension of the preprocessed feature vector. Then determine the two-dimensional planar array structure of the competition layer, such as a 10x10 grid. Initialize the weights of the competition layer neurons, and you can use random decimals. Set the initial learning rate (such as 0.1) and the initial neighborhood radius (such as half the length of the competition layer side). Use the preprocessed feature vector to train the self-organizing map network. For each input sample, calculate its Euclidean distance to all competition layer neurons, and find the neuron with the smallest distance as the winning neuron. Update the weights of the winning neuron and the neurons in its neighborhood to make them closer to the input sample. As training progresses, gradually reduce the learning rate and neighborhood radius.

[0134] After training, the self-organizing map network is analyzed by unified distance matrix visualization. The unified distance matrix shows the distance between adjacent neurons, represented by color depth. Darker areas represent possible cluster boundaries, and lighter areas represent cluster interiors. By analyzing the unified distance matrix, different attack behavior clusters can be identified. For new attack behavior samples, they are mapped to the self-organizing map network, and the attack type to which they belong is determined based on the area they fall into.

[0135] Based on the clustering results of the self-organizing map network, fuzzy sets of attack types and interaction strengths are determined. For example, the attack type can be defined as {"port scan", "brute force cracking", "vulnerability exploitation"}, and the interaction strength can be defined as {"low", "medium", "high"}. Membership functions are constructed to map specific attack behaviors to these fuzzy sets. For example, for interaction strength, a membership function can be defined based on attack duration and complexity.

[0136] Collect and organize historical attack handling experience, use fuzzy language values ​​to represent rule antecedents (such as IF the attack type is "brute force cracking" AND the interaction intensity is "high"), and determine rule consequences based on predefined response strategies (THEN the response strategy is "high vigilance"). In this way, a series of IF-THEN fuzzy rules are formed to build a fuzzy rule base.

[0137] For new attack behaviors, the trigger strength of each fuzzy rule is calculated. The outputs of all trigger rules are synthesized using the Mamdani fuzzy reasoning method to obtain the fuzzy set of response actions. Finally, the center of gravity method is used to defuzzify this fuzzy set to obtain the specific response control amount.

[0138] According to the response control quantity obtained by defuzzification, the response strategy of the distributed intelligent honeypot is dynamically adjusted. This may include: increasing the interaction delay time to slow down the attack process; limiting the openness of certain services to reduce system exposure; adjusting the allocation of honeypot resources to invest more resources in high-threat attacks.

[0139] Continuously monitor attacker behavior and honeypot interactions to obtain multimodal data. This data may include network traffic, system calls, user input, etc. Input these multimodal data into the pre-built attack intention reasoning model to generate multi-dimensional attack feature vectors and behavior sequences for further analysis and prediction of attacker intentions.

[0140] In this embodiment, by integrating multi-source heterogeneous data such as network traffic, system logs and malicious samples, the feature extraction of intrusion behavior is enriched and the ability to identify complex attack behaviors is improved; the clustering analysis of attack behaviors is dynamically updated through a self-organizing mapping network, the real-time mapping and judgment capabilities of unknown attack samples are enhanced, and intelligent attack detection and classification are realized; the honeypot strategy is dynamically adjusted according to the attack intensity and type using a fuzzy inference algorithm, which can flexibly respond to different types of attacks and maximize information collection; based on the fuzzy rule base and the Mamdani reasoning method, the response measures of the honeypot are intelligently generated to ensure that the honeypot can adopt the optimal strategy in different scenarios and improve the defense effect; by inputting multi-modal data into the attack intention reasoning model, a multi-dimensional attack feature vector and behavior sequence are generated, which improves the understanding of the attack purpose and behavior pattern, thereby optimizing the security protection strategy.

[0141] In an optional embodiment, the self-organizing map network includes:

[0142] Based on the number of dimensions corresponding to the preprocessed feature vector, the number of input layer nodes of the self-organizing map network is determined, and according to the number of input layer nodes, the two-dimensional plane array structure of the competition layer is determined to form a rectangular grid neuron array; the weight of each neuron in the competition layer is initialized, and a random number with the same dimension as the number of input layer nodes is generated for each neuron as an initial weight to form a weight matrix;

[0143] Based on the preset grid size of the competition layer, set the initial neighborhood radius and the initial learning rate;

[0144] The preprocessed feature vectors matching the number of nodes in the input layer are used as input vectors, and the Euclidean distance between each input vector and each neuron in the competition layer is calculated, including calculating the difference between the input vector and the weight vector of each neuron, and calculating the sum of the squares and the square root of the difference;

[0145] Based on the calculated Euclidean distance, the neuron with the smallest distance to the input vector is determined as the winning neuron; according to the initial learning rate, the weight of the winning neuron is updated to make the corresponding weight vector closer to the current input vector;

[0146] Determine the neighborhood range of the winning neuron based on the initial neighborhood radius, determine the influence area centered on the winning neuron, update the weights of all neurons in the neighborhood range, move the neurons in the neighborhood in the direction of the input vector, determine the adjustment direction, and determine the adjustment amplitude based on the distance from the winning neuron according to the preset inverse proportional norm;

[0147] Repeat processing all input vectors to complete a training cycle, reducing the initial learning rate and initial neighborhood radius;

[0148] Repeat multiple training cycles until the preset number of iterations is reached to generate the optimal self-organizing map network.

[0149] Determine the number of nodes in the input layer of the self-organizing map network according to the dimension of the preprocessed feature vector. If the feature vector has 100 dimensions, the input layer is also set to 100 nodes; determine the two-dimensional planar array structure of the competition layer. Usually a rectangular grid is selected, such as a 10x10 or 20x20 neuron array. The array size depends on the data complexity and the desired clustering accuracy.

[0150] Initialize the weights of each neuron in the competition layer. For each neuron, generate random numbers with the same dimension as the number of nodes in the input layer as the initial weights. These random numbers are usually uniformly distributed between 0 and 1. The weights of all neurons form a weight matrix.

[0151] Set the initial neighborhood radius, which is usually half the length of the competition layer grid or less. For example, for a 10x10 grid, the initial neighborhood radius might be set to 5. Also set the initial learning rate, which is usually between 0.1 and 1, such as 0.5.

[0152] Start the training process. For each input vector (i.e., the preprocessed feature vector), calculate the Euclidean distance between it and each neuron in the competitive layer, calculate the difference between the input vector and the weight vector of each neuron, square the difference, sum it, and finally take the square root.

[0153] Find the neuron with the smallest distance to the input vector and determine it as the winning neuron. Update the weight of the winning neuron to make it closer to the current input vector. The update formula is: new weight = old weight + learning rate * (input vector - old weight).

[0154] Determine the neighborhood range of the winning neuron, that is, the area of ​​influence centered on the winning neuron. Update the weights of all neurons in this range so that the neurons in the neighborhood also move in the direction of the input vector. The adjustment amplitude decreases as the distance from the winning neuron increases. Usually, a Gaussian function or a Mexican hat function is used to determine the adjustment strength.

[0155] Repeat the process for all input vectors to complete a training cycle. After each cycle, reduce the learning rate and neighborhood radius. The learning rate can be linearly or exponentially decayed, and the neighborhood radius is usually linearly reduced.

[0156] Repeat multiple training cycles until the preset number of iterations is reached or the network converges. The convergence criterion can be that the weight change is less than a certain threshold, or the quantization error no longer decreases significantly. After the training is completed, the optimal self-organizing map network is obtained.

[0157] Exemplarily, a large amount of network traffic data is collected and 50 key features are extracted, including packet size, protocol type, source port, destination port, etc.; it is determined that the input layer of the SOM network has 50 nodes, corresponding to 50 features. Considering the complexity of the data and the expected clustering accuracy, a 15x15 competitive layer grid structure is selected; the weights of the 225 competitive layer neurons are randomly initialized. Each neuron has 50 weights, corresponding to the 50 nodes of the input layer. These initial weights are random numbers between 0 and 1; the initial neighborhood radius is set to 7 (about half of 15), and the initial learning rate is 0.5.

[0158] Start the training process. Assume there is an input vector representing a suspicious network connection. The system calculates the Euclidean distance between this input vector and 225 neurons. Assume that the neuron (8, 7) has the smallest distance with the input vector and is determined to be the winning neuron.

[0159] The system updates the weight of neuron (8, 7) to make it closer to the input vector. Then it determines all neurons in a circular area with a radius of 7 and a center of (8, 7) and updates their weights. The closer the neuron is to (8, 7), the greater the adjustment of its weight.

[0160] The system repeats this process to process all training samples and complete a training cycle. After each cycle, the learning rate decreases linearly from 0.5 and the neighborhood radius decreases linearly from 7.

[0161] After 1,000 training cycles, the system reached the preset number of iterations and was able to map different types of network behaviors to different areas. For example, normal traffic might be concentrated in the upper left corner of the grid, DDoS attacks in the lower right corner, and port scans in the middle.

[0162] This trained self-organizing map network can be used to detect new network attacks. When new network connection data is input, the system can quickly determine what type of behavior it belongs to, thereby identifying potential attacks.

[0163] In this embodiment, the self-organizing map network can map high-dimensional input data to a two-dimensional plane, achieve data dimensionality reduction and visualization, and help discover hidden patterns and relationships in the data; through competitive learning and neighborhood updating, the self-organizing map network can map similar input vectors to adjacent neurons, thereby achieving automatic clustering of data; the trained self-organizing map network weight matrix contains the main features of the input data and can be used for feature extraction and data compression; as the training progresses, the learning rate and the neighborhood radius gradually decrease, so that the network can balance between coarse learning and fine adjustment, thereby improving the learning effect; the self-organizing map network maintains the topological structure of the input space, and adjacent inputs are also adjacent in the mapping space, which helps to understand the intrinsic structure of the data; after training, inputs that are at a large distance from all neurons may represent abnormal data and can be used for anomaly detection; the self-organizing map network does not require labeled data and is an unsupervised learning algorithm suitable for exploratory data analysis and pattern discovery.

[0164] S103. Based on the attack feature vector and behavior sequence, historical defense experience data is integrated, combined with the real-time satellite network dynamic topology changes and business traffic forecasts, and a combination of reinforcement learning and genetic algorithms is used to adaptively generate a multi-level and multi-time collaborative defense strategy. Based on the collaborative defense strategy, a defense process is generated that includes dynamically adjusting the network traffic path, optimizing the allocation of computing resources, and updating the encryption strategy. The defense process and the corresponding defense results are recorded through the blockchain and fed back to the network behavior baseline model. Through transfer learning and the construction of an attack and defense knowledge graph, subsequent security situations are responded to.

[0165] Based on the intruder's attack feature vector and behavior sequence, historical defense experience data is integrated, including known attack modes, defense measures and corresponding effects, as the basis for generating defense strategies.

[0166] Acquire dynamic topology changes of satellite networks (such as intersatellite link status changes, node failures, etc.) and business traffic forecast data in real time, and combine this information to provide a current network environment reference for the generation of defense strategies.

[0167] Using reinforcement learning models, we optimize strategies based on historical experience and real-time data, and adjust defense strategies through repeated trials, learning, and feedback. At the same time, we combine genetic algorithms and adopt evolutionary mechanisms to screen and optimize strategy parameters in multiple iterations to ensure that the generated defense strategies can effectively respond to intrusions in a dynamically changing network environment.

[0168] Based on the output of reinforcement learning and genetic algorithms, a multi-level, multi-time collaborative defense strategy is generated, and targeted measures are formulated for attack threats at different network levels and time periods to form a comprehensive and coordinated defense system.

[0169] The defense process includes: adaptively adjusting the transmission path of network traffic according to changes in attacks and network topology to avoid traffic bottlenecks or high-risk paths; dynamically adjusting the computing resource allocation of satellites, ground stations and other nodes to ensure that key nodes have sufficient resources during the attack process to avoid resource overload affecting the defense effect; adaptively updating encryption and authentication strategies according to the evolution of attack threats to improve the security of communication links.

[0170] The above-mentioned defense process and its corresponding defense results are recorded through blockchain technology to ensure that the data cannot be tampered with and is traceable, which facilitates subsequent audits and security analysis.

[0171] Feedback the defense process and results to the network behavior baseline model, update the model to adapt to new attack patterns, and further optimize the network behavior baseline.

[0172] Using transfer learning technology, the current defense experience is transferred to the new environment to improve the adaptability of the model in different scenarios. At the same time, combining historical defense data and current defense information, an attack and defense knowledge graph is constructed to form a comprehensive security knowledge base for subsequent situation response and decision optimization.

[0173] In this embodiment, reinforcement learning and genetic algorithms are combined to generate multi-level and multi-time defense strategies to adapt to different attack scenarios and improve the flexibility and accuracy of defense. The network's defense efficiency is improved by dynamically adjusting network traffic paths, optimizing computing resource allocation, and updating encryption strategies to ensure network robustness under attack. Blockchain technology is used to record the defense process and results to ensure that data cannot be tampered with, increase security and traceability, feed back defense results to the network behavior baseline model, continuously optimize the baseline model, and improve the accuracy of future defense strategies. Through transfer learning and the construction of attack and defense knowledge graphs, historical defense experience is accumulated to improve the intelligence level of subsequent security situation awareness and response.

[0174] In an optional embodiment, the method of combining reinforcement learning and genetic algorithm to adaptively generate a multi-level and multi-time coordinated defense strategy includes:

[0175] Construct a reinforcement learning environment, taking the satellite network security status and attack characteristics as the state space and the defense behavior as the action space;

[0176] Initialize the parameters of the deep reinforcement learning model, including the weights of the policy network and the value network; use the deep reinforcement learning model to interact with the environment to generate an initial defense strategy set; encode the initial defense strategy set into chromosomes to form the initial population of the genetic algorithm;

[0177] Based on the effectiveness and resource consumption of the defense strategy, the fitness value of each chromosome in the initial population is calculated, and the fitness values ​​are sorted from high to low. Based on the preset number of preferred individuals, excellent individuals are selected, and a first-generation chromosome is generated through a crossover operation. Based on the first-generation chromosome, a random mutation operation is performed to generate a second-generation chromosome. The first-generation chromosome and the second-generation chromosome are decoded to form a new defense strategy set, and the strategy network of the deep reinforcement learning model is updated based on the new defense strategy set.

[0178] Repeat the iteration until the preset number of iterations is reached to obtain the final defense strategy;

[0179] The final defense strategy is layered according to the physical layer, link layer, network layer and application layer of the satellite network, and the layered strategy is determined. The future of each layered strategy is divided into three time scales: short-term, medium-term and long-term, and the layered scale defense plan is determined accordingly;

[0180] By building inter-layer collaboration and time-sequence collaboration, a coordination mechanism for each layer of defense plans is established. At the same time, the execution order and priority of the defense plans corresponding to each time scale are determined to build a multi-level and multi-time-sequence collaborative defense strategy.

[0181] Construct a reinforcement learning environment. The state space includes the security status of the satellite network (such as network traffic, system load, number of abnormal events, etc.) and attack characteristics (such as attack type, attack intensity, attack duration, etc.). The action space includes various possible defense behaviors, such as adjusting firewall rules, updating intrusion detection systems, isolating infected nodes, etc.

[0182] Initialize the parameters of the deep reinforcement learning model. This includes the weights of the policy network (used to select actions) and the value network (used to evaluate the value of states). These weights are usually initialized with small random values, and the initialized model is allowed to interact with the environment to generate a series of initial defense strategies. These strategies may not be optimal, but provide a starting point for subsequent optimization.

[0183] The initial defense strategy set is encoded as a chromosome to form the initial population of the genetic algorithm. The encoding method can be a binary string, where each bit represents whether a specific defense action is executed. For example, an 8-bit chromosome may represent 8 different defense actions, 1 means execution, and 0 means not execution.

[0184] Calculate the fitness value of each chromosome (i.e. each defense strategy) in the initial population. The fitness function takes into account the effectiveness of the strategy (such as the degree of successful defense against attacks) and resource consumption (such as network bandwidth and computing resource usage). Sort the fitness values ​​from high to low and select the top N excellent individuals (N is the preset number of optimal individuals).

[0185] The selected excellent individuals are crossovered to generate the first generation chromosomes. The crossover operation can be a single-point crossover (exchanging the genes of the two parents at random positions on the chromosome) or a multi-point crossover. The purpose of this step is to combine the characteristics of excellent individuals to produce potentially better offspring.

[0186] The first-generation chromosome is subjected to random mutation to generate the second-generation chromosome. The mutation operation randomly changes certain bits in the chromosome, introduces new features, increases population diversity, and avoids falling into local optimality.

[0187] The first and second offspring chromosomes are decoded to form a new set of defense strategies. These new strategies are used to update the policy network of the deep reinforcement learning model, enabling the model to generate better defense strategies.

[0188] Repeat the above process until the preset number of iterations is reached or a certain convergence condition is met, and the final defense strategy is obtained.

[0189] The final defense strategy is divided into layers according to the physical layer, link layer, network layer and application layer of the satellite network. The physical layer strategy may involve adjusting the antenna direction, power control, etc.; the link layer strategy may include link encryption, access control, etc.; the network layer strategy may include routing optimization, traffic filtering, etc.; the application layer strategy may include data encryption, identity authentication, etc.

[0190] Each layer of strategy is further divided into three time scales: short-term, medium-term and long-term. Short-term strategies may target immediate threats, medium-term strategies focus on continuous defense, and long-term strategies focus on improving the overall security of the system.

[0191] Construct inter-layer coordination and time-sequence coordination mechanisms. Inter-layer coordination ensures that defense measures at different layers cooperate with each other to avoid conflicts. Time-sequence coordination determines the execution order and priority of defense plans at each time scale, forming a complete, multi-level, multi-sequence coordinated defense strategy.

[0192] For example, a reinforcement learning environment was first constructed, and after initializing the deep reinforcement learning model, 100 initial defense strategies were generated, such as "when signal interference is detected, switch to the backup frequency band". These strategies were encoded into 100-bit binary strings to form the initial population of the genetic algorithm.

[0193] The fitness value of each strategy is calculated, taking into account factors such as the number of successful defense attacks and satellite energy consumption. After sorting, the top 20 best strategies are selected for crossover operations to generate 20 new strategies. These 20 new strategies are then mutated to randomly change certain defense actions to generate another 20 strategies.

[0194] The newly generated 40 strategies are used to update the deep reinforcement learning model. This process is repeated for 1000 iterations, and finally an optimized defense strategy set is obtained.

[0195] The final strategies are layered: the physical layer strategy includes "adjusting antenna direction when strong interference is detected"; the link layer strategy includes "using dynamic keys for link encryption"; the network layer strategy includes "reconstructing routes when abnormal traffic is detected"; and the application layer strategy includes "end-to-end encryption of sensitive data".

[0196] Each layer of strategy is further divided by time scale. For example, the short-term strategy of the network layer is "immediately block suspicious IP", the medium-term strategy is "update the routing table every week", and the long-term strategy is "gradually upgrade to a new routing protocol".

[0197] Build a collaborative mechanism. For example, after the physical layer adjusts the antenna direction, the link layer needs to re-establish an encrypted connection. In terms of timing, the short-term strategy of "blocking suspicious IPs" takes precedence over the medium-term strategy of "updating routing tables".

[0198] In this embodiment, by combining reinforcement learning with genetic algorithms, defense strategies are optimized to improve the accuracy and effectiveness of satellite network security defense. Based on the effectiveness and resource consumption of defense strategies, resource-efficient defense plans are generated to ensure that defense measures maximize their effects while minimizing resource consumption. Defense strategies are layered according to the physical layer, link layer, network layer, and application layer of the satellite network, and deployed in time according to short-term, medium-term, and long-term time scales to achieve full coverage of defense strategies. By building inter-layer and time-series collaborative defense mechanisms, defense strategies at different levels and time periods are coordinated in an orderly manner to improve the systematicness and coordination of the overall defense. Reinforcement learning and iterative optimization of genetic algorithms are used to continuously improve the adaptability and robustness of defense strategies to ensure that they can cope with complex and changing attack scenarios.

[0199] Figure 2 FIG. 1 is a schematic diagram of the structure of an intrusion detection and response system of a satellite Internet target range according to an embodiment of the present invention. Figure 2 As shown, the system comprises:

[0200] The first unit is used to collect network traffic in the satellite Internet target range in real time from multiple dimensions. It builds a network behavior baseline model through quantum-inspired deep packet inspection technology combined with an adaptive multi-scale feature extraction algorithm. It locates and identifies abnormal traffic by integrating satellite orbit positioning data and inter-satellite link dynamic topology information, deploys anomaly detection nodes based on edge computing, performs preliminary screening at the orbital end, and transmits the preliminary screening results to the ground-based deep analysis center. Through graph knowledge reasoning and combined with the historical attack pattern library, it performs multi-angle correlation and outputs abnormal event reports.

[0201] The second unit is used to activate the distributed intelligent honeypot based on the abnormal event report, induce the potential intrusion behavior to interact deeply, use the self-organizing map network combined with the fuzzy reasoning algorithm, dynamically adjust the response strategy of the distributed intelligent honeypot according to the interaction of the potential intrusion behavior, maximize the amount of information collection, obtain multimodal data, input the multimodal data into the pre-built attack intention reasoning model, and generate a multi-dimensional attack feature vector and behavior sequence;

[0202] The third unit is used to integrate historical defense experience data based on attack feature vectors and behavior sequences, combined with real-time satellite network dynamic topology changes and business traffic forecasts, and use a combination of reinforcement learning and genetic algorithms to adaptively generate multi-level and multi-time collaborative defense strategies. Based on the collaborative defense strategy, a defense process is generated that includes dynamically adjusting network traffic paths, optimizing computing resource allocation, and updating encryption strategies. The defense process and corresponding defense results are recorded through blockchain and fed back to the network behavior baseline model. Through transfer learning and the construction of an attack and defense knowledge graph, subsequent security situations are responded to.

[0203] According to a third aspect of the embodiments of the present invention,

[0204] An electronic device is provided, comprising:

[0205] processor;

[0206] a memory for storing processor-executable instructions;

[0207] The processor is configured to call the instructions stored in the memory to execute the aforementioned method.

[0208] According to a fourth aspect of the embodiments of the present invention,

[0209] A computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the aforementioned method is implemented.

[0210] The present invention may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present invention.

[0211] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. The intrusion detection and response method of the satellite Internet target range is characterized by: include: The network traffic of the satellite Internet target range is collected in real time from multiple dimensions. Through the combination of quantum-inspired deep packet inspection technology and adaptive multi-scale feature extraction algorithm, a baseline model of network behavior is constructed. By integrating satellite orbit positioning data and dynamic topology information of inter-satellite links, abnormal traffic is located and identified. Anomaly detection nodes based on edge computing are deployed, and preliminary screening is performed at the orbital end. The preliminary screening results are transmitted to the ground-based deep analysis center. Through graph knowledge reasoning and combined with the historical attack pattern library, multi-angle correlation is performed to output abnormal event reports. Based on the abnormal event report, the distributed intelligent honeypot is activated to induce deep interaction of potential intrusion behaviors. The response strategy of the distributed intelligent honeypot is dynamically adjusted according to the interaction of potential intrusion behaviors by using a self-organizing map network combined with a fuzzy reasoning algorithm to maximize the amount of information collected and obtain multimodal data. The multimodal data is input into a pre-built attack intention reasoning model to generate a multi-dimensional attack feature vector and behavior sequence; Based on attack feature vectors and behavior sequences, historical defense experience data is integrated, combined with real-time satellite network dynamic topology changes and business traffic predictions, and a combination of reinforcement learning and genetic algorithms is used to adaptively generate multi-level and multi-time series collaborative defense strategies. Based on the collaborative defense strategy, a defense process is generated that includes dynamically adjusting network traffic paths, optimizing computing resource allocation, and updating encryption strategies. The defense process and corresponding defense results are recorded through blockchain and fed back to the network behavior baseline model. Through transfer learning and the construction of an attack and defense knowledge graph, subsequent security situations are responded to; Through quantum-inspired deep packet inspection technology combined with adaptive multi-scale feature extraction algorithm, a network behavior baseline model is constructed, including: Mapping network data packets to quantum state space through quantum bit encoding, encoding multiple data packets simultaneously based on the superposition property of quantum bits to obtain an initial quantum state; transforming the initial quantum state through quantum gate operation to construct a multi-bit entangled state, determining the correlation between data packets, and obtaining a correlated quantum state; constructing a quantum circuit-based perceptron unit based on the correlated quantum state, mapping the quantum state corresponding to the input data packet to a high-dimensional space through quantum gate operation to obtain a high-dimensional quantum state; A quantum convolution operation is introduced into the high-dimensional quantum state, and a convolution transformation is performed through a quantum convolution circuit to obtain a quantum convolution state, and a dimension reduction and feature aggregation are performed on the quantum convolution state through a quantum pooling circuit to obtain a quantum pooling state, a quantum classification circuit is constructed, and the quantum pooling state is input into the quantum classification circuit for classification to obtain a quantum feature vector; statistics are performed on the quantum feature vector to determine the distribution of different length intervals to obtain a length distribution feature; a data packet load part is extracted, and load distribution characteristics of different protocols and applications are analyzed to obtain a load distribution feature; based on the length distribution feature and the load distribution feature, a segmentation granularity and a step size are adaptively selected to obtain an adaptive segmentation strategy; Based on the adaptive segmentation strategy, a multi-scale convolutional neural network is constructed, and the segmented data blocks are scanned based on convolution kernels of different scales to obtain a multi-scale convolutional network; in the multi-scale convolutional network, convolution kernels of different scales are used to construct multiple parallel convolution branches to obtain parallel convolution branches; cross-layer connections are introduced between different layers of the parallel convolution branches, and the feature maps of the low layer are fused with the feature maps of the high layer to obtain cross-layer fusion features, and the importance of features of different scales is adaptively adjusted in combination with the attention mechanism to obtain attention weighted features; the attention weighted features are adaptively weighted fused through the feature fusion layer to obtain fusion features, and residual connections are introduced between different layers of the fusion features to add the input features and the output features element by element to obtain residual fusion features; A density clustering algorithm is used to cluster normal behaviors according to the local density of the residual fusion features to obtain behavior clusters, and statistical features of the behavior clusters are extracted to build a baseline model of normal behaviors.

2. The method according to claim 1, characterized in that: Also includes: Based on the baseline model, a behavior baseline is determined, an abnormal point far from the behavior baseline is identified by an abnormality detection algorithm, an abnormal behavior sample is obtained, the abnormal behavior sample is stored in an abnormal behavior library, and an initial abnormal behavior library is established; The continuous data packets are divided into behavior sequences according to the time window, and the key features of each data packet are extracted to form the feature representation of the behavior sequence, and the behavior sequence features are obtained; The abnormal behavior samples in the abnormal behavior library are combined with normal behavior samples to construct a training data set, and the behavior sequence features in the training data set are modeled using a long short-term memory network. A gating mechanism and a memory unit are introduced to capture the long-distance dependency in the sequence to obtain a sequence model; a self-attention mechanism is introduced into the sequence model to assign different importances to different time steps in the behavior sequence to obtain an attention sequence representation, and the attention sequence representation is mapped to a low-dimensional embedding space to obtain a behavior vector; By cluster analysis and anomaly detection, typical behavior patterns are identified in the embedding space of the behavior vector, a behavior template library is constructed, and a behavior template is obtained. The behavior vector corresponding to the abnormal behavior sample in the abnormal behavior library is added to the behavior template to form a comprehensive behavior template including normal and abnormal behaviors; Regularly collect new network behavior data, perform incremental training on the behavior baseline, the abnormal behavior library and the comprehensive behavior template to obtain an updated model, locally adjust the updated model using the new behavior data to obtain a fine-tuning model, and add the newly identified unknown behaviors in the fine-tuning model to the abnormal behavior library and the comprehensive behavior template to obtain a dynamically updated model; A teacher model is constructed based on the dynamic update model, and a student model is constructed based on the simplified teacher model to obtain a knowledge distillation model pair. The distillation loss function is determined, and the distillation student model is obtained by minimizing the distillation loss. The final lightweight anomaly detection model is obtained through model pruning and quantization.

3. The method according to claim 1, characterized in that: Based on the abnormal event report, the distributed intelligent honeypot is activated to induce deep interaction of potential intrusion behaviors. The self-organizing map network is combined with the fuzzy reasoning algorithm to dynamically adjust the response strategy of the distributed intelligent honeypot according to the interaction of potential intrusion behaviors, maximize the amount of information collection, obtain multimodal data, input the multimodal data into the pre-built attack intention reasoning model, and generate multi-dimensional attack feature vectors and behavior sequences including: Receive abnormal event reports, activate distributed intelligent honeypots, and induce potential intrusion behaviors to interact deeply; Based on the multi-source heterogeneous honeypot data in the distributed intelligent honeypot, multi-source heterogeneous features are obtained through parsing and feature extraction, wherein the multi-source heterogeneous honeypot data includes network traffic data, system log data and malicious sample files; The multi-source heterogeneous features are fused and converted into numerical vectors, and the numerical vectors are normalized and preprocessed to generate preprocessed feature vectors; By determining the number of nodes in the input layer and the two-dimensional planar array structure of the competition layer, a self-organizing map network is constructed, the competition layer neurons and the corresponding weight matrix are initialized, and the learning rate and neighborhood radius are set; the self-organizing map network is trained using the preprocessed feature vector, the winning neuron is determined by calculating the Euclidean distance between the input sample and the competition layer neuron, and the weights of the winning neuron and the neurons in the corresponding neighborhood are updated; Perform unified distance matrix visualization analysis on the trained self-organizing map network, identify attack behavior clusters, perform real-time mapping and clustering judgment on new attack behavior samples, determine the fuzzy set of attack type and interaction intensity, construct a membership function based on the membership distribution of the fuzzy set, and convert the attack type and interaction intensity into fuzzy language values ​​based on the membership function; Collect attack handling experience, use fuzzy language values ​​to represent rule antecedents, determine rule consequences based on the language variables corresponding to the predefined response strategy, form fuzzy rules in the form of IF-THEN, build a fuzzy rule base, calculate the trigger strength of each fuzzy rule, and use the Mamdani reasoning method to synthesize the output of the trigger rules to obtain the fuzzy set of response actions; The center of gravity method is used to defuzzify the response action fuzzy set to obtain the response control quantity. The response strategy of the distributed intelligent honeypot is dynamically adjusted according to the response control quantity, including adjusting the interaction delay time, limiting the service openness and adjusting the honeypot resource allocation, and implementing corresponding response measures. Continuously monitor attacker behaviors and distributed intelligent honeypot interactions, obtain multimodal data, input the multimodal data into a pre-built attack intent reasoning model, and generate multi-dimensional attack feature vectors and behavior sequences.

4. The method according to claim 3, characterized in that The self-organizing map network comprises: Based on the number of dimensions corresponding to the preprocessed feature vector, the number of input layer nodes of the self-organizing map network is determined, and according to the number of input layer nodes, the two-dimensional plane array structure of the competition layer is determined to form a rectangular grid neuron array; the weight of each neuron in the competition layer is initialized, and a random number with the same dimension as the number of input layer nodes is generated for each neuron as an initial weight to form a weight matrix; Based on the preset grid size of the competition layer, set the initial neighborhood radius and the initial learning rate; The preprocessed feature vectors matching the number of nodes in the input layer are used as input vectors, and the Euclidean distance between each input vector and each neuron in the competition layer is calculated, including calculating the difference between the input vector and the weight vector of each neuron, and calculating the sum of the squares and the square root of the difference; Based on the calculated Euclidean distance, the neuron with the smallest distance to the input vector is determined as the winning neuron; according to the initial learning rate, the weight of the winning neuron is updated to make the corresponding weight vector closer to the current input vector; Determine the neighborhood range of the winning neuron based on the initial neighborhood radius, determine the influence area centered on the winning neuron, update the weights of all neurons in the neighborhood range, move the neurons in the neighborhood in the direction of the input vector, determine the adjustment direction, and determine the adjustment amplitude based on the distance from the winning neuron according to the preset inverse proportional norm; Repeat processing all input vectors to complete a training cycle, reducing the initial learning rate and initial neighborhood radius; Repeat multiple training cycles until the preset number of iterations is reached to generate the optimal self-organizing map network.

5. The method according to claim 1, characterized in that: Using a combination of reinforcement learning and genetic algorithms, a multi-level and multi-time collaborative defense strategy is adaptively generated, including: Construct a reinforcement learning environment, taking the satellite network security status and attack characteristics as the state space and the defense behavior as the action space; Initialize the parameters of the deep reinforcement learning model, including the weights of the policy network and the value network; use the deep reinforcement learning model to interact with the environment to generate an initial defense strategy set; encode the initial defense strategy set into chromosomes to form the initial population of the genetic algorithm; Based on the effectiveness and resource consumption of the defense strategy, the fitness value of each chromosome in the initial population is calculated, and the fitness values ​​are sorted from high to low. Based on the preset number of preferred individuals, excellent individuals are selected, and a first-generation chromosome is generated through a crossover operation. Based on the first-generation chromosome, a random mutation operation is performed to generate a second-generation chromosome. The first-generation chromosome and the second-generation chromosome are decoded to form a new defense strategy set, and the strategy network of the deep reinforcement learning model is updated based on the new defense strategy set. Repeat the iteration until the preset number of iterations is reached to obtain the final defense strategy; The final defense strategy is layered according to the physical layer, link layer, network layer and application layer of the satellite network, and the layered strategy is determined. The future of each layered strategy is divided into three time scales: short-term, medium-term and long-term, and the layered scale defense plan is determined accordingly; By building inter-layer collaboration and time-sequence collaboration, a coordination mechanism for each layer of defense plans is established. At the same time, the execution order and priority of the defense plans corresponding to each time scale are determined to build a multi-level and multi-time-sequence collaborative defense strategy.

6. An intrusion detection and response system for a satellite internet target range, used to implement the method according to any one of claims 1 to 5, characterized in that: include: The first unit is used to collect network traffic in the satellite Internet target range in real time from multiple dimensions. It builds a network behavior baseline model through quantum-inspired deep packet inspection technology combined with an adaptive multi-scale feature extraction algorithm. It locates and identifies abnormal traffic by integrating satellite orbit positioning data and inter-satellite link dynamic topology information, deploys anomaly detection nodes based on edge computing, performs preliminary screening at the orbital end, and transmits the preliminary screening results to the ground-based deep analysis center. Through graph knowledge reasoning and combined with the historical attack pattern library, it performs multi-angle correlation and outputs abnormal event reports. The second unit is used to activate the distributed intelligent honeypot based on the abnormal event report, induce the potential intrusion behavior to interact deeply, use the self-organizing map network combined with the fuzzy reasoning algorithm, dynamically adjust the response strategy of the distributed intelligent honeypot according to the interaction of the potential intrusion behavior, maximize the amount of information collection, obtain multimodal data, input the multimodal data into the pre-built attack intention reasoning model, and generate a multi-dimensional attack feature vector and behavior sequence; The third unit is used to integrate historical defense experience data based on attack feature vectors and behavior sequences, combined with real-time satellite network dynamic topology changes and business traffic forecasts, and use a combination of reinforcement learning and genetic algorithms to adaptively generate multi-level and multi-time collaborative defense strategies. Based on the collaborative defense strategy, a defense process is generated that includes dynamically adjusting network traffic paths, optimizing computing resource allocation, and updating encryption strategies. The defense process and corresponding defense results are recorded through blockchain and fed back to the network behavior baseline model. Through transfer learning and the construction of an attack and defense knowledge graph, subsequent security situations are responded to.

7. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to call the instructions stored in the memory to execute the method described in any one of claims 1 to 5.

8. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images