Abnormal state detection method and system for shore-based control of inland river ship groups

Abstract

The present invention relates to the field of ship automation control and information security technology, and solves the technical problem that traditional methods cannot effectively monitor in real time and quickly warn to prevent various accidents in inland river vessels under complex and changeable operating environments. In particular, it relates to a method and system for detecting abnormal states of shore-based inland river ship groups, which is divided into four parts: identity authentication, node anomaly detection, dynamic trust evaluation, and node adaptive control. The present invention ensures that only reliable entities can participate in communications through strict verification processes and continuous trust evaluations, which not only enhances communication security, but also realizes comprehensive and real-time monitoring of inland river ship groups, and can promptly detect abnormal situations such as physical failures or network attacks, and warn of potential risks in advance, thereby improving the overall safety and reliability of navigation.

Description

Technical Field

[0001] The present invention relates to the field of ship automation control and information security technology, and in particular to a method and system for detecting abnormal states of a shore-based inland river ship group. Background Art

[0002] With the development of my country's shipping industry, the number and size of ships are increasing, which puts forward higher requirements for maritime supervision. Although modern technologies such as Automatic Identification System (AIS) and Vessel Traffic Service (VTS) have been widely used, these technologies have not yet fully achieved the supervision goal of "full coverage, all-weather operation, and rapid response". Traditional supervision methods rely on manual monitoring and are difficult to adapt to the growing safety needs.

[0003] However, the traditional network security perimeter protection model is powerless in the face of complex network attacks. Once the perimeter defense is breached, the security of the internal system will be seriously threatened. For inland river ship clusters, such a security model cannot fully protect them from external threats and internal failures.

[0004] To solve the above problems, zero-trust architecture has become a more effective solution. This architecture abandons the traditional concept of trusting internal network traffic by default, and instead believes that all communications and access requests need to be strictly verified. Each node needs to undergo continuous trust evaluation before interacting, which not only enhances the security of the system, but also provides a more flexible response mechanism to cope with the ever-changing security environment.

[0005] The operating environment of inland vessels is complex and changeable. Factors such as congested waterways and bad weather conditions can affect navigation safety. In order to effectively prevent accidents, there must be a method that can monitor in real time and quickly issue warnings. Although existing offline detection methods can provide some help, they have obvious shortcomings in terms of real-time and accuracy. In addition, although technologies based on statistical analysis or machine learning have improved detection efficiency, they still face challenges in complex environments. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention provides a method and system for detecting abnormal conditions of a group of shore-based controlled inland vessels, which solves the technical problem that traditional methods cannot effectively monitor in real time and quickly warn to prevent various accidents in scenarios where the operating environment of inland vessels is complex and changeable.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for detecting abnormal state of a shore-based inland river ship group, the method comprising the following steps:

[0008] Based on the zero-trust architecture, an identity authentication mechanism is established for interconnection and communication between different types of inland vessels and auxiliary equipment. The identity authentication mechanism includes a hierarchical authorization strategy and a multi-factor authentication strategy. The auxiliary equipment includes AIS base stations, VTS monitoring stations, and smart navigation marks.

[0009] Under the identity authentication mechanism, a hybrid abnormal state detection model is used to perform unsupervised detection on each node in different scenarios, and the weight of the node in the graph network structure is adjusted in real time based on the trust; the nodes include different types of inland vessels and auxiliary equipment; the unsupervised detection includes online detection of known anomalies and unknown anomalies of each node;

[0010] Obtain the node's behavior data and historical interaction data in real time, and dynamically update the node's initial trust based on the anomaly detection results of unsupervised detection Generate dynamic trust ;

[0011] Based on dynamic trust Execute adaptive control strategies for nodes with abnormalities.

[0012] Furthermore, under the identity authentication mechanism, a hybrid abnormal state detection model is used to perform unsupervised detection on each node in different scenarios, and the weight of the node in the graph network structure is adjusted in real time based on the trust. The specific process includes:

[0013] Obtain historical data of any node in different scenarios, and preprocess the historical data to obtain multi-source data within the same scale range and with balanced data;

[0014] Feature extraction is performed on multi-source data to obtain information gain features with highly important information features, and a graph network structure for unsupervised anomaly detection of inland ship groups is established based on multi-source data;

[0015] Information gain features are used to train multiple machine learning models, and the trained multiple machine learning models are used to supervise online detection of abnormal conditions of inland river ship groups;

[0016] If an anomaly is detected, the matching anomaly category is output;

[0017] If no abnormality is detected, proceed to the next step;

[0018] Abnormal state detection of inland ship groups based on unsupervised learning of graph network structure;

[0019] If an anomaly is detected, it is marked as an unknown anomaly and added to the anomaly category library.

[0020] Furthermore, the feature extraction of multi-source data to obtain information gain features with highly important information features specifically includes:

[0021] Calculate any feature in multi-source data Information entropy , and in the known features Conditional target variable The conditional entropy , the calculation formula is:

[0022] ;

[0023] ;

[0024] In the formula, Representation characteristics the number of Indicates Data frequency;

[0025] According to information entropy and conditional entropy Calculate features Information gain , the calculation formula is:

[0026] ;

[0027] The BO-GP method is used to set the threshold with verification accuracy as the objective function. Optimize

[0028] According to information gain Sort all features in multi-source data and select from top to bottom until the total importance of the selected features reaches the threshold , the total importance of the remaining features is less than The features are discarded.

[0029] Furthermore, the graph network structure for unsupervised anomaly detection of inland river ship groups is established based on multi-source data, and the specific process includes:

[0030] Inland vessels or related auxiliary equipment are used as nodes of the graph network structure, and each node is given a node identifier. The node identifier is implemented in the following ways:

[0031] Unique identifier: Each node can consist of a unique identifier for the vessel or auxiliary equipment, including an IP address, MAC address, or equipment serial number;

[0032] The communication flow between any two nodes is used as the edge of the graph network structure. The communication flow includes the frequency of communication, the amount of data in each communication, the type of communication protocol used, and the duration of a single communication.

[0033] Add a timestamp to each edge and record the specific time when the communication occurs to obtain a dynamic graph network structure.

[0034] Furthermore, the machine learning model includes support vector machine SVM, random forest RF and CatBoost.

[0035] Furthermore, the abnormal state detection of inland river ship groups based on unsupervised learning of the graph network structure specifically includes:

[0036] Calculate any two nodes and nodes Between Order Similarity , and according to Order Similarity To obtain similar node sequences;

[0037] Introducing the trustworthiness of nodes , and based on the degree of trust Compute Node and nodes Adjusted edge weights in the graph network structure , the adjusted edge weight The calculation formula is:

[0038] ;

[0039] in, Representation Node and nodes The degree of trust between It is an adjustable parameter used to control the influence of trust on edge weight;

[0040] According to the adjusted edge weight Adjust nodes in real time To Node Random walk probability of multi-order weighted walk , random walk probability The calculation formula is:

[0041] ;

[0042] in, Representation Node The set of all adjacent nodes of Representation Node The sum of weights of all adjacent edges;

[0043] Based on random walk probability Perform multi-order weighted walks on sequences of similar nodes for unsupervised learning detection.

[0044] Furthermore, the order similarity The calculation formula is:

[0045] ;

[0046] in, , Respectively represent and node and nodes Distance is A collection of nodes; Represents two ordered queues and The distance between.

[0047] Furthermore, the initial trust of the node is dynamically updated according to the abnormal detection result of the unsupervised detection. Generate dynamic trust The specific process includes:

[0048] Calculate the initial trust of each node based on historical interaction data , initial trust The calculation formula is:

[0049] ;

[0050] in, is the number of successful interactions; is the number of interaction failures; is the penalty factor;

[0051] Calculate the initial trust Increase rate parameters that can be adaptively adjusted according to driving environment and abnormality level , increase the rate parameter The expression is:

[0052] ;

[0053] in, Increase the rate to the baseline; It is a driving environment factor, a value between 0 and 1. Indicates the worst driving conditions; Indicates the optimal driving environment; , They are adjustment coefficients, which are used to further fine-tune the change in trust; It is the assessment level of the abnormality, a value between 0 and 1, where 0 indicates the mildest abnormality and 1 indicates the most severe abnormality;

[0054] According to the increase rate parameter Generate dynamic trust , the expression is:

[0055] ;

[0056] in, Indicates the number of anomalies detected by the node; Representation Node and Trust before dynamic update.

[0057] Furthermore, the adaptive control strategy includes encryption and isolation of privacy data, dynamic permission management, network topology switching, and timely response to anomalies.

[0058] By means of the above technical solution, the present invention provides a method and system for detecting abnormal status of a shore-based inland river ship group, which has at least the following beneficial effects:

[0059] 1. The present invention ensures that only reliable entities can participate in communications through strict verification processes and continuous trust assessments, which not only enhances communication security, but also realizes comprehensive and real-time monitoring of inland river ship groups, and can promptly detect abnormal situations such as physical failures or network attacks, and warn of potential risks in advance, thereby improving the overall safety and reliability of navigation.

[0060] 2. This invention introduces a trust-driven mechanism under a zero-trust architecture to ensure that all communications and access requests go through a strict verification process and conduct continuous trust evaluation on each node. Through this strict security framework, real-time data collection and analysis can be achieved, and abnormal behaviors such as physical failures or network attacks can be quickly identified, thereby providing immediate warnings and ensuring navigation safety.

[0061] 3. The hybrid abnormal state detection model proposed in the present invention can solve the comprehensive detection of known and unknown anomalies, while considering the influence of the ship's motion characteristics and the navigation situation in which it is located, and improve the accuracy of detection. It can not only quickly capture known anomalies, but also flexibly adapt to emerging threats and unknown anomalies, greatly improving the safety performance of inland river ship groups, enabling them to maintain a high level of protection in a complex and changing threat environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0063] Figure 1 is a flow chart of the abnormal state detection method in the present invention;

[0064] Figure 2 This is a principle block diagram of the zero trust architecture in the present invention;

[0065] Figure 3 This is an anomaly detection flow chart of the hybrid anomaly state detection model in the present invention. DETAILED DESCRIPTION

[0066] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific implementation methods, so that the implementation process of how the present application uses technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly.

[0067] In this embodiment, in view of the technical defects mentioned in the background technology, the technical problems mainly solved by this embodiment are as follows:

[0068] 1. Realize efficient real-time monitoring and early warning.

[0069] In the existing technology, offline detection methods based on historical data are difficult to meet the real-time requirements, resulting in the inability to detect and respond to abnormal situations in a timely manner. In addition, traditional detection models are not accurate and adaptable enough in the face of complex and changing navigation environments, and are prone to high false alarm rates.

[0070] 2. Improve the accuracy and reliability of abnormal state detection.

[0071] Current detection technologies, such as statistical analysis, neural networks, and image recognition, have the problem of unstable detection results when dealing with complex traffic events. Especially in bad weather conditions or when data quality is poor, the performance of these technologies may be greatly reduced, affecting the final detection results.

[0072] 3. Through the hybrid abnormal state detection model, the comprehensive detection of known and unknown anomalies is solved.

[0073] Existing abnormal state detection systems usually rely on preset rules and fixed thresholds to judge abnormal situations, and lack the ability to automatically adjust according to real-time environmental changes. This limits the applicability and response speed of the system in different scenarios, especially when facing emergencies, making it difficult to make the best decision.

[0074] Based on the technical defects of the existing technology, please refer to Figure 1-Figure 3This embodiment proposes a method for detecting abnormal states of inland river vessel groups controlled by shore-based control, which is divided into four parts: identity authentication, node anomaly detection, dynamic trust evaluation, and node adaptive control. Through strict verification processes and continuous trust evaluation, it is ensured that only reliable entities can participate in communications, which not only enhances communication security, but also realizes comprehensive and real-time monitoring of inland river vessel groups, and can promptly detect abnormal situations such as physical failures or network attacks, and warn of potential risks in advance, thereby improving the overall safety and reliability of navigation. The method comprises the following steps:

[0075] S1. Based on the zero-trust architecture, an identity authentication mechanism is established for interconnection and communication between different types of inland vessels and auxiliary equipment. The identity authentication mechanism includes hierarchical authorization strategy and multi-factor authentication strategy. Auxiliary equipment includes AIS base stations, VTS monitoring stations, and intelligent navigation marks.

[0076] like Figure 2 As shown, in the zero-trust architecture, the first step in building the security system of the inland waterway vessel group in this embodiment is to implement strict identity authentication. In order to ensure the speed and efficiency of authentication and maintain the security of the abnormal state detection system, this method adopts a hierarchical authorization mechanism and combines a multi-factor authentication strategy to achieve fine-grained authorization and precise management of inland waterway vessels and related equipment. Among them:

[0077] Hierarchical authorization:

[0078] This embodiment implements a hierarchical authorization strategy for different types of inland vessels and auxiliary equipment (such as AIS base stations, VTS monitoring stations, smart navigation beacons, etc.). This strategy ensures that each auxiliary device obtains appropriate access rights based on its function and importance. For example, critical infrastructure equipment will have a higher security level and stricter access control, while ordinary auxiliary equipment can be granted lower levels of authority as needed. This differentiated authorization not only meets the needs of various types of equipment, but also improves the management efficiency of the system in large-scale networks.

[0079] Multi-factor authentication:

[0080] In order to improve the accuracy and security of the authentication process and prevent unauthorized access, this method adopts a multi-factor authentication mechanism. The following factors can be considered in the authentication process:

[0081] Physical characteristics: Utilize the vessel’s unique identifier or hardware characteristics such as vessel ID, sensor readings, etc.

[0082] Digital Certificate: A unique digital certificate is issued to each ship and its associated equipment as an important basis for identity verification.

[0083] Access History: Record and analyze the historical access behavior of the device to identify abnormal patterns.

[0084] Behavioral patterns: Based on machine learning algorithms, the behavioral patterns of ships are monitored and evaluated in real time to further enhance the reliability of certification.

[0085] By combining these factors, a more comprehensive and reliable identity authentication mechanism is established to effectively prevent potential security threats.

[0086] Fine-grained authorization:

[0087] Fine-grained authorization is the key to ensuring that each device operates within its legitimate usage scenario. By setting detailed permission policies, including but not limited to permissions to access specific system functions and data resources, the scope of behavior of each device can be precisely controlled. This not only reduces the risk of potential malicious behavior, but also ensures the smooth progress of normal operations.

[0088] Manage digital identities with precision:

[0089] Ultimately, accurate management of the digital identity of inland vessels is an indispensable step. This includes continuous monitoring and detailed recording of identity information, access history, behavior patterns, etc., to establish a complete digital identity profile. This profile provides a solid foundation for auditing, tracing and security analysis, and helps to quickly respond to and handle any security incidents.

[0090] Therefore, in the intelligent networking system, all related devices connected to the network must undergo strict identity authentication. This process uses a multi-factor authentication mechanism to ensure that inland vessels, AIS base stations, VTS monitoring stations, smart navigation beacons and other equipment can be authorized layer by layer. For specific key equipment, more detailed and strict authorization management is implemented to ensure that only verified entities can participate in communications. This step is the foundation of the entire security system and is designed to prevent unauthorized access.

[0091] This embodiment introduces a trust-driven mechanism under the zero-trust architecture to ensure that all communications and access requests go through a strict verification process and conduct continuous trust assessments on each node. This strict security framework enables real-time data collection and analysis, and rapid identification of abnormal behaviors such as physical failures or network attacks, thereby providing immediate warnings and ensuring navigation safety.

[0092] S2. Under the identity authentication mechanism, a hybrid abnormal state detection model is used to perform unsupervised detection on each node in different scenarios, and the weight of the node in the graph network structure is adjusted in real time based on the trust; the nodes include different types of inland vessels and auxiliary equipment; the unsupervised detection includes online detection of known anomalies and unknown anomalies of each node.

[0093] like Figure 3As shown, this embodiment uses advanced deep learning algorithms, combined with historical information such as logs and network traffic collected by the node data platform, to achieve unsupervised detection of the identity, behavior and hardware status of inland vessels and related equipment. By continuously monitoring and analyzing this data, potential abnormalities can be automatically identified and quickly traced to determine the root cause of the problem. Once an abnormality is found, necessary processing measures will be taken immediately, such as issuing an alarm or isolating the affected node, thereby minimizing the possibility of risk spread.

[0094] For ships in the graph network structure, there are definitely different hardware failures, identity anomalies, network attacks and environmental risks, etc., which need to be detected in time through anomaly detection technology, and the trust of nodes can be adjusted at any time and isolation control can be performed. The specific process includes the following steps:

[0095] S21. Obtain the historical data of any node in different scenarios, and pre-process the historical data to obtain multi-source data within the same scale range and with balanced data; Due to the complex and changeable operating environment of inland vessels, there are many different scenarios, such as congested waterways, bad weather conditions and other factors that will affect navigation safety. And combined with the historical data such as logs and network traffic collected by the node data platform, unsupervised detection of the identity, behavior and hardware status of inland vessels and related equipment is achieved.

[0096] In this embodiment, in order to optimize the abnormal state detection model of the inland ship system, the dynamic data set must be effectively preprocessed. Specifically, through normalization and standardization, it can be ensured that the data from different features are in the same scale range, thereby eliminating dimensional differences and improving the stability and performance of the model.

[0097] Normalization is to scale the data to a specific range, usually [0,1], to eliminate the dimensionality differences between different features. For each feature in the inland vessel population , assuming is the minimum value in this feature, is the maximum value, it can be normalized by the following formula:

[0098] ;

[0099] Assumptions is the standardized value, represents the average value of a feature; represents the standard deviation of the feature; Represents the normalized data set. It can be standardized by the following formula:

[0100] ;

[0101] In the dataset after normalization and standardization, this embodiment pays special attention to the balance of data of each node. Unbalanced data distribution may cause the model to prefer certain categories during training and prediction, thus affecting the overall performance. To solve this problem, this embodiment introduces the SMOTE algorithm of synthetic minority oversampling technology.

[0102] The SMOTE algorithm achieves data balance by synthesizing samples of minority classes to increase their representation in the data set. The core idea of ​​the algorithm is to generate new sample points in the feature space by interpolating samples of minority classes. This not only increases the number of samples of minority classes, but also enhances the model's ability to identify minority classes, making it more robust and comprehensive.

[0103] Through the SMOTE algorithm, this embodiment can effectively deal with the problem of data imbalance, ensuring that the model will not be biased towards the majority category, but can treat each category fairly, especially those rare but critical anomalies.

[0104] In summary, through the comprehensive application of normalization, standardization and SMOTE algorithm, this embodiment ensures high-quality and balanced input of inland ship system data, providing a more reliable foundation for subsequent modeling and analysis. This multi-pronged data preprocessing strategy not only improves the quality and consistency of data, but also solves the problem of unbalanced data distribution, laying a solid foundation for efficient training and accurate prediction of hybrid abnormal state detection models.

[0105] S22. Feature extraction is performed on multi-source data to obtain information gain features with highly important information features, and a graph network structure for unsupervised anomaly detection of inland ship groups is established based on the multi-source data.

[0106] Among them, feature extraction is performed on multi-source data to obtain information gain features with highly important information features. The specific process includes the following steps:

[0107] S22-11. Calculate any feature in multi-source data Information entropy , and in the known features Conditional target variable The conditional entropy , the calculation formula is:

[0108] ;

[0109] ;

[0110] In the formula, Representation characteristics the number of Indicates Data frequency;

[0111] S22-12. According to information entropy and conditional entropy Calculate features Information gain , the calculation formula is:

[0112] ;

[0113] S22-13, using BO-GP method to verify the accuracy as the objective function of the threshold Optimize; in order to get a suitable threshold In this implementation, Bayesian Optimization (BO) combined with Gaussian Process (GP) is used to find the optimal threshold. , which can be achieved by using the existing technical method, so it will not be described in detail.

[0114] S22-14, according to information gain Sort all features in multi-source data and select from top to bottom until the total importance of the selected features reaches the threshold , the total importance of the remaining features is less than After this process, irrelevant features can be eliminated and a smaller number of highly important information features can be obtained for the next step.

[0115] In this embodiment, the information gain The larger the value, the For the target variable The more the uncertainty of the data is reduced, the more The more important it is. The total importance is the sum of the information gains corresponding to the selected features.

[0116] In order to realize unsupervised anomaly detection of inland river ship groups, this embodiment needs to convert the preprocessed multi-source data into a graph network structure. This method can not only capture the complex relationship between nodes, but also effectively identify and analyze abnormal behaviors. In step S22, a graph network structure for unsupervised anomaly detection of inland river ship groups is established based on multi-source data. The specific process includes the following steps:

[0117] S22-21. Inland vessels or related auxiliary equipment (such as AIS base stations, VTS monitoring stations, intelligent navigation marks, etc.) are used as nodes of the graph network structure, and each node is given a node identifier. The node identifier is implemented in the following ways:

[0118] Unique Identifier: Each node can consist of a unique identifier for the vessel or auxiliary equipment, such as an IP address, MAC address, or device serial number. This helps to uniquely identify each participant in the network and allows for more detailed tracing of communication flows. This unique identification method ensures the identifiability and traceability of each node in the network, thereby enhancing the security and management efficiency of the system.

[0119] S22-22. The communication flow between any two nodes is used as the edge of the graph network structure. The communication flow includes the frequency of communication, the amount of data in each communication, the type of communication protocol used (such as TCP, UDP), and the duration of a single communication. These detailed flow information enables the system to capture the actual communication patterns between different nodes in the graph network structure, helping to identify normal communication behaviors and potential abnormal activities.

[0120] S22-23, add a timestamp to each edge and record the specific time when the communication occurs to obtain a dynamic graph network structure. Since the inland ship network changes in real time, the graph data must contain time information to reflect the changes in communication between nodes over time.

[0121] Timestamps: Timestamps are added to each edge to record the specific time when the communication occurred. This not only gives the graph a time dimension, but also creates a dynamic graph that allows the system to detect patterns and anomalies that change over time. By introducing timestamps, it is possible to track the time series characteristics of communication between nodes and promptly discover unusual behavior patterns, thereby improving the accuracy and response speed of anomaly detection.

[0122] S23. Use information gain features to train multiple machine learning models, and use the trained multiple machine learning models to supervise online detection of abnormal conditions of inland ship groups. The machine learning models include support vector machine SVM, random forest RF and CatBoost.

[0123] If an anomaly is detected, the matching anomaly category is output. Here, known anomalies are detected. All kinds of abnormal situations included in the historical records are stored in the known anomaly category library. Therefore, when an anomaly of a known category is detected, the matching anomaly category can be output.

[0124] If no abnormality is detected, proceed to step S34.

[0125] In step S23, in order to achieve efficient and accurate anomaly detection, this embodiment first screens out the most discriminative information gain features through the information gain method. These information gain features will be used for supervised training of multiple machine learning models, including support vector machines (SVM), random forests (RF), and CatBoost. The specific steps are as follows:

[0126] Feature selection: Use information gain to evaluate the importance of each feature and select the key features that can most effectively distinguish normal from abnormal behaviors. This step ensures that subsequent model training is based on the most representative and discriminative data.

[0127] Offline model training: Use an annotated anomaly dataset for offline training. This dataset contains various anomalies in historical records. The model trained in this way can better understand and identify potential anomaly patterns. During the training process, this embodiment focuses on optimizing model parameters to improve its generalization ability and accuracy.

[0128] Model integration: An integrated learning strategy with a voting mechanism is used to combine multiple different types of models (such as SVM, RF, and CatBoost). Each model may perform differently in a specific scenario, and integrated learning can improve the overall detection performance and reliability by combining the advantages of each model.

[0129] Online detection: The trained model will be deployed in a real-time environment to detect abnormal conditions of inland river vessels online. When new data flows in, the system will automatically call the trained model for real-time analysis. If the model determines that there is an anomaly, it will output the matching anomaly category; if no anomaly is detected, it will proceed to the next step.

[0130] S24, abnormal state detection of inland river ship groups based on unsupervised learning of graph network structure; if an abnormality is detected, the abnormality is marked as an unknown abnormality and added to the abnormal category library. This step is to perform unknown abnormality detection again by unsupervised learning after no known abnormality is detected. When an unknown abnormality is detected, the abnormal category library can be supplemented by manual annotation so that it can be detected and labeled later. If no abnormality is detected, it means that there is no abnormal state in the inland river ship group.

[0131] In this embodiment, unknown anomalies are mainly detected by a trust-weighted multi-order weighted walk algorithm. The multi-order weighted walk method aims to obtain similar node sequences by considering the structural similarity and attribute similarity between nodes, especially for those nodes that are far away but similar in features. The following are the main steps and related formulas of the multi-order weighted walk algorithm:

[0132] 1. Similarity evaluation strategy: Calculate the similarity between any two nodes and nodes Between Order Similarity , and according to Order Similarity To obtain similar node sequences;

[0133] To evaluate the two nodes and The similarity between them defines a function , indicating a node and nodes of The initial value is set to . The calculation formula of order similarity is as follows:

[0134] ;

[0135] in, , Respectively represent and node and nodes Distance is A collection of nodes; Represents two ordered queues and The distance between the two sequences is calculated using the dynamic time warping (DTW) algorithm. The formula is as follows:

[0136] ;

[0137] in, , Respectively represent the sequence The maximum and minimum values ​​of .

[0138] Based on random walk probability Perform multi-order weighted walks on sequences of similar nodes for unsupervised learning detection.

[0139] 2. Weight adjustment: introducing the trust of nodes , adjust nodes in real time To Node Random walk probability of multi-order weighted walk .

[0140] In order to optimize the edge weights in the graph network structure, this embodiment introduces the trust of the node as the basis for adjustment. Specifically, for those nodes with low trust, this embodiment will increase the weights of the edges between them and the adjacent nodes accordingly. The purpose of this adjustment is to increase the probability of these low-trust nodes being visited during the random walk. The formula is defined as follows:

[0141] ;

[0142] in, Representation Node and nodes The degree of trust between It is an adjustable parameter used to control the influence of trust on edge weight;

[0143] According to the above adjusted edge weights , the new random walk probability The calculation formula is as follows:

[0144] ;

[0145] in, Representation Node The set of all adjacent nodes of Representation Node The sum of weights of all adjacent edges.

[0146] In this way, when performing random walks, this embodiment can be more inclined to visit nodes with lower trust, so as to better identify potential problem nodes in tasks such as anomaly detection. For unknown anomaly information, if the anomaly category is obtained, the anomaly category library can be supplemented through manual annotation so that it can be detected and labeled later.

[0147] This embodiment uses advanced big data processing technology and deep learning algorithms, combined with multi-source heterogeneous data (such as AIS data, VTS information, meteorological data, etc.), to build a comprehensive ship behavior dynamic hybrid abnormal state detection model to solve the comprehensive detection of known and unknown anomalies. The model can take into account the influence of ship motion characteristics and the navigation situation in which it is located, and improve the accuracy of detection. At the same time, emerging technologies such as graph neural networks are used to further enhance the processing capabilities of irregular data structures and ensure the reliability and interpretability of detection results.

[0148] S3, obtain the node's behavior data and historical interaction data in real time, and dynamically update the node's initial trust based on the anomaly detection results of unsupervised detection Generate dynamic trust The specific process includes the following steps:

[0149] S31. Calculate the initial trust of each node based on historical interaction data , for the initial trust The present embodiment adopts a risk probability model, and the specific calculation formula is as follows:

[0150] ;

[0151] in, is the number of successful interactions; is the number of interaction failures; is the penalty factor, the penalty factor The introduction of can effectively prevent sudden attacks that occur after trust accumulation reaches a high level.

[0152] S32, calculate the initial trust Increase rate parameters that can be adaptively adjusted according to driving environment and abnormality level , increase the rate parameter Used to control how fast the adjustment factor increases.

[0153] In order to make the trust level adaptively adjusted according to the driving environment and abnormality level, the rate parameter will be increased. The design is in the form of adaptive adjustment, as follows:

[0154] ;

[0155] in, Increase the rate to the baseline; It is a driving environment factor, a value between 0 and 1. Indicates the worst driving conditions; Indicates the optimal driving environment; , They are adjustment coefficients, which are used to further fine-tune the change in trust; It is the assessment level of the abnormality, a value between 0 and 1, where 0 indicates the mildest abnormality and 1 indicates the most severe abnormality. It is used to indicate the severity of the abnormality. It can be obtained by the following formula:

[0156] ;

[0157] in, is the anomaly category, which can be a discrete value, such as point anomaly, network attack, each category can be given a different weight, and a weight table can be constructed; is an abnormal pattern, indicating an abnormal behavior pattern or characteristic, which can be a continuous value or a categorical value; is the frequency, which indicates how often an anomaly occurs or how often it appears in the data.

[0158] S33, according to the increase rate parameter Generate dynamic trust , dynamic trust It needs to be dynamically updated according to the results of anomaly detection. The specific formula is as follows:

[0159] ;

[0160] in, Indicates the number of anomalies detected by the node; Representation Node and Trust before dynamic update.

[0161] This dynamic adjustment helps improve the model's responsiveness in complex environments and ensures that the model's sensitivity to anomalies adapts to the current system state, making anomaly detection more sensitive and flexible.

[0162] The hybrid abnormal state detection model of this embodiment integrates a variety of detection algorithms and technologies, which not only covers the effective identification of known abnormal patterns, but also captures unknown or new abnormal behaviors. The model combines the advantages of supervised learning and unsupervised learning, uses historical data to train a detector that is highly sensitive to common anomalies, and continuously updates the model parameters through an adaptive learning mechanism to respond to emerging threats. In addition, the integrated reinforcement learning algorithm enables the system to accumulate experience during operation, dynamically adjust the detection strategy, and automatically adapt to new threat patterns. This not only improves the flexibility and robustness of the system, but also provides regulators with a more scientific decision-making basis and enhances the overall ability to respond to emergencies. This achieves comprehensive coverage of known and unknown anomalies, providing a more comprehensive and accurate abnormal state detection service for inland ship groups.

[0163] S4. Based on dynamic trust Adaptive control strategies are implemented for nodes with abnormalities. The adaptive control strategies include encrypting and isolating privacy data, dynamic permission management, network topology switching, and timely response to abnormalities.

[0164] In this embodiment, the primary task of the adaptive control strategy is to encrypt and isolate the privacy data of each inland vessel and related equipment to ensure that these sensitive information are effectively protected and prevent potential attacks. By implementing strict encryption measures and access control strategies, the privacy information of the equipment can be protected from unauthorized access or theft, thereby maintaining the data security and user trust of the entire system.

[0165] Dynamic permission management is one of the core elements of the adaptive control strategy. According to the node trust calculated by the dynamic trust evaluation in the third step, the permissions of each node can be flexibly and dynamically managed. The permission management mechanism based on trust enables the system to adjust its operation permissions according to the actual performance of the node, which not only improves the responsiveness and adaptability of the overall security of the system, but also ensures the rational allocation and use of resources. For example, for nodes with low trust, their rights to access key data or perform sensitive operations can be restricted; while for nodes with high trust, the permissions can be appropriately relaxed to improve work efficiency.

[0166] Network topology switching is designed to deal with situations where the trust of a node drops to zero, usually because the node is identified as a malicious node. In this case, the system needs to immediately initiate a network topology switching mechanism to isolate the suspected or confirmed malicious node from the inland vessel network. This mechanism helps maintain the controllability and security of the overall system, prevent the spread of malicious behavior, and quickly restore normal operation. The switching process should be as transparent as possible and should not affect the communication efficiency of other normal nodes.

[0167] Timely response to anomalies is responsible for real-time monitoring and identification of potential risks and abnormal situations. Once an anomaly is detected, the system needs to quickly trace the source and take appropriate measures. Broadcasting abnormal information to all relevant nodes is an important means to promptly notify the entire system and take collective preventive measures. In this way, not only can the impact of abnormal events be quickly contained, but other nodes can also be urged to make preventive preparations in advance, enhancing the emergency response capabilities of the entire system.

[0168] In this embodiment, the implementation of the adaptive control strategy can achieve comprehensive and efficient security protection in terms of protecting privacy data, dynamically managing permissions, switching network topology, and timely responding to anomalies. This integrated strategy not only provides a strong security guarantee for the inland river ship group, but also improves the flexibility and robustness of the system in a complex and changing security environment, which helps to cope with increasingly complex network security challenges and ensure the safety and stability of inland river shipping.

[0169] In this embodiment, the adaptive control strategy of the execution node can achieve refined management of abnormal nodes based on the evaluation results of dynamic trust. Specific operations include but are not limited to: adjusting access rights, implementing stricter permission control, temporarily isolating problematic nodes, dynamically switching network topology, and broadcasting risk information to other nodes. By imposing appropriate restrictions on nodes with low trust, the module effectively reduces the impact range of potential threats while ensuring efficient communication between nodes that are operating normally. In addition, it also supports the system's self-healing capabilities to help quickly restore normal operating conditions.

[0170] Corresponding to the abnormal state detection method provided in the above embodiment, this embodiment also provides a system applied to the abnormal state detection method. Since the abnormal state detection system provided in this embodiment corresponds to the abnormal state detection method provided in the above embodiment, the implementation method of the aforementioned abnormal state detection method is also applicable to the abnormal state detection system provided in this embodiment, and will not be described in detail in this embodiment.

[0171] A system for abnormal state detection method, the system is composed of an identity authentication module, a network node abnormality detection module, a dynamic trust evaluation module and a node adaptive control module. Among them:

[0172] The identity authentication module is based on the zero-trust architecture and establishes an identity authentication mechanism for interconnected communications between different types of inland vessels and auxiliary equipment; the network node anomaly detection module is used to perform unsupervised detection of each node in different scenarios using a hybrid anomaly state detection model under the identity authentication mechanism, and adjust the weight of the node in the graph network structure in real time based on the trust level; the dynamic trust evaluation module is used to obtain the node's behavior data and historical interaction data in real time, and dynamically update the node's initial trust level based on the anomaly detection results of the unsupervised detection Generate dynamic trust ; The node adaptive control module is used to Execute adaptive control strategies for nodes with abnormalities.

[0173] The abnormal state detection method and system of a shore-based inland river ship group proposed in this embodiment have at least the following beneficial effects:

[0174] 1. Reduce security risks

[0175] Security risks are significantly reduced by default distrusting any inland vessels, related equipment and users, making access decisions based on continuous risk assessment, and adopting encrypted transmission. In particular, in terms of data protection, the potential risk of data leakage is effectively reduced. In the face of malicious network attacks, it can detect and take emergency measures such as broadcast warnings and node isolation in a timely manner to prevent potential accidents. For hardware failures or environmental anomalies, corrective or preventive measures can be quickly discovered and implemented. These strategies strengthen the system's ability to respond to and handle various security threats and ensure the safety of inland shipping.

[0176] 2. Reduce data attacks

[0177] Compared with the traditional border defense method, the zero-trust architecture adopts the principle of authentication before access, hiding sensitive data in the back end (usually through access proxy devices), thereby greatly reducing the direct exposure of data. This method not only improves data security, but also effectively reduces the possibility of data attacks and protects key information in inland ship group communications.

[0178] 3. High sensitivity

[0179] This embodiment introduces a hybrid abnormal state detection model based on deep learning under the zero-trust architecture, which can monitor the state changes of inland ships and related equipment in real time, quickly identify physical failures or network attacks, and immediately take dynamic adjustment measures to control abnormal nodes. This mechanism ensures the efficient operation of the entire system, enhances the ability to respond quickly and adapt to abnormal events, and provides a more stable and reliable guarantee for inland shipping.

[0180] 4. Hybrid detection of unknown and known anomalies

[0181] By building a hybrid abnormal state detection model, the advantages of feature detection model and anomaly detection model are integrated to achieve efficient detection speed of known common anomalies and comprehensive coverage of unknown anomalies. This model can not only quickly capture known anomalies, but also flexibly adapt to emerging threats and unknown anomalies, providing a more robust and reliable security solution. This integrated strategy greatly improves the safety performance of inland river ship groups, enabling them to maintain a high level of protection in a complex and changing threat environment.

[0182] This embodiment also provides a computer device, including a memory, a processor, and computer-readable instructions (such as a computer program) stored in the memory and executable on the processor. When the processor executes the computer-readable instructions, the steps of the abnormal state detection method in the above embodiment, as well as other extensions of the method and extensions of related steps are implemented. Alternatively, when the processor executes the computer-readable instructions, the functions of each module / unit of the abnormal state detection system in the above embodiment are implemented. To avoid repetition, it will not be repeated here.

[0183] Those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, so the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0184] The above implementation methods have been described in detail. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for detecting abnormal state of a shore-based inland river ship group, characterized in that: The method comprises the following steps: Based on the zero-trust architecture, an identity authentication mechanism is established for interconnection and communication between different types of inland vessels and auxiliary equipment; Under the identity authentication mechanism, a hybrid abnormal state detection model is used to perform unsupervised detection on each node in different scenarios, and the weight of the node in the graph network structure is adjusted in real time based on the trust. The specific process includes: Obtain historical data of any node in different scenarios, and preprocess the historical data to obtain multi-source data within the same scale range and with balanced data; Feature extraction is performed on multi-source data to obtain information gain features with highly important information features, and a graph network structure for unsupervised anomaly detection of inland ship groups is established based on multi-source data; Information gain features are used to train multiple machine learning models, and the trained multiple machine learning models are used to supervise online detection of abnormal conditions of inland river ship groups; If an anomaly is detected, the matching anomaly category is output; If no abnormality is detected, proceed to the next step; Abnormal state detection of inland ship groups based on unsupervised learning of graph network structure; If an anomaly is detected, it is marked as an unknown anomaly and added to the anomaly category library; Obtain the node's behavior data and historical interaction data in real time, and dynamically update the node's initial trust based on the anomaly detection results of unsupervised detection Generate dynamic trust ; Based on dynamic trust Execute adaptive control strategies for nodes with abnormalities.

2. The abnormal state detection method according to claim 1, characterized in that: The feature extraction of multi-source data to obtain information gain features with highly important information features specifically includes: Calculate any feature in multi-source data Information entropy , and in the known features Conditional target variable The conditional entropy , the calculation formula is: ； ； In the formula, Representation characteristics the number of Indicates Data frequency; According to information entropy and conditional entropy Calculate features Information gain , the calculation formula is: ； The BO-GP method is used to set the threshold with verification accuracy as the objective function. Optimize According to information gain Sort all features in multi-source data and select from top to bottom until the total importance of the selected features reaches the threshold , the total importance of the remaining features is less than The features are discarded.

3. The abnormal state detection method according to claim 1, characterized in that: The graph network structure for unsupervised anomaly detection of inland river ship groups is established based on multi-source data, and the specific process includes: Inland vessels or related auxiliary equipment are used as nodes of the graph network structure, and each node is given a node identifier. The node identifier is implemented in the following ways: Unique identifier: Each node can consist of a unique identifier for the vessel or auxiliary equipment, including an IP address, MAC address, or equipment serial number; The communication flow between any two nodes is used as the edge of the graph network structure. The communication flow includes the frequency of communication, the amount of data in each communication, the type of communication protocol used, and the duration of a single communication. Add a timestamp to each edge and record the specific time when the communication occurs to obtain a dynamic graph network structure.

4. The abnormal state detection method according to claim 1, characterized in that: The machine learning models include support vector machine SVM, random forest RF and CatBoost.

5. The abnormal state detection method according to claim 1, characterized in that: The abnormal state detection of inland river ship groups based on unsupervised learning of the graph network structure specifically includes: Calculate any two nodes and nodes Between Order Similarity , and according to Order Similarity To obtain similar node sequences; Introducing the trustworthiness of nodes , and based on the degree of trust Compute Node and nodes Adjusted edge weights in the graph network structure , the adjusted edge weight The calculation formula is: ； in, Representation Node and nodes The degree of trust between It is an adjustable parameter used to control the influence of trust on edge weight; According to the adjusted edge weight Adjust nodes in real time To Node Random walk probability of multi-order weighted walk , random walk probability The calculation formula is: ； in, Representation Node The set of all adjacent nodes of Representation Node The sum of weights of all adjacent edges; Based on random walk probability Perform multi-order weighted walks on sequences of similar nodes for unsupervised learning detection.

6. The abnormal state detection method according to claim 5, characterized in that: The order similarity The calculation formula is: ； in, , Respectively represent and node and nodes Distance is A collection of nodes; Represents two ordered queues and The distance between.

7. The abnormal state detection method according to claim 1, characterized in that: The initial trust of the node is dynamically updated according to the abnormal detection results of the unsupervised detection Generate dynamic trust The specific process includes: Calculate the initial trust of each node based on historical interaction data , initial trust The calculation formula is: ； in, is the number of successful interactions; is the number of interaction failures; is the penalty factor; Calculate the initial trust The increase rate parameter can be adaptively adjusted according to the driving environment and abnormal level , increase the rate parameter The expression is: ； in, Increase the rate to the baseline; It is a driving environment factor, a value between 0 and 1. Indicates the worst driving conditions; Indicates the optimal driving environment; , They are adjustment coefficients, which are used to further fine-tune the change in trust; It is the assessment level of the abnormality, a value between 0 and 1, where 0 indicates the mildest abnormality and 1 indicates the most severe abnormality; According to the increase rate parameter Generate dynamic trust , the expression is: ； in, Indicates the number of anomalies detected by the node; Representation Node and Trust before dynamic update.

8. The abnormal state detection method according to claim 1, characterized in that: The adaptive control strategy includes encryption and isolation of privacy data, dynamic permission management, network topology switching, and timely response to anomalies.

9. A system applied to the abnormal state detection method according to any one of claims 1 to 8, characterized in that: The system includes: An identity authentication module, which is based on a zero-trust architecture and establishes an identity authentication mechanism for interconnection and communication between different types of inland waterway vessels and auxiliary equipment; A network node anomaly detection module, which is used to perform unsupervised detection of each node in different scenarios using a hybrid anomaly state detection model under an identity authentication mechanism, and adjust the weight of the node in the graph network structure in real time based on the trust degree; Dynamic trust evaluation module, which is used to obtain the behavior data and historical interaction data of the node in real time, and dynamically update the initial trust of the node according to the abnormal detection results of unsupervised detection Generate dynamic trust ; A node adaptive control module is used to control the node according to the dynamic trust Execute adaptive control strategies for nodes with abnormalities.

Images