Method, device and equipment for identifying low-orbit satellite network inner network structure on ground side

Abstract

The application provides a method, device and equipment for identifying an intranet structure of a low-orbit satellite network ground side. The method comprises: acquiring a domain name of the low-orbit satellite network ground side; determining a device type and a PoP point to which a node corresponding to the domain name belongs; identifying directly connected nodes in the PoP point among nodes belonging to the same PoP point and having the same device type; identifying cross-PoP-point nodes between PoP points among nodes belonging to different PoP points; and determining the intranet structure of the low-orbit satellite network ground side according to the directly connected nodes and the cross-PoP-point nodes. According to the application, the intranet structure of the low-orbit satellite network ground side can be comprehensively identified without relying on internal assistance or control authority of the low-orbit satellite network.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, and equipment for identifying the ground-side internal network structure of a low-Earth orbit satellite network. Background Technology

[0002] Starlink, as a representative low-Earth orbit satellite internet system, comprises two main components: space infrastructure, namely the satellite constellation operating in orbit, and globally distributed ground-side communication infrastructure, including user terminals, Starlink gateways, and Points of Presence (PoPs). In Starlink's network architecture, PoPs typically refer to the core nodes in the ground infrastructure responsible for backbone network access, regional data aggregation, and transmission to satellite gateways. The structural distribution of PoPs exhibits geographical correlation and a center-edge hierarchical structure, reflected in specific naming rules and IP allocation strategies.

[0003] In a satellite network topology measurement method provided by existing technology, the specific steps are as follows: 1) First, send node detection data and path detection data to the nodes in the satellite network, and receive the first feedback data, the second feedback data, and the satellite data of the satellite network returned by the nodes; 2) Then, based on the first feedback data, the second feedback data, and the satellite data, node association analysis is performed on the satellite network, and topology link analysis is performed based on the association analysis results; 3) Subsequently, the interface aliases of the nodes in the topology links are detected and analyzed to determine the topology of the satellite network.

[0004] In another method for inferring deep intranet topology based on traffic provided by existing technology, the specific steps are as follows: 1) Obtain NTP and TCP traffic characteristics; 2) Infer the scale of Windows and Linux devices at each level of the intranet based on NTP traffic characteristics; 3) Based on TCP traffic characteristics and the scale of Windows and Linux devices in each layer of the intranet, TCP traffic is clustered by hierarchical features to obtain TCP packet arrays classified by host device; 4) Based on the TCP packet array classified by host device, perform host device relationship inference to construct a deep intranet topology.

[0005] Through the aforementioned technical solutions, the inventors discovered that existing technologies often rely on internal assistance or control permissions to acquire core data. For example, this requires deploying acquisition devices, deploying probe programs, or accessing system resources on controlled hosts within the target network. Because this method's acquisition path depends on the controllability of the target's internal network, it cannot be implemented without internal cooperation or access permissions, severely limiting its applicability. This makes it difficult to promote and apply this type of technology to highly closed, complex, and large-scale "black box" networks like Starlink, limiting its practical value and general applicability. Furthermore, existing technologies only construct a logical topology diagram between Points of Presence (PoPs) in the low-Earth orbit (LEO) satellite network. Because the internal structure of each PoP cannot be observed, the reasoning and perception of the LEO satellite network's internal structure is insufficient.

[0006] Therefore, how to comprehensively identify the internal network structure of the ground side of low-orbit satellite networks has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0007] The purpose of this invention is to provide a method, apparatus, and device for identifying the internal network structure of a low-Earth orbit satellite network on the ground side, in order to solve the aforementioned technical problems in the prior art.

[0008] On the one hand, in order to achieve the above objectives, the present invention provides a method for identifying the internal network structure of the ground side of a low-orbit satellite network.

[0009] The method for identifying the ground-side intranet structure of the low-Earth orbit satellite network includes: obtaining the domain name of the ground side of the low-Earth orbit satellite network; determining the device type and PoP point to which the domain name corresponds; identifying directly connected nodes within the PoP point among nodes belonging to the same PoP point and having the same device type; identifying cross-PoP point nodes between nodes belonging to different PoP points; and determining the ground-side intranet structure of the low-Earth orbit satellite network based on the directly connected nodes and the cross-PoP point nodes.

[0010] Furthermore, the step of obtaining the domain name on the ground side of the low-Earth orbit satellite network includes: obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-Earth orbit satellite network; and obtaining the domain name of the intranet of the low-Earth orbit satellite network.

[0011] Further, the steps for obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-Earth orbit satellite network include: setting up multiple distributed probe nodes; determining the path from the probe nodes to the target IP of the low-Earth orbit satellite network; extracting the IP address of the intermediate node in the path; and performing DNS reverse resolution on the IP address of the intermediate node to obtain the domain name. The steps for obtaining the domain name of the intranet of the low-Earth orbit satellite network include: querying the DNS response record related to the low-Earth orbit satellite network from the PDNS data flow log; and extracting the private network domain name from the response record to obtain the domain name.

[0012] Further, the steps of determining the device type and the PoP (Point of Purchase) to which the domain name corresponds include: splitting the domain name into multiple semantic units; extracting a first semantic unit representing the device type from the multiple semantic units; determining the device type of the node corresponding to the domain name based on the first semantic unit; extracting a second semantic unit containing a PoP keyword from the multiple semantic units; determining the PoP to which the node corresponding to the domain name belongs based on the second semantic unit; when the second semantic unit cannot be extracted, extracting a third semantic unit containing a city code and a numerical code; determining the PoP to which the node corresponding to the domain name belongs based on the third semantic unit; when the third semantic unit cannot be extracted, extracting a fourth semantic unit representing regional information from the multiple semantic units; searching for the PoP corresponding to the fourth semantic unit; and determining the PoP corresponding to the fourth semantic unit as the PoP to which the node corresponding to the domain name belongs.

[0013] Further, the step of identifying directly connected nodes within a PoP point among nodes belonging to the same PoP point and having the same device type includes: clustering all nodes according to the PoP point to obtain a first subset of nodes under each PoP point; clustering the first subset of nodes according to the device type to obtain a second subset of nodes of the same device type under the PoP point; comparing the subnet masks of the private network IPs of the nodes in the second subset of nodes; and when two nodes fall in the same private network subnet, the two nodes are the directly connected nodes.

[0014] Furthermore, the step of identifying cross-PoP nodes among nodes belonging to different PoP points includes: extracting one node from each of the two different PoP points to obtain two nodes; and determining whether the two nodes belong to cross-PoP nodes based on the cross-regional co-occurrence relationship, private network address range relationship, whether they meet network networking rules and geographical location relationship.

[0015] Further, the number of times the two nodes appear as adjacent hops in the path is counted to obtain the cross-regional co-occurrence relationship; the private network prefixes of the two nodes are read respectively, and it is determined whether the private network prefixes of the two nodes are continuous in the numerical space, or whether the mask plan shows an increasing adjacency relationship, to obtain the private network address segment relationship; the regional semantic units of the two nodes are parsed respectively, and it is determined whether the two nodes meet the network networking rules based on the regional semantic units of the two nodes; the distance between the two nodes is calculated, and it is determined whether the distance is less than a preset operating distance threshold to obtain the geographical location relationship.

[0016] Further, the step of determining the ground-side intranet structure of the low-Earth orbit satellite network based on the directly connected nodes and the cross-PoP nodes includes: constructing a graph structure based on the domain name corresponding nodes, the directly connected nodes, and the cross-PoP nodes; inputting the node naming pattern and the graph structure into a large model, and outputting the confidence scores of edges and nodes in the graph structure; and determining the ground-side intranet structure of the low-Earth orbit satellite network based on the graph structure and the confidence scores of its edges and nodes.

[0017] On the other hand, in order to achieve the above objectives, the present invention provides a device for identifying the structure of the ground-side internal network of a low-orbit satellite network.

[0018] The identification device for the ground-side intranet structure of the low-Earth orbit satellite network includes: an acquisition module for acquiring the domain name of the ground side of the low-Earth orbit satellite network; a first determination module for determining the device type and PoP point to which the domain name corresponds; a first identification module for identifying directly connected nodes within a PoP point among nodes belonging to the same PoP point and having the same device type; a second identification module for identifying cross-PoP point nodes between PoP points among nodes belonging to different PoP points; and a second determination module for determining the ground-side intranet structure of the low-Earth orbit satellite network based on the directly connected nodes and the cross-PoP point nodes.

[0019] On the other hand, to achieve the above objectives, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.

[0020] On the other hand, to achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above method.

[0021] The present invention provides a method, apparatus, and device for identifying the intranet structure of a low-Earth orbit (LEO) satellite network on the ground side. First, the domain name of the LEO satellite network on the ground side is obtained. Then, based on the domain name, the device type and PoP (Point of Purchase) to which the node belongs are determined. Within a set of nodes of the same PoP and the same device type, directly connected nodes within the PoP are identified. Within a set of nodes in different PoPs, cross-PoP nodes are identified. Finally, the intranet structure of the LEO satellite network on the ground side is determined based on the directly connected nodes and cross-PoP nodes. This invention first obtains the domain name of the LEO satellite network on the ground side, quickly locates the node role and PoP affiliation, and further identifies local directly connected links and cross-site backbone links. This accurately reconstructs the hierarchical intranet topology of the LEO satellite network on the ground side, including the PoP structure and cross-PoP results. It does not rely on internal assistance or control permissions within the LEO satellite network, reducing costs. Furthermore, the structured output topology results provide reliable data support for operation and maintenance monitoring, capacity planning, and risk assessment. Attached Figure Description

[0022] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart of a method for identifying the ground-side internal network structure of a low-orbit satellite network provided in Embodiment 1 of the present invention; Figure 2 This is a block diagram of the identification device for the ground-side internal network structure of a low-orbit satellite network provided in Embodiment 2 of the present invention; Figure 3 This is a hardware structure diagram of a computer device provided in Embodiment 3 of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0024] Example 1 This invention provides a method for identifying the ground-side internal network structure of a low-Earth orbit (LEO) satellite network. This method enables comprehensive identification of the LEO satellite network's ground-side internal network structure without relying on internal assistance or control permissions within the LEO satellite network. Specifically, Figure 1The flowchart is a method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to Embodiment 1 of the present invention, as shown below. Figure 1 As shown, the method for identifying the ground-side internal network structure of a low-orbit satellite network provided in this embodiment includes the following steps S101 to S105.

[0025] Step S101: Obtain the domain name of the ground side of the low-Earth orbit satellite network.

[0026] The domain name on the ground side of a low-Earth orbit (LEO) satellite network refers to the reverse DNS lookup name of the LEO satellite network's ground-side nodes, used to identify node attributes. Optionally, on the one hand, the IP address of the LEO satellite network can be detected by selecting a probe point, and the domain name can be further resolved, for example, by performing traceroute through the probe point and combining it with DNS reverse lookup to obtain the domain name. On the other hand, PDNS can be used to passively detect and obtain the domain name of the LEO satellite network's internal network. Combining these two methods yields the domain name on the ground side of the LEO satellite network.

[0027] Taking Starlink as an example, the first aspect specifically includes: selecting multiple distributed probe nodes globally, using the traceroute tool to obtain the IP addresses of intermediate nodes in the path to the Starlink target IP, and then performing reverse DNS lookup on the IP addresses appearing in the path to obtain possible device domain names. The second aspect specifically includes: combining limited publicly available information from official sources to collect Starlink-related DNS response records from Passive DNS (PDNS) data stream logs, and extracting private network IP addresses and internal network domain names from these response records.

[0028] Step S102: Determine the device type and PoP point to which the domain name corresponds.

[0029] A Point of Presence (PoP) refers to a terrestrial location established by an operator for accessing satellite links and the backbone network. It comprises a group of multiple node devices located in the same geographical / logical position, jointly advertising network prefixes and under unified management. Device types include gateways (GW), ground station controllers (GSC), or user terminals (UES). In this step, for the domain name obtained in step S101, the device type of the corresponding node and its associated PoP are determined.

[0030] Optionally, the domain names obtained through active or passive detection are subjected to word segmentation, rule parsing, and field extraction to extract semantic features such as geographic information, device type, PoP point identifier, and purpose abbreviation. Based on naming rules and prior knowledge, the device type (such as terminal, router, satellite gateway, etc.), purpose (such as access, forwarding, management, etc.), and the PoP point or regional cluster to which the domain name belongs are determined.

[0031] Step S103: Identify the directly connected nodes within the PoP point among nodes belonging to the same PoP point and having the same device type.

[0032] Directly connected nodes refer to two devices located within the same PoP site that can reach each other with a single hop at the network layer. Their packets do not need to go through any cross-site routing or backbone links. Physically, they are usually connected to the uplink port of the same switch or the same rack, and logically they are a one-hop MAC or IP adjacency.

[0033] Specifically, in this step, when determining directly connected nodes, the nodes are first grouped according to the PoP identifier, and then each PoP group is further subdivided according to the device type (gw, gsc, ues, etc.) to form several "PoP × device type" buckets, and then each device in the bucket is directly connected.

[0034] Optionally, cluster analysis can be performed on nodes using the device's PoP affiliation, geotag, and device type; devices under the same PoP are grouped together and aggregated by device type. Within each device category, they can be further sorted by number to infer deployment density or physical topology.

[0035] Step S104: Identify cross-PoP nodes among nodes belonging to different PoP points.

[0036] Cross-PoP nodes refer to two devices belonging to two different PoP sites and directly interconnected via inter-site backbone links. They each serve the local network of their respective PoP and also act as cross-site forwarding devices: in end-to-end routing paths, these two devices often appear as consecutive hops, undertaking the function of diverting traffic from one PoP site to another.

[0037] Specifically, in this step, when determining cross-PoP nodes, all nodes of different PoP points are paired up to obtain cross-PoP candidate pairs, and then it is further determined whether the cross-PoP candidate pairs belong to cross-PoP points.

[0038] Optionally, by combining features such as private network address range allocation strategies, semantic naming rules, network networking common sense, geographical location information, and cross-regional co-occurrence relationships, the attribution PoP relationship and interconnection path between each private network node can be inferred.

[0039] Step S105: Determine the ground-side internal network structure of the low-Earth orbit satellite network based on the directly connected nodes and the nodes across PoPs.

[0040] Optionally, a network structure graph can be constructed using graph modeling methods (such as GraphX ​​or Neo4j) to identify backbone paths and functional clusters. A large model is then used to perform semantic understanding and confidence verification of node naming patterns, structural logic, and functional relationships, aiding in the verification of the accuracy and completeness of the inference results, thereby forming the final low-Earth orbit satellite network ground-side intranet structure graph. Further, optionally, the inferred node information is saved to an intranet node information database, which may include fields such as IP address, domain name, DNS records, semantic features, device type, purpose tags, and PoP affiliation. Information sources include active DNS probing and passive DNS records (PDNS). The node information database not only stores observation results but also supports inference modeling, structural comparison, node change tracking, and security analysis.

[0041] In the method for identifying the intranet structure of the ground side of a low-Earth orbit (LEO) satellite network provided in this embodiment, the domain name of the LEO satellite network ground side is first obtained. Then, the device type and PoP (Point of Purchase) to which the node belongs are determined based on the domain name. In the set of nodes with the same PoP and the same device type, directly connected nodes within the PoP are identified. In the set of nodes in different PoPs, cross-PoP nodes are identified. Finally, the intranet structure of the LEO satellite network ground side is determined based on the directly connected nodes and cross-PoP nodes. Using the method for identifying the intranet structure of the LEO satellite network ground side provided in this embodiment, the node roles and PoP affiliations are quickly located by obtaining the domain name of the LEO satellite network ground side. Furthermore, local directly connected links and cross-site backbone links are identified, thereby accurately reconstructing the hierarchical intranet topology of the LEO satellite network ground side, including the PoP structure and the results between cross-PoPs. This method does not rely on internal assistance or control permissions within the LEO satellite network, reducing costs. Moreover, the structured output topology results provide reliable data support for operation and maintenance monitoring, capacity planning, and risk assessment.

[0042] Optionally, in one embodiment, the step of obtaining the domain name on the ground side of the low-Earth orbit satellite network includes: obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-Earth orbit satellite network; and obtaining the domain name of the intranet of the low-Earth orbit satellite network.

[0043] Specifically, on the one hand, several existing cloud hosts are deployed across multiple continents globally as probe nodes to detect the path from the local host to the target IP address in the low-Earth orbit satellite network. Intermediate nodes along this path are extracted, and the domain names corresponding to these intermediate nodes are further determined to obtain the actively probed domain names. On the other hand, domain names carrying private network address resolution records are discovered in passive DNS logs or other network measurement data to obtain the domain names of the low-Earth orbit satellite network's internal network.

[0044] The method for identifying the ground-side intranet structure of low-Earth orbit satellite networks provided in this embodiment can simultaneously collect intermediate node domain names and passive DNS domain names obtained from route tracing. This method can cover both public paths and private network side information sources without the need for additional probe deployment, significantly improving the completeness of domain name collection and providing a more sufficient data foundation for subsequent node attribution determination and topology reconstruction.

[0045] Optionally, in one embodiment, the step of obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-Earth orbit satellite network includes: setting up multiple distributed probe nodes; determining the path from the probe nodes to the target IP of the low-Earth orbit satellite network; extracting the IP address of the intermediate node in the path; and performing DNS reverse resolution on the IP address of the intermediate node to obtain the domain name. The step of obtaining the domain name of the low-Earth orbit satellite network's internal network includes: querying DNS response records related to the low-Earth orbit satellite network from the PDNS data flow log; and extracting the private domain name from the response record to obtain the domain name.

[0046] Specifically, when obtaining the domain names corresponding to intermediate nodes in the path to the target IP of the LEO satellite network, distributed probe nodes can be deployed on cloud servers in different autonomous systems or geographical regions for active route probing. Each probe node executes the `traceroute` command, recording the complete hop sequence to obtain the path from the probe node to the target IP of the LEO satellite network. For each `traceroute` result, the start and end points are removed, retaining only the relay hop IPs to obtain the IP addresses of the intermediate nodes. A public DNS server is then used to perform reverse DNS lookup on the intermediate node IP addresses, querying the PTR records to obtain the relay node domain names.

[0047] When obtaining domain names of the intranet of a low-Earth orbit satellite network, query the DNS response records related to the low-Earth orbit satellite network from the PDNS data flow log. For example, use Starlink keywords (such as "starlink" or "sl-") to filter and obtain DNS response records related to Starlink. Then, filter the domain names that carry private intranet segment addresses in the response records to obtain the intranet domain names.

[0048] The identification method for the ground-side intranet structure of the low-Earth orbit satellite network provided in this embodiment captures both public network routing relay domain names and supplements domain names that are only resolved in the private network through distributed active route detection and passive DNS log dual-channel collection. This achieves comprehensive and high-coverage acquisition of the names of ground-side nodes in the low-Earth orbit satellite network, laying a reliable data foundation for the reconstruction of the intranet structure.

[0049] Optionally, in one embodiment, the step of determining the device type and the PoP (Point of Purchase) to which the domain name corresponds includes: splitting the domain name into multiple semantic units; extracting a first semantic unit representing the device type from the multiple semantic units; determining the device type of the domain name corresponding to the node based on the first semantic unit; extracting a second semantic unit containing a PoP keyword from the multiple semantic units; determining the PoP to which the domain name corresponding to the node belongs based on the second semantic unit; when the second semantic unit cannot be extracted, extracting a third semantic unit containing a city code and a numerical code; determining the PoP to which the domain name corresponding to the node belongs based on the third semantic unit; when the third semantic unit cannot be extracted, extracting a fourth semantic unit representing regional information from the multiple semantic units; searching for the PoP corresponding to the fourth semantic unit; and determining the PoP corresponding to the fourth semantic unit as the PoP to which the domain name corresponding to the node belongs.

[0050] Specifically, domain names obtained through active and passive probing are segmented using hyphens, periods, and other delimiters, breaking them down into multiple semantic units to form a token list. Each domain name includes a fixed prefix identifying the node's role, i.e., the device type. For example, "gw" represents a gateway, "gsc" represents a ground station controller, and "ues" represents a user terminal. When determining the device type of a node corresponding to a domain name, the semantic unit representing the device type is extracted from the token list. In this embodiment, this is defined as the first semantic unit. The extracted first semantic unit is then used to map the node's device type; for example, "gw" → gateway, "gsc" → ground station controller.

[0051] When determining the PoP (Point of Presence) to which a domain name corresponds, the token list is first searched for semantic units containing the keyword "PoP," such as semantic units directly containing keywords like "PoP" or "site." In this embodiment, these are defined as the second semantic unit. If found, the PoP to which the node belongs is directly determined using this keyword. If the second semantic unit is not found, semantic units consisting of a city code and a numerical identifier are extracted from the token list, such as "ber02," which is defined as the third semantic unit in this embodiment. For the extracted third semantic unit, the city code is first mapped to a city in the city dictionary, and then the PoP to which the node belongs is determined together with the numerical identifier. If the third semantic unit is not found, semantic units representing geographical information, i.e., fragments in the domain name representing continents, countries, or cities, such as "eu," "na," "ber," and "jfk," are extracted from the token list. In this embodiment, these are defined as the fourth semantic unit. If found, the PoP to which this geographical information belongs is searched, and it is determined as the PoP to which the node belongs.

[0052] The identification method for the ground-side intranet structure of the low-orbit satellite network provided in this embodiment, by resolving the domain name layer by layer: device type, PoP keyword, city number and regional information, can accurately locate the role of the node device and determine its PoP affiliation under different naming specifications, avoiding identification loss caused by naming differences. It achieves highly reliable and low-cost automatic determination of the attributes of ground-side nodes, laying an accurate foundation for node classification and site mapping for subsequent topology reconstruction.

[0053] Optionally, in one embodiment, the step of identifying directly connected nodes within a PoP point among nodes belonging to the same PoP point and having the same device type includes: clustering all nodes according to the PoP point to obtain a first subset of nodes under each PoP point; clustering the first subset of nodes according to device type to obtain a second subset of nodes of the same device type under the PoP point; comparing the subnet masks of the private network IPs of the nodes in the second subset of nodes; and when two nodes fall in the same private network subnet, the two nodes are directly connected nodes.

[0054] Specifically, when identifying directly connected nodes, all nodes are divided into several first-node subsets based on the node's PoP ID, each corresponding to its respective PoP. After clustering by PoP, the resulting first-node subsets represent the entire set of nodes under a given PoP. Within each first-node subset, nodes are further subdivided based on their device type field, such as gw, gsc, or ues, resulting in several second-node subsets. Nodes within each second-node subset have the same device type. For nodes within the same second-node subset, their private IP network prefixes and subnet masks are compared. If two nodes fall within the same private subnet, they are considered directly connected within the PoP and can be reached in one hop.

[0055] The method for identifying the internal network structure of the ground side of the low-Earth orbit satellite network provided in this embodiment, through two-level clustering of PoP points and device types, supplemented by private network subnet determination, can quickly locate physical or Layer 2 directly connected node pairs within the PoP. This avoids cross-PoP misjudgments and simplifies the workload of comparing massive numbers of nodes, realizing the identification of the structure within the PoP point and providing accurate and high-confidence local connectivity information for subsequent topology modeling. In this invention, by combining the private network IP address segmentation rules with semantic fields such as geography and numbering embedded in the domain name, the attribution relationship between gateway nodes, router devices, and management nodes under the Starlink PoP node is identified, realizing the inference of the internal network structure of the Starlink ground-side PoP.

[0056] Optionally, in one embodiment, the step of identifying cross-PoP nodes among nodes belonging to different PoP points includes: extracting one node from each of the two different PoP points to obtain two nodes; and determining whether the two nodes belong to cross-PoP nodes based on the cross-regional co-occurrence relationship, private network address range relationship, whether they meet network networking rules and geographical location relationship.

[0057] Specifically, when identifying cross-PoP nodes, one node is selected from each of two different PoPs. The determination of whether these two nodes belong to a cross-PoP node is based on four factors: cross-regional co-occurrence relationship, private network address segment relationship, compliance with network topology rules, and geographical location. Network path arrangement typically follows the shortest or optimal link principle. For two directly interconnected PoPs, their boundary nodes will frequently and stably appear in adjacent hops, while occasional detours or third-party relays will only result in scattered appearances. Therefore, the higher the frequency of cross-regional co-occurrence between two nodes, the greater the probability that they belong to a cross-PoP node. Operators often allocate private network address blocks sequentially to adjacent PoPs based on geography or function, for example, 10.60.0.0 / 24 to PoP-A and 10.60.1.0 / 24 to PoP-B. If the private network address segment relationship between two nodes indicates that they are adjacent sites at the same level and were allocated by the same address planning template, then these two nodes belong to a cross-PoP node. The confidence level will be further improved. In some scenarios, operators will predefine which PoPs must be interconnected (such as "PoPs in the same country's capital must be connected to PoPs in the same country"), or use numbering rules (numbers that differ by 1 are interconnected) to indicate the default backbone route. Therefore, when two nodes happen to meet these official or agreed interconnection rules, they have the necessary interconnection, which will also increase the confidence that the two nodes are cross-PoP nodes. Finally, direct cross-PoP links need to be economically feasible. Direct connections beyond a certain distance are often too costly and will instead go through an intermediate aggregation station. Therefore, the distance between two nodes is judged by their geographical relationship. The closer the distance, the greater the possibility that the two nodes are cross-PoP nodes.

[0058] The method for identifying the ground-side intranet structure of low-Earth orbit satellite networks provided in this embodiment uses a multi-dimensional fusion judgment based on cross-regional co-occurrence, address planning, operational networking rules, and geographical feasibility. Cross-regional co-occurrence provides evidence of observed traffic behavior, private network address segment relationships reflect static evidence of planned adjacency, network networking rules embody official evidence of design requirements, and geographical location relationships verify real-world evidence of physical feasibility. Without the need for additional hardware probes, these four types of evidence complement and cross-verify from four dimensions, thereby selecting nodes that truly undertake backbone forwarding between PoPs with high confidence. This reduces misjudgments caused by path detours or occasional routing, providing accurate and reliable cross-site connection information for the construction of the entire ground-side network topology.

[0059] Optionally, in one embodiment, the number of times two nodes appear as adjacent hops in the path is counted to obtain the cross-regional co-occurrence relationship; the private network prefixes of the two nodes are read respectively, and it is determined whether the private network prefixes of the two nodes are continuous in the numerical space, or whether the mask plan shows an increasing adjacency relationship, to obtain the private network address segment relationship; the regional semantic units of the two nodes are parsed respectively, and it is determined whether the two nodes meet the network networking rules based on the regional semantic units of the two nodes; the distance between the two nodes is calculated, and it is determined whether the distance is less than a preset operating distance threshold to obtain the geographical location relationship.

[0060] Specifically, when determining whether two nodes belong to cross-PoP nodes through the above four aspects, each aspect adopts the following processing method. As mentioned above, by setting up multiple distributed probe nodes, the paths of these probe nodes to the target IP of the low-Earth orbit satellite network are determined. Regarding the cross-regional co-occurrence relationship, the adjacent hop node pairs of each path are counted. For the selected two nodes, the total number of times they appear in adjacent positions is counted to obtain the co-occurrence frequency, which is then normalized to obtain the co-occurrence score S1, as the cross-regional co-occurrence relationship. Regarding the private network address segment relationship, the private network prefixes of the two nodes are read respectively, and it is determined whether the prefix values ​​are continuous or whether the mask is incrementally adjacent. If they are satisfied, the private network adjacency flag S2 is recorded as 1; otherwise, S2 is not recorded. S3=0, representing the private network address range relationship; regarding network topology rule matching, the geographical semantic unit in the domain names of the two nodes is parsed, and the interconnection whitelist or numbering rules on the operator side are queried. If the geographical combination conforms to the interconnection rules, the rule flag S3=1 is recorded; otherwise, S3=0, which serves as the determination result of whether the network topology rules are met; regarding geographical location relationship, the latitude and longitude are obtained based on the Geo-IP data of the node's public IP, and the straight-line distance D between the two nodes is calculated. If D≤ the operator's distance threshold, the distance flag S4=1 is recorded; otherwise, S4=0, which serves as the geographical location relationship. Optionally, a confidence score is calculated using the weighted score=0.4*S1+0.2*S2+0.2*S3+0.2*S4. When the confidence score ≥ 0.6, the two nodes are identified as cross-PoP point nodes and recorded as a backbone interconnection edge.

[0061] The identification method for the ground-side intranet structure of the low-orbit satellite network provided in this embodiment provides specific calculation methods for cross-regional co-occurrence relationships, private network address segment relationships, whether network networking rules are met, and geographical location relationships, thereby achieving high-precision and automated identification of cross-PoP backbone interconnection.

[0062] Optionally, in one embodiment, the step of determining the ground-side intranet structure of the low-Earth orbit satellite network based on directly connected nodes and cross-PoP nodes includes: constructing a graph structure based on the domain name corresponding nodes, directly connected nodes, and cross-PoP nodes; inputting the node naming pattern and graph structure into a large model, and outputting the confidence scores of edges and nodes in the graph structure; and determining the ground-side intranet structure of the low-Earth orbit satellite network based on the graph structure and the confidence scores of its edges and nodes.

[0063] Specifically, using all nodes corresponding to a domain name as vertices and directly connected nodes and nodes across PoPs as edges, attributes such as device type, PoPID, and centrality are written for each node, and attributes such as subnet or co-occurrence confidence are written for each edge. A graph modeling method (such as GraphX ​​or Neo4j) is used to construct the network graph structure. This graph structure is an attributed graph composed of a set of nodes and a set of edges. Nodes represent the ground-side devices obtained from the resolution, and edges are divided into directly connected edges within PoPs and backbone edges between PoPs. The node naming pattern refers to the fixed arrangement rules of the LEO satellite network domain name in terms of device type, regional abbreviation, and PoP number. It is used to verify whether the node name is consistent with its topological role. The node naming pattern and this graph structure are input into a Large Language Model (LLM). The LLM outputs a confidence quantification result for each node or edge in the graph, indicating the level of semantic and topological consistency. Finally, edges and nodes with confidence scores higher than a preset threshold are retained to form a verified LEO satellite network ground-side intranet structure, and elements with low confidence scores are marked for manual review.

[0064] The identification method for the ground-side intranet structure of the low-orbit satellite network provided in this embodiment integrates node and edge information through a graph structure, and then uses a large language model to verify the consistency between name semantics and topological logic. This method can quickly mark low-confidence elements and retain high-confidence backbones and local connections, thereby outputting a ground-side intranet topology with clear hierarchy and quantifiable credibility.

[0065] In summary, the method for identifying the ground-side internal network structure of a low-Earth orbit satellite network provided by this invention can achieve automatic reasoning and fine-grained perception of its ground-side internal network structure without the need for cooperation from the target network (e.g., Starlink network). On the one hand, it reduces the dependence on measurement systems and enables an independently operable structural reasoning mechanism. Specifically, it does not rely on the internal deployment permissions or interaction interfaces of the target network. Instead, it extracts multi-dimensional features and performs semantic analysis on information that can be passively or boundary probed, such as domain names, hostnames, and subnet structures, to establish a structural identification model based on semantic features such as naming rules, geographic affiliation, and device abbreviations. This enables attribution reasoning and structural inference of internal network nodes in the target network, significantly reducing the dependence on internal control and improving the general applicability of the technology in practical closed networks. On the other hand, by deeply reasoning about the internal structure of the PoP, it constructs a multi-level logical topology map. By performing structured parsing of information in DNS responses and combining information such as naming semantics, subnet affiliation, and naming rules, it can effectively identify gateways, routers, and subnet division relationships within the PoP. This breaks through the limitation of existing technologies that can only identify "PoP→PoP" relationships and achieves comprehensive reasoning and perception of the internal network structure of the ground side of the low-Earth orbit satellite network.

[0066] Example 2 Corresponding to Embodiment 1 above, Embodiment 2 of the present invention provides an identification device for the ground-side internal network structure of a low-orbit satellite network. The technical features and corresponding technical effects can be referred to Embodiment 1 above, and will not be repeated in this embodiment. Figure 2 This is a block diagram of the identification device for the ground-side internal network structure of a low-orbit satellite network provided in Embodiment 2 of the present invention, as shown below. Figure 2 As shown, the device includes: an acquisition module 201, a first determination module 202, a first identification module 203, a second identification module 204, and a second determination module 205.

[0067] The acquisition module 201 is used to acquire the domain name of the ground side of the low-orbit satellite network; the first determination module 202 is used to determine the device type and PoP point to which the domain name belongs; the first identification module 203 is used to identify the directly connected nodes within the PoP point among nodes belonging to the same PoP point and having the same device type; the second identification module 204 is used to identify the cross-PoP point nodes between PoP points among nodes belonging to different PoP points; the second determination module 205 is used to determine the internal network structure of the ground side of the low-orbit satellite network based on the directly connected nodes and the cross-PoP point nodes.

[0068] Optionally, in one embodiment, the acquisition module includes: a first acquisition unit, configured to acquire the domain name corresponding to an intermediate node in the path to the target IP of the low-Earth orbit satellite network; and a second acquisition unit, configured to acquire the domain name of the intranet of the low-Earth orbit satellite network.

[0069] Optionally, in one embodiment, the steps specifically performed by the first acquisition unit include: setting up multiple distributed probe nodes; determining the path from the probe nodes to the target IP of the low-Earth orbit satellite network; extracting the IP addresses of intermediate nodes in the path; performing DNS reverse resolution on the IP addresses of the intermediate nodes to obtain the domain name; the steps specifically performed by the first acquisition unit include: querying DNS response records related to the low-Earth orbit satellite network from the PDNS data stream log; extracting the private domain name from the response record to obtain the domain name.

[0070] Optionally, in one embodiment, the first determining module includes: a segmentation unit for splitting the domain name into multiple semantic units; a first extraction unit for extracting a first semantic unit representing a device type from the multiple semantic units; a first determining unit for determining the device type of the node corresponding to the domain name based on the first semantic unit; a second extraction unit for extracting a second semantic unit containing a PoP (Point of Purchase) keyword from the multiple semantic units; a second determining unit for determining the PoP to which the node corresponding to the domain name belongs based on the second semantic unit; a third extraction unit for extracting a third semantic unit containing a city code and a numerical code when the second semantic unit cannot be extracted; a third determining unit for determining the PoP to which the node corresponding to the domain name belongs based on the third semantic unit; a fourth extraction unit for extracting a fourth semantic unit representing regional information from the multiple semantic units when the third semantic unit cannot be extracted; a search unit for searching for the PoP corresponding to the fourth semantic unit; and a fourth determining unit for determining that the PoP corresponding to the fourth semantic unit is the PoP to which the node corresponding to the domain name belongs.

[0071] Optionally, in one embodiment, the first identification module includes: a first clustering unit, configured to cluster all nodes according to the PoP point to obtain a first node subset under each PoP point; a second clustering unit, configured to cluster the first node subset according to the device type to obtain a second node subset of the same device type under the PoP point; and a comparison unit, configured to compare the subnet masks of the private network IPs of the nodes in the second node subset, wherein when two nodes fall in the same private network subnet, the two nodes are the directly connected nodes.

[0072] Optionally, in one embodiment, the second identification module includes: a fifth extraction unit, used to extract one node from each of two different PoP points to obtain two nodes; and a fifth determination unit, used to determine whether the two nodes belong to cross-PoP point nodes based on the cross-regional co-occurrence relationship, private network address segment relationship, whether they meet network networking rules and geographical location relationship of the two nodes.

[0073] Optionally, in one embodiment, the fifth determining unit is specifically used to perform the following steps: count the number of times the two nodes appear as adjacent hops in the path to obtain the cross-regional co-occurrence relationship; read the private network prefixes of the two nodes respectively, determine whether the private network prefixes of the two nodes are continuous in the numerical space, or whether the mask planning is in an increasing adjacency relationship, to obtain the private network address segment relationship; parse the regional semantic units of the two nodes respectively, and determine whether the two nodes meet the network networking rules based on the regional semantic units of the two nodes; calculate the distance between the two nodes, determine whether the distance is less than a preset operating distance threshold, to obtain the geographical location relationship.

[0074] Optionally, in one embodiment, the second determining module includes: a construction unit, configured to construct a graph structure based on the domain name corresponding node, the directly connected node, and the cross-PoP node; an input unit, configured to input the node naming pattern and the graph structure into a large model, and output the confidence scores of the edges and nodes in the graph structure; and a sixth determining unit, configured to determine the ground-side intranet structure of the low-orbit satellite network based on the graph structure and the confidence scores of its edges and nodes.

[0075] Example 3 This embodiment also provides a computer device, such as a smartphone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server, or cabinet server (including a standalone server or a server cluster composed of multiple servers), etc., capable of executing programs. Figure 3 As shown, the computer device 01 in this embodiment includes, but is not limited to, a memory 012 and a processor 011 that can be interconnected via a system bus, such as... Figure 3 As shown. It should be noted that, Figure 3 Only a computer device 01 with component memory 012 and processor 011 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0076] In this embodiment, the memory 012 (i.e., the readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 012 may be an internal storage unit of the computer device 01, such as the hard disk or memory of the computer device 01. In other embodiments, the memory 012 may also be an external storage device of the computer device 01, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the computer device 01. Of course, the memory 012 may include both the internal storage unit and the external storage device of the computer device 01. In this embodiment, the memory 012 is typically used to store the operating system and various reference software installed on the computer device 01, such as the program code of the identification device for the ground-side intranet structure of the low-Earth orbit satellite network in Embodiment 2. In addition, memory 012 can also be used to temporarily store various types of data that have been output or will be output.

[0077] In some embodiments, processor 011 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. This processor 011 is typically used to control the overall operation of computer device 01. In this embodiment, processor 011 is used to run program code stored in memory 012 or process data, such as a method for identifying the structure of the ground-side intranet of a low-Earth orbit satellite network.

[0078] Example 4 This embodiment also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, App application store, etc., which stores a computer program. When the program is executed by a processor, it implements the corresponding function. The computer-readable storage medium of this embodiment is used to store a device for identifying the ground-side intranet structure of a low-Earth orbit satellite network. When executed by a processor, it implements the method for identifying the ground-side intranet structure of a low-Earth orbit satellite network as described in Embodiment 1.

[0079] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0080] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0081] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0082] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for identifying the ground-side internal network structure of a low-Earth orbit satellite network, characterized in that, include: Obtain the domain name on the ground side of the low-Earth orbit satellite network; Determine the device type and PoP point to which the domain name corresponds; Identify directly connected nodes within a PoP point among nodes belonging to the same PoP point and of the same device type; Identifying cross-PoP nodes among nodes belonging to different PoP points includes: extracting one node from each of the two different PoP points to obtain two nodes; determining whether the two nodes belong to cross-PoP nodes based on the cross-regional co-occurrence relationship, private network address segment relationship, whether they meet network networking rules, and geographical location relationship; wherein, the cross-regional co-occurrence relationship is obtained by counting the number of times the two nodes appear as adjacent hops in the path; the private network prefixes of the two nodes are read respectively, and it is determined whether the private network prefixes of the two nodes are continuous in the numerical space or whether the mask planning shows an increasing adjacency relationship to obtain the private network address segment relationship. The ground-side intranet structure of the low-orbit satellite network is determined based on the directly connected nodes and the cross-PoP node.

2. The method for identifying the ground-side internal network structure of a low-orbit satellite network according to claim 1, characterized in that, The steps to obtain the domain name on the ground side of a low-Earth orbit satellite network include: Obtain the domain names corresponding to intermediate nodes in the path to the target IP address of the low-Earth orbit satellite network; and Obtain the domain name of the intranet of the low-orbit satellite network.

3. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 2, characterized in that, The steps for obtaining the domain name corresponding to the intermediate node in the path to the target IP of the low-Earth orbit satellite network include: setting up multiple distributed probe nodes; determining the path from the probe nodes to the target IP of the low-Earth orbit satellite network; extracting the IP address of the intermediate node in the path; and performing DNS reverse resolution on the IP address of the intermediate node to obtain the domain name. The steps for obtaining the domain name of the intranet of the low-Earth orbit satellite network include: querying the DNS response records related to the low-Earth orbit satellite network from the PDNS data stream log; extracting the private domain name from the response records to obtain the domain name.

4. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 1, characterized in that, The steps for determining the device type and PoP point to which the domain name corresponds include: The domain name is split into multiple semantic units; Extract the first semantic unit representing the device type from the plurality of semantic units; The device type of the node corresponding to the domain name is determined based on the first semantic unit; Extract a second semantic unit containing the PoP point keyword from the plurality of semantic units; The PoP point to which the node corresponding to the domain name belongs is determined based on the second semantic unit; If the second semantic unit cannot be extracted, extract the third semantic unit containing the city code and the numerical code; The PoP point to which the node corresponding to the domain name belongs is determined based on the third semantic unit; When the third semantic unit cannot be extracted, a fourth semantic unit representing regional information is extracted from the plurality of semantic units; Find the PoP point corresponding to the fourth semantic unit; and The PoP point corresponding to the fourth semantic unit is determined to be the PoP point to which the node corresponding to the domain name belongs.

5. The method for identifying the ground-side internal network structure of a low-orbit satellite network according to claim 1, characterized in that, The steps for identifying directly connected nodes within a PoP (Point of Premises) among nodes belonging to the same PoP and of the same device type include: Cluster all nodes based on the PoP points to obtain the first subset of nodes under each PoP point; Cluster the first node subset according to the device type to obtain a second node subset of the same device type under the PoP point; In the second node subset, compare the subnet masks of the node's private network IP; When two nodes fall within the same private subnet, the two nodes are the directly connected nodes.

6. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 1, characterized in that, The geographic semantic units of the two nodes are parsed respectively, and it is determined whether the two nodes meet the network networking rules based on the geographic semantic units of the two nodes; Calculate the distance between the two nodes, determine whether the distance is less than a preset operating distance threshold, and obtain the geographical location relationship.

7. The method for identifying the ground-side internal network structure of a low-Earth orbit satellite network according to claim 1, characterized in that, The steps for determining the ground-side internal network structure of the low-Earth orbit satellite network based on the directly connected nodes and the cross-PoP nodes include: A graph structure is constructed based on the domain name corresponding node, the directly connected node, and the cross-PoP node; Input the node naming pattern and the graph structure into the large model, and output the confidence scores of the edges and nodes in the graph structure; The ground-side internal network structure of the low-Earth orbit satellite network is determined based on the confidence scores of the graph structure, its edges, and nodes.

8. A device for identifying the structure of a ground-side internal network of a low-Earth orbit satellite network, characterized in that, include: The acquisition module is used to acquire the domain name of the ground side of the low-Earth orbit satellite network; The first determining module is used to determine the device type and the PoP point to which the domain name corresponds; The first identification module is used to identify directly connected nodes within a PoP point among nodes that belong to the same PoP point and have the same device type. The second identification module is used to identify cross-PoP nodes among nodes belonging to different PoP points. The module includes: extracting one node from each of the two different PoP points to obtain two nodes; determining whether the two nodes belong to cross-PoP nodes based on the cross-regional co-occurrence relationship, private network address segment relationship, whether they meet network networking rules and geographical location relationship; wherein, the cross-regional co-occurrence relationship is obtained by counting the number of times the two nodes appear as adjacent hops in the path; the private network prefixes of the two nodes are read respectively; and the private network prefixes of the two nodes are determined to be continuous in the numerical space or whether the mask planning is in an increasing adjacency relationship to obtain the private network address segment relationship. The second determining module is used to determine the ground-side intranet structure of the low-orbit satellite network based on the directly connected nodes and the cross-PoP point nodes.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images