Method, device and equipment for identifying ground side intranet structure of low earth orbit satellite network

Abstract

The invention provides a method, a device and equipment for identifying a ground side intranet structure of a low earth orbit satellite network. The method comprises the following steps: acquiring a domain name of a ground side of a low-orbit satellite network; determining a device type of a node corresponding to the domain name and a PoP point to which the node belongs; identifying direct connection nodes in the PoP point from the nodes which belong to the same PoP point and have the same equipment type; cross-PoP point nodes among the PoP points are identified from the nodes belonging to the different PoP points; and determining the ground side intranet structure of the low-orbit satellite network according to the direct connection nodes and the cross-PoP node. According to the invention, the ground side intranet structure of the low earth orbit satellite network can be comprehensively identified without depending on the internal assistance or control authority of the low earth orbit satellite network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a method, device and equipment for identifying an inner network structure of a ground side of a low-orbit satellite network. BACKGROUND

[0002] The Starlink network, as a representative system of low-orbit satellite Internet, includes two major components: one is a space facility, i.e., a satellite constellation running in orbit, and the other is a ground side communication infrastructure distributed globally, including user terminals, Starlink gateways, and PoP points, etc. In the network architecture of Starlink, the PoP point usually refers to a core node in the ground infrastructure that undertakes backbone network access, regional data aggregation, and transmission to the satellite gateway. The structure distribution between PoP points has regional relevance, center-edge hierarchical characteristics, and embodies certain naming rules and IP allocation strategies.

[0003] In a satellite network topology measurement method provided by the prior art, the specific steps are as follows: 1) First, node probe data and path probe data are sent to nodes in the satellite network, and first feedback data, second feedback data, and satellite data of the satellite network returned by the nodes are received; 2) Then, based on the first feedback data, the second feedback data, and the satellite data, node association analysis is performed on the satellite network, and based on the association analysis result, topology link analysis is performed; 3) Thereafter, node interface alias detection analysis is performed on the topology link, and the topology structure of the satellite network is determined.

[0004] In another deep-level inner network topology structure inference method based on traffic provided by the prior art, the specific steps are as follows: 1) Obtain NTP traffic features and TCP traffic features of the traffic; 2) Infer the Windows device scale and Linux device scale of each level of inner network according to the NTP traffic features; 3) Based on the TCP traffic features and the Windows device scale and Linux device scale of each level of inner network, perform hierarchical feature clustering on the TCP traffic to obtain a TCP packet array classified by host devices; 4) Perform host device relationship inference based on the TCP packet array classified by host devices to construct a deep-level inner network topology structure.

[0005] Through the technical solution, the inventor finds that the prior art often relies on internal assistance or control authority to obtain core data, such as the need to arrange a collection device inside the target network, deploy a probe program or call system resources on a controlled host. This method is dependent on the controllability of the target internal network for its access path, and once the internal cooperation or access authority is lacking, it cannot be implemented, resulting in a serious limitation of the scope of application. This makes it difficult to promote the application of this type of technology in the face of closed, complex structure and large number of nodes "black box" networks such as star chains, limiting its practical value and universal applicability. In addition, the prior art only constructs a logical topology graph between the PoPs of the low-orbit satellite network. Since the structure inside the PoP point cannot be observed, the reasoning and perception of the internal network structure of the low-orbit satellite network are not comprehensive enough.

[0006] Therefore, how to comprehensively identify the ground side internal network structure of the low-orbit satellite network has become a technical problem that needs to be solved in the field. SUMMARY

[0007] The purpose of the present application is to provide a method, device and equipment for identifying the ground side internal network structure of a low-orbit satellite network, to solve the above technical problems in the prior art.

[0008] In one aspect, to achieve the above-mentioned purpose, the present application provides a method for identifying the ground side internal network structure of a low-orbit satellite network.

[0009] The method for identifying the ground side internal network structure of a low-orbit satellite network comprises: obtaining the domain name of the ground side of the low-orbit satellite network; determining the device type and the PoP point to which the domain name corresponds; identifying direct connection nodes within the PoP point among nodes belonging to the same PoP point and having the same device type; identifying cross-PoP point nodes between PoP points among nodes belonging to different PoP points; and determining the ground side internal network structure of the low-orbit satellite network according to the direct connection nodes and the cross-PoP point nodes.

[0010] Further, the step of obtaining the domain name of the ground side of the low-orbit satellite network comprises: obtaining the domain name corresponding to the intermediate node in the target IP path to the low-orbit satellite network; and obtaining the domain name leaked from the internal network of the low-orbit satellite network.

[0011] Further, the step of obtaining the domain name corresponding to the intermediate node in the target IP path of the low-orbit satellite network comprises: setting a plurality of distributed probe nodes; determining the path of the probe node to the target IP of the low-orbit satellite network; extracting the IP address of the intermediate node in the path; performing DNS reverse resolution on the IP address of the intermediate node to obtain the domain name; and the step of obtaining the domain name of the intranet of the low-orbit satellite network comprises: querying the DNS response record related to the low-orbit satellite network from the PDNS data stream log; and extracting the private network domain name leaked in the response record to obtain the domain name.

[0012] Further, the step of determining the device type of the node corresponding to the domain name and the PoP point to which the node belongs comprises: splitting the domain name into a plurality of semantic units; extracting a first semantic unit representing the device type from the plurality of semantic units; determining the device type of the node corresponding to the domain name according to the first semantic unit; extracting a second semantic unit containing a PoP point keyword from the plurality of semantic units; determining the PoP point to which the node corresponding to the domain name belongs according to the second semantic unit; when the second semantic unit cannot be extracted, extracting a third semantic unit containing a city code and a digital number; determining the PoP point to which the node corresponding to the domain name belongs according to the third semantic unit; when the third semantic unit cannot be extracted, extracting a fourth semantic unit representing regional information from the plurality of semantic units; finding the PoP point corresponding to the fourth semantic unit; and determining the PoP point corresponding to the fourth semantic unit as the PoP point to which the node corresponding to the domain name belongs.

[0013] Further, the step of identifying the direct connection node within the PoP point among nodes belonging to the same PoP point and having the same device type comprises: clustering all nodes according to the PoP point to obtain a first node subset under each PoP point; clustering the first node subset according to the device type to obtain a second node subset of the same device type under the PoP point; and comparing the subnet mask of the private network IP of the nodes in the second node subset; when two nodes fall into the same private network subnet, the two nodes are the direct connection nodes.

[0014] Further, the step of identifying the cross-PoP node between PoP points among nodes belonging to different PoP points comprises: extracting one node from each of the two different PoP points to obtain two nodes; and determining whether the two nodes belong to the cross-PoP node according to the cross-regional co-occurrence relationship, the private network address segment relationship, whether the network networking rules are met, and the geographical location relationship of the two nodes.

[0015] Further, the number of times that the two nodes appear as adjacent hops in the path is counted to obtain the cross-region co-occurrence relationship; the private network prefixes of the two nodes are read respectively to determine whether the private network prefixes of the two nodes are continuous in the numerical space or whether the mask planning presents an increasing adjacency relationship to obtain the private network address segment relationship; the regional semantic units of the two nodes are parsed respectively to determine whether the two nodes satisfy the network configuration rule according to the regional semantic units of the two nodes; the distance between the two nodes is calculated to determine whether the distance is less than a preset operation distance threshold to obtain the geographic location relationship.

[0016] Further, the step of determining the low-orbit satellite network ground side intranet structure according to the direct connection node and the cross-PoP node includes: constructing a graph structure according to the domain name corresponding node, the direct connection node and the cross-PoP node; inputting a node naming mode and the graph structure into a large model to output a confidence score of edges and nodes in the graph structure; and determining the low-orbit satellite network ground side intranet structure according to the graph structure and the confidence scores of edges and nodes thereof.

[0017] In another aspect, to achieve the above object, the present application provides a low-orbit satellite network ground side intranet structure identification device.

[0018] The low-orbit satellite network ground side intranet structure identification device includes: an acquisition module configured to acquire domain names of a low-orbit satellite network ground side; a first determination module configured to determine the device types and PoP points to which the domain name corresponding nodes belong; a first identification module configured to identify direct connection nodes within a PoP point among nodes belonging to the same PoP point and having the same device type; a second identification module configured to identify cross-PoP nodes between PoP points among nodes belonging to different PoP points; and a second determination module configured to determine the low-orbit satellite network ground side intranet structure according to the direct connection nodes and the cross-PoP nodes.

[0019] In another aspect, to achieve the above object, the present application further provides a computer device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above method when executing the computer program.

[0020] In another aspect, to achieve the above object, the present application further provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executable on a processor to implement the steps of the above method.

[0021] The low-orbit satellite network ground side intranet structure identification method, device and equipment provided by the application first acquire the domain name of the low-orbit satellite network ground side, then determine the device type and PoP point of the node according to the domain name, identify the direct connection node in the PoP point in the node set of the same PoP point and the same device type, identify the cross-PoP point node between the PoP points in the node set of different PoP points, and finally determine the intranet structure of the low-orbit satellite network ground side according to the direct connection node and the cross-PoP point node. Through the application, the domain name of the low-orbit satellite network ground side is acquired first, the node role and PoP attribution are quickly located, the local direct connection link and the cross-station backbone link are further identified, the hierarchical intranet topology of the low-orbit satellite network ground side is accurately reconstructed, including the PoP point structure and the result between the cross-PoP points, the cost is reduced without relying on the internal assistance or control authority of the low-orbit satellite network, and the structured output topology result provides reliable data support for operation and maintenance, capacity planning and risk assessment. BRIEF DESCRIPTION OF DRAWINGS

[0022] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The detailed description is made with reference to the accompanying drawings. Figure 1 The flow chart of the low-orbit satellite network ground side intranet structure identification method provided by the first embodiment of the application; Figure 2 The block diagram of the low-orbit satellite network ground side intranet structure identification device provided by the second embodiment of the application; Figure 3 The hardware structure diagram of the computer device provided by the third embodiment of the application. DETAILED DESCRIPTION

[0023] In order to make the objects, technical solutions and advantages of the application clearer, the application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the application and not to limit the application. Based on the embodiments in the application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the application.

[0024] Embodiment one The embodiment of the application provides a low-orbit satellite network ground side intranet structure identification method, which can comprehensively identify the low-orbit satellite network ground side intranet structure without relying on the internal assistance or control authority of the low-orbit satellite network. Specifically, Figure 1A flowchart of the identification method of the low-orbit satellite network ground side intranet structure provided by Embodiment One of the present application is shown in Figure 1 The identification method of the low-orbit satellite network ground side intranet structure provided by this embodiment includes the following steps S101 to S105.

[0025] Step S101: Obtain the domain name of the low-orbit satellite network ground side.

[0026] The domain name of the low-orbit satellite network ground side refers to the reverse resolution name of the low-orbit satellite network ground side node in the DNS system, used to identify the node attribute. Optionally, on the one hand, the IP address of the low-orbit satellite network is detected by selecting a detection point, and the domain name is further resolved, for example, traceroute is performed by the detection point, and the domain name is obtained in combination with DNS reverse resolution, on the other hand, the domain name leaked in the low-orbit satellite network intranet is obtained by passive detection of PDNS, and the domain name of the low-orbit satellite network ground side is obtained by combining the two aspects.

[0027] For example, with Starlink, the first aspect specifically includes: selecting a plurality of distributed detection nodes in a global range, using the traceroute tool to obtain the IP address of the intermediate node in the path to the Starlink target IP, and then performing DNS reverse resolution on the IP addresses appearing in the path to obtain possible device domain names. The second aspect specifically includes: collecting DNS response records related to Starlink from PassiveDNS (PDNS) data stream logs in combination with a small amount of official public information, and extracting private network IP addresses and leaked intranet domain names therefrom.

[0028] Step S102: Determine the device type and the PoP point to which the domain name corresponds.

[0029] The PoP point refers to the Point of Presence set up by the operator on the ground for accessing satellite links and backbone networks, which contains a group of node devices at the same geographical / logical location, jointly publishes network prefixes to the outside, and accepts unified management. Device types include gateway (gw), ground station controller (gsc), or user terminal (ues), etc. In this step, for the domain name obtained in step S101, the device type and the PoP point to which the domain name corresponds are determined.

[0030] Optionally, the domain names obtained by active detection and passive detection are subjected to word segmentation, rule analysis, field extraction, etc. to extract semantic features such as regional information, device type, PoP point identifier, and purpose abbreviation. Based on naming rules and prior knowledge, the device type (such as terminal, route, satellite gateway, etc.), purpose (such as access, forwarding, management, etc.), and the PoP point or regional cluster to which it belongs corresponding to the domain name are determined.

[0031] Step S103: Identify the direct connection nodes within the PoP point in the nodes belonging to the same PoP point and having the same device type.

[0032] The direct connection nodes refer to two devices within the same PoP station that can reach each other in a single hop at the network layer. The messages between them do not need to pass through any inter-station routing or backbone link. Physically, they are usually connected to the same switch or the same uplink port of the same cabinet, and logically they show one-hop MAC or IP adjacency.

[0033] Specifically, in this step, when determining the direct connection nodes, the nodes are first grouped according to the PoP identifier, and then subdivided according to the device type (gw, gsc, ues, etc.) within each PoP group to form several "PoP x device type" small buckets. Then, the direct connection of each device in the bucket is determined.

[0034] Optionally, the nodes are clustered and analyzed using the PoP attribution, geographical markers, and device types of the devices. The devices under the same PoP are grouped into a group, and grouped and aggregated according to the device type. Each type of device can be further sorted by number for inferring the deployment density or physical topology layout.

[0035] Step S104: Identify the inter-PoP nodes between the PoP points in the nodes belonging to different PoP points.

[0036] The inter-PoP nodes refer to two devices respectively belonging to two different PoP stations and directly interconnected through an inter-station backbone link. They each serve the local network of the PoP and simultaneously act as a cross-station forwarding role: in an end-to-end routing path, the two devices often appear as consecutive hops and undertake the function of introducing traffic from one PoP station to another PoP station.

[0037] Specifically, in this step, when determining the inter-PoP nodes, all nodes of different PoP points are paired two by two to obtain inter-PoP candidate pairs, and it is further determined whether the inter-PoP candidate pairs belong to the inter-PoP points.

[0038] Optionally, the attribution PoP relationship and interconnection path between the private network nodes are inferred in combination with the private network address segment allocation strategy, semantic naming rules, network configuration common sense, geographical location information, and cross-regional co-occurrence relationship.

[0039] Step S105: Determine the internal network structure of the ground side of the low-orbit satellite network according to the direct connection nodes and the inter-PoP nodes.

[0040] Optionally, a network structure graph is constructed using a graph modeling method (such as GraphX or Neo4j) to identify the backbone path and the functional cluster. A large model is used to perform semantic understanding and confidence checking on the node naming pattern, structural logic and functional relationship, to assist in verifying the accuracy and integrity of the reasoning result, thereby forming the final low-orbit satellite network ground-side intranet structure graph. Further optionally, the node information obtained by reasoning is saved in an intranet node information database, which can specifically include fields such as IP, domain name, DNS record, semantic feature, device type, purpose label, PoP attribution, etc., and the information sources include active DNS detection, passive DNS record (PDNS), etc. The node information database is not only used to store observation results, but also supports reasoning modeling, structure comparison, node change tracking and security analysis.

[0041] In the method for identifying the low-orbit satellite network ground-side intranet structure provided in this embodiment, the domain name of the low-orbit satellite network ground side is first obtained, and then the device type and the PoP point to which the node belongs are determined according to the domain name. In the node set of the same PoP point and the same device type, the direct connection nodes in the PoP point are identified, and in the node set of different PoP points, the cross-PoP point nodes between PoP points are identified. Finally, the intranet structure of the low-orbit satellite network ground side is determined according to the direct connection nodes and the cross-PoP point nodes. By obtaining the domain name of the low-orbit satellite network ground side, the node role and PoP attribution are quickly located, and the local direct connection link and the cross-station backbone link are further identified, so as to accurately reconstruct the hierarchical intranet topology of the low-orbit satellite network ground side, including the PoP point structure and the result between the cross-PoP points, without relying on the assistance or control authority of the low-orbit satellite network, thereby reducing the cost, and providing reliable data support for operation and maintenance, capacity planning and risk assessment through the structured output of the topology result.

[0042] Optionally, in an embodiment, the step of obtaining the domain name of the low-orbit satellite network ground side includes: obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-orbit satellite network; and obtaining the domain name leaked from the intranet of the low-orbit satellite network.

[0043] Specifically, on the one hand, a plurality of existing cloud hosts are arranged in multiple continents around the world as detection nodes to detect the path from the local host to the target IP of the low-orbit satellite network, extract the intermediate nodes in the path, and further determine the domain names corresponding to the intermediate nodes to obtain the actively detected domain names. On the other hand, the domain names carrying private network address resolution records are found in passive DNS (Passive DNS) logs or other network measurement data to obtain the domain names leaked from the intranet of the low-orbit satellite network.

[0044] The low-orbit satellite network ground side internal network structure identification method provided in the embodiment can cover two types of information sources, i.e., public path and private network side, by simultaneously collecting the intermediate node domain name obtained through route tracking and the passive DNS exposure domain name, without the need of deploying additional probes, thereby significantly improving the completeness of domain name collection and providing a more sufficient data basis for subsequent node attribution determination and topology reconstruction.

[0045] Optionally, in an embodiment, the step of obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-orbit satellite network includes: setting a plurality of distributed probe nodes; determining the path to the target IP of the low-orbit satellite network by the probe nodes; extracting the IP address of the intermediate node in the path; and performing DNS reverse resolution on the IP address of the intermediate node to obtain the domain name. The step of obtaining the domain name of the internal network of the low-orbit satellite network includes: querying the DNS response record related to the low-orbit satellite network from the PDNS data stream log; and extracting the private network domain name exposed in the response record to obtain the domain name.

[0046] Specifically, when obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-orbit satellite network, the distributed probe nodes can be implemented by cloud servers deployed in different autonomous systems or geographic regions, and are used for active route probing. The traceroute command is executed at each probe node to record a complete sequence of relay points and obtain the path to the target IP of the low-orbit satellite network by the probe node. The start point and the end point are removed from each traceroute result, and only the relay hop IP is retained to obtain the IP address of the intermediate node. The public DNS server is called to perform DNS reverse resolution on the IP address of the intermediate node, query the PTR record, and obtain the domain name of the relay node.

[0047] When obtaining the domain name of the internal network of the low-orbit satellite network, the DNS response record related to the low-orbit satellite network is queried from the PDNS data stream log, for example, the starlink keyword (such as “starlink” and “sl-”) is used for filtering to obtain the DNS response record related to starlink, and the domain name carrying the private internal network segment address in the response record is further screened to obtain the domain name exposed in the internal network.

[0048] The low-orbit satellite network ground side internal network structure identification method provided in the embodiment can capture the relay domain name of the route facing the public network and make up the exposure domain name exposed only in the private network analysis through the distributed active route probing and passive DNS log dual-channel collection, thereby realizing comprehensive and high-coverage acquisition of the node name of the low-orbit satellite network ground side, and laying a reliable data foundation for internal network structure reconstruction.

[0049] Optionally, in an embodiment, the step of determining the device type of the node corresponding to the domain name and the PoP point to which the node belongs comprises: splitting the domain name into a plurality of semantic units; extracting a first semantic unit representing the device type from the plurality of semantic units; determining the device type of the node corresponding to the domain name according to the first semantic unit; extracting a second semantic unit containing a PoP point keyword from the plurality of semantic units; determining the PoP point to which the node corresponding to the domain name belongs according to the second semantic unit; when the second semantic unit cannot be extracted, extracting a third semantic unit containing a city code and a number; determining the PoP point to which the node corresponding to the domain name belongs according to the third semantic unit; when the third semantic unit cannot be extracted, extracting a fourth semantic unit representing regional information from the plurality of semantic units; finding the PoP point corresponding to the fourth semantic unit; and determining the PoP point corresponding to the fourth semantic unit as the PoP point to which the node corresponding to the domain name belongs.

[0050] Specifically, the domain name obtained by active detection or passive detection is segmented by hyphen, dot and other delimiters to split the domain name into a plurality of semantic units, forming a token list. The domain name includes a fixed prefix for identifying the node role, i.e., the device type, such as “gw” representing a gateway, “gsc” representing a ground station controller, and “ues” representing a user terminal. When determining the device type of the node corresponding to the domain name, the type of semantic unit representing the device type is extracted from the token list, which is defined as the first semantic unit in this embodiment. The device type of the node is obtained by mapping the extracted first semantic unit, such as “gw”→ gateway and “gsc”→ ground station controller.

[0051] When determining the PoP point to which the node corresponding to the domain name belongs, the semantic unit containing the PoP keyword, such as the semantic unit directly containing the keywords “PoP” and “site”, is first found in the token list, which is defined as the second semantic unit in this embodiment. If found, the PoP point to which the node belongs is directly determined by the PoP keyword. If the second semantic unit cannot be found, the semantic unit containing the city code and the number is extracted from the token list, such as “ber02”, which is defined as the third semantic unit in this embodiment. For the extracted third semantic unit, the city code is first mapped to the city in the city dictionary, and then the number is used to determine the PoP point. If the third semantic unit cannot be found, the semantic unit representing the regional information is extracted from the token list, i.e., the segment in the domain name representing the continent, country or city, such as “eu”, “na”, “ber”, “jfk”, etc., which is defined as the fourth semantic unit in this embodiment. If found, the PoP point corresponding to the regional information is found, which is determined as the PoP point to which the node belongs.

[0052] By using the low-orbit satellite network ground side intranet structure identification method provided in the embodiment, through layer-by-layer back-off analysis of the domain name: device type, PoP keyword, city number and regional information, the node device role can be accurately located and its PoP attribution is determined under different naming specifications, the identification loss caused by naming difference is avoided, the high-reliability and low-cost automatic determination of the ground side node attribute is realized, and an accurate node classification and site mapping foundation is laid for subsequent topology reconstruction.

[0053] Optionally, in an embodiment, the step of identifying the direct connection nodes in the PoP point includes: clustering all nodes according to the PoP point, to obtain a first node subset under each PoP point; clustering the first node subset according to the device type, to obtain a second node subset of the same device type under the PoP point; and comparing the subnet mask of the private network IP of the nodes in the second node subset; when two nodes fall in the same private network subnet, the two nodes are direct connection nodes.

[0054] Specifically, in the identification of the direct connection nodes, the PoP ID of the node is taken as the key, and all nodes are divided into a plurality of first node subsets, respectively corresponding to respective PoP points. After clustering according to the PoP point, the first node subset obtained is the total node set under a PoP. In each first node subset, the node set is further divided according to the device type field of the node, for example, gw, gsc and ues, and the subdivided node set is a plurality of second node subsets, and the device types of the nodes in each second node subset are consistent. For the nodes in the same second node subset, the network prefix and mask of the private network IP of the nodes are compared, if two nodes fall in the same private network subnet, they are considered as the direct connection relationship in the PoP that can reach each other in one hop, and it is determined that the two nodes are direct connection nodes in the PoP point.

[0055] By using the low-orbit satellite network ground side intranet structure identification method provided in the embodiment, through the two-level clustering of the PoP point and the device type, and with the aid of the private network subnet determination, the node pairs in the PoP that are physically or two-layer directly connected can be quickly located, the misjudgment across the PoP is avoided, the comparison workload of the massive nodes is simplified, the identification of the structure in the PoP point is realized, and accurate and high-confidence local connection information is provided for subsequent topology modeling. In the present application, in combination with the division rule of the private network IP address segment and the geographical and numbered semantic fields embedded in the domain name, the attribution relationship among the gateway nodes, the router devices and the management nodes under the Starlink PoP node is identified, and the intranet structure reasoning of the Starlink PoP is realized.

[0056] Optionally, in an embodiment, the step of identifying the cross-PoP nodes between the PoP points identified in the nodes belonging to different PoP points comprises: extracting one node from each of the two different PoP points to obtain two nodes; and determining whether the two nodes belong to the cross-PoP nodes according to the cross-regional co-occurrence relationship, the private network address segment relationship, whether the network networking rules are met, and the geographical location relationship.

[0057] Specifically, in identifying the cross-PoP nodes, one node is selected from each of the two different PoP points, and in identifying whether the two nodes belong to the cross-PoP nodes, the four aspects of cross-regional co-occurrence relationship, private network address segment relationship, whether the network networking rules are met, and geographical location relationship are comprehensively judged. Among them, the network path is usually arranged according to the shortest or optimal link principle, the boundary nodes of the two PoP that are truly directly interconnected will frequently and stably appear in the adjacent hops, and the occasional detours or third-party relays will only appear sporadically, so if the cross-regional co-occurrence frequency of the two nodes is higher, the probability that the two nodes belong to the cross-PoP nodes is greater; the operator often divides the private network address block in sequence according to geography or function to adjacent PoP, for example, 10.60.0.0 / 24 is given to PoP-A and 10.60.1.0 / 24 is given to PoP-B, if the private network address segment relationship of the two nodes reflects that the two nodes are divided by the same address planning template and located in adjacent sites at the same level, the confidence that the two nodes belong to the cross-PoP nodes will be further improved; in some scenarios, the operator will predefine which PoP must be interconnected (such as “the capital PoP must be connected to the national aggregation PoP”), or use the numbering rule (interconnected with a difference of 1) to indicate the default backbone direction, so when the two nodes meet these official or agreed interconnection rules, they have the necessary interconnection, which will also improve the confidence that the two nodes belong to the cross-PoP nodes; finally, the cross-PoP direct link needs to be economically feasible, and direct connection beyond a certain distance is often too costly and will be replaced by intermediate aggregation stations, so the mutual distance of the two nodes is judged through the geographical location relationship, the closer the distance, the greater the possibility that the two nodes are cross-PoP nodes.

[0058] The identification method of the low-orbit satellite network ground side intranet structure provided by the embodiment determines through multi-dimensional fusion of cross-regional co-occurrence, address planning, operation networking rules and geographical feasibility. The cross-regional co-occurrence relationship provides observed traffic behavior evidence, the private network address segment relationship reflects the static evidence of planning adjacency, the network networking rules embody the official evidence of design requirements, and the geographical position relationship verifies the reality evidence of physical feasibility. Without additional hardware probes, the four types of evidence complement each other from four dimensions, cross-verify, and thus high-confidence screening of the nodes that truly undertake the PoP inter-bone forwarding is realized, reducing the misjudgment caused by path detouring or incidental routing, and providing accurate and reliable cross-site connection information for ground side full-network topology construction.

[0059] Optionally, in an embodiment, the number of times that two nodes appear as adjacent hops in a path is counted to obtain a cross-regional co-occurrence relationship; the node private network prefixes of the two nodes are read respectively to determine whether the private network prefixes of the two nodes are continuous in the numerical space or whether the mask planning presents an increasing adjacency relationship to obtain a private network address segment relationship; the regional semantic units of the two nodes are parsed respectively to determine whether the two nodes satisfy the network networking rules according to the regional semantic units of the two nodes; and the distance between the two nodes is calculated to determine whether the distance is less than a preset operation distance threshold to obtain a geographical position relationship.

[0060] Specifically, when determining whether two nodes belong to cross-PoP nodes through the above four aspects, each aspect adopts the following processing method. As described above, by setting multiple distributed probe nodes, the paths of these probe nodes to the target IP of the low-orbit satellite network are determined. For the cross-region co-occurrence relationship, the adjacent node pairs of each path are counted, and for the selected two nodes, the total number of their occurrence in adjacent positions is counted to obtain the co-occurrence frequency, which is normalized to obtain the co-occurrence score S1 as the cross-region co-occurrence relationship. For the private network address segment relationship, the private network prefixes of the two nodes are read respectively, and it is judged whether the prefix values are continuous or the masks are in increasing adjacency. If it is satisfied, the private network adjacency flag S2=1 is recorded, otherwise S2=0, as the private network address segment relationship. For network networking rule matching, the regional semantic units in the domain names of the two nodes are analyzed, and the operation side interconnection whitelist or numbering rules are queried. If the regional combination meets the interconnection rules, the rule flag S3=1 is recorded, otherwise S3=0, as the determination result of whether the network networking rules are met. For the geographical position relationship, the latitude and longitude are obtained according to the Geo-IP data of the node public IP, the straight-line distance D between the two nodes is calculated, and if D≤operation distance threshold, the distance flag S4=1 is recorded, otherwise S4=0, as the geographical position relationship. Optionally, the confidence score score is calculated according to the weight score=0.4*S1+0.2*S2+0.2*S3+0.2*S4. When the confidence score score≥0.6, the two nodes are identified as cross-PoP nodes, and recorded as the backbone interconnection edge.

[0061] The low-orbit satellite network ground side intranet structure recognition method provided by the embodiment provides specific calculation methods for cross-region co-occurrence relationship, private network address segment relationship, whether the network networking rules are met, and geographical position relationship, and realizes high-precision and automatic identification of cross-PoP backbone interconnection.

[0062] Optionally, in an embodiment, according to the direct connection nodes and the cross-PoP nodes, the step of determining the low-orbit satellite network ground side intranet structure comprises: constructing a graph structure according to the domain name corresponding nodes, the direct connection nodes and the cross-PoP nodes; inputting the node naming mode and the graph structure into a large model to output the confidence scores of the edges and nodes in the graph structure; and determining the low-orbit satellite network ground side intranet structure according to the graph structure and the confidence scores of the edges and nodes thereof.

[0063] Specifically, all nodes corresponding to the domain name are taken as vertices, direct connection nodes and cross PoP nodes are taken as edges, meanwhile, device type, PoPID, centrality and other attributes are written for each node, subnet or co-occurrence confidence and other attributes are written for each edge, a network graph structure is constructed using a graph modeling method (such as GraphX or Neo4j), the graph structure is an attributed graph composed of a node set and an edge set, the node represents a ground side device obtained by parsing, and the edge is divided into a PoP intra direct connection edge and a PoP inter backbone edge. The node naming mode refers to a fixed arrangement rule of the low-orbit satellite network domain name on the device type, regional abbreviation and PoP number, which is used to verify whether the node name and its topology role are consistent, the node naming mode and the graph structure are input into a large language model (LLM) together, the large language model outputs a credibility quantitative result of each node or edge in the graph, which represents the consistency of semantics and topology, finally, edges and nodes with a credibility higher than a preset threshold are reserved to form a verified low-orbit satellite network ground side intranet structure, and elements with a lower credibility are marked as to be manually reviewed.

[0064] The identification method of the low-orbit satellite network ground side intranet structure provided by the embodiment can quickly mark low-confidence elements and retain high-confidence backbone and local connection by uniformly integrating node and edge information through a graph structure and then verifying the consistency of name semantics and topology logic with the help of a large language model, so that a ground side intranet topology with clear levels and quantifiable credibility can be output.

[0065] In summary, the identification method of the low-orbit satellite network ground side intranet structure provided by the embodiment can automatically reason and finely perceive the ground side intranet structure of a target network (for example, a Starlink network) without the cooperation of the target network. On the one hand, the dependence on a measurement system is reduced, and a structure reasoning mechanism that can operate independently is realized. Specifically, the internal deployment authority or interactive interface of the target network does not need to be relied on, but information such as domain name, host name and subnet structure that can be passively or boundary detected is extracted and analyzed to establish a structure identification model based on semantic features such as naming rules, geographical attribution and device abbreviation, so that the attribution reasoning and structure inference of the intranet nodes of the target network are realized, the dependence on internal control is significantly reduced, and the universal applicability of the technology in actual closed networks is improved. On the other hand, by deeply reasoning the internal structure of a PoP, a multi-level logical topology graph is constructed, information in a DNS response is structurally analyzed, and information such as naming semantics, subnet attribution and naming rules is combined, so that the gateway, router and subnet division relationship in the PoP can be effectively identified, the limitation that the existing technology can only identify the "PoP→PoP" relationship is broken, and the low-orbit satellite network ground side intranet structure is comprehensively reasoned and perceived.

[0066] Embodiment two Corresponding to the above embodiment one, the embodiment two of the present application provides a low-orbit satellite network ground side intranet structure identification device, and the corresponding technical feature details and the corresponding technical effects can refer to the above-mentioned embodiment one, in this embodiment, no longer tedious. Figure 2 The block diagram of the low-orbit satellite network ground side intranet structure identification device provided for the embodiment two of the present application is shown as follows, Figure 2 The device comprises: an acquisition module 201, a first determination module 202, a first identification module 203, a second identification module 204 and a second determination module 205.

[0067] The acquisition module 201 is used for acquiring the domain name of the low-orbit satellite network ground side; the first determination module 202 is used for determining the device type and the PoP point to which the node corresponding to the domain name belongs; the first identification module 203 is used for identifying the direct connection node in the PoP point in the nodes belonging to the same PoP point and having the same device type; the second identification module 204 is used for identifying the cross-PoP point node between the PoP points in the nodes belonging to different PoP points; and the second determination module 205 is used for determining the low-orbit satellite network ground side intranet structure according to the direct connection node and the cross-PoP point node.

[0068] Optionally, in an embodiment, the acquisition module comprises: a first acquisition unit, used for acquiring the domain name corresponding to the intermediate node in the path to the target IP of the low-orbit satellite network; and a second acquisition unit, used for acquiring the domain name leaked in the low-orbit satellite network intranet.

[0069] Optionally, in an embodiment, the steps specifically performed by the first acquisition unit comprise: setting a plurality of distributed probe nodes; determining the path to the target IP of the low-orbit satellite network by the probe nodes; extracting the IP address of the intermediate node in the path; performing DNS reverse resolution on the IP address of the intermediate node to obtain the domain name; the steps specifically performed by the first acquisition unit comprise: querying the DNS response record related to the low-orbit satellite network from the PDNS data stream log; and extracting the private network domain name leaked in the response record to obtain the domain name.

[0070] Optionally, in an embodiment, the first determining module comprises: a splitting unit configured to split the domain name into a plurality of semantic units; a first extracting unit configured to extract a first semantic unit representing a device type from the plurality of semantic units; a first determining unit configured to determine the device type of the node corresponding to the domain name according to the first semantic unit; a second extracting unit configured to extract a second semantic unit containing a PoP point keyword from the plurality of semantic units; a second determining unit configured to determine the PoP point to which the node corresponding to the domain name belongs according to the second semantic unit; a third extracting unit configured to extract a third semantic unit containing a city code and a number when the second semantic unit cannot be extracted; a third determining unit configured to determine the PoP point to which the node corresponding to the domain name belongs according to the third semantic unit; a fourth extracting unit configured to extract a fourth semantic unit representing regional information from the plurality of semantic units when the third semantic unit cannot be extracted; a searching unit configured to search for a PoP point corresponding to the fourth semantic unit; and a fourth determining unit configured to determine the PoP point corresponding to the fourth semantic unit as the PoP point to which the node corresponding to the domain name belongs.

[0071] Optionally, in an embodiment, the first identifying module comprises: a first clustering unit configured to cluster all nodes according to the PoP points to obtain a first node subset under each PoP point; a second clustering unit configured to cluster the first node subset according to the device types to obtain a second node subset of the same device type under a PoP point; and a comparing unit configured to compare the subnet masks of the private network IPs of nodes in the second node subset, wherein when two nodes fall in the same private network subnet, the two nodes are the direct connection nodes.

[0072] Optionally, in an embodiment, the second identifying module comprises: a fifth extracting unit configured to extract one node from each of two different PoP points to obtain two nodes; and a fifth determining unit configured to determine whether the two nodes belong to cross-PoP point nodes according to the cross-area co-occurrence relationship, the private network address segment relationship, whether the two nodes satisfy the network networking rules, and the geographical location relationship of the two nodes.

[0073] Optionally, in one embodiment, the fifth determining unit is specifically used to perform the following steps: count the number of times the two nodes appear as adjacent hops in the path to obtain the cross-regional co-occurrence relationship; read the private network prefixes of the two nodes respectively, determine whether the private network prefixes of the two nodes are continuous in the numerical space, or whether the mask planning is in an increasing adjacency relationship, to obtain the private network address segment relationship; parse the regional semantic units of the two nodes respectively, and determine whether the two nodes meet the network networking rules based on the regional semantic units of the two nodes; calculate the distance between the two nodes, determine whether the distance is less than a preset operating distance threshold, to obtain the geographical location relationship.

[0074] Optionally, in one embodiment, the second determining module includes: a construction unit, configured to construct a graph structure based on the domain name corresponding node, the directly connected node, and the cross-PoP node; an input unit, configured to input the node naming pattern and the graph structure into a large model, and output the confidence scores of the edges and nodes in the graph structure; and a sixth determining unit, configured to determine the ground-side intranet structure of the low-orbit satellite network based on the graph structure and the confidence scores of its edges and nodes.

[0075] Example 3 This embodiment also provides a computer device, such as a smartphone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server, or cabinet server (including a standalone server or a server cluster composed of multiple servers), etc., capable of executing programs. Figure 3 As shown, the computer device 01 in this embodiment includes, but is not limited to, a memory 012 and a processor 011 that can be interconnected via a system bus, such as... Figure 3 As shown. It should be noted that, Figure 3 Only a computer device 01 with component memory 012 and processor 011 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0076] In this embodiment, the memory 012 (i.e., a readable storage medium) includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 012 can be an internal storage unit of the computer device 01, such as a hard disk or a memory of the computer device 01. In other embodiments, the memory 012 can also be an external storage device of the computer device 01, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device 01. Of course, the memory 012 can also include both the internal storage unit and the external storage device of the computer device 01. In this embodiment, the memory 012 is generally used to store an operating system and various types of reference software installed on the computer device 01, such as program codes of the identification device of the low-orbit satellite network ground side intranet structure of Embodiment Two, etc. In addition, the memory 012 can also be used to temporarily store various types of data that have been output or will be output.

[0077] The processor 011 can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 011 is generally used to control the overall operation of the computer device 01. In this embodiment, the processor 011 is used to run program codes or process data stored in the memory 012, such as the identification method of the low-orbit satellite network ground side intranet structure, etc.

[0078] Embodiment Four This embodiment also provides a computer readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, a server, an App reference mall, etc., on which a computer program is stored. The program is executed by the processor to realize the corresponding function. The computer readable storage medium of this embodiment is used to store the identification device of the low-orbit satellite network ground side intranet structure, which is executed by the processor to realize the identification method of the low-orbit satellite network ground side intranet structure of Embodiment One.

[0079] It should be noted that, in this text, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0080] The above-mentioned embodiment numbers of the application are only for description, not representing the advantages and disadvantages of the embodiments.

[0081] Through the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases the former is a better embodiment.

[0082] The above is only the preferred embodiment of the application, and does not limit the patent scope of the application, and any equivalent structure or equivalent process transformation using the content of the application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the application.

Claims

1. A method for identifying the ground-side internal network structure of a low-Earth orbit satellite network, characterized in that, include: Obtain the domain name on the ground side of the low-Earth orbit satellite network; Determine the device type and PoP point to which the domain name corresponds; Identify directly connected nodes within a PoP point among nodes belonging to the same PoP point and of the same device type; Cross-PoP node identification among nodes belonging to different PoP points; The ground-side intranet structure of the low-orbit satellite network is determined based on the directly connected nodes and the cross-PoP node.

2. The method for identifying the ground-side internal network structure of a low-orbit satellite network according to claim 1, characterized in that, The steps to obtain the domain name on the ground side of a low-Earth orbit satellite network include: Obtain the domain names corresponding to intermediate nodes in the path to the target IP address of the low-Earth orbit satellite network; and Obtain the domain names leaked from the intranet of the low-orbit satellite network.

3. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 2, characterized in that, The steps for obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-Earth orbit satellite network include: setting up multiple distributed probe nodes; determining the path from the probe nodes to the target IP of the low-Earth orbit satellite network; extracting the IP address of the intermediate node in the path; and performing DNS reverse resolution on the IP address of the intermediate node to obtain the domain name. The steps for obtaining the domain name of the low-Earth orbit satellite network intranet include: querying DNS response records related to the low-Earth orbit satellite network from the PDNS data stream log; extracting the private network domain name leaked in the response record to obtain the domain name.

4. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 1, characterized in that, The steps for determining the device type and PoP point to which the domain name corresponds include: The domain name is split into multiple semantic units; Extract the first semantic unit representing the device type from the plurality of semantic units; The device type of the node corresponding to the domain name is determined based on the first semantic unit; Extract a second semantic unit containing the PoP point keyword from the plurality of semantic units; The PoP point to which the node corresponding to the domain name belongs is determined based on the second semantic unit; If the second semantic unit cannot be extracted, extract the third semantic unit containing the city code and the numerical code; The PoP point to which the node corresponding to the domain name belongs is determined based on the third semantic unit; When the third semantic unit cannot be extracted, a fourth semantic unit representing regional information is extracted from the plurality of semantic units; Find the PoP point corresponding to the fourth semantic unit; and The PoP point corresponding to the fourth semantic unit is determined to be the PoP point to which the node corresponding to the domain name belongs.

5. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 1, characterized in that, The steps for identifying directly connected nodes within a PoP (Point of Premises) among nodes belonging to the same PoP and of the same device type include: Cluster all nodes based on the PoP points to obtain the first subset of nodes under each PoP point; Cluster the first node subset according to the device type to obtain a second node subset of the same device type under the PoP point; In the second node subset, compare the subnet masks of the node's private network IP; When two nodes fall within the same private subnet, the two nodes are the directly connected nodes.

6. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 3, characterized in that, The steps for identifying cross-PoP nodes among nodes belonging to different PoP points include: Extract one node from each of the two different PoP points to obtain two nodes; Based on the cross-regional co-occurrence relationship, private network address range relationship, whether the network topology rules are met, and geographical location relationship of the two nodes, it is determined whether the two nodes belong to cross-PoP point nodes.

7. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 6, characterized in that, The cross-regional co-occurrence relationship is obtained by counting the number of times the two nodes appear as adjacent hops in the path. Read the private network prefixes of the two nodes respectively, determine whether the private network prefixes of the two nodes are continuous in the numerical space, or whether the mask plan is in an increasing adjacency relationship, and obtain the private network address segment relationship; The geographic semantic units of the two nodes are parsed respectively, and it is determined whether the two nodes meet the network networking rules based on the geographic semantic units of the two nodes; Calculate the distance between the two nodes, determine whether the distance is less than a preset operating distance threshold, and obtain the geographical location relationship.

8. The method for identifying the ground-side internal network structure of a low-orbit satellite network according to claim 1, characterized in that, The steps for determining the ground-side internal network structure of the low-Earth orbit satellite network based on the directly connected nodes and the cross-PoP nodes include: A graph structure is constructed based on the domain name corresponding node, the directly connected node, and the cross-PoP node; Input the node naming pattern and the graph structure into the large model, and output the confidence scores of the edges and nodes in the graph structure; The ground-side internal network structure of the low-Earth orbit satellite network is determined based on the confidence scores of the graph structure, its edges, and nodes.

9. A device for identifying the structure of a ground-side internal network of a low-Earth orbit satellite network, characterized in that, include: The acquisition module is used to acquire the domain name of the ground side of the low-Earth orbit satellite network; The first determining module is used to determine the device type and the PoP point to which the domain name corresponds; The first identification module is used to identify directly connected nodes within a PoP point among nodes that belong to the same PoP point and have the same device type. The second identification module is used to identify cross-PoP nodes between nodes belonging to different PoP points. The second determining module is used to determine the ground-side intranet structure of the low-orbit satellite network based on the directly connected nodes and the cross-PoP point nodes.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 8.

Images