Airborne network threat monitoring and warning system and warning method

Abstract

The invention provides an airborne network threat monitoring alarm system and alarm method, the alarm system comprises an airborne end, a hardware end, a ground end and a monitoring alarm module, the airborne end comprises a protocol analysis module, an equipment acquisition module, a security detection module and a threat injection module; the ground end is deployed on the ground, realizes risk assessment and protocol testing under conventional tasks, and comprises an intrusion simulation module, an operation simulation module, a risk assessment module and a protocol testing module; and the hardware end is used for supporting control ports, energy input and authority management and control capabilities required by system and platform operation, is integrated hardware equipment deployed for supporting the platform, and comprises a voltage energy control module, a decentralized key management module and a control instruction input module.

Description

Technical Field

[0001] The present application relates to the field of avionics security, and specifically to an airborne network threat monitoring and warning system and an warning method. Background Art

[0002] With the continuous penetration of computing technology and network technology into the field of avionics networks, especially the deep integration of informatization and intelligence and the rapid development of the Internet of Things, avionics networks such as airborne network threat monitoring and warning systems are increasingly using common protocols, common hardware and common software, and connecting to public networks such as the Internet and 5G core networks in various ways. Security threats are moving from single machines to interconnected, from local to global, and from individual hacker intrusions to organized attacks. Once a security threat incident occurs, it may cause the theft of sensitive data such as key design parameters and business data in production, operation and maintenance, and services, and even cause command interruption, signal deception, casualties and environmental damage, causing a series of serious economic, social and political problems and endangering national security.

[0003] Under the traditional mode, airborne network monitoring and other systems do not have the ability to monitor and warn of network threats. Safety accidents caused by abnormal command operations and virus and Trojan intrusions require thorough accident tracing and investigation to restore the abnormal command operations and virus and Trojan intrusions. With the continuous emergence of various new technologies, new products, new models, and new business forms, information security risks and hidden dangers are intertwined. After the airborne network threat monitoring and warning system is deployed and pre-set, it can provide early warning of abnormal command operations and virus and Trojan intrusions in the avionics network, issue event alarms in advance and remind personnel to deal with them. It is of great significance to grasp the information security situation of the avionics network, effectively prevent and reduce avionics network risks, and ensure the safe operation of the avionics network and production safety.

[0004] At present, there is no equipment with this function in China. Raytheon and other units in the United States have jointly developed an abnormal detection system (CADS) for the US military's avionics 1553B protocol, which realizes the monitoring of abnormal behavior of 1553B and ARINC-429 protocol communications. The European Defense Agency has also jointly developed a device that can carry out cyber attacks on aircraft on the 1553B bus with Italian aviation cadets and other units.

[0005] The research on airborne network threat monitoring and warning systems has made certain progress abroad, but there are also some shortcomings and areas for improvement. First, the current airborne network threat monitoring and warning systems are still facing the challenges of unified technical standards and interoperability. Systems developed by different manufacturers and research institutions often use different protocols and interfaces. It is difficult for external systems to obtain multi-vendor data and to perceive the overall situation of the airborne network, which limits the integration and expansion capabilities of the system. In this regard, this method creatively proposes an avionics bus parsing mode, which realizes lossless access and parsing of multi-vendor data through avionics equipment channel pattern matching algorithm and data packet interpretation technology based on data format recognition; secondly, the current system still has certain weaknesses in network security. Due to the complexity and openness of the system, it is vulnerable to malicious attacks and data leakage. It is difficult for the outside world to disclose security issues and access the airborne environment for verification in a timely manner, and it is impossible to strengthen security measures and protection mechanisms in a timely manner. To this end, it was proposed for the first time to build an airborne network simulation environment dedicated to network security testing. A highly simulated airborne network environment was constructed from the perspectives of target node characteristics, link characteristics, protocol types, network characteristics, etc., and external vulnerability information was integrated and verified to achieve timely verification of known vulnerabilities. In addition, the system lacks airborne network security monitoring means. Due to the complexity and diversity of airborne equipment, the existing security detection mode is difficult to cover the entire airborne network, and cannot meet the ever-changing network security risk needs, and it is difficult to ensure the standardization, process and systematization of security detection technology. Summary of the invention

[0006] The present application provides an airborne network threat monitoring and warning system and an alarm method, which can solve the problems that airborne protocols are complex and diverse and difficult to parse, airborne equipment security detection capabilities are difficult to iterate, and known vulnerabilities are difficult to verify. The application conducts technical development of the airborne network threat monitoring and warning system, and the basic system is customized and developed using a mature security monitoring and analysis system. The establishment of an avionics bus security "fingerprint" and a threat model library is completed based on an experimental test environment, providing a data basis for the development and verification of comparative models.

[0007] In a first aspect, the present application provides an airborne network threat monitoring and warning system, including an airborne end, a hardware end, a ground end, and a monitoring and warning module, wherein:

[0008] The airborne terminal includes a protocol analysis module, a device acquisition module, a security detection module, and a threat injection module;

[0009] The ground terminal is deployed on the ground to implement risk assessment and protocol testing for conventional tasks, including an intrusion simulation module, an operation simulation module, a risk assessment module, and a protocol testing module;

[0010] The hardware end is used to support the control ports, energy input, and authority management capabilities required for the operation of the system and platform. It is an integrated hardware device to support platform deployment, including a voltage energy control module, a decentralized key management module, and a control instruction input module.

[0011] Specifically, the protocol parsing module is used to parse the acquired communication data by field through channel monitoring and filtering, obtain its communication protocol type and its corresponding key fields, refer to the traditional IT protocol and OT protocol parsing mode, and use the avionics bus protocol collection. After acquiring the communication data packet, the protocol parsing module will interpret its data packet type, and then store the specific content in the data packet according to the protocol frame structure and pass it to the security detection module;

[0012] The security detection module is used to perform threat detection on the communication data passed by the protocol analysis module and pass the results to the platform.

[0013] Specifically, the threat injection module is used to automatically retrieve the vulnerability library of related system products; use the system product vulnerability library POC / EXP to automatically verify and demonstrate vulnerability risks, and support the download of payloads such as POC / EXP threat injection scripts.

[0014] Specifically, the monitoring and alarm module is used to present security threats in a visual interface. It collects data, restores and reorganizes system processing data, and uses the built-in vulnerability information library to match traffic data with vulnerability features, thereby achieving real-time vulnerability sniffing perception capabilities. It can also issue alarms based on comprehensive considerations such as vulnerability severity, vulnerability type, and vulnerability impact range; it realizes visual display functions such as threat monitoring and analysis, event alarms, and system management.

[0015] Specifically, the intrusion simulation module is used to simulate real attack behaviors, use information data to simulate the lethality and dangerousness of the target, and then determine the level of threat we are facing, evaluate the safety and fault tolerance of the aircraft, and identify and resolve potential security vulnerabilities by simulating security threats, thereby avoiding real attacks from damaging the aircraft, thereby improving the stability and safety of the entire aircraft system.

[0016] Specifically, the running simulation module is used to realize the function of quickly generating simulation running instances and simulation object instances of the target model according to the node characteristics, link characteristics, protocol type, network characteristics, business behavior, and security mechanism of the airborne network, and at the same time complete the process control of a series of simulation engines and simulation middleware.

[0017] Specifically, the risk assessment module is used to verify whether the vulnerability information collected externally can be reused on the airborne equipment. It uses the simulation environment built by running the simulation module to reproduce the external vulnerability information; it verifies whether the vulnerability really exists and the possible harm it may cause from a practical perspective.

[0018] In a second aspect, the present application provides an airborne network threat monitoring and warning method, the method comprising:

[0019] Step 1: Deploy logical isolation environment probes and physical isolation environment probes, adopt network isolation and bypass data collection methods, do not introduce external risk items, collect normal duty data and airworthiness operation data of airborne equipment, and complete equipment asset profiling;

[0020] Step 2: Deploy probes through data collection to monitor the communication data of airborne equipment, obtain communication data packets, store the specific content in the data packets according to the frame structure and perform fingerprint feature matching, determine the transmission channel mode, use the self-developed avionics protocol parsing algorithm, actively access the database to obtain the protocol parsing model, perform a preliminary interpretation of the data packet information, and transmit the interpreted data to the security detection module for behavior judgment; store the interpreted data in the airborne network threat monitoring and warning system database, and update the audit protocol type characteristics at any time;

[0021] Step 3: Store the detection rules in the database, obtain the protocol parsing data through the built-in data interface of the airborne network threat monitoring and warning system, establish a baseline rule library using the normal data of the data acquisition sensing device, creatively propose an improved model for calculating the risk level by assisting the risk source with the threat state, and a multi-state airborne system safety assessment method based on the Bayesian network. Perform data modeling from the two aspects of module detection and specification detection to achieve the discovery and detection of threat behaviors, and finally aggregate the detection data to the monitoring and warning module for unified display;

[0022] Step 4: Based on the security detection alarm data, the corresponding abnormal traffic information is retained, a security exploitation library is built, the latest external vulnerability exploitation information is collected, and a vulnerability verification library is built; during the mission period, simulation verification is performed to perceive the impact of abnormal vulnerabilities on actual flight, and to provide equipment information support for the intrusion simulation module of the airborne network monitoring and warning system;

[0023] Step 5: According to the specific application scenario and business process, obtain security detection data and threat injection verification data, and present the security threat attack and defense threat situation, multi-dimensional airworthiness task analysis, equipment vulnerability map portrait, and attack chain path content through UI visualization to present visual interface alarms.

[0024] Specifically, step 2 includes:

[0025] Step 21: Use bypass probe collection technology to monitor communications, collect device channel communication data in real time, and perform real-time traffic analysis through data packet protocol interpretation, protocol fingerprint matching, and data packet content parsing steps to achieve automatic discarding of normal traffic and high-precision perception of abnormal traffic;

[0026] Step 22: Use nftables packet filtering technology to pre-process large-scale network communication data, conduct preliminary screening by checking traffic consistency, handling invalid traffic and missing traffic, reduce the load of the airborne network threat monitoring and warning system, and transmit the preliminary filtered data to the protocol fingerprint matching part;

[0027] Step 23: Combine signature-based recognition, behavior-based recognition, port-based recognition and static feature-based recognition to build an avionics equipment channel pattern matching algorithm, integrate signatures, behaviors, ports and static features, check the TCP header payload information of each data packet, and determine its protocol type through algorithm matching;

[0028] Step 24: Identify the data packet frame structure features through protocol fingerprint matching, use an iterative decryption algorithm, scan and identify the frame structure encryption algorithm and use the corresponding decryption algorithm for decryption, and then use the decrypted file as input for secondary decryption; until the data packet information is completely decrypted, the data packet transmission security detection part will be further analyzed and processed.

[0029] Specifically, step 3 includes:

[0030] Step 31: Use the data interface to obtain protocol analysis data, extract the communication quintuple and communication content through a semi-interactive design approach, match them with the specification library stored in the database to obtain the test results, and provide iterative data and preliminary judgment information for subsequent module detection models and specification detection models;

[0031] Step 32: According to the state relationship between the channel components of the equipment, an airborne network threat detection model based on the Bayesian network is constructed. The conditional probability table of the non-root node of the Bayesian network is given by using the general generating function. A method for calculating the probability of channel failure state occurrence is proposed based on the variable elimination method. The importance algorithm of the channel component unit is derived to effectively evaluate the safety level of the airborne system and determine the impact of each unit on the system safety.

[0032] Step 33: Adopt the safety risk module detection technology model based on abnormal state, use the hierarchical analysis method to establish two sets of safety detection indicator systems, use the grey fixed weight clustering method to calculate the fixed weight clustering coefficient, and combine the two evaluation results to determine the risk level;

[0033] Step 34: Aggregate and integrate the data obtained from the module detection and specification detection, and forward it to the monitoring and alarm part for unified display.

[0034] In summary, the present application provides an airborne network threat monitoring and warning system and warning method, which can meet the future intelligent aircraft multi-dimensional dynamic networking communication needs. The airborne network threat monitoring and warning system can help flight units to form an efficient and coordinated aviation network communication system based on the principles of "high reliability, networking, and intelligence", and provide communication guarantee for the realization of the final form of the intelligent flight assistance enhancement system and the flight verification environment, with the following advantages:

[0035] 1. Realize the development and verification, installation and deployment, and power-on operation of the supporting cables for the airborne terminal of the avionics bus network threat monitoring and warning system equipment;

[0036] 2. Realize threat monitoring and alarm of avionics bus network, support 5 hacker intrusion scenarios, detect 20 abnormal / unsafe network threat behaviors of platform system and give timely alarm, master the information security situation of avionics network, effectively prevent and reduce avionics network risks, and ensure the safe operation and production safety of avionics network;

[0037] 3. Carry out information security risk testing and assessment work on the information system and control system of a certain civil aircraft installed equipment, the internal network and external exposure interface of the civil aircraft installed equipment, and support the output of a security risk testing and assessment report on a certain civil aircraft installed equipment;

[0038] 4. Carry out system security risk test and assessment of 5G ATG network for a civil aircraft equipped with an air-ground integrated intelligent communication system, and support the output of information security risk test and assessment report of the air-ground integrated intelligent communication system of a civil aircraft. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 Schematic diagram of an airborne network threat monitoring and warning system provided for this application

[0040] Figure 2 A schematic diagram of an airborne network protocol data packet interpretation and filtering process provided for this application

[0041] Figure 3 A simple Bayesian network diagram for this application

[0042] Figure 4 A flowchart of an airborne network threat monitoring and warning method provided for this application DETAILED DESCRIPTION

[0043] Embodiment 1

[0044] like Figure 1 As shown, the present application provides an airborne network threat monitoring and warning system, including an airborne end, a hardware end, a ground end, and a monitoring and warning module, wherein:

[0045] The airborne terminal includes a protocol analysis module, a device acquisition module, a security detection module, and a threat injection module;

[0046] The ground terminal is deployed on the ground to implement risk assessment and protocol testing for conventional tasks, including an intrusion simulation module, an operation simulation module, a risk assessment module, and a protocol testing module;

[0047] The hardware end is used to support the control ports, energy input, and authority management capabilities required for the operation of the system and platform. It is an integrated hardware device to support platform deployment, including a voltage energy control module, a decentralized key management module, and a control instruction input module.

[0048] Specifically, the protocol parsing module is used to parse the acquired communication data by field through channel monitoring and filtering, obtain its communication protocol type and its corresponding key fields, refer to the traditional IT protocol and OT protocol parsing mode, and use the avionics bus protocol collection. After acquiring the communication data packet, the protocol parsing module will interpret its data packet type, and then store the specific content in the data packet according to the protocol frame structure and pass it to the security detection module;

[0049] The security detection module is used to detect threats to the communication data passed by the protocol analysis module and pass the results to the platform end;

[0050] It should be noted that the security detection of the security detection module of the airborne network threat monitoring and warning system is to discover and detect threat behaviors by establishing a baseline rule base through threat modeling;

[0051] The equipment collection module is used to support the collection of avionics bus data from the avionics onboard bus data gateway device. It uses bypass data collection technology to collect network traffic in real time and perform traffic analysis in real time to obtain relevant information. The analyzed traffic system is automatically discarded and no longer saved.

[0052] It should be noted that the data collection capability is high and the efficiency is fast, and the data collection process will not affect the operation of the entire network.

[0053] Threat injection module, used to automatically retrieve the vulnerability library of related system products; use the system product vulnerability library POC / EXP to automatically verify and demonstrate vulnerability risks, and support the download of payloads such as POC / EXP threat injection scripts;

[0054] It should be noted that users can also customize vulnerability detection rules, and quickly verify corresponding assets based on the vulnerability rules.

[0055] The monitoring and alarm module is used to present security threats in a visual interface. It collects data, restores and reorganizes system processing data, and uses the built-in vulnerability information library to match traffic data with vulnerability features. It achieves real-time vulnerability sniffing perception capabilities and can issue alarms based on comprehensive considerations such as vulnerability severity, vulnerability type, and vulnerability impact scope. It can realize visual display functions such as threat monitoring and analysis, event alarms, and system management.

[0056] Specifically, the intrusion simulation module is used to simulate real attack behaviors, use information data to simulate the lethality and dangerousness of the target, and then determine the level of threat we are facing, evaluate the safety and fault tolerance of the aircraft, and identify and resolve potential security vulnerabilities by simulating security threats, thereby avoiding real attacks from damaging the aircraft, thereby improving the stability and safety of the entire aircraft system.

[0057] The running simulation module is used to quickly generate simulation running instances and simulation object instances based on the node characteristics, link characteristics, protocol types, network characteristics, business behaviors, and security mechanisms of the airborne network, while completing the process control of a series of simulation engines and simulation middleware.

[0058] The risk assessment module is used to verify whether the vulnerability information collected externally can be reused on the airborne equipment. It uses the simulation environment built by running the simulation module to reproduce the external vulnerability information. It verifies whether the vulnerability really exists and the possible harm it may cause from a practical perspective.

[0059] The protocol testing module is used to verify the impact of the threat traffic filtered in the task. It verifies the threat traffic information obtained based on security detection in the simulation environment generated by the running simulation module, confirms the hazards of abnormal behavior of filtered traffic, refines common problems of protocol threats, accelerates the iteration rate of security detection models, and strengthens the filtering, analysis and verification capabilities of unknown threats and new attacks.

[0060] The monitoring and alarm module is used to present security threats in a visual interface. It collects data, restores and reorganizes system processing data, and uses the built-in vulnerability information library to match traffic data with vulnerability features. It achieves real-time vulnerability sniffing perception capabilities and can conduct comprehensive analysis and judgment based on vulnerability severity, vulnerability type, vulnerability impact range and other dimensions to issue alarms. It can realize visual display functions such as threat monitoring and analysis, event alarms and system management.

[0061] Specifically, the system hardware device uses an embedded control unit as the main control, connects to the chip through a PCIE interface, and uses a PCIE interface to connect to the embedded control unit. The power supply uses LDO combined with DCDC devices to provide various voltage requirements required by the board. The USB interface is used to connect the system administrator and operator to realize decentralized management and board internal key management.

[0062] The present invention is mainly applied to:

[0063] (1) Applied to the enhancement of ATG air-to-ground link transmission performance and threat detection in 5G converged networking applications for air-to-ground multi-layer users, providing communication guarantee for the intelligent flight assistance enhancement system and the flight verification environment;

[0064] (2) Applied to 5G ATG communication system application security risk testing and assessment;

[0065] (3) Rapid integration and application verification of flight test technologies applied to airborne bus communication networks.

[0066] Embodiment 2

[0067] like Figure 4 As shown, an airborne network threat monitoring and warning method is provided for application, which is applied to an airborne network threat monitoring and warning system, and the method includes:

[0068] Step 1: Deploy logical isolation environment probes and physical isolation environment probes, adopt network isolation and bypass data collection methods, do not introduce external risk items, collect normal duty data and airworthiness operation data of airborne equipment, and complete equipment asset profiling;

[0069] It should be noted that step 1 provides normal data reference for subsequent protocol analysis and provides a security baseline reference for security testing.

[0070] It should be noted that the module supports the collection of avionics bus data from avionics onboard bus data gateway devices. The module uses bypass data collection technology to collect network traffic in real time, and performs real-time traffic analysis to obtain relevant information. The system automatically discards the analyzed traffic and no longer saves it. The data collection process will not affect the operation of the entire network.

[0071] Step 2: Deploy probes through data collection to monitor the communication data of airborne equipment, obtain communication data packets, store the specific content in the data packets according to the frame structure and perform fingerprint feature matching, determine the transmission channel mode, use the self-developed avionics protocol parsing algorithm, actively access the database to obtain the protocol parsing model, perform a preliminary interpretation of the data packet information, and transmit the interpreted data to the security detection module for behavior judgment; store the interpreted data in the airborne network threat monitoring and warning system database, and update the audit protocol type characteristics at any time.

[0072] Specifically, step 2 includes:

[0073] Step 21: Use bypass probe collection technology to monitor communications, collect device channel communication data in real time, and perform real-time traffic analysis through data packet protocol interpretation, protocol fingerprint matching, and data packet content parsing steps to achieve automatic discarding of normal traffic and high-precision perception of abnormal traffic;

[0074] Step 22: Use nftables packet filtering technology to pre-process large-scale network communication data, conduct preliminary screening by checking traffic consistency, handling invalid traffic and missing traffic, reduce the load of the airborne network threat monitoring and warning system, and transmit the preliminary filtered data to the protocol fingerprint matching part;

[0075] It should be noted that nftables packet filtering technology mainly controls communications at the network layer or transport layer. It analyzes the packet header and determines whether to discard the packet based on the rules defined in the packet header data field. Iptables contains at least three built-in tables: the NAT table manages backend hosts, the Filter table manages local packet entry, and the Mangle table manages the use of special flags. Before a communication packet enters the airborne network, it will first be checked by Netfilter. If it passes the check, it will be accepted (ACCEPT) to enter the airborne network to obtain resources. If it fails, it will be discarded (DROP). Figure 2 It can be seen that the rules have an order. When the communication data packet starts to be compared with Rule1, if the comparison result is consistent with Rule1, the network data packet will perform Action1 and directly ignore Rule2, Rule3 and other rules. If the data packet does not match Rule1 after comparison, it will enter the comparison of Rule2. If all rules do not match, the default action (data packet policy) will be used to determine the destination of the data packet.

[0076] Step 23: Combine signature-based recognition, behavior-based recognition, port-based recognition and static feature-based recognition to build an avionics equipment channel pattern matching algorithm, integrate signatures, behaviors, ports and static features, check the TCP header payload information of each data packet, and determine its protocol type through algorithm matching;

[0077] Step 24: Identify the data packet frame structure features through protocol fingerprint matching, use an iterative decryption algorithm, scan and identify the frame structure encryption algorithm and use the corresponding decryption algorithm for decryption, and then use the decrypted file as input for secondary decryption; until the data packet information is completely decrypted, the data packet transmission security detection part will be further analyzed and processed.

[0078] It should be noted that the existing technical means cannot directly decrypt the encrypted and obfuscated data packets. This solution creatively proposes a data packet interpretation technology based on data format recognition to realize the data packet parsing work.

[0079] It should be noted that the protocol parsing module creatively proposed an avionics bus protocol parsing mode based on the common IT and OT protocol parsing, realizing lossless parsing of the avionics protocols in use.

[0080] Step 3: Store the detection rules in the database, obtain the protocol parsing data through the built-in data interface of the airborne network threat monitoring and warning system, and use the normal data of the data acquisition sensing device to establish a baseline rule library. Creatively propose an improved model for calculating the risk level by assisting the risk source with the threat status and a multi-state airborne system safety assessment method based on the Bayesian network. Perform data modeling from two aspects: module detection and specification detection to achieve the discovery and detection of threat behaviors, and finally aggregate the detection data to the monitoring and alarm module for unified display.

[0081] Specifically, step 3 includes:

[0082] Step 31: Use the data interface to obtain protocol analysis data, extract the communication quintuple and communication content through a semi-interactive design approach, match them with the specification library stored in the database to obtain the test results, and provide iterative data and preliminary judgment information for subsequent module detection models and specification detection models;

[0083] Step 32: According to the state relationship between the channel components of the equipment, an airborne network threat detection model based on the Bayesian network is constructed. The conditional probability table of the non-root node of the Bayesian network is given by using the general generating function. A method for calculating the probability of channel failure state occurrence is proposed based on the variable elimination method. The importance algorithm of the channel component unit is derived to effectively evaluate the safety level of the airborne system and determine the impact of each unit on the system safety.

[0084] It should be noted that the Bayesian network used in this method is a directed acyclic graph, which is a graphical representation of the joint probability distribution of a series of random variables. The nodes represent random variables, and the arcs between nodes represent the direct dependencies between variables. The strength of the dependencies is reflected by the conditional probability table. Each node is attached to a probability distribution, and the root node is attached to the marginal distribution of the variable P(X|pa(X)). A simple Bayesian network such as Figure 3 As shown (conditional probability table is not included). The series-parallel structure of the multi-state channel is described using the universal generating function, and the conditional probability table of the Bayesian network node is constructed. The generating function polynomial describing the multi-state unit is:

[0085]

[0086] In the formula, s is the unit number, j is s is the number of the state of unit s, k s represents the number of states of unit s, The jth unit s Status value, represents the jth s The probability of a state occurring, z is an auxiliary variable.

[0087] The failure probability algorithm based on Bayesian network adopted in this method includes two parts: solving the probability of top events and solving the importance of bottom events.

[0088] The top event probability is solved according to the expression of the joint probability distribution of variables by Bayesian network reasoning. The joint probability distribution is the product of all probabilities in the network, that is, Where X1, X2, …, X n is a node in the Bayesian network, pa(X t ) is X k Therefore, the occurrence probability of the top event TE can be directly calculated using the joint probability distribution.

[0089]

[0090] Where X1, X2, …, X i are the bottom nodes and middle nodes in the network, x i It represents the possible state value of event i, 0 represents the complete failure of the event; i represents the number of non-leaf nodes in the network. The probability of occurrence of the top event TE can be calculated by the above formula.

[0091] The probability of the bottom event is solved. According to the importance analysis, it is an important part of the probabilistic safety analysis. It is used to reflect the degree to which a small change in the state of a component causes a change in the system. The bottom event X is calculated through Bayesian network reasoning. j The structural importance I(j) is shown as follows:

[0092]

[0093] In the formula, m j Represents event X j Different fault states, I represents event X j In fault state, m represents event X j The number of states.

[0094] Step 33: Adopt the safety risk module detection technology model based on abnormal state, use the hierarchical analysis method to establish two sets of safety detection indicator systems, use the grey fixed weight clustering method to calculate the fixed weight clustering coefficient, and combine the two evaluation results to determine the risk level.

[0095] It should be noted that the hierarchical analysis method used in this method constructs an evaluation index system from three parts: the target layer, the criterion layer and the indicator layer. Among them, the judgment matrix B is established. * = {b ij} and check the consistency. ij Taking a certain element of the upper layer as the standard, the importance of each indicator of the lower layer relative to this element is obtained by pairwise comparison using the table reading method proposed by Saaty, as shown in the following table.

[0096]

[0097] The matrix is ​​tested for consistency, that is, CR = CI / RI. The requirement is met only when CR is less than or equal to 0.1. CI is the consistency index:

[0098]

[0099] RI is the average random consistency index obtained by comparison and search. The corresponding relationship between this index and the matrix dimension n is shown in the following table:

[0100]

[0101] Calculate the relative weight and composite weight. The relative weight is the importance of the compared element relative to the previous layer, which is generally calculated by square root and normalized:

[0102]

[0103] For indicators directly associated with the top layer, their composite weight is equal to the relative weight; otherwise, it is equal to the product of the relative weight of the indicator and the composite weight of other upper-layer associated elements.

[0104] The grey fixed weight clustering method adopted in this scheme first assumes η j (j=1, 2, ..., m) is the weight of each clustering index, let For object i to belong to k grey fixed-weight clustering system:

[0105]

[0106] Suppose there are m indicators, n objects, and s gray classes. To classify object i into a gray class, the specific implementation steps are as follows:

[0107] 1) Determine the whitening weight function such as j index k based on experience

[0108] 2) Determine the clustering coefficient η of each indicator based on the calculation results of the hierarchical analysis method j (j=1, 2, ..., m);

[0109] 3) Calculate the grey fixed weight clustering coefficient according to step 1), step 2) and formula (4)

[0110] 4) Perform cluster analysis on the vector and determine whether object i belongs to gray class k:

[0111]

[0112] Step 34: Aggregate and integrate the data obtained from the module detection and specification detection, and forward it to the monitoring and alarm part for unified display.

[0113] It should be noted that security detection includes two sets of detection processes, one of which is the normal airborne equipment risk assessment detection. This process extracts the communication quintuple and communication content as key fields, and obtains the detection results by matching them with the detection rules. It is mainly used to support the functional implementation of the ground-side risk assessment and protocol testing modules. The other set creatively combines vulnerability detection with machine learning, trains machine learning models using common IT / OT vulnerability features, and then conducts special training through known vulnerabilities of airborne equipment, using autonomous detection models to respond to security risks, promote model iteration speed, and accumulate known abnormal information. It is mainly used to support the functional implementation of the airborne security monitoring module and the abnormal injection module.

[0114] Step 4: Based on the security detection alarm data, retain the corresponding abnormal traffic information, build a security exploitation library, collect the latest external vulnerability exploitation information, and build a vulnerability verification library; conduct simulation verification during the mission period to perceive the impact of abnormal vulnerabilities on actual flight, and provide equipment information support for the intrusion simulation module of the airborne network monitoring and warning system.

[0115] It should be noted that anomaly injection can automatically retrieve the product vulnerability library of the airborne network threat monitoring and warning system. Users can also customize vulnerability detection rules, and quickly verify airborne equipment based on the vulnerability rules. The airborne network threat monitoring and warning system product vulnerability library POC / EXP can be used to perform automated verification and demonstration of vulnerability risks, and support the download of payloads such as POC / EXP anomaly injection scripts.

[0116] Step 5: According to the specific application scenarios and business processes, obtain security detection data and threat injection verification data, and present visual interface alarms through UI visualization for security threat attack and defense threat situation, multi-dimensional airworthiness task analysis, equipment vulnerability map portrait, attack chain path, etc.

[0117] After the above steps, the security analysis and security behavior extraction of avionics bus protocol, avionics bus network security threat behavior modeling and avionics bus unknown virus and Trojan analysis are realized. The threat information and analyzed information are presented on the ground deployment platform.

[0118] The above embodiments are only preferred embodiments of the present invention and are not limitations of the technical solutions of the present invention. Any technical solution that can be implemented on the basis of the above embodiments without creative work should be deemed to fall within the scope of protection of the patent of the present invention.

Claims

1. An airborne network threat monitoring and warning system, characterized in that: It includes airborne end, hardware end, ground end, and monitoring and warning module, among which: The airborne terminal includes a protocol analysis module, a device acquisition module, a security detection module, and a threat injection module; The ground terminal is deployed on the ground to implement risk assessment and protocol testing for conventional tasks, including an intrusion simulation module, an operation simulation module, a risk assessment module, and a protocol testing module; The hardware end is used to support the control ports, energy input, and authority management capabilities required for the operation of the system and platform. It is an integrated hardware device to support platform deployment, including a voltage energy control module, a decentralized key management module, and a control instruction input module.

2. The system according to claim 1, characterized in that The protocol parsing module is used to parse the acquired communication data by field through channel monitoring and filtering, obtain its communication protocol type and its corresponding key fields, refer to the traditional IT protocol and OT protocol parsing mode, and use the avionics bus protocol collection. After acquiring the communication data packet, the protocol parsing module will interpret its data packet type, and then store the specific content in the data packet according to the protocol frame structure and pass it to the security detection module; The security detection module is used to perform threat detection on the communication data passed by the protocol analysis module and pass the results to the platform.

3. The system according to claim 1, characterized in that The threat injection module is used to automatically retrieve the vulnerability library of related system products; use the system product vulnerability library POC / EXP to automatically verify and demonstrate vulnerability risks, and support the download of payloads such as POC / EXP threat injection scripts.

4. The system according to claim 1, characterized in that The monitoring and alarm module is used to present security threats in a visual interface. It collects data, restores and reorganizes system processing data, and uses the built-in vulnerability information library to match traffic data with vulnerability features. It achieves real-time vulnerability sniffing perception capabilities and can issue alarms based on comprehensive considerations such as vulnerability severity, vulnerability type, and vulnerability impact scope. It also realizes visual display functions such as threat monitoring and analysis, event alarms, and system management.

5. The system according to claim 1, characterized in that The intrusion simulation module is used to simulate real attack behaviors, use information data to simulate the lethality and dangerousness of the target, and then determine the level of threat to us, evaluate the safety and fault tolerance of the aircraft, and identify and resolve potential security vulnerabilities by simulating security threats, avoiding real attacks from damaging the aircraft, thereby improving the stability and safety of the entire aircraft system.

6. The system according to claim 1, characterized in that The running simulation module is used to quickly generate simulation running instances and simulation object instances based on the node characteristics, link characteristics, protocol types, network characteristics, business behaviors, and security mechanisms of the airborne network, while completing the process control of a series of simulation engines and simulation middleware.

7. The system according to claim 1, characterized in that The risk assessment module is used to verify whether the vulnerability information collected externally can be reused on the airborne equipment. It uses the simulation environment built by running the simulation module to reproduce the external vulnerability information. It verifies whether the vulnerability really exists and the possible harm it may cause from a practical perspective.

8. An airborne network threat monitoring and warning method, characterized in that: Methods include: Step 1: Deploy logical isolation environment probes and physical isolation environment probes, adopt network isolation and bypass data collection methods, do not introduce external risk items, collect normal duty data and airworthiness operation data of airborne equipment, and complete equipment asset profiling; Step 2: Deploy probes through data collection to monitor the communication data of airborne equipment, obtain communication data packets, store the specific content in the data packets according to the frame structure and perform fingerprint feature matching, determine the transmission channel mode, use the self-developed avionics protocol parsing algorithm, actively access the database to obtain the protocol parsing model, perform a preliminary interpretation of the data packet information, and transmit the interpreted data to the security detection module for behavior judgment; store the interpreted data in the airborne network threat monitoring and warning system database, and update the audit protocol type characteristics at any time; Step 3: Store the detection rules in the database, obtain the protocol parsing data through the built-in data interface of the airborne network threat monitoring and warning system, establish a baseline rule library using the normal data of the data acquisition sensing device, creatively propose an improved model for calculating the risk level by assisting the risk source with the threat state, and a multi-state airborne system safety assessment method based on the Bayesian network. Perform data modeling from the two aspects of module detection and specification detection to achieve the discovery and detection of threat behaviors, and finally aggregate the detection data to the monitoring and warning module for unified display; Step 4: Based on the security detection alarm data, store the corresponding abnormal traffic information, build a security exploitation library, collect the latest external vulnerability exploitation information, and build a vulnerability verification library; Conduct simulation verification during the mission period to perceive the impact of abnormal vulnerabilities on actual flight and provide equipment information support for the intrusion simulation module of the airborne network monitoring and warning system; Step 5: According to the specific application scenario and business process, obtain security detection data and threat injection verification data, and present the security threat attack and defense threat situation, multi-dimensional airworthiness task analysis, equipment vulnerability map portrait, and attack chain path content through UI visualization to present visual interface alarms.

9. The method according to claim 8, characterized in that Step 2 includes: Step 21: Use bypass probe collection technology to monitor communications, collect device channel communication data in real time, and perform real-time traffic analysis through data packet protocol interpretation, protocol fingerprint matching, and data packet content parsing steps to achieve automatic discarding of normal traffic and high-precision perception of abnormal traffic; Step 22: Use nftables packet filtering technology to pre-process large-scale network communication data, conduct preliminary screening by checking traffic consistency, handling invalid traffic and missing traffic, reduce the load of the airborne network threat monitoring and warning system, and transmit the preliminary filtered data to the protocol fingerprint matching part; Step 23: Combine signature-based recognition, behavior-based recognition, port-based recognition and static feature-based recognition to build an avionics equipment channel pattern matching algorithm, integrate signatures, behaviors, ports and static features, check the TCP header payload information of each data packet, and determine its protocol type through algorithm matching; Step 24: Identify the data packet frame structure features through protocol fingerprint matching, use an iterative decryption algorithm, scan and identify the frame structure encryption algorithm and use the corresponding decryption algorithm for decryption, and then use the decrypted file as input for secondary decryption; until the data packet information is completely decrypted, the data packet transmission security detection part will be further analyzed and processed.

10. The method according to claim 8, characterized in that Step 3 includes: Step 31: Use the data interface to obtain protocol analysis data, extract the communication quintuple and communication content through a semi-interactive design approach, match them with the specification library stored in the database to obtain the test results, and provide iterative data and preliminary judgment information for subsequent module detection models and specification detection models; Step 32: According to the state relationship between the channel components of the equipment, an airborne network threat detection model based on the Bayesian network is constructed. The conditional probability table of the non-root node of the Bayesian network is given by using the general generating function. A method for calculating the probability of channel failure state occurrence is proposed based on the variable elimination method. The importance algorithm of the channel component unit is derived to effectively evaluate the safety level of the airborne system and determine the impact of each unit on the system safety. Step 33: Adopt the safety risk module detection technology model based on abnormal state, use the hierarchical analysis method to establish two sets of safety detection indicator systems, use the grey fixed weight clustering method to calculate the fixed weight clustering coefficient, and combine the two evaluation results to determine the risk level; Step 34: Aggregate and integrate the data obtained from the module detection and specification detection, and forward it to the monitoring and alarm part for unified display.

Images