Ship network abnormal behavior detection system based on multi-protocol deep analysis

Abstract

The invention discloses a ship network abnormal behavior detection system based on multi-protocol deep analysis, and belongs to the technical field of ship network security. According to the ship network abnormal behavior detection system integrating multi-protocol semantic analysis, communication chain modeling, state awareness and behavior scoring, a unified semantic intermediate expression structure is constructed, fields of various heterogeneous protocols are abstracted into standard semantic units, behavior portraits are established in combination with a communication topological graph and an equipment state sequence, and the behavior portraits are subjected to state awareness and behavior scoring. And multi-dimensional anomaly recognition and hierarchical response are realized based on a weighted scoring mechanism, so that the blank in the aspects of cross-protocol fusion recognition and behavior modeling closed-loop detection in the prior art is filled, and the security risk recognition requirements of complex data and frequent switching in a ship scene are met.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of ship network security, and particularly relates to a ship network abnormal behavior detection system based on multi-protocol deep analysis. BACKGROUND

[0002] With the continuous development of ship informatization and intelligentization, modern ships have integrated navigation systems, automatic identification systems, radar communication systems and other key subsystems. These subsystems are built into a highly complex communication network through internal local area networks or remote links. Due to the use of Modbus, NMEA, CAN and other heterogeneous protocols for interaction, different protocols differ significantly in format, field structure and semantic definition, resulting in the significant characteristics of ship networks, such as multi-protocol mixing, complex data structure and frequent state switching.

[0003] At present, the existing ship network anomaly detection methods have obvious limitations, mostly relying on single protocol rule filtering, shallow packet field comparison or fixed mode analysis. Such methods cannot achieve semantic-level unified identification of multi-protocol heterogeneous data, making it difficult to capture complex dynamic characteristics such as device behavior mutation and path drift, thereby causing problems such as anomaly omission, misjudgment and response lag, which seriously threaten the safety of ship navigation and network stability.

[0004] Therefore, an integrated detection system that can deeply integrate multi-protocol semantics, accurately model device behavior and implement intelligent response is urgently needed to address the unique security challenges of ship networks. SUMMARY

[0005] In view of the above technical problems in the prior art, the application provides a ship network abnormal behavior detection system based on multi-protocol deep analysis, which is reasonable in design, overcomes the shortcomings of the prior art and has good effects.

[0006] To achieve the above purpose, the application adopts the following technical solutions: A ship network abnormal behavior detection system based on multi-protocol deep analysis, comprising a protocol identification and classification module, a multi-protocol semantic abstraction module, a communication relationship modeling module, a device state perception module, a behavior portrait construction module, an abnormal behavior detection and scoring module, and a response decision and strategy linkage module. The protocol identification and classification module: first process the ship network raw data stream, combine the port features, data fingerprints and traffic behavior characteristics, accurately determine the communication protocol to which the data packet belongs and add an identifier, so as to facilitate the unified processing of multi-protocol data by the subsequent modules. Multi-protocol semantic abstraction module: After receiving data with communication protocol identification, call the corresponding syntax parsing rules to build an abstract syntax tree, extract semantic elements and map them to a unified intermediate semantic expression structure, eliminate differences in different protocol semantics, and prepare data for the communication relationship modeling module; Communication relationship modeling module: Based on the unified intermediate semantic expression structure, extract device identification, communication direction, and other information, track device interaction process, record instruction direction, response behavior, and other key data, and build communication link map for the device state perception module to provide communication context; Device state perception module: Relying on the control and state feedback fields in the communication link, continuously monitor and generate device running state sequence, label state change events and trigger conditions, and provide device state dimension data support for the behavior portrait construction module; Behavior portrait construction module: Fuse the received communication link map and device state sequence, mine normal behavior patterns of the device, build node behavior map and state evolution model, and fully depict behavior characteristics and state laws; Abnormal behavior detection and scoring module: Compare real-time communication behavior with behavior portrait, identify abnormalities from multiple dimensions such as fields and paths, generate quantitative results through a weighted multi-dimensional scoring function, and provide accurate basis for response decision; Response decision and strategy linkage module: According to the abnormal scoring results, match the security strategy library, execute hierarchical response operations, and link other security systems to form a complete closed loop from detection to disposal, and ensure ship network security.

[0007] Preferably, the protocol identification and classification module comprises: (1) Multi-level identification mechanism: As the system data processing entrance, this module builds a multi-level identification mechanism for the complex scene of mixed protocols in ship networks, first preliminarily filters according to port characteristics, classifies data packets using default or commonly used port characteristics of each protocol, such as NMEA protocol specific port clues. Then form data fingerprints by extracting fixed fields in the packet header, match with the pre-built fingerprint library, and further narrow down the protocol range; (2) Precise determination and identification unit: Combined with traffic behavior characteristics, determine the dynamic characteristics such as data packet sending frequency and message length change, compare with the typical behavior characteristic library, accurately identify multiple protocols such as Modbus and NMEA, and add clear protocol identification to each data packet after identification.

[0008] Preferably, the multi-protocol semantic abstraction module comprises: (1) Syntax analysis and element extraction unit: connected with the protocol identification and classification module, according to the output of the protocol identification, automatically call the corresponding syntax analysis rules, based on the rule library covering the field structure, etc., deep analysis of the protocol message, construct abstract syntax tree, intuitive present field logical relationship, and extract device identification, instruction type and other key semantic elements; Rule library content: analysis rules covering Modbus protocol function code 0x01-0x17, field mapping of NMEA protocol all standard sentences (such as GPRMC, GPGGA), analysis logic of CAN protocol common DBC signal (such as EngineSpeed, OilPressure); (2) Unified semantic expression conversion unit: map the extracted semantic elements to the unified intermediate semantic expression structure, which uses a standardized data model to define common semantic fields and data types. For example, the device running status field in different protocols is mapped to the "device status" field and standardized, eliminating semantic differences and facilitating subsequent communication relationship analysis.

[0009] Preferably, the communication relationship modeling module comprises: (1) Key information acquisition unit: connected with the multi-protocol semantic abstraction module, based on the unified intermediate semantic expression structure, extract device identification, communication direction and other information. Track the device interaction process, record the instruction direction (such as the instruction from the control center to the device), response behavior (including content and state), millisecond level round trip delay and communication frequency of different time granularity, etc. Key data; (2) Communication link graph construction unit: using graph theory method, taking device as node and communication connection as edge to construct communication link graph, the attributes of edge include instruction direction, response behavior, etc. The graph intuitively presents the ship network communication topology and interaction mode, and provides comprehensive communication context for device state analysis.

[0010] Preferably, the device state perception module comprises: (1) State field extraction and tracking unit: connected with the communication relationship modeling module, extract control field and state feedback field from the communication process, these fields contain device running parameters, operation execution situation, etc. Information, such as speed, temperature and other parameters feedback by power control system device, device state perception module continuously tracks these fields, generates device running state sequence according to time sequence; (2) State change event labeling unit: when the device state changes significantly, such as switching from normal to fault or parameter out of range, automatically label the state change event, record the occurrence time, trigger condition and other details. The generated state sequence and event information provide data support for the device state dimension of the behavior portrait construction module.

[0011] Preferably, the behavior portrait construction module comprises: (1) Node behavior atlas construction unit: This module is connected with the communication relationship modeling module and the device state perception module respectively, and associates the device nodes of the communication link atlas with the device state sequence. Each node integrates the basic information of the device and the communication behavior in different states, mines the normal behavior mode through analyzing the historical data, and forms the node behavior baseline; (2) State evolution model construction unit: Combined with the device state sequence and the communication link change, the device state transition law, the triggering factor and the accompanying communication behavior change are analyzed, the state transition mutation rate model and the evolution path model are established, and the device behavior characteristics and the state change law are fully described to provide a benchmark for anomaly detection.

[0012] State transition mutation rate model expression; ; In the formula: is the state mutation proportion in unit time; is the state jump number (such as standby running failure); is the total state transition number; Source description: The behavior model is commonly used to identify unexpected state jumps, which is derived from the theory of Markov chain and state machine.

[0013] Preferably, the abnormal behavior detection and scoring module comprises: (1) Multi-dimensional anomaly identification unit: connected with the behavior portrait construction module, compares the real-time communication behavior data with the preset behavior portrait model, analyzes from multiple dimensions such as field, path, state, and period, identifies multiple abnormal types such as field anomaly, path deviation, state mutation, and period anomaly, and realizes comprehensive monitoring; (2) Weighted scoring calculation unit: according to the influence degree of each abnormal index on the ship network security, weights are assigned, and the abnormal scoring result is obtained through a weighted multi-dimensional abnormal scoring function model. This result not only reflects the severity of the anomaly, but also clearly identifies the type and key influencing factors, and provides accurate basis for response decision.

[0014] Weighted multi-dimensional abnormal scoring function model expression: ; In the formula: is the final abnormal score (between 0 and 1) is the field matching abnormal score (field value deviation); is the path deviation abnormal score (different behavior path); is the state sequence abnormal score (state sequence variation); is the weighted coefficient of the three types of scores, which satisfies .

[0015] Source: Weighted average model, suitable for security scoring, anomaly quantitative synthesis, commonly used in intrusion detection systems (IDS).

[0016] This scoring model is different from the scoring mechanism for Internet attacks in general intrusion detection systems (IDS). It has been optimized in three aspects in the ship network scenario: first, the path offset dimension is added to adapt to the link anomaly recognition demand under the dynamic topology of the ship; second, the device state mutation rate evaluation function is introduced to improve the recognition accuracy of potential faults or tampering behavior; third, the scoring result directly links the response module to realize dynamic security policy adjustment based on quantitative indicators; the above optimizations ensure that the scoring mechanism is strongly related to the ship application scenario and has practicality and innovation.

[0017] Preferably, the response decision and strategy linkage module comprises: (1) Hierarchical response operation unit: connected with the abnormal behavior detection and scoring module, matching the preset security policy library according to the abnormal score result, generating an alarm when the score is below the threshold; when a certain threshold is reached, the alarm and communication blocking are executed; when a high-risk level is reached, the alarm, blocking and security policy model updating are executed simultaneously; (2) Multi-system cooperative protection unit: with linkage function with other security systems of the ship, can transfer abnormal information and response instructions, cooperatively take protective measures, form a complete safety control closed loop from detection to disposal, effectively improve the overall security protection capability of the ship network.

[0018] The beneficial technical effects brought by the present application are: 1. The present application successfully realizes semantic-level unified recognition of multi-protocol heterogeneous data by means of multi-protocol deep semantic analysis and unified intermediate semantic expression, solves the problem of rough multi-protocol data recognition in the prior art, and can accurately capture complex dynamic behavior characteristics such as device behavior mutation and path drift by fusing communication chain atlas and device state sequence to construct behavior portrait, which effectively reduces abnormal false alarms and misjudgments, significantly improves the accuracy of ship network anomaly recognition, and provides more reliable identification protection for ship network security.

[0019] 2. The present application sets a response decision and strategy linkage module, performs hierarchical response operation based on multi-dimensional abnormal score results, and links with the security policy library to form a complete closed loop from abnormal detection to response disposal. Compared with the prior art which lacks scoring mechanism and security policy linkage, the system can automatically adjust the response strategy according to the severity of the abnormality, realize intelligent dynamic response, not only improve the processing efficiency and timeliness of abnormal events, but also further enhance the security protection capability of the ship network, making the response to abnormality more targeted.

[0020] 3、The application has unified analysis capability for multiple protocols by setting protocol identification and classification module, multi-protocol semantic abstraction module, etc., builds a fusion modeling mechanism of communication chain structure and device state sequence, and can calmly cope with the high complexity scene of mixed multiple protocols, complex data structure and frequent state switching of ship network. This advantage solves the problem that the prior art is only applicable to single protocol environment and is difficult to adapt to complex scenes of ship network, and effectively improves the security situation awareness capability of ship network in complex operating environment. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 It is a schematic diagram of the principle of the detection system of the application. DETAILED DESCRIPTION

[0022] The application will be further described in detail below in combination with the drawings and specific embodiments: The core innovation of the application is to propose a ship network abnormal behavior detection system that fuses multi-protocol semantic analysis, communication chain modeling, state awareness and behavior scoring. By building a unified semantic intermediate expression structure, the fields of multiple heterogeneous protocols are abstracted into standard semantic units, the behavior portrait is established in combination with the communication topology graph and the device state sequence, and the multi-dimensional abnormality recognition and hierarchical response are realized based on the weighted scoring mechanism, thereby filling the gap of the prior art in cross-protocol fusion identification and behavior modeling closed-loop detection, and adapting to the security risk identification needs of complex data and frequent switching in ship scene.

[0023] As shown in Figure 1 The embodiment of the application provides a ship network abnormal behavior detection system based on multi-protocol deep analysis, which comprises a protocol identification and classification module, a multi-protocol semantic abstraction module, a communication relationship modeling module, a device state awareness module, a behavior portrait construction module, an abnormal behavior detection and scoring module, and a response decision and strategy linkage module.

[0024] Protocol identification and classification module: first process the original data stream of ship network, combine port features, data fingerprints and traffic behavior features, accurately determine the communication protocol to which the data packet belongs and add an identifier, so as to facilitate the unified processing of multiple protocol data by the subsequent modules; Multi-protocol semantic abstraction module: after receiving data with communication protocol identifier, call corresponding syntax analysis rules to build abstract syntax tree, extract semantic elements and map them to unified intermediate semantic expression structure, eliminate semantic differences of different protocols, and prepare data for communication relationship modeling module; Communication relationship modeling module: based on the unified intermediate semantic expression structure, extract device identifier, communication direction and other information, track device interaction process, record key data such as instruction direction and response behavior, and build communication link graph, to provide communication context for device state awareness module; Device state awareness module: relying on the control and state feedback field in the communication link, continuously monitoring and generating device operation state sequence, marking state change events and trigger conditions, the results provide data support for device state dimension for behavior portrait construction module; Behavior portrait construction module: integrate the received communication link graph and device state sequence, mine device normal behavior patterns, construct node behavior graph and state evolution model, and fully depict behavior characteristics and state rules; Abnormal behavior detection and scoring module: compare real-time communication behavior with behavior portrait, identify abnormalities from multiple dimensions such as fields and paths, generate quantitative results through weighted multi-dimensional scoring function, and provide accurate basis for response decision; Response decision and strategy linkage module: match the security strategy library according to the abnormal scoring results, execute hierarchical response operations, and link other security systems to form a complete closed loop from detection to disposal, and guarantee ship network security.

[0025] Among them, the protocol identification and classification module constructs a hierarchical identification system according to the characteristics of multiple protocols coexisting in ship networks. First, according to the default port or common port characteristics of each protocol, preliminary screening is carried out, for example, the specific port of NMEA protocol can be used as an identification clue to quickly classify data packets; then, by extracting the fixed field, characteristic flag bit and other information of the data packet header, a unique data fingerprint is formed, which is matched and compared with the pre-established protocol fingerprint library to further narrow down the protocol range and improve the identification accuracy.

[0026] Combined with the flow behavior characteristics, the dynamic characteristics such as the sending frequency of data packets, the length variation law of messages, the session establishment and termination mode are analyzed in depth, and compared with the typical protocol behavior characteristic library, so as to accurately identify Modbus, NMEA, CAN and other protocols. After identification, a clear protocol identifier is added to each data packet, providing a reliable basis for the unified analysis and processing of subsequent modules; Modbus and NMEA protocol identification process: Modbus: default port 502 → header field "0x0001 (transaction processing identifier)" → flow characteristics "fixed period 100 ms sending, message length 12-25 bytes"; NMEA: default port 2000 → header feature "$GPRMC" → flow characteristics "random sending, message length 50-80 bytes"; Among them, the multi-protocol semantic abstraction module receives data packets with protocol identification, and automatically calls the syntax analysis rules of the corresponding protocol. Relying on the rule library containing field structure, data type, coding method and other contents, the protocol message is deeply disassembled, and the logical association between fields is clearly presented by constructing an abstract syntax tree, while the core semantic elements such as device identification, instruction type, parameter value, timestamp are accurately extracted, laying a data foundation for subsequent processing; Construction example of abstract syntax tree: Take Modbus protocol message (such as "010300000001840A") as an example, the syntax analysis rule is disclosed: Field disassembly: device address (01), function code (03), start address (0000), data length (0001), check bit (840A); Abstract syntax tree structure: root node "Modbus message"→subnode "device address" "function code"→leaf node "value 01" "value 03"; Unified semantic expression transformation is one of the core functions of the module, which maps the extracted semantic elements of various types to a unified intermediate semantic expression structure. This structure uses a standardized data model, which predefines common semantic fields and data types, such as merging the fields representing device running status in different protocols into the "device status" field and standardizing the value range, to eliminate semantic differences between protocols and enable efficient use of multi-source data for communication relationship analysis; Unified intermediate semantic structure={ Basic fields: device ID (string), timestamp (millisecond level), communication direction (uplink / downlink), semantic type (control / status / query / response); Protocol mapping fields: Modbus function code (int), NMEA statement type (str), CAN signal name (str); Unified semantic fields: instruction type (START / STOP, etc.), status code (0 / 1 / 2), parameter value (float), unit (RPM / ℃, etc.); Relationship fields: opposite device ID list, state sequence ID Supplementary CAN protocol mapping example: CAN signal "EngineSpeed=1500rpm"→parameter value=1500, unit=RPM, semantic type=STATUS.

[0027] Among them, the communication relationship modeling module extracts device identification, communication direction and other core information from unified semantic data, and traces the interaction process between devices throughout the process. The specific recording content includes the direction of instruction transmission, such as control instructions sent by the control center to the device; the response behavior of the receiver, including the response content and whether the state is normal; the communication round-trip delay accurate to the millisecond level; and the communication frequency statistics according to different time granularity such as minutes and hours, which accumulates comprehensive data for subsequent analysis.

[0028] Using graph theory method, the devices in the network are set as nodes, and the communication connection between devices is set as edges. The attributes of the edges integrate key information such as instruction direction and response behavior. The constructed graph clearly presents the communication topology structure and device interaction mode of the ship network, providing complete communication context support for subsequent device state analysis.

[0029] Among them, the device state perception module accurately captures the control field and state feedback field from the communication interaction process. These fields contain core running data of the device, such as the power control system device which will feedback the key parameters such as speed, temperature, pressure, and information such as the success or failure of operation execution. The module continuously tracks these fields, organizes them in chronological order to form a device running state sequence, and clearly shows the dynamic change trajectory of the device state over time.

[0030] When the device state fluctuates significantly, such as switching from normal operation state to fault state, or a parameter exceeds the preset normal range, the module will automatically trigger the labeling mechanism to record the key details such as the time node of the event occurrence and the specific trigger condition of the state change. The generated state sequence and event information provide complete data support for the device state dimension for the subsequent behavior portrait construction module, helping to accurately depict the behavior characteristics of the device.

[0031] Among them, the behavior portrait construction module integrates the device nodes in the communication link graph and the device state sequence. Each node not only contains the basic information of the device itself, but also integrates the communication behavior data in different states, such as the interaction frequency with other devices, the type of instructions sent, and the response time. Through analysis of historical running data, the typical behavior mode of the device under normal working conditions is extracted, forming a stable node behavior baseline to provide a reference standard for abnormal judgment. The time sequence attention mechanism is used to integrate the communication link graph and the device state sequence, and the communication interaction weight (0.6) and the state response weight (0.4) are weighted. Through sliding window (window size 5 minutes), the normal behavior mode is mined. Fusion method of communication link graph and device state sequence: Timestamp alignment: Align the device state sequence with the communication link topology based on the interaction time (e.g., state feedback within 100ms after the communication instruction is considered as relevant data); Conflict resolution: When the communication link shows "normal interaction" but the state sequence shows "abnormal values", prioritize the state sequence (as state feedback more directly reflects device operation); By combining device state sequence and dynamic changes in communication link, the internal rules of device state transition from one form to another, the key factors triggering the transition, and the changes in communication behavior accompanying the state switch are analyzed in depth. On this basis, a state transition mutation rate model and an evolution path model are established to fully present the device behavior characteristics and state change rules, providing accurate reference for the abnormal behavior detection module.

[0032] State transition mutation rate model expression; ; In the formula: is the state mutation rate per unit time; is the number of state jumps (e.g., standby running fault); is the total number of state transitions; "State jump" determination criteria: The interval between two consecutive state switches is less than 1 second, and does not meet the predefined normal process (e.g., "standby -> running" requires a "warm-up" state first, direct switching is considered as a jump) Source explanation: The behavior model is commonly used to identify unexpected state jumps, derived from Markov chain and state machine theory.

[0033] Among them, the abnormal behavior detection and scoring module compares the real-time collected communication behavior data with the preset behavior portrait model one by one, and analyzes from multiple dimensions: field level checks the deviation of message field and normal semantics, path level checks the deviation of communication link and reference topology, state level monitors the difference between device operation sequence and evolution model, and period level compares the difference between communication frequency and regular period, to fully identify various abnormal situations.

[0034] According to the influence degree of different abnormal indicators on network security, the corresponding weight is allocated, and the comprehensive score result is obtained through weighted multi-dimensional scoring function. This result can not only intuitively reflect the severity of the anomaly, but also clearly mark the anomaly type and key causes, providing accurate judgment basis for the subsequent response decision module, ensuring the pertinence and effectiveness of the disposal measures.

[0035] Weighted multi-dimensional abnormal scoring function model expression: ; In the formula: Final anomaly score (0~1) Field matching anomaly score (field value offset) Path offset anomaly score (behavior path difference) State sequence anomaly score (state sequence variation) Weighted coefficients of three types of scores, satisfying .

[0036] Field anomaly threshold: 3 times the standard deviation based on historical data, exceeding the range triggers Sf score Path offset threshold: normal path length is 3 hops, real-time path length ≥ 5 hops triggers Sp score Weighted coefficient value: w1=0.4 (field anomaly, affecting semantic accuracy), w2=0.3 (path offset, affecting topology security), w3=0.3 (state anomaly, affecting device operation), based on ship network security risk assessment report (reference industry standard IEC61162) Explicit anomaly feature extraction standard: Field anomaly: field value deviates from baseline ±30% is considered abnormal (S_f=0.5) Path offset: communication path adds more than 2 nodes compared with baseline is considered abnormal (S_p=0.6) Policy update rule: when S≥0.7 for 3 consecutive times, automatically add abnormal field or path to blacklist and retrain behavior portrait Formula source explanation: weighted average model, suitable for safety score, anomaly comprehensive quantification, etc., commonly used in intrusion detection system (IDS) field.

[0037] This scoring model is different from the scoring mechanism for Internet attacks in general intrusion detection systems (IDS), which has been optimized in three aspects in the ship network scenario: first, the path offset dimension is added to adapt to the link anomaly recognition needs under the dynamic topology of the ship; second, the device state mutation rate evaluation function is introduced to improve the recognition accuracy of potential faults or tampering behavior; third, the scoring result is directly linked to the response module to realize dynamic security policy adjustment based on quantitative indicators; the above optimizations ensure that the scoring mechanism is strongly related to the ship application scenario and has practicality and innovation.

[0038] Among them, the response decision and strategy linkage module matches the preset security policy library according to the anomaly score result: when the score is below the threshold, only alarm information is generated to prompt the administrator to troubleshoot; when it reaches a certain threshold, communication blocking is performed at the same time of the alarm to prevent abnormal spread; if it reaches a high-risk level, in addition to the alarm and blocking, the security policy model is updated synchronously, and the detection rules are dynamically adjusted; Correspondence between score and response: Low risk: abnormal score S < 0.3 -> only generate alarm log (format: time + device ID + abnormal type); Medium risk: 0.3 <= S < 0.7 -> alarm + temporary blocking (blocking duration: 5 minutes, only block abnormal link); High risk: S >= 0.7 -> alarm + permanent blocking + policy update (update content: add abnormal features to blacklist, such as specific instruction field); The response decision and policy linkage module can be linked with other safety systems of the ship, transmit abnormal information and response instructions, and promote various systems to take protective measures in cooperation. Through such linkage, a complete safety control closed loop from detection to disposal is formed, and the overall safety protection capability of the ship network is effectively improved.

[0039] Of course, the above description is not a limitation on the present application, and the present application is not limited to the above examples. Changes, modifications, additions or substitutions made by those skilled in the art within the scope of the present application should also be within the scope of the present application.

Claims

1. A ship network anomaly behavior detection system based on multi-protocol deep parsing, characterized in that: The system includes a protocol identification and classification module, a multi-protocol semantic abstraction module, a communication relationship modeling module, a device status perception module, a behavior profile construction module, an abnormal behavior detection and scoring module, and a response decision and strategy linkage module; among them, The protocol identification and classification module is configured to process the raw data stream of the ship network, and combine port characteristics, data fingerprints and traffic behavior characteristics to determine the communication protocol to which the data packet belongs and add an identifier. The multi-protocol semantic abstraction module is configured to receive data with communication protocol identifiers, call the corresponding syntax parsing rules to construct an abstract syntax tree, extract semantic elements and map them to a unified intermediate semantic expression structure to eliminate semantic differences between different protocols. The communication relationship modeling module is configured to extract device identifiers and communication direction information based on a unified intermediate semantic expression structure, track device interaction processes, record key data on command direction and response behavior, and construct a communication link graph. The device status awareness module is configured to continuously monitor and generate a sequence of device operating status based on control and status feedback fields in the communication link, label status change events and triggering conditions, and output the results to the behavior profile building module. The behavior profile building module is configured to fuse the received communication link graph and device state sequence, mine the normal behavior pattern of the device, build node behavior graph and state evolution model, and comprehensively characterize the behavior features and state patterns. The abnormal behavior detection and scoring module is configured to compare real-time communication behavior with behavior profiles, identify anomalies from multiple dimensions such as fields and paths, and generate anomaly scoring results through a weighted multidimensional scoring function model. The response decision and strategy linkage module is configured to match the security policy library based on the anomaly scoring results and execute graded response operations.

2. The ship network abnormal behavior detection system based on multi-protocol deep parsing according to claim 1, characterized in that: The protocol identification and classification module includes: (1) A multi-level identification mechanism is used to perform preliminary screening based on port characteristics, classify data packets by using the default or common port characteristics of each protocol, form data fingerprints by extracting fixed fields from the header of the data packets, and match them with the pre-built fingerprint database. (2) Precise judgment and identification unit, which is used to combine traffic behavior characteristics to make comprehensive judgments, analyze the dynamic characteristics of data packet sending frequency and message length changes, compare with the typical behavior feature library, accurately identify multiple protocols, and add a clear protocol identifier to each data packet.

3. The ship network abnormal behavior detection system based on multi-protocol deep parsing according to claim 1, characterized in that: The multi-protocol semantic abstraction module includes: (1) Syntax parsing and element extraction unit, which is used to perform deep parsing of protocol messages based on the protocol identifier and a rule base covering the field structure, construct an abstract syntax tree, and extract key semantic elements of device identifier and instruction type; (2) A unified semantic expression transformation unit is used to map the extracted semantic elements to a unified intermediate semantic expression structure. This structure adopts a standardized data model and defines common semantic fields and data types.

4. The ship network abnormal behavior detection system based on multi-protocol deep parsing according to claim 1, characterized in that: The communication relationship modeling module includes: (1) Key information collection unit, used to extract device identification and communication direction information based on a unified intermediate semantic expression structure, track device interaction process, and record key data such as instruction direction, response behavior, millisecond round-trip delay and communication frequency at different time granularities; (2) Communication link graph construction unit, which is used to construct a communication link graph using graph theory, with devices as nodes and communication connections as edges. The attributes of the edges include command direction and response behavior information.

5. The ship network abnormal behavior detection system based on multi-protocol deep parsing according to claim 1, characterized in that: The device status sensing module includes: (1) Status field extraction and tracking unit, used to extract control fields and status feedback fields, and generate equipment operation status sequence according to time series; the fields include equipment operation parameters and operation execution information; (2) State change event labeling unit, used to automatically label state change events when the device state changes significantly, record the occurrence time, trigger condition details, and generate state sequence and event information.

6. The ship network abnormal behavior detection system based on multi-protocol deep parsing according to claim 1, characterized in that: The behavior profile building module includes: (1) Node behavior graph construction unit, which is used to associate the device nodes of the communication link graph with the device state sequence, integrate the basic information of the device and the communication behavior under different states, and form the node behavior baseline by analyzing historical data to mine normal behavior patterns; (2) State evolution model construction unit, which is used to combine equipment state sequence and communication link changes to analyze the equipment state transition law, triggering factors and accompanying communication behavior changes, establish state transition mutation rate model and evolution path model, and comprehensively characterize equipment behavior characteristics and state change law; The expression for the state transition mutation rate model is: ； In the formula: The proportion of state changes per unit time; This represents the number of state transitions. This represents the total number of state transitions.

7. The ship network abnormal behavior detection system based on multi-protocol deep parsing according to claim 1, characterized in that: The abnormal behavior detection and scoring module includes: (1) Multi-dimensional anomaly identification unit, used to compare real-time communication behavior data with preset behavior profile model, analyze from multiple dimensions such as field, path, status and period, and identify various anomaly types such as field anomaly, path deviation, status change and period anomaly; (2) Weighted scoring calculation unit, used to assign weights to the impact of each abnormal indicator on the cybersecurity of the ship, and obtain the abnormal scoring result through the weighted multidimensional abnormal scoring function model; Weighted multidimensional anomaly scoring function model expression: ； In the formula: For the final anomaly score Scoring for anomalies in the field; Scoring for path offset anomalies; Scoring for anomalies in state sequences; The weighting coefficients for the three types of scores satisfy... .

8. The ship network abnormal behavior detection system based on multi-protocol deep parsing according to claim 1, characterized in that: The response decision and strategy linkage module includes: (1) Hierarchical response operation unit, used to perform alarm, communication blocking or policy update operations according to the abnormal score results; when the abnormal score is lower than the threshold, only an alarm is generated; when the abnormal score reaches a certain threshold, an alarm is triggered and communication is blocked; when the abnormal score reaches the high risk level, an alarm is triggered, communication is blocked and the security policy model is updated at the same time. (2) Multi-system collaborative protection unit, used to link with other safety systems of the ship, transmit abnormal information and response instructions, and take protective measures in a coordinated manner.

Images