Radio supportability monitoring method based on real-time data

Abstract

The invention discloses a radio supportability monitoring method based on real-time data, and relates to the technical field of radio supportability monitoring, and the method comprises the steps: obtaining a source object of a radio signal represented as appearing in a target region, and marking a stable label or an accidental label on the source object according to the everyday appearing duration of the source object, marking the target area as a stable area or a disordered area according to the proportion between the stable label and the accidental label; when a monitoring time period arrives, all real-time source objects can be obtained, when the real-time source objects are obtained, when the real-time source objects meet related requirements, the real-time source objects are marked as suspicion sources, and targeted investigation is carried out on the suspicion sources, so that the situation that investigation is carried out simply according to used sources is avoided; and meanwhile, used frequency spectrum signals can be monitored, and the method is simple, effective and easy to use.

Description

Technical Field

[0001] The invention belongs to the technical field of radio security monitoring, and in particular relates to a radio security monitoring method based on real-time data. Background Art

[0002] Patent application number CN201910253245.8 discloses a radio frequency gene library system and an illegal radio wave detection system. The radio frequency gene library system includes: an individual division device, configured to determine the scope of the target geographical area, determine the individual division method according to the communication environment of the target geographical area, and divide the target geographical area into multiple individuals according to the individual division method; a wireless detector, configured to detect each individual and obtain the basic radio frequency data of each individual; a radio frequency gene library generation device, configured to perform deep neural network calculations based on the basic radio frequency data of each individual to obtain the radio frequency genes of each individual; save the radio frequency genes of each individual and generate a radio frequency gene library for the target geographical area. The technical solution provided by the present invention can realize the intelligence and automation of radio monitoring work, reduce unnecessary waste of manpower, money, materials and time, improve the work efficiency of radio management, and improve the radio management system.

[0003] For radio monitoring, how to monitor different areas and different situations, especially detecting anomalies in the use of radio frequencies corresponding to different spectrums, is a difficult problem. Based on this, a solution is provided. Summary of the Invention

[0004] The present invention aims to solve at least one of the technical problems existing in the prior art;

[0005] To achieve the above objectives, a radio security monitoring method based on real-time data is proposed, including:

[0006] Obtain the source object of the radio signal appearing in the target area, label the source object as stable or sporadic based on the duration of the source object's appearance each day, and label the target area as stable or sporadic based on the ratio of the stable label to the sporadic label;

[0007] When the monitoring period arrives, all real-time source objects will be obtained. When a real-time source object meets the following requirements, it will be marked as a suspect source. The specific requirements are as follows:

[0008] The real-time source object does not belong to the source object in the source library;

[0009] The real-time source object and the real-time interval between the last use of the same source object are not within the interval range or the expanded fluctuation range;

[0010] The continuous real-time usage duration during use exceeds the duration range or the expanded fluctuating duration range;

[0011] The source library contains all source objects that appeared in the last set number of days;

[0012] The interval range or fluctuation range is determined by analyzing the discrete degree of the time intervals before and after each occurrence of the source object in the past, and the duration range or fluctuation duration range is determined by analyzing the discrete degree of the duration of each occurrence of the source object in the past.

[0013] Furthermore, the stable label or occasional label of the source object is determined as follows:

[0014] Obtain the duration of the source object's appearance within the set number of days, and the ratio of days with non-zero duration to the total number of days;

[0015] The number of non-zero maintenance durations whose absolute difference from the mean maintenance duration does not exceed X1 is obtained, which accounts for a stable ratio of the total number of non-zero maintenance durations;

[0016] The stability ratio and occupancy ratio are assigned different weights and then added together to obtain the stability evaluation value. Source objects with a stability evaluation value exceeding the set value X2 are labeled as stable, and source objects with a stability value less than or equal to X4 are labeled as occasional. The value of X4 is 0.65 times of X2.

[0017] Furthermore, when the sporadic ratio exceeds the set ratio B2, the corresponding target area is marked as a random area; if it is lower than 0.4 times B2, it is marked as a stable area.

[0018] Furthermore, the interval range and fluctuation range are determined as follows:

[0019] Get the time interval between each occurrence of the source object and the last occurrence, and get several time intervals Zi, i = 1, ..., m. Get the mean of Zi and mark it as U, and then automatically calculate its deviation value Q. The calculation formula is:

[0020] ;

[0021] When Q does not exceed the preset value X3, the range from the minimum value to the maximum value of Zi is marked as the interval range;

[0022] When Q exceeds X3, Zi is automatically sorted in descending order according to the value of |Zi-U|, and then the Zi values ​​are selected in sequence. Each time one is selected, it is deleted. After deletion, the Q values ​​of the remaining Zi are recalculated. When Q still exceeds X3, the next Zi value is selected and deleted until Q does not exceed X3. The number of deleted Zi values ​​is obtained and divided by m. The resulting value is marked as the deletion ratio. When the deletion ratio does not exceed the set ratio B3, the range from the minimum to the maximum value of the remaining Zi after deletion is marked as the fluctuation interval range.

[0023] Furthermore, the duration range and the fluctuation duration range are determined as follows:

[0024] The duration of each past occurrence of the source object is obtained, and the duration is processed in the same way according to the time interval to obtain the duration range and the fluctuation duration range.

[0025] Furthermore, the fluctuation range and fluctuation duration range are expanded as follows:

[0026] Add one to the expansion ratio and multiply by the maximum value in the range. Subtract one from the expansion ratio and multiply by the minimum value in the range.

[0027] Furthermore, when the target area is a stable area, the expansion ratio is 0.3;

[0028] When the target area is a random hair area, the expansion ratio is 0.15.

[0029] Furthermore, X1 is a preset value.

[0030] Furthermore, X1 is determined as follows:

[0031] Select several labeled stable source objects, then obtain all source objects, calculate the stability evaluation values ​​of all source objects, obtain several stability evaluation values, calculate their deviation values, and filter the stability evaluation values ​​based on the relationship between the deviation value and the preset value X4 until the deviation value is less than X4;

[0032] Obtain the deleted stable evaluation value, obtain the sum of the deleted stable evaluation values ​​that are greater than the mean, mark it as the average-up total value, and mark the sum of the deleted stable evaluation values ​​that are less than the mean as the average-down total value;

[0033] When the value of (average upper total value - average lower total value) / average lower total value exceeds B1, the median of the mean of the undeleted stable assessment values ​​and the minimum value of the stable assessment values ​​will be marked as the corresponding value of X2. Otherwise, the minimum value of the undeleted stable assessment values ​​will be marked as the value of X2. If the deviation value is less than X4 from the beginning, the minimum value of the stable assessment values ​​will also be marked as the value of X2.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] The present application obtains the source object of the radio signal appearing in the target area, labels the source object with a stable label or an occasional label according to the duration of the source object's appearance every day, and marks the target area as a stable area or a random area according to the ratio between the stable label and the occasional label;

[0036] When the monitoring period arrives, all real-time source objects will be obtained. When the real-time source objects meet the relevant requirements, they will be marked as suspected sources, and targeted investigation will be carried out on the suspected sources, thereby avoiding the situation of simply investigating based on the used ones. At the same time, the used spectrum signals can also be monitored. The present invention is simple, effective, and easy to use. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0038] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0039] See also Figure 1 ,This application provides a radio security monitoring method based on real-time data;

[0040] As the first embodiment of the present application, the following steps are specifically included:

[0041] The source object of the radio signal appearing in the target area is obtained, and the source object is labeled as stable or sporadic according to the duration of the source object's appearance every day. The target area is marked as a stable area or a random area according to the ratio between the stable label and the sporadic label.

[0042] When the monitoring period arrives, all real-time source objects will be obtained. When a real-time source object meets the following requirements, it will be marked as a suspect source. The specific requirements are as follows:

[0043] The real-time source object does not belong to the source object in the source library;

[0044] The real-time source object and the real-time interval between the last use of the same source object are not within the interval range or the fluctuation range after the expansion ratio;

[0045] The continuous real-time usage duration during use exceeds the duration range or the expansion ratio of the fluctuating duration range;

[0046] The source library contains all source objects that appeared within the last set number of days;

[0047] The interval range or fluctuation range is determined by analyzing the discrete degree of the time intervals before and after each occurrence of the source object in the past, and the duration range or fluctuation duration range is determined by analyzing the discrete degree of the duration of each occurrence of the source object in the past.

[0048] As a second embodiment of the present application, the method specifically includes the following steps:

[0049] Step 1: Monitor the preset target area, which is the target location to be monitored. Then, collect the radio spectrum data that appears in the target area every day in the recent period. The recent period mentioned here refers to 30 days from now, which can be changed to 60 days, depending on the administrator's needs. For ease of description, the corresponding radio spectrum data is marked as the source object.

[0050] Step 2: Select a source object and obtain its maintenance duration on each day. The maintenance duration is the total duration from the appearance to the end of the spectrum signal on that day. Obtain several maintenance durations Wi, where i = 1, ..., n, indicating that a total of n days of data have been obtained, and the maintenance duration corresponding to the i-th day is Wi;

[0051] Obtain the number of days with a non-zero maintenance duration, and divide it by n to obtain the value to be marked as the occupancy ratio;

[0052] Remove the ones with a maintenance duration of 0, and then obtain the mean of the remaining maintenance durations Wi, mark it as P, and use the filtering condition |Wi-P|≤X1, where X1 is a preset value set by the administrator; obtain the number of Wi that meet the filtering condition and mark it as the stability ratio;

[0053] Use the formula to calculate the stability assessment value of the corresponding source object. The specific calculation formula is:

[0054] Stability assessment value = 0.42*occupancy ratio + 0.58*stability ratio;

[0055] Get the stability evaluation value of the corresponding source object. When it exceeds the preset value X2, the source object is automatically labeled as stable. When it is less than or equal to X4, it is automatically labeled as sporadic. The value of X4 is 0.65 times of X2.

[0056] Perform the same process on all other source objects to obtain all source objects with either stable or occasional labels.

[0057] Step 3: Then obtain all labeled source objects in the target area;

[0058] Obtain the number of objects with occasional label sources, divide it by the number of objects with stable label sources, and mark it as the occasional ratio;

[0059] When the sporadic rate exceeds the set ratio B2, the corresponding target area will be marked as a random area. B2 is generally set to 0.35, and of course the administrator can set it to other values ​​according to actual needs. If it is lower than 0.4 times B2, it will be marked as a stable area.

[0060] Step 4: After arriving at the target area during the monitoring period, conduct security monitoring. The specific monitoring methods are as follows:

[0061] All source objects that have occurred in the target area will be obtained, and all source objects will be verified to be problem-free before the monitoring period. Here, problem-free means that all source objects are legal and regular signal exchanges;

[0062] Build all source objects into a source library;

[0063] Perform inertia analysis on all source objects in the target area. The specific method is as follows:

[0064] Select a source object and obtain the duration of each occurrence of the source object, the time interval between the previous and next occurrences, and the user who communicates with the source object, including the sender and receiver. A single occurrence refers to the absence of a source object within T1 after the source object is interrupted, which is expressed as "sequentially". T1 is a preset value, generally half a minute.

[0065] Get the deviation value of all time intervals. The specific acquisition method is:

[0066] The time interval is marked as Zi, i = 1, ..., m, indicating that there are m source objects;

[0067] Automatically obtain the mean of Zi and mark it as U, and then automatically calculate its deviation value Q. The specific calculation formula is:

[0068] ;

[0069] When Q does not exceed the preset value X3, the range from the minimum value to the maximum value of Zi is automatically marked as the interval range;

[0070] When Q exceeds the preset value X3, Zi values ​​are automatically sorted in descending order according to the value of |Zi-U|, and then the Zi values ​​are selected in sequence. Each selected one is deleted, and the Q values ​​of the remaining Zi values ​​are recalculated after deletion. If Q still exceeds X3, the next Zi value is selected and deleted until Q does not exceed X3. The number of deleted Zi values ​​is obtained and divided by m. The resulting value is marked as the deletion ratio. When the deletion ratio does not exceed the set ratio B3, the range from the minimum to the maximum value of the remaining Zi values ​​after deletion is marked as the fluctuation interval range.

[0071] If the deletion ratio exceeds B3, no action will be taken;

[0072] The same processing is performed on the time length to obtain the duration range or fluctuation duration range of the corresponding time length;

[0073] Step 5: Then obtain all users and establish a usage database, which includes the sender and the receiver;

[0074] All real-time sources are obtained. When a new source is added, it means there is no corresponding source object in the source library. The new source is automatically marked as a suspicious source and verified by the management staff.

[0075] When the real-time source is not a newly added source, it will be verified whether it belongs to the two parties in the database. If so, no processing will be performed. If not, the real-time time interval of the last use of this real-time source will be obtained. At this time, the interval range or fluctuation interval range of the corresponding source object will be obtained;

[0076] If there is an interval range and the real-time time interval is within the fluctuation range, no processing will be performed. If it exceeds the real-time interval range, the corresponding real-time source will be marked as a suspicious source;

[0077] If a fluctuation interval exists, the real-time time interval is compared with the fluctuation interval range. If it does not exceed the expansion ratio of the fluctuation interval range, no action is taken. If it exceeds, the real-time source is marked as a suspect source.

[0078] The expansion ratio is determined as follows:

[0079] When the target area is a random hair area, the expansion ratio is 0.15, which means that the maximum value in the range will be multiplied by 1.15 and the minimum value will be multiplied by 0.85;

[0080] When the target area is a stable area, an expansion ratio of 0.3 means that the maximum value in the range will be multiplied by 1.3 and the minimum value will be multiplied by 0.7;

[0081] At the same time, the real-time usage duration of the real-time source will be continuously monitored during use. If the continuous real-time usage duration exceeds the duration range or the expansion ratio of the fluctuation duration range, the real-time source will be marked as a suspicious source;

[0082] Of course, as the third embodiment of the present application, X2 in the first embodiment can be determined by the following method, specifically:

[0083] The administrator selects several labeled stable source objects, obtains all source objects, calculates the stability evaluation values ​​of all source objects, obtains several stability evaluation values, calculates their deviation values, and selects the stability evaluation values ​​according to the relationship between the deviation value and X4 in the manner provided in Example 1 until the deviation value is less than X4; X4 is a preset value;

[0084] Obtain the deleted stable evaluation value, obtain the sum of the deleted stable evaluation values ​​that are greater than the mean, mark it as the average-up total value, and mark the sum of the deleted stable evaluation values ​​that are less than the mean as the average-down total value;

[0085] When the value of (average upper total value - average lower total value) / average lower total value exceeds B1, the median of the average of the undeleted stable evaluation values ​​and the minimum value among the stable evaluation values ​​is marked as the corresponding X2 value. Otherwise, the minimum value among the undeleted stable evaluation values ​​is marked as the X2 value. If the deviation value is less than X4 from the beginning, the minimum value among the stable evaluation values ​​is also marked as the X2 value.

[0086] Some of the data in the above formula are calculated by removing the dimensions and taking their numerical values. The formula is a formula that is closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0087] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A radio security monitoring method based on real-time data, characterized in that: include: Obtain the source object of the radio signal appearing in the target area, label the source object as stable or sporadic based on the duration of the source object's appearance each day, and label the target area as stable or sporadic based on the ratio of the stable label to the sporadic label; When the monitoring period arrives, all real-time source objects will be obtained. When a real-time source object meets the following requirements, it will be marked as a suspect source. The specific requirements are as follows: The real-time source object does not belong to the source object in the source library; The real-time source object and the real-time interval between the last use of the same source object are not within the interval range or the expanded fluctuation range; The continuous real-time usage duration during use exceeds the duration range or the expanded fluctuating duration range; The source library contains all source objects that appeared in the last set number of days; The interval range or fluctuation range is determined by analyzing the discrete degree of the time intervals before and after each occurrence of the source object in the past, and the duration range or fluctuation duration range is determined by analyzing the discrete degree of the duration of each occurrence of the source object in the past.

2. The method for monitoring radio security based on real-time data according to claim 1, characterized in that: The stable or sporadic label of a source object is determined as follows: Obtain the duration of the source object's appearance within the set number of days, and the ratio of days with non-zero duration to the total number of days; The number of non-zero maintenance durations whose absolute difference from the mean maintenance duration does not exceed X1 is obtained, which accounts for a stable ratio of the total number of non-zero maintenance durations; The stability ratio and occupancy ratio are assigned different weights and then added together to obtain the stability evaluation value. Source objects with a stability evaluation value exceeding the set value X2 are labeled as stable, and source objects with a stability value less than or equal to X4 are labeled as occasional. The value of X4 is 0.65 times of X2.

3. The method for monitoring radio security based on real-time data according to claim 1, characterized in that: When the sporadic ratio exceeds the set ratio B2, the corresponding target area will be marked as a random area; if it is lower than 0.4 times B2, it will be marked as a stable area.

4. The method for monitoring radio security based on real-time data according to claim 1, characterized in that: The interval range and fluctuation range are determined as follows: Get the time interval between each occurrence of the source object and the last occurrence, and get several time intervals Zi, i = 1, ..., m. Get the mean of Zi and mark it as U, and then automatically calculate its deviation value Q. The calculation formula is: ； When Q does not exceed the preset value X3, the range from the minimum value to the maximum value of Zi is marked as the interval range; When Q exceeds X3, Zi is automatically sorted in descending order according to the value of |Zi-U|, and then the Zi values ​​are selected in sequence. Each time one is selected, it is deleted. After deletion, the Q values ​​of the remaining Zi are recalculated. When Q still exceeds X3, the next Zi value is selected and deleted until Q does not exceed X3. The number of deleted Zi values ​​is obtained and divided by m. The resulting value is marked as the deletion ratio. When the deletion ratio does not exceed the set ratio B3, the range from the minimum to the maximum value of the remaining Zi after deletion is marked as the fluctuation interval range.

5. The method for monitoring radio security based on real-time data according to claim 4, characterized in that: The duration range and fluctuation duration range are determined as follows: The duration of each past occurrence of the source object is obtained, and the duration is processed in the same way according to the time interval to obtain the duration range and the fluctuation duration range.

6. The method for monitoring radio security based on real-time data according to claim 1, characterized in that: The way to expand the fluctuation range and fluctuation duration is as follows: Add one to the expansion ratio and multiply by the maximum value in the range. Subtract one from the expansion ratio and multiply by the minimum value in the range.

7. The method for monitoring radio security based on real-time data according to claim 6, characterized in that: When the target area is a stable area, the expansion ratio is 0.3; When the target area is a random hair area, the expansion ratio is 0.

15.

8. The method for monitoring radio security based on real-time data according to claim 2, characterized in that: X1 is the preset value.

9. The method for monitoring radio security based on real-time data according to claim 2, characterized in that: X1 is determined as follows: Select several labeled stable source objects, then obtain all source objects, calculate the stability evaluation values ​​of all source objects, obtain several stability evaluation values, calculate their deviation values, and filter the stability evaluation values ​​based on the relationship between the deviation value and the preset value X4 until the deviation value is less than X4; Obtain the deleted stable evaluation value, obtain the sum of the deleted stable evaluation values ​​that are greater than the mean, mark it as the average-up total value, and mark the sum of the deleted stable evaluation values ​​that are less than the mean as the average-down total value; When the value of (average upper total value - average lower total value) / average lower total value exceeds B1, the median of the mean of the undeleted stable assessment values ​​and the minimum value of the stable assessment values ​​will be marked as the corresponding value of X2. Otherwise, the minimum value of the undeleted stable assessment values ​​will be marked as the value of X2. If the deviation value is less than X4 from the beginning, the minimum value of the stable assessment values ​​will also be marked as the value of X2.

Images