Network security detection method, device, equipment and storage medium

Abstract

The present invention relates to the field of drone network security technology, specifically to a network security detection method, device, equipment and storage medium. First, the drone nodes are sorted according to a real-time node sorting algorithm, and then the nodes to be detected are obtained according to the sorting results and it is determined whether the nodes to be detected are malicious nodes; if they are not malicious nodes, the nodes to be detected are obtained and it is determined whether the nodes to be detected are hijacked nodes; if they are not hijacked nodes, the nodes to be detected are obtained and processed, and it is determined whether the nodes to be detected have communication link security problems, data security problems and navigation signal security problems. If there are problems, an early warning is issued; after performing network security detection on all nodes to be detected, the early warning data is sent to a ground station, and the early warning data includes abnormal drone nodes and network security problems. The present invention improves the detection efficiency of network security problems of drone nodes by sorting and detecting drone nodes.

Description

Technical Field

[0001] The present invention relates to the field of drone network security technology, and specifically to a network security detection method, device, equipment and storage medium. Background Art

[0002] Network security detection refers to the process of monitoring and analyzing possible security threats, vulnerabilities and attack behaviors in the network through technical means and tools, with the aim of preventing potential threats and maintaining the stability of network and communication systems. Real-time network security detection has a wide range of applications, covering multiple industries and scenarios, including finance, medical care, automation equipment, intelligent transportation and many other fields.

[0003] Drones are aircraft that are controlled by ground control systems or automated programs. They were first used in the military field. With the development of technology, the application of drones has gradually expanded to the civilian field and has been widely used in many industries such as agriculture, logistics, security and entertainment. Drone network security testing refers to the security inspection of the communication network of drone systems and drone swarms to find potential security vulnerabilities or attack risks. Drone systems include the drone itself, ground control stations and communication links, so drone network security testing involves security assessments at multiple levels, including drone control systems, data transmission security and device firmware security. Due to the multi-connectivity and openness of drone networks, drone networks are more vulnerable to malicious threats.

[0004] Currently, the protection of drone networks is fragile and the security threats are diverse. The efficiency and accuracy of network security detection of drone nodes need to be further improved.

[0005] To this end, a network security detection method, device, equipment and storage medium are proposed. Summary of the invention

[0006] The purpose of the present invention is to provide a network security detection method, device, equipment and storage medium. By acquiring the data of drone nodes and calculating the data importance weight of the nodes, a real-time node sorting algorithm is used to sort the drone nodes to be detected to improve the network security detection efficiency of subsequent drone nodes; then malicious nodes and hijacked nodes are detected on the nodes to be detected to determine whether the nodes can communicate normally; then, it is analyzed whether the nodes to be detected have communication link security problems, data security problems, navigation signal security problems and other common network security problems in drone networks, so as to achieve comprehensive detection of network security problems.

[0007] To achieve the above object, the present invention provides the following technical solutions:

[0008] Network security detection methods, including:

[0009] Step S1: Obtain all drone nodes and data and process them to obtain a drone node set; sort the drone nodes according to a real-time node sorting algorithm to obtain a sorted drone node set; obtain the data in the sorted drone node set to obtain the node to be detected.

[0010] Furthermore, the real-time node sorting algorithm includes:

[0011] The function weight, real-time data transmission volume, real-time weight and real-time trust of the drone node are obtained and processed to obtain the data importance weight of the drone node;

[0012] The functional weight is assigned according to the function of the drone node, the real-time data transmission volume represents the amount of data transmitted by the drone node per unit time, the real-time weight is assigned according to the response time and transmission speed of the drone node transmitting data, and the real-time trust represents the robustness of the drone node;

[0013] Calculating the data importance weights of all the drone nodes, and sorting the drone nodes according to the values ​​of the data importance weights to obtain a sorted drone node set;

[0014] When acquiring the node to be detected, selection is performed according to the data importance weight.

[0015] Step S2: Acquire the node to be detected and determine whether the node to be detected is a malicious node. If the node to be detected is the malicious node, issue an early warning.

[0016] Furthermore, the malicious nodes include:

[0017] Obtaining and processing the data packet loss rate, data delay and data consistency to obtain the real-time data transmission abnormality of the node to be detected;

[0018] Obtaining and processing direct trust, recommended trust and historical trust of adjacent communication nodes to obtain real-time trust of the node to be detected;

[0019] The real-time data transmission abnormality and the real-time trust are obtained and processed to obtain a comprehensive trust score; if the comprehensive trust score is lower than a preset comprehensive trust score threshold, the node to be detected is the malicious node;

[0020] The calculation formula of the comprehensive trust score is: ;in, represents the comprehensive trust score, represents the weight coefficient, Indicates the abnormality degree of the real-time data transmission, Indicates the real-time confidence.

[0021] Step S3: If the node to be detected is not the malicious node, the node to be detected is obtained and processed to determine whether the node to be detected is a hijacked node. If the node to be detected is the hijacked node, an early warning is issued.

[0022] Furthermore, the hijacked node includes:

[0023] The transmission data per unit time of the node to be detected is obtained and processed to obtain the mean value of data transmission per unit time and the standard deviation of data transmission per unit time; the calculation formula of the data anomaly detection threshold is: ;in, represents the data anomaly detection threshold, Indicates the mean value of data transmission per unit time The weight coefficient of Indicates the standard deviation of data transmission per unit time ; if the real-time data transmission speed of the node to be detected is less than the data anomaly detection threshold, it means that the node to be detected is the hijacked node.

[0024] Step S4: If the node to be detected is not the hijacked node, the node to be detected is obtained and processed to determine whether the node to be detected has communication link security problems, data security problems and navigation signal security problems. If there are problems, an early warning is issued.

[0025] Furthermore, the communication link security issues include:

[0026] The communication signal strength anomaly index, data integrity index, replay attack detection index and denial of service attack detection index are obtained and processed to obtain a comprehensive evaluation index of the communication link. If the comprehensive evaluation index of the communication link is greater than the preset comprehensive evaluation threshold of the communication link, it indicates that there is a security problem of the communication link and an early warning is issued.

[0027] Furthermore, the data security issues include:

[0028] Perform encrypted data verification. If the verification fails, there is a security issue with the transmitted data.

[0029] If the verification is successful, the actual formation data of the node to be detected, the historical formation data of the node to be detected and the simulated formation data of the node to be detected are obtained and processed to obtain the comprehensive data similarity. If it is less than the preset similarity threshold, it indicates that there is a security problem with the transmitted data.

[0030] Furthermore, the navigation signal security issues include:

[0031] Obtaining and processing the navigation signal strength of the adjacent communication nodes of the node to be detected to obtain a local navigation signal strength range, if the navigation signal strength of the node to be detected is not within the local navigation signal strength range, it indicates that there is a safety problem with the navigation signal;

[0032] If there is no problem with the navigation signal strength, the navigation signal and the simulated navigation signal of the adjacent communication node are obtained to calculate the real-time navigation deviation; the navigation signal and the simulated navigation signal of the node to be detected are obtained and processed to obtain the deviation to be detected. If the deviation to be detected is less than or equal to the real-time navigation deviation, it indicates that there is no problem with the navigation signal of the node to be detected. If the deviation to be detected is greater than the real-time navigation deviation, it indicates that there is a security problem with the navigation signal of the node to be detected.

[0033] Step S5: If there is no problem with the node to be detected, it means that there is no abnormality in the node to be detected, and the next node to be detected is obtained and a network security detection is performed; after the network security detection is performed on all the nodes to be detected, the network security detection is terminated.

[0034] Step S6: Send the early warning data to the ground station, wherein the early warning data includes abnormal drone nodes and network security issues.

[0035] The present invention also provides a network security detection device, comprising:

[0036] The node processing module is used to obtain and process all drone nodes and data to obtain a drone node set; sort the drone nodes according to a real-time node sorting algorithm to obtain a sorted drone node set; obtain data in the sorted drone node set to obtain a node to be detected;

[0037] A malicious node detection module is used to obtain the node to be detected and determine whether the node to be detected is a malicious node, and issue an early warning if the node to be detected is the malicious node;

[0038] A hijacked node detection module, used to obtain and process the node to be detected, determine whether the node to be detected is a hijacked node, and issue an early warning if the node to be detected is the hijacked node;

[0039] A data detection module is used to obtain and process the node to be detected, determine whether the node to be detected has communication link security problems, data security problems and navigation signal security problems, and issue an early warning if there are any problems;

[0040] The network security problem summary module is used to send early warning data to the ground station, and the early warning data includes abnormal drone nodes and network security problems.

[0041] The present invention also provides a computer device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the computer program, any step in the network security detection method is implemented.

[0042] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any step in the network security detection method is implemented.

[0043] Compared with the prior art, the present invention has the following beneficial effects:

[0044] 1. The real-time node sorting algorithm calculates the data importance weight of the drone node based on the functional weight, real-time data transmission volume, real-time weight and real-time trust of the drone node, and sorts the drone nodes from large to small according to the value of their data importance weight, ensuring that the most important nodes with the greatest potential for security risks are detected first, providing a guarantee for the subsequent rapid discovery and processing of high-risk nodes, effectively improving the speed of network security detection and the efficiency of node network security detection.

[0045] 2. After sorting the drone nodes, the data of the nodes to be detected are obtained and network security detection is performed. First, the anomaly is calculated by integrating transmission characteristics such as packet loss rate, data delay and data consistency. Then, the real-time trust is obtained by combining direct trust, recommended trust and historical trust to construct a comprehensive trust score for comprehensive detection of malicious nodes. It can more accurately distinguish normal nodes from malicious nodes and reduce false positives and negatives. Then, the data anomaly detection threshold is calculated through the mean and standard deviation of data transmission to detect whether the node is hijacked. The hijacked node can be quickly identified and an early warning can be issued.

[0046] 3. If the node to be detected is neither a malicious node nor a hijacked node, specific network security detection is carried out, including communication link detection, data security detection and navigation signal detection; communication link detection is comprehensively evaluated through signal strength anomaly indicators, data integrity indicators, replay attack detection indicators and denial of service attack detection indicators, which can quickly identify potential security issues in the communication link; data security detection detects data content security issues through the dual steps of encrypted data verification and data similarity check to ensure data confidentiality and integrity; for the important navigation signal security detection of the drone formation, signal strength detection and navigation deviation detection are used to comprehensively evaluate the security of the navigation signal and identify abnormal navigation signals in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1A flowchart of a network security detection method provided in Example 1 of the present invention;

[0048] Figure 2 A flow chart for calculating the comprehensive trust score provided in Example 1 of the present invention;

[0049] Figure 3 This is a schematic diagram of the structure of a network security detection device provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] The specific contents of the first embodiment are as follows:

[0052] A drone performance team uses the network security detection method provided by the present invention to detect whether there are network security issues in the drone formation during the performance, including interception of data, forged data packets and malicious attacks. The process of the network security detection method is as follows: Figure 1 The specific implementation process is as follows:

[0053] Step S1: Obtain all drone nodes and data and process them to obtain a drone node set; sort the drone nodes according to a real-time node sorting algorithm to obtain a sorted drone node set; obtain data in the sorted drone node set to obtain a node to be detected;

[0054] Furthermore, the real-time node sorting algorithm includes:

[0055] The function weight, real-time data transmission volume, real-time weight and real-time trust of the drone node are obtained and processed to obtain the data importance weight of the drone node; the function weight is assigned according to the function of the drone node, the real-time data transmission volume represents the data transmission volume of the drone node per unit time, the real-time weight is assigned according to the real-time requirement of the data transmitted by the drone node, and the real-time trust represents the robustness of the drone node, and the robustness represents whether the node is reliable and trustworthy in the network.

[0056] Calculating the data importance weights of all the drone nodes, and sorting the drone nodes according to the values ​​of the data importance weights to obtain a sorted drone node set;

[0057] When acquiring the node to be detected, selection is performed according to the data importance weight.

[0058] Furthermore, the calculation formula of the data importance weight is: ;in Indicates The importance weight of the data of each drone node, Represents the functional weight of the drone node The weight coefficient of The weight coefficient representing the real-time data transmission volume of the drone node, Indicates the unit time, Indicates the data transmission rate, Indicates the real-time weight of the drone node The weight coefficient of The weight coefficient representing the real-time trust of the drone node, the real-time trust The calculation method of will be given in the following examples.

[0059] Table 1 shows the functional weights and real-time weights of some drone nodes. The data importance weights of drone nodes can be further calculated through the following data.

[0060] Table 1. Functional weights and real-time weights of some drone nodes

[0061] Node Number Node Function Functional weight Real-time weight Drone Node 1 Leader Node 0.90 0.95 Drone Node 2 Scouting Node 0.80 0.85 Drone Node 3 Communication relay node 0.70 0.80 Drone Node 4 Scouting Node 0.80 0.85 Drone Node 5 Secondary Node 0.60 0.70

[0062] The real-time node sorting algorithm obtains data such as the functional weight, real-time data transmission volume, real-time weight and real-time trust of the drone node, comprehensively calculates the data importance weight of the drone node, and sorts the drone nodes from large to small according to the value of the data importance weight to obtain the sorted drone node set, ensuring that the most important nodes with the most potential security risks are given priority for network security testing, providing protection for the subsequent rapid discovery and processing of high-risk nodes, effectively improving the speed of network security testing, and improving the network security testing efficiency of the nodes.

[0063] Step S2: Obtain the node to be detected and determine whether the node to be detected is a malicious node by calculating the comprehensive trust score. The calculation process is as follows: Figure 2 As shown; if the node to be detected is the malicious node, an early warning is issued;

[0064] Furthermore, the malicious nodes include:

[0065] Obtaining and processing the data packet loss rate, data delay and data consistency to obtain the real-time data transmission abnormality of the node to be detected;

[0066] Furthermore, the calculation formula of the real-time data transmission abnormality is: in, Indicates the abnormality degree of the real-time data transmission, represents the weight coefficient of the packet loss rate, Indicates lost packets. Indicates the total number of packets. represents the weight coefficient of the data delay, Indicates the packet transmission delay, Indicates the preset maximum allowed delay, Indicates the data consistency The weight coefficient of .

[0067] Furthermore, the data consistency indicates whether the data content received or sent by the node is consistent with the expected content or the data content transmitted by other nodes. Data consistency can be obtained by obtaining node data and comparing and analyzing other node data.

[0068] Obtaining and processing direct trust, recommended trust and historical trust of adjacent communication nodes to obtain real-time trust of the node to be detected;

[0069] Furthermore, direct trust It can be calculated by the data forwarding success rate, node communication frequency and node response time. The data forwarding success rate indicates whether the node successfully forwards the received data packet, the node communication frequency indicates whether the node frequently communicates with other nodes, and the node response time indicates whether the node responds to the communication request in time.

[0070] Furthermore, the recommended trust of the adjacent communication nodes It is calculated by the evaluation of the node by the adjacent communication nodes. Each adjacent communication node will provide a trust evaluation based on the interaction with the node to be detected. , usually ranging from 0 to 1. The formula for calculating the recommendation trust is: Among them, Indicates The trust evaluation of the neighboring communication nodes on the node to be detected, Indicates The real-time trust of neighboring communication nodes, Represents a set of adjacent communication nodes.

[0071] Furthermore, the historical trust of the node to be detected is obtained, and combined with the above direct trust and the recommended trust of the adjacent communication nodes, the real-time trust of the node to be detected can be obtained. The calculation formula is: ;in, Indicates the real-time trust of the node to be detected, It indicates the real-time trust of the node to be detected calculated during the last network security detection process. , and is the weight coefficient and satisfies .

[0072] The real-time data transmission abnormality and the real-time trust are obtained and processed to obtain a comprehensive trust score. If the comprehensive trust score is lower than a preset comprehensive trust score threshold, the node to be detected is a malicious node. The calculation formula of the comprehensive trust score is: ;in, represents the comprehensive trust score, represents the weight coefficient, Indicates the abnormality degree of the real-time data transmission, Indicates the real-time confidence.

[0073] The real-time data transmission anomaly of the node to be detected is calculated by comprehensively analyzing transmission characteristics such as packet loss rate, data delay and data consistency. The real-time trust of the node to be detected is then obtained through direct trust, recommended trust and historical trust. A comprehensive trust score that can comprehensively detect malicious nodes is designed. It can more accurately determine whether the node to be detected is a malicious node, reduce the possibility of misjudgment, and improve the accuracy of malicious node detection.

[0074] Step S3: if the node to be detected is not the malicious node, the node to be detected is obtained and processed, and it is determined whether the node to be detected is a hijacked node. If the node to be detected is the hijacked node, an early warning is issued;

[0075] Furthermore, the hijacked node includes:

[0076] The transmission data per unit time of the node to be detected is obtained and processed to obtain the mean value of data transmission per unit time and the standard deviation of data transmission per unit time. The calculation formula of the data anomaly detection threshold is: ;in, represents the data anomaly detection threshold, Indicates the mean value of data transmission per unit time The weight coefficient of Indicates the standard deviation of data transmission per unit time ; if the real-time data transmission speed of the node to be detected is less than the data anomaly detection threshold, it means that the node to be detected is the hijacked node.

[0077] Further, obtain the node to be detected in the past Unit time The amount of data transmitted within the period, and then calculate the amount of data transmitted by the node to be detected in the past The mean and standard deviation of data transmission per unit time. The formula for calculating the mean is: ;in Indicated in The amount of data transmitted per unit time; the standard deviation is calculated as: ;in Represents the standard deviation of data transmission. By obtaining the amount of data transmitted in the past period of time and calculating the data anomaly detection threshold, rather than giving a fixed preset threshold, dynamic monitoring of the behavior of the node to be detected can be achieved, the hijacked drone node can be effectively identified, and the accuracy of detection can be improved.

[0078] Step S4: if the node to be detected is not the hijacked node, the node to be detected is acquired and processed, and it is determined whether the node to be detected has communication link security problems, data security problems, and navigation signal security problems. If there are problems, an early warning is issued;

[0079] Furthermore, the communication link security issues include:

[0080] The communication signal strength anomaly index, data integrity index, replay attack detection index and denial of service attack detection index are obtained and processed to obtain a comprehensive evaluation index of the communication link. If the comprehensive evaluation index of the communication link is greater than the preset comprehensive evaluation threshold of the communication link, it indicates that there is a communication link security problem and an early warning is issued.

[0081] Furthermore, the communication signal strength of the node to be detected is continuously monitored. If the communication signal strength is lower than the preset communication signal strength, the communication signal strength abnormality index is 1, and the communication link may be at risk of being interfered or eavesdropped. Otherwise, the communication signal strength abnormality index is 0.

[0082] Furthermore, at each communication, the sent data packet is processed to generate a hash value, and the hash value is recalculated after the data packet is received and compared with the received hash value. If they are not equal, it means that the data packet may have been tampered with, and the data integrity index is 1, otherwise it is 0;

[0083] Furthermore, a timestamp is added to each data packet to show the time when the data packet was sent. If the difference between the sending time and the receiving time of the data packet is greater than the allowed time delay, and the number of occurrences is greater than the preset abnormal number threshold, it indicates that a replay attack may exist, and the replay attack detection index is 1, otherwise it is 0;

[0084] Furthermore, if the request frequency of the node to be detected exceeds the preset frequency threshold, it may be attacked by a denial of service, and the denial of service attack detection index is 1, otherwise it is 0;

[0085] Furthermore, the calculation formula of the comprehensive evaluation index of the communication link is: ;in, represents the comprehensive evaluation index of the communication link of the node to be detected, Indicates abnormal communication signal strength indicator The weight coefficient of Indicates data integrity index The weight coefficient of Replay attack detection indicator The weight coefficient of Indicates the weight coefficient of the denial of service attack detection indicator, , , and The sum of is 1.

[0086] Furthermore, after calculation and processing, the indicators of the nodes to be detected are 1, 0, 0 and 1 respectively, the weight coefficients are set to 0.3, 0.4, 0.2 and 0.1, and the calculated comprehensive evaluation index of the communication link is 0.4, which is greater than the preset communication link comprehensive evaluation threshold of 0.3, indicating that there is a communication link security problem.

[0087] Through multi-dimensional detection of multiple security issues such as communication signal strength, data integrity, replay attacks and denial of service attacks of the communication link, combined with flexible allocation of weight coefficients and threshold warnings, timely warnings of communication link security issues can be achieved, thereby improving the efficiency of network security detection.

[0088] Furthermore, the data security issues include:

[0089] Perform encrypted data verification. If the verification fails, there is a security issue with the transmitted data.

[0090] If the verification is successful, the actual formation data of the node to be detected, the historical formation data of the node to be detected and the simulated formation data of the node to be detected are obtained and processed to obtain the comprehensive data similarity. If it is less than the preset similarity threshold, it indicates that there is a security problem with the transmitted data.

[0091] Furthermore, firstly, data verification can be performed by existing technologies, such as digital signatures, etc. If the verification fails, the data is unreliable or has been tampered with; if the verification passes, the actual formation data of the node to be detected and the historical formation data of similar formation scenes are obtained and processed to obtain the first data similarity between the actual formation data and the historical formation data. ; Then obtain the actual formation data and simulated formation data of the node to be detected and process them to obtain the second data similarity ; Combine the two similarities to get the comprehensive similarity of the data ,in and is the weight coefficient. If it is less than the preset data similarity threshold, it means that the currently transmitted data has security issues such as data tampering and forgery, and an early warning should be triggered immediately.

[0092] First, the integrity of the transmitted data is verified by encrypting the data to ensure that the data has not been tampered with during the transmission process; after encryption verification, double confirmation is performed through further data consistency detection, which can effectively identify abnormal data, enhance the ability to detect abnormal data, and improve the accuracy of abnormal data detection.

[0093] Furthermore, the navigation signal security issues include:

[0094] First, perform navigation signal strength detection, obtain the navigation signal strength of adjacent communication nodes and process them to obtain a local navigation signal strength range. If the signal strength of the node to be detected is not within the local navigation signal strength range, it indicates that there is a safety problem with the navigation signal;

[0095] Furthermore, first obtain the set of adjacent communication nodes The The navigation signal strength value of each node , and calculate the average of the navigation signal strength values ​​of all adjacent communication nodes and standard deviation , and then set a reasonable local navigation signal strength range\left [ {{\mu}_{DH}{-}_{}{\kappa}_{}{\cdot}_{}{\sigma}_{DH}{,}_{}{\mu}_{DH}{+}_{}{\kappa}_{}{\cdot}_{}{\sigma}_{DH}} \right ] ,in is the weight coefficient. If the navigation signal strength of the node to be detected is If it is not within the strength range of the local navigation signal, it means that the navigation strength is abnormal, and an early warning is issued that there is a safety problem with the navigation signal.

[0096] If the navigation signal strength does not have a safety problem, obtain the navigation signal of the adjacent communication node and the simulated navigation signal to calculate the real-time navigation deviation , the calculation formula is: ;in, Indicates The navigation signal of adjacent communication nodes, Indicates The simulated navigation signal of adjacent communication nodes, Represents the number of nodes in the set of adjacent communication nodes;

[0097] Furthermore, the navigation signal and the simulated navigation signal of the node to be detected are obtained and processed to obtain the deviation to be detected. If the deviation to be detected is less than or equal to the real-time navigation deviation, it means that the navigation signal of the node to be detected has no security problem. If the deviation to be detected is greater than the real-time navigation deviation, it means that the navigation information of the node to be detected has security problems.

[0098] First, the local navigation signal strength range is calculated using statistical methods, and the navigation signal strength of the node to be detected is detected, so as to detect the possible interference or tampering of the navigation signal as early as possible, ensuring the rapid and accurate detection; then, by comparing the navigation signal deviation of the node to be detected with the navigation signal deviation of the adjacent communication nodes, real-time navigation signal monitoring can be achieved, potential navigation signal security issues can be discovered in time, and early warnings can be issued.

[0099] Step S5: If there is no problem with the node to be detected, it means that there is no abnormality in the node to be detected, and the next node to be detected is obtained and a network security detection is performed; after the network security detection is performed on all the nodes to be detected, the network security detection is terminated;

[0100] Table 2. Network security test results of drone nodes

[0101] Node Number Malicious node detection Hijacked Node Detection Communication link security detection Data security testing Navigation signal safety detection Node 001 no no no no no Node 002 yes - - - - Node 003 no yes - - - Node 004 no no no no yes Node 005 no no yes - -

[0102] The detection results of whether the drone nodes have network security issues are shown in Table 2, which realizes the rapid detection of whether the drone nodes have network security issues.

[0103] Step S6: Send the early warning data to the ground station, wherein the early warning data includes abnormal drone nodes and network security issues.

[0104] First, the drone nodes are sorted by a real-time node sorting algorithm to ensure that the most important nodes with the greatest potential for security risks are given priority for network security detection, thereby improving the detection efficiency of drone nodes; then, the comprehensive trust score is used to achieve rapid and accurate malicious node detection of the nodes to be detected, and then the hijacked nodes are detected by analyzing the amount of data transmitted per unit time; then, the nodes to be detected are tested for communication link security issues, data security issues, and navigation signal security issues that are common in drone nodes. Through the network security detection method provided by the present invention, the drone performance team has achieved rapid detection of network security issues of each node in the drone formation, thereby improving detection efficiency.

[0105] The specific contents of the second embodiment are as follows:

[0106] like Figure 3Shown is a schematic diagram of the structure of the network security detection device provided by the present invention.

[0107] The node processing module is used to obtain and process all drone nodes and data to obtain a drone node set; sort the drone nodes according to a real-time node sorting algorithm to obtain a sorted drone node set; obtain data in the sorted drone node set to obtain a node to be detected;

[0108] Further, the function weight, real-time data transmission volume, real-time weight and real-time trust of the drone node are obtained and processed to obtain the data importance weight of the drone node;

[0109] The functional weight is assigned according to the function of the drone node, the real-time data transmission volume represents the data transmission volume of the drone node per unit time, the real-time weight is assigned according to the real-time requirement of the data transmitted by the drone node, and the real-time trust represents the robustness of the drone node;

[0110] Calculating the data importance weights of all the drone nodes, and sorting the drone nodes according to the values ​​of the data importance weights to obtain a sorted drone node set;

[0111] When acquiring the node to be detected, selection is performed according to the data importance weight.

[0112] Table 3. Data importance weights of some drone nodes

[0113] Drone Node Functional weight Real-time data transfer rate (kb / s) Real-time weight Real-time trust Data importance weight Node A 0.4 532 0.3 0.8 0.55 Node B 0.5 392 0.2 0.9 0.54 Node C 0.3 620 0.4 0.7 0.67 Node D 0.2 291 0.5 0.85 0.44 Node E 0.6 428 0.3 0.6 0.65

[0114] Table 3 shows the relevant data for calculating the data importance weights of drone nodes. After calculating the data importance weights, they are sorted and subsequently tested for network security based on their numerical values.

[0115] A malicious node detection module is used to obtain the node to be detected and determine whether the node to be detected is a malicious node, and issue an early warning if the node to be detected is the malicious node;

[0116] Furthermore, the real-time data transmission anomaly of the node to be detected is calculated by comprehensively considering transmission characteristics such as packet loss rate, data delay and data consistency. The real-time trust of the node to be detected is then obtained through direct trust, recommended trust and historical trust. A comprehensive trust score that can comprehensively detect malicious nodes is designed, thereby improving the detection efficiency of malicious nodes.

[0117] A hijacked node detection module, used to obtain and process the node to be detected, determine whether the node to be detected is a hijacked node, and issue an early warning if the node to be detected is the hijacked node;

[0118] Furthermore, by acquiring and processing data, a data anomaly detection threshold is obtained. If the real-time data transmission volume per unit time is less than the data anomaly detection threshold, it indicates that the node to be detected is the hijacked node.

[0119] A data detection module is used to obtain and process the node to be detected, determine whether the node to be detected has communication link security problems, data security problems and navigation signal security problems, and issue an early warning if there are any problems;

[0120] Furthermore, the data detection module includes a communication link security problem detection unit, a data security problem detection unit and a navigation signal security problem detection unit.

[0121] Furthermore, in the data security problem detection unit, data encryption verification is first performed, and after verification, the actual formation data is analyzed. The data on network communication in the formation data includes the communication signal strength and content, the control instructions and status feedback executed by the drone, etc. The data on network security includes the communication log of the node and the data verification results, etc. Obtain the actual formation data vector of the node to be detected , historical formation data vector and simulation formation data vector After that, first obtain the actual formation data vector and the historical formation data vector and calculate the first data similarity. The calculation formula is: in, represents the first data similarity, represents the length of the vector, The actual formation data vector data, The first vector representing the historical formation data Team data.

[0122] Furthermore, a similar calculation method can be used to obtain the second data similarity: , and then through weighted calculation, the final data comprehensive similarity is obtained If the comprehensive similarity of the data is less than the preset data similarity threshold, it means that there may be security issues with the data.

[0123] The network security problem summary module is used to send early warning data to the ground station, and the early warning data includes abnormal drone nodes and network security problems.

[0124] Furthermore, after the network security detection is performed on all drone nodes, early warning data will be generated immediately, and the early warning data contains detailed abnormal information, including:

[0125] Abnormal drone node identification: specifically mark the drone node or nodes where network security issues are detected. The node’s unique identifier, such as the node number or MAC address, will also be included in the warning data;

[0126] Problem type: Indicates the specific network security issues detected, such as malicious nodes, hijacked nodes, communication link security issues, data security issues, and navigation signal security issues;

[0127] Timestamp: records the time when the network security problem is detected, which is convenient for subsequent security problem analysis;

[0128] Abnormal data: Provides relevant indicators of network security issues, such as packet loss rate, signal strength, delay time and data, to facilitate subsequent fault diagnosis and troubleshooting;

[0129] Abnormal drone node historical information: including historical trust and data of abnormal drone nodes, which facilitates the analysis of the historical behavior of the node.

[0130] Table 4. Node network security detection results

[0131] Node Number Malicious node detection Hijacked Node Detection Communication link security detection Data security testing Navigation signal safety detection Node A no no no no no Node B no no no no no Node C no no no no no Node D no no no no no Node E no no yes - -

[0132] Table 4 shows the network security detection results of drone nodes. Through the above-mentioned network security problem detection method, real-time network security detection of nodes in the drone formation is realized, which improves the detection efficiency. Then, by sending early warning data to the ground station in a timely manner, real-time monitoring and rapid processing of network security issues can be achieved, which improves the network security processing efficiency of drone nodes, reduces the impact of drone node network security problems on the entire formation, and effectively improves the security and fault tolerance of the drone network.

[0133] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network security detection method, characterized in that: include: Step S1: Obtain and process all drone nodes and data to obtain a drone node set; Sorting the drone nodes according to a real-time node sorting algorithm to obtain a sorted drone node set; Acquire the data in the sorted drone node set to obtain the node to be detected; The real-time node sorting algorithm includes: The function weight, real-time data transmission volume, real-time weight and real-time trust of the drone node are obtained and processed to obtain the data importance weight of the drone node; The functional weight is assigned according to the function of the drone node, the real-time data transmission volume represents the amount of data transmitted by the drone node per unit time, the real-time weight is assigned according to the response time and transmission speed of the drone node transmitting data, and the real-time trust represents the robustness of the drone node; Calculating the data importance weights of all the drone nodes, and sorting the drone nodes according to the values ​​of the data importance weights to obtain a sorted drone node set; When acquiring the node to be detected, selecting according to the importance weight of the data; Step S2: obtaining the node to be detected and determining whether the node to be detected is a malicious node, and issuing an early warning if the node to be detected is the malicious node; The malicious nodes include: Obtaining and processing the data packet loss rate, data delay and data consistency to obtain the real-time data transmission abnormality of the node to be detected; Obtaining and processing direct trust, recommended trust and historical trust of adjacent communication nodes to obtain real-time trust of the node to be detected; The real-time data transmission abnormality and the real-time trust are obtained and processed to obtain a comprehensive trust score; if the comprehensive trust score is lower than a preset comprehensive trust score threshold, the node to be detected is the malicious node; The calculation formula of the comprehensive trust score is: in, represents the comprehensive trust score, represents the weight coefficient, Indicates the abnormality degree of the real-time data transmission, indicating the real-time confidence level; Step S3: if the node to be detected is not the malicious node, the node to be detected is obtained and processed, and it is determined whether the node to be detected is a hijacked node. If the node to be detected is the hijacked node, an early warning is issued; Step S4: if the node to be detected is not the hijacked node, the node to be detected is acquired and processed, and it is determined whether the node to be detected has communication link security problems, data security problems, and navigation signal security problems. If there are problems, an early warning is issued; The navigation signal security issues include: Obtaining and processing the navigation signal strength of the adjacent communication nodes of the node to be detected to obtain a local navigation signal strength range, if the navigation signal strength of the node to be detected does not fall within the local navigation signal strength range, it indicates that there is a safety problem with the navigation signal; If there is no problem with the navigation signal strength, the navigation signal and the simulated navigation signal of the adjacent communication node are obtained to calculate the real-time navigation deviation; the navigation signal and the simulated navigation signal of the node to be detected are obtained and processed to obtain the deviation to be detected; if the deviation to be detected is less than or equal to the real-time navigation deviation, it indicates that there is no problem with the navigation signal of the node to be detected; if the deviation to be detected is greater than the real-time navigation deviation, it indicates that there is a security problem with the navigation signal of the node to be detected; Step S5: If there is no problem with the node to be detected, it means that there is no abnormality in the node to be detected, and the next node to be detected is obtained and a network security detection is performed; after the network security detection is performed on all the nodes to be detected, the network security detection is terminated; Step S6: Send the early warning data to the ground station, wherein the early warning data includes abnormal drone nodes and network security issues.

2. The network security detection method according to claim 1, characterized in that: The hijacked nodes include: The transmission data per unit time of the node to be detected is obtained and processed to obtain the mean value of data transmission per unit time and the standard deviation of data transmission per unit time; the calculation formula of the data anomaly detection threshold is: in, represents the data anomaly detection threshold, Indicates the mean value of data transmission per unit time The weight coefficient of Indicates the standard deviation of data transmission per unit time ; if the real-time data transmission speed of the node to be detected is less than the data anomaly detection threshold, it means that the node to be detected is the hijacked node.

3. The network security detection method according to claim 1, characterized in that: The communication link security issues include: The communication signal strength anomaly index, data integrity index, replay attack detection index and denial of service attack detection index are obtained and processed to obtain a comprehensive evaluation index of the communication link. If the comprehensive evaluation index of the communication link is greater than the preset comprehensive evaluation threshold of the communication link, it indicates that there is a security problem of the communication link and an early warning is issued.

4. The network security detection method according to claim 1, characterized in that: The data security issues include: Perform encrypted data verification. If the verification fails, there is a security issue with the transmitted data. If the verification is successful, the actual formation data of the node to be detected, the historical formation data of the node to be detected and the simulated formation data of the node to be detected are obtained and processed to obtain the comprehensive data similarity. If it is less than the preset similarity threshold, it indicates that there is a security problem with the transmitted data.

5. A network security detection device, characterized in that: include: The node processing module is used to obtain and process all drone nodes and data to obtain a drone node set; Sorting the drone nodes according to a real-time node sorting algorithm to obtain a sorted drone node set; Acquire the data in the sorted drone node set to obtain the node to be detected; The real-time node sorting algorithm includes: The function weight, real-time data transmission volume, real-time weight and real-time trust of the drone node are obtained and processed to obtain the data importance weight of the drone node; The functional weight is assigned according to the function of the drone node, the real-time data transmission volume represents the amount of data transmitted by the drone node per unit time, the real-time weight is assigned according to the response time and transmission speed of the drone node transmitting data, and the real-time trust represents the robustness of the drone node; Calculating the data importance weights of all the drone nodes, and sorting the drone nodes according to the values ​​of the data importance weights to obtain a sorted drone node set; When acquiring the node to be detected, selecting according to the importance weight of the data; A malicious node detection module is used to obtain the node to be detected and determine whether the node to be detected is a malicious node, and issue an early warning if the node to be detected is the malicious node; The malicious nodes include: Obtaining and processing the data packet loss rate, data delay and data consistency to obtain the real-time data transmission abnormality of the node to be detected; Obtaining and processing direct trust, recommended trust and historical trust of adjacent communication nodes to obtain real-time trust of the node to be detected; The real-time data transmission abnormality and the real-time trust are obtained and processed to obtain a comprehensive trust score; if the comprehensive trust score is lower than a preset comprehensive trust score threshold, the node to be detected is the malicious node; The calculation formula of the comprehensive trust score is: in, represents the comprehensive trust score, represents the weight coefficient, Indicates the abnormality degree of the real-time data transmission, indicating the real-time confidence level; A hijacked node detection module is used to obtain and process the node to be detected, determine whether the node to be detected is a hijacked node, and issue an early warning if the node to be detected is the hijacked node; A data detection module is used to obtain and process the node to be detected, determine whether the node to be detected has communication link security problems, data security problems and navigation signal security problems, and issue an early warning if there are any problems; The navigation signal security issues include: Obtaining and processing the navigation signal strength of the adjacent communication nodes of the node to be detected to obtain a local navigation signal strength range, if the navigation signal strength of the node to be detected does not fall within the local navigation signal strength range, it indicates that there is a safety problem with the navigation signal; If there is no problem with the navigation signal strength, the navigation signal and the simulated navigation signal of the adjacent communication node are obtained to calculate the real-time navigation deviation; the navigation signal and the simulated navigation signal of the node to be detected are obtained and processed to obtain the deviation to be detected; if the deviation to be detected is less than or equal to the real-time navigation deviation, it indicates that there is no problem with the navigation signal of the node to be detected; if the deviation to be detected is greater than the real-time navigation deviation, it indicates that there is a security problem with the navigation signal of the node to be detected; The network security problem summary module is used to send early warning data to the ground station, and the early warning data includes abnormal drone nodes and network security problems.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images