Satellite-ground link vulnerability analysis method and device for sky-ground fusion Internet

Abstract

The invention provides a satellite-ground link vulnerability analysis method and device for a space-ground fusion internet. The method comprises the following steps: acquiring accumulated service duration of each ground station in the space-ground fusion internet; obtaining the number of service blocks of each ground station in the sky-ground fusion Internet; obtaining legal user traffic of each satellite-ground link in the sky-ground fusion Internet under a set time slice; and according to the accumulated service duration and the service block number corresponding to each ground station and the legal user traffic of each satellite-ground link under the set time slice, analyzing the vulnerability of the satellite-ground links in the sky-ground fusion Internet to obtain a vulnerability analysis result of the satellite-ground links. According to the method, vulnerability analysis is carried out from the three aspects of the number of ground station service blocks, the accumulated service duration of the ground station and the satellite-ground link flow, a vulnerable satellite-ground link which is vulnerable to attacks is positioned, effective analysis of the vulnerability of the satellite-ground link in the sky-ground fusion Internet is realized, potential security threats are helped to be identified and relieved, and the security of the satellite-ground link is improved. And the stability and reliability of the network are ensured.

Description

Technical Field

[0001] The present invention relates to the field of satellite communication technology, and in particular to a satellite-to-ground link vulnerability analysis method and device for a space-ground integrated Internet. Background Art

[0002] With the rapid development of communication technology and aerospace technology, low-orbit satellites are being deployed on a large scale and have attracted widespread attention for their ability to provide global Internet services.

[0003] Some commercial companies are actively deploying a large number of low-orbit satellites to form giant low-orbit satellite constellations, such as SpaceX's Starlink, Amazon's Kuiper, and Telesat. These giant low-orbit satellite constellations are composed of multiple layers of satellites. For example, the first phase of Starlink's plan is to deploy a giant constellation consisting of five layers of satellites, totaling 4,408 satellites. Low-orbit satellites provide low-latency, high-bandwidth network services by deploying high-speed laser or microwave links. In the ground segment, satellites can be connected to ground stations and user terminals. Therefore, the integrated Internet of space and earth, composed of satellite networks, ground infrastructure and the global Internet, can provide high-quality network services to a large number of users around the world.

[0004] At the same time, the space-ground integrated Internet also faces severe security threats. There are various potential threats in satellite terminal systems and satellite communications, such as link interference, electromagnetic attacks, energy attacks, and deception attacks. Real security threat incidents of the space-ground integrated Internet are also emerging in an endless stream. On November 18, 2022, Killne claimed to have completed three distributed denial-of-service attacks on Starlink satellites, causing a large number of users to be unable to use Starlink services for hours.

[0005] Therefore, how to alleviate the security issues existing in the existing space-ground integrated Internet is an important issue that needs to be urgently addressed in the field of satellite communications. Summary of the invention

[0006] The present invention provides a satellite-to-ground link vulnerability analysis method and device for a space-ground integrated Internet, so as to overcome the defect that the prior art cannot effectively evaluate the security risks in the space-ground integrated Internet, resulting in various security problems, and realizes effective analysis of the satellite-to-ground link vulnerability in the space-ground integrated Internet, thereby helping to identify and alleviate potential security threats and ensure the stability and reliability of the network.

[0007] On the one hand, the present invention provides a satellite-to-ground link vulnerability analysis method for a space-ground integrated Internet, comprising: obtaining the cumulative service time of each ground station in the space-ground integrated Internet; obtaining the number of service blocks of each ground station in the space-ground integrated Internet; obtaining the legal user flow of each satellite-to-ground link in the space-ground integrated Internet under a set time slice; analyzing the vulnerability of the satellite-to-ground link in the space-ground integrated Internet according to the cumulative service time and the number of service blocks corresponding to each ground station, and the legal user flow of each satellite-to-ground link under the set time slice, to obtain a vulnerability analysis result of the satellite-to-ground link.

[0008] Furthermore, the vulnerability of the satellite-to-ground link in the space-ground integrated Internet is analyzed according to the cumulative service time and the number of service blocks corresponding to each ground station, and the legitimate user flow of each satellite-to-ground link in a set time slice, including: sorting the cumulative service time and the number of service blocks of all ground stations in descending order; selecting ground stations whose cumulative service time and the number of service blocks are both ranked before a set sequence number, and using the selected ground stations as candidate ground stations; determining the legitimate user flow of the satellite-to-ground link connected to the candidate ground station in the set time slice, and selecting the satellite-to-ground link whose legitimate user flow in the set time slice is higher than the set link capacity threshold; sorting the legitimate user flow of the selected satellite-to-ground link in descending order to obtain a sorted satellite-to-ground link set; wherein the sorted satellite-to-ground link set in the set time slice includes vulnerable satellite-to-ground links of the space-ground integrated Internet, and the vulnerable satellite-to-ground links are the vulnerability analysis results of the satellite-to-ground links.

[0009] Furthermore, the method of obtaining the vulnerability analysis result of the satellite-to-ground link then includes: deploying malicious terminals in a set time slice to obtain a block weight table in the set time slice; aggregating and deploying a target block weight table according to multiple block weight tables in the set time slices; based on the target block weight table, flooding the vulnerable satellite-to-ground link with the deployed malicious terminals to cause congestion, so as to verify the obtained vulnerability analysis result; wherein each element in the block weight table represents the number of malicious terminals that need to be deployed in a geographical block in the set time slice.

[0010] Further, the malicious terminal is deployed in a set time slice to obtain a block weight table in the set time slice, including: determining target links one by one according to the legitimate user traffic of the fragile satellite-to-ground link; wherein the target link is the fragile satellite-to-ground link with the largest legitimate user traffic; determining candidate satellites connected to the target link, and selecting a target satellite from the candidate satellites; wherein the target satellite is a candidate satellite whose coverage area is adjacent to the block in which the malicious terminal is deployed, or the target satellite is the satellite closest to the target link among the candidate satellites; determining the number of deployed malicious terminals in the geographical block covered by the target satellite according to the available bandwidth of the target satellite; and repeating the steps of selecting the target satellite and determining the number of deployed malicious terminals in the geographical block covered by it to obtain the block weight table in the set time slice.

[0011] Furthermore, the block weight tables under multiple set time slices are aggregated and deployed to obtain a target block weight table, including: taking an average value of the block weight tables under multiple set time slices to create an average block weight table; selecting the geographical block with the highest weight in the average block weight table as the target geographical block, and determining the satellite connected to the target geographical block as the aggregated satellite; adding the weights of all geographical blocks covered by the aggregated satellite to the weight of the target geographical block, and setting the original weights of the remaining geographical blocks covered by the aggregated satellite to zero; repeating the target geographical block selection and aggregation steps to obtain the target block weight table.

[0012] Furthermore, determining the number of deployed malicious terminals in the geographical block covered by the target satellite based on the available bandwidth of the target satellite includes: when the available bandwidth of the target satellite is less than a first threshold, determining the number of deployed malicious terminals in the geographical block covered by the target satellite as a first number; when the available bandwidth of the target satellite is greater than or equal to the first threshold, determining the number of deployed malicious terminals in the geographical block covered by the target satellite as a second number.

[0013] Furthermore, the link flooding is performed on the vulnerable satellite-to-ground link by the deployed malicious terminal to make it congested so as to verify the obtained vulnerability analysis result, including: sending malicious traffic of a set throughput to the uplink connected to the satellite by the deployed malicious terminal; counting the throughput reduction rate of legitimate user traffic of the vulnerable satellite-to-ground link; and verifying the validity of the vulnerability analysis result according to the throughput reduction rate of legitimate user traffic of the vulnerable satellite-to-ground link.

[0014] In a second aspect, the present invention also provides a satellite-to-ground link vulnerability analysis device for a space-ground integrated Internet, comprising: a cumulative service time acquisition module, used to obtain the cumulative service time of each ground station in the space-ground integrated Internet; a service block number acquisition module, used to obtain the number of service blocks of each ground station in the space-ground integrated Internet; a legal user traffic acquisition module, used to obtain the legal user traffic of each satellite-to-ground link in the space-ground integrated Internet under a set time slice; a satellite-to-ground link vulnerability analysis module, used to analyze the vulnerability of the satellite-to-ground link in the space-ground integrated Internet according to the cumulative service time and the number of service blocks corresponding to each ground station, and the legal user traffic of each satellite-to-ground link under the set time slice, and obtain a vulnerability analysis result of the satellite-to-ground link.

[0015] In a third aspect, the present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet as described in any one of the above-mentioned methods is implemented.

[0016] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a satellite-to-ground link vulnerability analysis method for a space-ground integrated Internet as described in any one of the above.

[0017] The satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet provided by the present invention obtains the cumulative service time and the number of service blocks of each ground station in the space-ground integrated Internet, and obtains the legal user flow of each satellite-to-ground link in the space-ground integrated Internet under a set time slice, and then analyzes the vulnerability of the satellite-to-ground link in the space-ground integrated Internet according to the cumulative service time and the number of service blocks corresponding to each ground station, and the legal user flow of each satellite-to-ground link under a set time slice, and obtains the vulnerability analysis result of the satellite-to-ground link. The method performs vulnerability analysis from three perspectives, namely, the number of service blocks of the ground station, the cumulative service time of the ground station, and the flow of the satellite-to-ground link, locates the vulnerable satellite-to-ground link that is vulnerable to attack, realizes the effective analysis of the vulnerability of the satellite-to-ground link in the space-ground integrated Internet, helps identify and alleviate potential security threats, and ensures the stability and reliability of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of a satellite-to-ground link vulnerability analysis method of a space-ground integrated Internet provided by an embodiment of the present invention.

[0020] Figure 2 It is a schematic diagram of the overall process of the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet provided by an embodiment of the present invention.

[0021] Figure 3 It is a comparison diagram of the results of the present invention and ICARUS attacking the same number of satellite-to-ground links provided by an embodiment of the present invention.

[0022] Figure 4 It is a comparison diagram of the attack effect of the present invention on the vulnerable satellite-to-ground link of Starlink provided by an embodiment of the present invention.

[0023] Figure 5 It is a comparison diagram of the attack effect of ICARUS on the satellite-to-ground link of Starlink provided by an embodiment of the present invention.

[0024] Figure 6 It is a schematic diagram of the present invention and ICARUS attacking Starlink to cause a decrease in legitimate user traffic throughput provided by an embodiment of the present invention.

[0025] Figure 7 It is a comparison diagram of the attack effects of the present invention on vulnerable satellite-to-ground links of different low-orbit satellite constellations provided by an embodiment of the present invention.

[0026] Figure 8 It is a schematic diagram of cost situations under different topologies provided by an embodiment of the present invention.

[0027] Fig. 9 It is a structural schematic diagram of a satellite-to-ground link vulnerability analysis device of a space-ground integrated Internet provided by an embodiment of the present invention.

[0028] Fig.10 It is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0030] It should be noted that in response to the security issues faced by the space-ground integrated Internet, the existing technology lacks research on satellite-to-ground link security analysis methods targeting the dynamic interaction between satellite networks and ground networks, and the uneven distribution of users and ground stations. There is an urgent need for a satellite-to-ground link vulnerability analysis method.

[0031] Due to the uneven distribution of ground stations and users, there are differences in satellite-to-ground link traffic, connection duration, and the number of service blocks, which are time-varying, and some satellite-to-ground links will become vulnerable points.

[0032] In view of this, the present invention proposes a satellite-to-ground link vulnerability analysis method for a space-to-ground integrated Internet. Specifically, Figure 1 A schematic flow chart of a satellite-to-ground link vulnerability analysis method for a space-ground integrated Internet provided in an embodiment of the present invention is shown.

[0033] like Figure 1 As shown, the method includes steps S110-S140, and steps S110-S140 and related steps will be described in detail below.

[0034] S110, obtaining the accumulated service time of each ground station in the space-ground integrated Internet.

[0035] The space-ground integrated Internet is a comprehensive communication system that combines ground network and satellite communication technology. This system aims to provide wider, more stable and more efficient network coverage and services by integrating ground infrastructure (such as ground stations, optical fiber networks, mobile base stations, etc.) with space-based resources (satellites). The space-ground integrated Internet has the characteristics of wide geographical coverage, high reliability and redundancy, flexible services, and support for diversified applications.

[0036] It is understandable that in order to obtain the cumulative service time of each ground station in the space-ground integrated Internet, it is first necessary to ensure that the recorded data of the connection status between each ground station and the satellite in the space-ground integrated Internet can be accessed. These recorded data include at least the start time, end time and corresponding ground station information of each connection.

[0037] Then, the time range for analysis is determined (set time slice), which can be set according to actual needs and is not specifically limited here. For example, in a specific embodiment, a set time slice is a natural day (00:00 to 23:59 on October 1, 24).

[0038] It should be noted that the number of time slices may be one or more, and is not specifically limited here.

[0039] Next, all recorded data involving communication connections between ground stations and satellites within a set time slice are filtered out from the database or log file. For each recorded data of a communication connection, the duration of a single communication connection is calculated by subtracting the start time from the end time. The duration of all single communication connections of the same ground station on the same day is added together to obtain the daily cumulative service time of the ground station. In this way, the daily cumulative service time of all ground stations can be obtained.

[0040] On this basis, a table can be created to list each ground station and its corresponding daily cumulative service time, and all ground stations can be sorted according to the daily cumulative service time, so that the service busyness of each ground station can be clearly seen.

[0041] Among them, all ground stations are sorted according to the daily cumulative service time, which can be in ascending order or descending order. It can be set according to actual needs and is not specifically limited here.

[0042] For example, in a specific embodiment, all ground stations are sorted in descending order according to the daily accumulated service time, so that it can be clearly seen which ground stations have the busiest services.

[0043] While the accumulated service time of each ground station in the space-ground integrated Internet is obtained in step S110, step S120 is executed.

[0044] S120, obtaining the number of service blocks of each ground station in the space-ground integrated Internet.

[0045] Similarly, in order to obtain the number of service blocks of each ground station in the space-ground integrated Internet, it is first necessary to ensure that the recorded data of user traffic entering the Internet from the ground station through the low-orbit satellite network can be accessed. The recorded data here at least includes the user's location information, the ground station used, and the connection time.

[0046] Then, the size and boundaries of the geographic blocks are defined according to actual needs. They can be defined based on administrative regions (such as cities, counties), latitude and longitude grids, or other specific standards, which are not specifically limited here.

[0047] Next, filter out the recorded data of all user traffic interacting with the ground station through the low-orbit satellite network within the set time slice from the database or log file. For each user traffic record, determine the geographical block to which it belongs based on the user's geographical location information. For each ground station, count all the different geographical blocks it serves to obtain the number of service blocks of the ground station. In this way, the number of service blocks of all ground stations can be obtained.

[0048] On this basis, a table can also be created to list each ground station and its corresponding number of service blocks, and all ground stations can be sorted according to the number of service blocks.

[0049] Among them, all ground stations are sorted according to the number of service blocks, which can be in ascending order or descending order. It can be set according to actual needs and is not specifically limited here.

[0050] For example, in a specific embodiment, all ground stations are sorted in descending order according to the number of service blocks, so that it can be clearly seen which ground stations serve more geographical blocks.

[0051] While obtaining the number of service blocks of each ground station in the space-ground integrated Internet in step S120 , step S130 is executed.

[0052] S130, obtaining the legal user traffic of each satellite-to-ground link in the space-ground integrated Internet in a set time slice.

[0053] It is easy to understand that in order to obtain the legitimate user traffic of each satellite-to-ground link in the space-ground integrated Internet within a set time slice, it is first necessary to ensure that the recorded data transmitted through the satellite-to-ground link can be accessed. The recorded data here at least includes a link identifier, timestamp, user identifier, traffic size, and a flag indicating whether it is legitimate traffic.

[0054] Then, a set time slice for dividing the recorded data is determined, such as every hour, every day, etc., which can be set according to the accuracy level requirements and is not specifically limited here.

[0055] Next, based on the flag field indicating whether the traffic is legitimate, all the recorded data of legitimate user traffic is screened out, and all the legitimate user traffic is divided into set time slices according to the timestamps.

[0056] For each satellite-to-ground link within each set time slice, its legal user traffic is summarized to obtain the legal user traffic (total amount) of each satellite-to-ground link in the set time slice.

[0057] On this basis, a table can still be created to list each satellite-to-ground link and its corresponding legitimate user traffic (total amount) to evaluate the data transmission volume of each satellite-to-ground link in different time slices.

[0058] Based on obtaining the accumulated service time of each ground station in the space-ground integrated Internet in step S110, obtaining the number of service blocks of each ground station in the space-ground integrated Internet in step S120, and obtaining the legal user traffic of each satellite-to-ground link in the space-ground integrated Internet in a set time slice in step S130, further, executing step S140.

[0059] S140, analyzing the vulnerability of the satellite-to-ground link in the space-ground integrated Internet according to the accumulated service time and the number of service blocks corresponding to each ground station, and the legitimate user traffic of each satellite-to-ground link in a set time slice, and obtaining a vulnerability analysis result of the satellite-to-ground link.

[0060] It is easy to understand that in order to analyze the vulnerability of the satellite-to-ground link of the space-ground integrated Internet, this embodiment comprehensively considers multiple factors, including the service duration of the ground station, the number of service blocks, and the legitimate user traffic in a specific time slice. These factors can help evaluate the load of the satellite-to-ground link and the potential risks it may face.

[0061] Specifically, vulnerability indicators can be defined, such as continuous working time, service area density, and overload index. Among them, continuous working time refers to the number of hours that the ground station works continuously. Long-term operation may cause equipment fatigue or failure. Service area density refers to the ratio of the number of service blocks to the coverage area. High density may mean higher communication needs and greater pressure. The overload index refers to the ratio of the amount of data passing through a satellite-to-ground link within a set time slice to the maximum carrying capacity of the satellite-to-ground link.

[0062] After defining the vulnerability indicators, for each satellite-to-ground link, a comprehensive vulnerability score is calculated by combining the defined vulnerability indicators. For example, the defined vulnerability indicators can be integrated by weighted average.

[0063] Of course, the vulnerability of the satellite-to-ground link of the space-ground integrated Internet can also be analyzed by other methods, which will be elaborated in detail in the embodiments below.

[0064] In this embodiment, the vulnerability analysis result of the satellite-to-ground link may be a score representing the vulnerability score of the corresponding satellite-to-ground link, or may be a category representing whether the corresponding satellite-to-ground link is a vulnerable satellite-to-ground link, which is not specifically limited herein.

[0065] In this embodiment, by obtaining the cumulative service time and the number of service blocks of each ground station in the integrated Internet of Space and Earth, and obtaining the legal user flow of each satellite-to-ground link in the integrated Internet of Space and Earth under a set time slice, the vulnerability of the satellite-to-ground link in the integrated Internet of Space and Earth is analyzed according to the cumulative service time and the number of service blocks corresponding to each ground station, and the legal user flow of each satellite-to-ground link in the set time slice, and the vulnerability analysis result of the satellite-to-ground link is obtained. The method locates vulnerable satellite-to-ground links that are vulnerable to attack by performing vulnerability analysis from three perspectives: the number of service blocks of the ground station, the cumulative service time of the ground station, and the flow of the satellite-to-ground link, thereby realizing an effective analysis of the vulnerability of the satellite-to-ground link in the integrated Internet of Space and Earth, helping to identify and mitigate potential security threats, and ensuring the stability and reliability of the network.

[0066] On the basis of the above-mentioned embodiments, the vulnerability analysis process of the satellite-to-ground link in the space-ground integrated Internet will be described in detail below.

[0067] According to the cumulative service time and the number of service blocks corresponding to each ground station, and the legal user flow of each satellite-to-ground link in a set time slice, the vulnerability of the satellite-to-ground link in the space-ground integrated Internet is analyzed, including: sorting the cumulative service time and the number of service blocks of all ground stations in descending order; selecting the ground stations whose cumulative service time and the number of service blocks are both ranked before the set sequence number, and taking the selected ground stations as candidate ground stations; determining the legal user flow of the satellite-to-ground link connected to the candidate ground station in the set time slice, and selecting the satellite-to-ground link whose legal user flow in the set time slice is higher than the set link capacity threshold; sorting the legal user flow of the selected satellite-to-ground link in descending order to obtain a sorted satellite-to-ground link set; wherein the sorted satellite-to-ground link set includes vulnerable satellite-to-ground links of the space-ground integrated Internet, and the vulnerable satellite-to-ground links are the vulnerability analysis results of the satellite-to-ground links.

[0068] It can be understood that the accumulated service time and the number of service blocks corresponding to each ground station are sorted in descending order. Based on the descending sorting results of the accumulated service time and the number of service blocks, the accumulated service time and the number of service blocks are selected to be ranked first (at the set sequence number The ground stations before are selected as candidate ground stations.

[0069] For example, the cumulative service time will be sorted before , and the number of service blocks in the set time slice is also sorted before The ground station is determined as the candidate ground station. It can be set according to actual needs and is not specifically limited here.

[0070] In this embodiment, use To indicate the setting time slice These ground stations with the highest ranking are called candidate ground stations.

[0071] Then, the satellite-to-ground links connected to the candidate ground stations are determined, and the satellite-to-ground links whose legitimate user traffic in a set time slice is higher than a set link capacity threshold are selected as vulnerable satellite-to-ground links.

[0072] Optionally, the vulnerable satellite-to-ground links with legitimate user traffic above the set link capacity threshold can be sorted and the time slice can be set. The set of vulnerable satellite-to-ground links after sorting is , represents the setting time slice The fragile satellite-to-ground link.

[0073] Combining multiple set time slices The vulnerable satellite-to-ground links of the space-ground integrated Internet can be obtained by .in, Indicates the attack period, including multiple set time slices .

[0074] In this embodiment, the cumulative service time and the number of service blocks of all ground stations are sorted in descending order, and the ground stations whose cumulative service time and the number of service blocks are ranked before the set sequence number are selected, and the selected ground stations are used as candidate ground stations, and then the legal user flow of the satellite-to-ground link connected to the candidate ground station in the set time slice is determined, and the satellite-to-ground link whose legal user flow in the set time slice is higher than the set link capacity threshold is selected, thereby sorting the legal user flow of the selected satellite-to-ground link in descending order to obtain a sorted satellite-to-ground link set; wherein the sorted satellite-to-ground link set in the set time slice includes the vulnerable satellite-to-ground link of the space-ground integrated Internet, and the vulnerable satellite-to-ground link is the vulnerability analysis result of the satellite-to-ground link. The method locates vulnerable satellite-to-ground links that are vulnerable to attack by performing vulnerability analysis from three perspectives: the number of ground station service blocks, the cumulative service time of the ground station, and the satellite-to-ground link flow, thereby realizing an effective analysis of the vulnerability of the satellite-to-ground link in the space-ground integrated Internet, helping to identify and mitigate potential security threats, and ensuring the stability and reliability of the network.

[0075] On the basis of the above-mentioned embodiment, further, the process of verifying the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet provided by the embodiment of the present invention will be described in detail below.

[0076] After obtaining the vulnerability analysis result of the satellite-to-ground link, the method includes: deploying malicious terminals in a set time slice to obtain a block weight table in the set time slice; aggregating and deploying a target block weight table according to a plurality of block weight tables in the set time slices; and flooding the vulnerable satellite-to-ground link with the deployed malicious terminals based on the target block weight table to make it congested, so as to verify the obtained vulnerability analysis result; wherein each element in the block weight table represents the number of malicious terminals that need to be deployed in a geographical block in the set time slice.

[0077] It is easy to understand that for the cycle T Each set time slice t , first set the time slice t Determine the malicious terminal deployment plan (block weight table), and then, according to multiple set time slices tThe malicious terminal deployment scheme under the above conditions is analyzed to obtain the final malicious terminal deployment scheme (target block weight table). Finally, the malicious terminal is deployed through the final malicious terminal deployment scheme, and malicious traffic is initiated to flood the vulnerable satellite-to-ground link, causing congestion, thereby verifying the effectiveness of the satellite-to-ground link vulnerability analysis method.

[0078] In a specific embodiment, a single set time slice is described in detail. t The following is the analysis process of the malicious terminal deployment plan.

[0079] The malicious terminal is deployed in a set time slice to obtain a block weight table in the set time slice, including: determining target links one by one according to legitimate user traffic of a vulnerable satellite-to-ground link; wherein the target link is a vulnerable satellite-to-ground link with the largest legitimate user traffic; determining candidate satellites connected to the target link, and selecting a target satellite from the candidate satellites; wherein the target satellite is a candidate satellite whose coverage area is adjacent to the block in which the malicious terminal is deployed, or the target satellite is a satellite closest to the target link among the candidate satellites; determining the number of deployed malicious terminals in the geographical block covered by the target satellite according to the available bandwidth of the target satellite; and repeating the steps of selecting the target satellite and determining the number of deployed malicious terminals in the geographical block covered by the target satellite to obtain the block weight table in the set time slice.

[0080] It can be understood that, according to the above embodiments, the vulnerability of the satellite-to-ground links of the space-ground integrated Internet has been effectively analyzed, and several vulnerable satellite-to-ground links have been learned.

[0081] Furthermore, first, according to the size of the legitimate user traffic of the fragile satellite-to-ground link, Select the target link Specifically, in each selection, the fragile satellite-to-ground link in the fragile satellite-to-ground link set with the largest legitimate user traffic will be determined as the target link and will not be included in the next selection and subsequent selection processes.

[0082] Then, based on the topology and routing of the space-ground integrated Internet, candidate satellites connected to the target link can be identified. , and select a satellite from the candidate satellites whose coverage area is adjacent to the block where the malicious terminal is deployed as the target satellite. If no such candidate satellite is available, select the satellite closest to the target link from all the candidate satellites. And so on, and use Indicates the selected satellite, that is, the target satellite.

[0083] Next, the number of malicious terminals deployed in the geographical area covered by the target satellite is determined based on the available bandwidth of the target satellite. Compared with the set threshold, if the available bandwidth of the target satellite is less than the set first threshold, a first number of malicious terminals are deployed in this geographical block; if the available bandwidth of the target satellite is greater than or equal to the set first threshold, a second number of malicious terminals are deployed in this geographical block.

[0084] The first threshold, the first quantity, and the second quantity can be set according to actual needs and are not specifically limited here. For example, in one embodiment, the first threshold value is , the first quantity can take values , the second quantity value .in, Indicates the size of malicious traffic generated by the corresponding malicious terminal.

[0085] Then, continue to select candidate satellites The satellite closest to the target link among the remaining satellites in the block is selected, and the above steps are used to exclude the deployment of malicious terminals, and a block weight table is created for this purpose. , used to indicate the setting time slice Block weight table. Block weight table Each element in represents a geographical block in a set time slice The number of malicious terminals that need to be deployed.

[0086] In another specific embodiment, the attack period / cycle is described in detail. T The following is the analysis process of the malicious terminal deployment plan.

[0087] According to the block weight tables under multiple set time slices, the target block weight table is obtained by aggregation deployment, including: taking an average value of the block weight tables under the multiple set time slices to create an average block weight table; selecting the geographical block with the highest weight in the average block weight table as the target geographical block, and determining the satellite connected to the target geographical block as the aggregation satellite; adding the weights of all geographical blocks covered by the aggregation satellite to the weight of the target geographical block, and setting the original weights of the remaining geographical blocks covered by the aggregation satellite to zero; repeating the steps of selecting and aggregating the target geographical block to obtain the target block weight table.

[0088] It is understandable that for the attack cycle T First, we take the average weight of each block in all time slices to get an average block weight table. .Right now ,in, is the set number of time slices in the cycle, is the average block weight table Middle Line Elements of a column.

[0089] Then, from the average block weight table The geographic block with the highest weight is selected and used as the target geographic block. Next, the satellite connected to the selected target geographic block is used as the aggregation satellite, and the coverage of the aggregation satellite is calculated. The weights of all geographic blocks within the coverage are added to the weight of the selected target geographic block, and the original weights of the remaining geographic blocks within these coverage are set to zero. Thus, the weights within a specific range are aggregated into a single block (target geographic block). This process is repeated until the weights of all remaining geographic blocks become zero, that is, all geographic blocks are assigned appropriate weights, which represent the required number of malicious user terminals.

[0090] Since some of the geographical blocks may have too large weights after aggregation, this embodiment can prune the selected geographical blocks. , the excess malicious terminals will be redistributed to the nearest geographical block where the malicious terminals are deployed. Similarly, if the number of malicious terminals in a certain geographical block is lower than a certain lower limit (for example, 5), the malicious terminals will also be redistributed to the geographical block where the malicious terminals are deployed most recently. So far, this embodiment analyzes and obtains the final block weight table, that is, the target block weight table .

[0091] Finally, according to the target block weight table The weight of each geographical block in is used to deploy the same number of malicious terminals in the corresponding geographical block.

[0092] In yet another specific embodiment, the verification process of the vulnerability analysis result is described in detail.

[0093] The vulnerable satellite-to-ground link is flooded by the deployed malicious terminal to make it congested, so as to verify the obtained vulnerability analysis results, including: sending malicious traffic with a set throughput to the uplink connected to the satellite through the deployed malicious terminal; counting the throughput reduction rate of legitimate user traffic on the vulnerable satellite-to-ground link; and verifying the validity of the vulnerability analysis results according to the throughput reduction rate of legitimate user traffic on the vulnerable satellite-to-ground link.

[0094] In this embodiment, after obtaining the vulnerability analysis result of the satellite-to-ground link, malicious terminals are deployed in a set time slice to obtain a block weight table in the set time slice, and according to the block weight tables in multiple set time slices, the target block weight table is aggregated and deployed, and then based on the target block weight table, the vulnerable satellite-to-ground link is flooded by the deployed malicious terminals to make it congested, so as to verify the obtained vulnerability analysis result; wherein, each element in the block weight table represents the number of malicious terminals that need to be deployed in a geographical block in the set time slice. This method verifies the validity of the vulnerability analysis result by flooding the located vulnerable satellite-to-ground link with the deployed malicious terminals and counting the legitimate user traffic throughput drop rate of the vulnerable satellite-to-ground link, further verifying the effective analysis of the vulnerability of the satellite-to-ground link in the integrated Internet of Space and Earth by the present invention, helping to identify and alleviate potential security threats, thereby ensuring the stability and reliability of the network.

[0095] Additionally, in some embodiments, Figure 2 The overall flow chart of the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet provided by an embodiment of the present invention is shown.

[0096] like Figure 2 As shown, the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet provided by the embodiment of the present invention is mainly divided into two parts, namely, the satellite-to-ground link vulnerability analysis method part of the space-ground integrated Internet and the satellite-to-ground link vulnerability verification system part of the space-ground integrated Internet.

[0097] In the first part, it is necessary to carry out satellite-to-ground link vulnerability analysis based on the cumulative service time of the ground station, the number of service blocks of the ground station and the legitimate user traffic of the satellite-to-ground link to obtain the vulnerability analysis results of the satellite-to-ground link.

[0098] In the second part, we first analyze the deployment of malicious terminals for each set time slice, and then analyze the deployment of malicious terminals for multiple set time slices (attack cycles). Then, we use the deployed malicious terminals to flood the satellite-to-ground link, and finally verify the validity of the vulnerability analysis results by counting the traffic throughput drop rate of legitimate users.

[0099] In some other embodiments, the satellite-to-ground link vulnerability analysis method and verification method of the space-ground integrated Internet provided by the present invention are experimentally verified.

[0100] Specifically, this embodiment uses multiple physical machines to build an experimental platform to implement the analysis method and its verification system. The main attributes of the multiple physical machines are DELL R740 servers, each server is equipped with two Intel 5222 processors (quad-core processors, 3.8GHz), DDR4 memory stick and installed Ubuntu 20.04-LTS system.

[0101] Regarding the constellation and ground station configuration, the satellites include Starlink Phase 1 Layer 1 (72 orbital planes, 22 satellites in each orbital plane) and Kuiper (34 orbital planes and 34 satellites in each orbital plane). The ground station consists of 165 Starlink ground stations.

[0102] Regarding the topological configuration: (1) +Grid, one satellite is connected to two adjacent satellites in the same orbit, and two intersatellite links are connected to two satellites in adjacent orbits; (2) Ring structure, satellites in the same orbital plane form a ring structure, in which each satellite communicates with two neighboring satellites.

[0103] In addition, since intersatellite links are already in use and only intersatellite links are used for data transmission during transoceanic communications, satellites are set up to transmit data to nearby ground stations through bent-pipe or multi-hop intersatellite links.

[0104] Regarding the setting of legitimate user traffic, first, this embodiment discretizes the geographical area on the surface of the earth into geographical grid blocks of 1 longitude × 1 latitude, and each geographical block can represent an area of ​​12,000 square kilometers at the equator. Next, traffic is generated according to the traffic distribution ratio of Starlink in different countries or regions. 0.5Mbps of background traffic is added from the geographical block with a probability proportional to the traffic ratio of each place. The traffic generation process is repeated 2,000,000 times, and the traffic exceeding the link capacity will be discarded. In addition, the uplink / downlink capacity of the satellite-to-ground link is set to 4Gbps, while the capacity of the inter-satellite link is 20Gbps.

[0105] Regarding the comparison object ICARUS, malicious terminals are randomly deployed to send malicious traffic to flood the satellite-to-ground link, causing congestion.

[0106] Figure 3 The comparison chart of the results of the present invention and ICARUS attacking the same number of satellite-to-ground links provided by the embodiment of the present invention shows the proportion of the affected geographical blocks to the global geographical blocks, and the proportion of the affected legitimate user traffic to the total traffic. Figure 3 It can be seen that by attacking only 8% of the satellite-to-ground links in the world, the present invention can reduce more than 19% of legitimate user traffic and affect the traffic of approximately 41% of the global geographical blocks. In contrast, ICARUS only affects 11% to 14% of the geographical blocks or traffic. Other constellations such as Kuiper have the same results. This shows that launching attacks based on vulnerability analysis results can bring better attack effects, and the attack mechanism is not limited to a specific constellation.

[0107] Figure 4A comparison diagram showing the attack effect of the present invention on the vulnerable satellite-to-ground link of Starlink provided by an embodiment of the present invention is shown, Figure 5 A comparison diagram of the attack effect of ICARUS on the satellite-to-ground link of Starlink provided by an embodiment of the present invention is shown, Figure 6 A schematic diagram showing the present invention and ICARUS attacking Starlink to cause a decrease in legitimate user traffic throughput provided by an embodiment of the present invention is shown.

[0108] Figure 4 and Figure 5 The number of satellite-to-ground links congested by the present invention and ICARUS is shown. Figure 4 and Figure 5 From the above, the present invention can successfully congest 37% of legitimate user traffic by attacking 8% of satellite-to-ground links. The congested legitimate user traffic is 162 times that of ICARUS, while ICARUS only congests 0.2% of satellite-to-ground links in one hour. Figure 6 ,It can be seen from the continuously congested traffic that, under the malicious user terminal deployment of the present invention, only a small number of satellite-to-ground links attacked can bring a large attack return, which shows that the botnet of the present invention can effectively exploit vulnerabilities to launch attacks and achieve effective attacks within the entire attack cycle.

[0109] To demonstrate the continuous attack effect of the present invention on different low-orbit satellite constellations, Figure 7 A comparative diagram of the attack effects of the present invention on vulnerable satellite-to-ground links of different low-orbit satellite constellations provided by an embodiment of the present invention is shown, which shows the statistics of the number of satellite-to-ground links congested by the present invention at each set time slice within an hour. The number of satellite-to-ground links with link congestion remains stable throughout the cycle. For Starlink, 36 to 45 links are congested 80% of the time, while for Kuiper, there are 20 to 25. Therefore, for different low-orbit satellite constellations, the present invention can better analyze the vulnerability of satellite-to-ground links and use them to launch sustained attacks.

[0110] Figure 8 FIG. 2 shows a schematic diagram of cost situations in different topologies provided by an embodiment of the present invention. Figure 8 As shown, for different throughput drop rates, whether it is a +Grid structure or a ring topology, the number of malicious terminals of the present invention (SKYFALL) is within 2,500. In contrast, there are already millions of Starlink subscribers, and attackers can obtain this number of malicious terminals by purchasing or invading. Ground botnets, such as Srizbi, have a total of 12,978 to 16,750 active malicious terminals, and the scale of ground botnets was as high as 350,000 even ten years ago. Therefore, a botnet with one thousand to two thousand active malicious terminals is acceptable.

[0111] In contrast, ICARUS randomly distributes botnets to achieve the same throughput reduction rate, and its cost is Figure 8 As shown, the scale and malicious traffic of its botnet are three times that of the present invention. Therefore, when the present invention is verified by using the satellite-to-ground link vulnerability analysis results, it performs a low-cost and high-benefit link flooding attack.

[0112] Corresponding to the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet described in the above embodiments, the present invention also proposes a satellite-to-ground link vulnerability analysis device of the space-ground integrated Internet.

[0113] Specifically, Fig. 9 A schematic structural diagram of a satellite-to-ground link vulnerability analysis device for a space-ground integrated Internet provided by an embodiment of the present invention is shown.

[0114] like Fig. 9 As shown, the device includes: a cumulative service time acquisition module 910, which is used to obtain the cumulative service time of each ground station in the space-ground integrated Internet; a service block number acquisition module 920, which is used to obtain the number of service blocks of each ground station in the space-ground integrated Internet; a legal user flow acquisition module 930, which is used to obtain the legal user flow of each satellite-to-ground link in the space-ground integrated Internet under a set time slice; a satellite-to-ground link vulnerability analysis module 940, which is used to analyze the vulnerability of the satellite-to-ground link in the space-ground integrated Internet according to the cumulative service time and the number of service blocks corresponding to each ground station, and the legal user flow of each satellite-to-ground link in the set time slice, and obtain the vulnerability analysis result of the satellite-to-ground link.

[0115] In this embodiment, the cumulative service time acquisition module 910 and the service block number acquisition module 920 acquire the cumulative service time and service block number of each ground station in the integrated Internet of Space and Earth, and the legitimate user flow acquisition module 930 acquires the legitimate user flow of each satellite-to-ground link in the integrated Internet of Space and Earth under a set time slice, and then the satellite-to-ground link vulnerability analysis module 940 analyzes the vulnerability of the satellite-to-ground link in the integrated Internet of Space and Earth according to the cumulative service time and service block number corresponding to each ground station and the legitimate user flow of each satellite-to-ground link in the set time slice, and obtains the vulnerability analysis result of the satellite-to-ground link. The device performs vulnerability analysis from three perspectives: the number of ground station service blocks, the cumulative service time of the ground station, and the satellite-to-ground link flow, locates vulnerable satellite-to-ground links that are vulnerable to attack, realizes effective analysis of the vulnerability of satellite-to-ground links in the integrated Internet of Space and Earth, helps identify and mitigate potential security threats, and ensures the stability and reliability of the network.

[0116] It should be noted that the satellite-to-ground link vulnerability analysis device of the space-ground integrated Internet provided in the embodiment of the present invention and the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet described in the above embodiments can correspond to each other and will not be repeated here.

[0117] Fig.10 An example of a physical structure diagram of an electronic device is shown in FIG. Fig.10 As shown, the electronic device may include: a processor 1010, a communication interface 1020, a memory 1030 and a communication bus 1040, wherein the processor 1010, the communication interface 1020 and the memory 1030 communicate with each other through the communication bus 1040. The processor 1010 may call the logic instructions in the memory 1030 to execute the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet, the method comprising: obtaining the cumulative service time of each ground station in the space-ground integrated Internet; obtaining the number of service blocks of each ground station in the space-ground integrated Internet; obtaining the legal user flow of each satellite-to-ground link in the space-ground integrated Internet under a set time slice; analyzing the vulnerability of the satellite-to-ground link in the space-ground integrated Internet according to the cumulative service time and the number of service blocks corresponding to each ground station, and the legal user flow of each satellite-to-ground link under a set time slice, and obtaining the vulnerability analysis result of the satellite-to-ground link.

[0118] In addition, the logic instructions in the above-mentioned memory 1030 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0119] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet provided by the above-mentioned methods. The method includes: obtaining the cumulative service time of each ground station in the space-ground integrated Internet; obtaining the number of service blocks of each ground station in the space-ground integrated Internet; obtaining the legitimate user flow of each satellite-to-ground link in the space-ground integrated Internet under a set time slice; analyzing the vulnerability of the satellite-to-ground link in the space-ground integrated Internet according to the cumulative service time and the number of service blocks corresponding to each ground station, and the legitimate user flow of each satellite-to-ground link under the set time slice, to obtain the vulnerability analysis result of the satellite-to-ground link.

[0120] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0121] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A satellite-to-ground link vulnerability analysis method for a space-to-ground integrated Internet, characterized in that: include: Obtain the cumulative service time of each ground station in the integrated space-ground Internet; Get the number of service blocks of each ground station in the space-ground integrated Internet; Obtain the legal user traffic of each satellite-to-ground link in the space-ground integrated Internet within a set time slice; According to the accumulated service time and the number of service blocks corresponding to each ground station, and the legal user traffic of each satellite-to-ground link in a set time slice, the vulnerability of the satellite-to-ground link in the space-ground integrated Internet is analyzed to obtain a vulnerability analysis result of the satellite-to-ground link.

2. The satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet according to claim 1 is characterized in that: The vulnerability of the satellite-to-ground link in the space-ground integrated Internet is analyzed according to the accumulated service time and the number of service blocks corresponding to each ground station, and the legitimate user traffic of each satellite-to-ground link in a set time slice, including: Sort the cumulative service time and number of service blocks of all ground stations in descending order; Select the ground station whose cumulative service time and number of service blocks are ranked before the set sequence number, and use the selected ground station as a candidate ground station; Determine the legitimate user traffic of the satellite-to-ground link connected to the candidate ground station in a set time slice, and select the satellite-to-ground link whose legitimate user traffic in the set time slice is higher than a set link capacity threshold; Sort the selected legitimate user traffic of the satellite-to-ground link in descending order to obtain a sorted satellite-to-ground link set; The set of satellite-to-ground links sorted under the set time slice includes vulnerable satellite-to-ground links of the space-ground integrated Internet, and the vulnerable satellite-to-ground links are vulnerability analysis results of the satellite-to-ground links.

3. The satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet according to claim 1 or 2, characterized in that: The step of obtaining the vulnerability analysis result of the satellite-to-ground link comprises: Deploy malicious terminals in a set time slice and obtain the block weight table in the set time slice; According to the block weight tables under multiple set time slices, the target block weight table is obtained by aggregation deployment; Based on the target block weight table, the vulnerable satellite-to-ground link is flooded by the deployed malicious terminal to cause congestion, so as to verify the obtained vulnerability analysis results; Each element in the block weight table represents the number of malicious terminals that need to be deployed in a geographical block in a set time slice.

4. The satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet according to claim 3 is characterized in that: The malicious terminal is deployed in the set time slice to obtain the block weight table in the set time slice, including: Determine the target links one by one according to the legitimate user traffic of the fragile satellite-to-ground link; wherein the target link is the fragile satellite-to-ground link with the largest legitimate user traffic; Determine a candidate satellite connected to the target link, and select a target satellite from the candidate satellites; wherein the target satellite is a candidate satellite whose coverage area is adjacent to the block where the malicious terminal is deployed, or the target satellite is a satellite closest to the target link among the candidate satellites; Determine the number of malicious terminals deployed in the geographical area covered by the target satellite based on the available bandwidth of the target satellite; The steps of selecting a target satellite and determining the number of deployments of malicious terminals in the geographical block covered by the target satellite are repeated to obtain a block weight table under a set time slice.

5. The satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet according to claim 3 is characterized in that: The step of aggregating and deploying a target block weight table according to the block weight tables under the multiple set time slices includes: Take the average value of the block weight tables under multiple set time slices to create an average block weight table; Selecting the geographical block with the highest weight in the average block weight table as the target geographical block, and determining the satellite connected to the target geographical block as the aggregated satellite; Adding the weights of all geographical blocks covered by the aggregated satellite to the weight of the target geographical block, and setting the original weights of the remaining geographical blocks covered by the aggregated satellite to zero; Repeat the steps of selecting and aggregating the target geographic blocks to obtain the target block weight table.

6. The satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet according to claim 4 is characterized in that: The step of determining the number of deployed malicious terminals in the geographical area covered by the target satellite according to the available bandwidth of the target satellite comprises: When the available bandwidth of the target satellite is less than the first threshold, determining the number of deployed malicious terminals in the geographical block covered by the target satellite as a first number; When the available bandwidth of the target satellite is greater than or equal to the first threshold, the number of deployed malicious terminals in the geographical block covered by the target satellite is determined as the second number.

7. The satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet according to claim 3 is characterized in that: The deployment of malicious terminals to congest the vulnerable satellite-to-ground link to verify the obtained vulnerability analysis results includes: Send malicious traffic of a set throughput to the uplink connected to the satellite through the deployed malicious terminal; Count the traffic throughput drop rate of legitimate users on vulnerable satellite-to-ground links; The validity of the vulnerability analysis result is verified based on the legitimate user traffic throughput drop rate of the vulnerable satellite-to-ground link.

8. A satellite-to-ground link vulnerability analysis device for a space-ground integrated Internet, characterized in that: include: The cumulative service time acquisition module is used to obtain the cumulative service time of each ground station in the space-ground integrated Internet; A service block quantity acquisition module is used to obtain the service block quantity of each ground station in the space-ground integrated Internet; The legitimate user traffic acquisition module is used to obtain the legitimate user traffic of each satellite-to-ground link in the space-ground integrated Internet within a set time slice; The satellite-to-ground link vulnerability analysis module is used to analyze the vulnerability of the satellite-to-ground link in the space-ground integrated Internet according to the accumulated service time and the number of service blocks corresponding to each ground station, and the legitimate user traffic of each satellite-to-ground link in a set time slice, and obtain the vulnerability analysis result of the satellite-to-ground link.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet as described in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the satellite-to-ground link vulnerability analysis method of the space-ground integrated Internet as described in any one of claims 1 to 7 is implemented.

Images