Method, device and equipment for identifying ground side nodes of low earth orbit satellite network and medium

Abstract

The invention provides a method, a device and equipment for identifying ground side nodes of a low earth orbit satellite network, and a medium. The method comprises the following steps: acquiring an IP address list of a low earth orbit satellite network; fingerprint seeds of ground side nodes of the low earth orbit satellite network are constructed, and the fingerprint seeds comprise a plurality of fingerprint fields; performing RDNS reverse analysis on the IP addresses in the IP address list to obtain a PTR record corresponding to each IP address; extracting a feature field in the PTR record to construct a node fingerprint corresponding to the IP address; acquiring external multi-source information of the low-orbit satellite network; determining a node type and a credibility degree corresponding to the node fingerprint according to the fingerprint seed and the external multi-source information; generating a node fingerprint database according to the node fingerprints, the node types and the credibility; and identifying whether the target IP address is a ground side node of the low earth orbit satellite network based on the node fingerprint database. According to the invention, the ground side node of the low earth orbit satellite network can be better identified.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, equipment, and medium for identifying ground-side nodes in a low-Earth orbit satellite network. Background Technology

[0002] Cyberspace mapping refers to the theory and technology of using cyberspace as its object, based on computer science, network science, and surveying and mapping science, and obtaining information on the distribution of nodes in global cyberspace, network relationship indexes, the location, attributes, and topology of physical and virtual resources in cyberspace through network detection, collection, analysis, processing, and display. Based on geographic information and logical relationships, it creates graphical representations, constructs a global Internet map, and conducts spatial analysis and applications accordingly.

[0003] Asset mapping technology is an important component of cyberspace research, aiming to comprehensively identify various network assets on the Internet through active or passive detection methods. Currently, mainstream cyberspace mapping platforms such as Shodan, Censys, and ZoomEye widely employ methods such as port scanning, protocol identification, and banner extraction to establish a global Internet resource database, providing crucial support for network situational awareness and network node identification.

[0004] Figure 1 This is a schematic diagram of the Starlink network structure in existing technology. Starlink is a representative low-Earth orbit satellite internet system, such as... Figure 1 As shown, Starlink comprises two main components: space infrastructure, namely the satellite constellation operating in orbit, and global ground-based communication infrastructure, including user terminals, ground facilities, and the internet. The ground infrastructure includes Point of Presence (PoP) nodes, while the internet infrastructure includes IXP nodes. In Starlink's network architecture, the structural distribution of IXP and PoP nodes exhibits regional correlation and a center-edge hierarchical structure, reflected in specific naming rules and IP allocation strategies.

[0005] Node identification technology is primarily used to identify specific types of communication nodes or critical infrastructure within massive network addresses, such as PoP nodes, ground stations, IXP nodes, and CDN edge nodes in the Starlink network. This type of technology typically combines domain name resolution, IP attribution information, behavioral pattern analysis, and naming rule mining, leveraging semantic understanding and contextual features to automatically determine and classify node functions. It is an important tool for network asset profiling and structural analysis.

[0006] A method for discovering resources in a distributed satellite network is proposed in the prior art, and its specific steps are as follows: 1) During the initialization of the distributed satellite network, each node sends resource information advertising packets to other nodes, and each node establishes a resource information routing table.

[0007] 2) After the distributed satellite network is initialized, each node queries resources using the following methods: First, it queries the local resource information. If the local node can provide resource information that meets the conditions, the query ends; otherwise, the query information is routed to other nodes in the distributed network for querying.

[0008] This method emphasizes resource sharing and collaboration among nodes, but it is mainly aimed at links or servers in low-Earth orbit satellite networks and does not involve the discovery and identification of critical ground infrastructure such as POP nodes and IXP nodes.

[0009] Existing technologies also propose a method and apparatus for discovering and classifying network space mapping nodes, the specific steps of which are as follows: 1) Real-time collection of scan traffic is achieved by configuring and deploying different scan traffic sensing nodes in multiple regions around the world.

[0010] 2) Transfer the scan traffic to a local database for structured storage.

[0011] 3) Differentiate between domain-based mapping nodes and anonymous mapping nodes for separate mapping node discovery. Utilize a combination of methods, including rDNS database, WHOIS information, and comparison of timestamps used in network space search engine asset entry, to quickly discover the IP addresses of mapping nodes.

[0012] 4) Analyze the surveying behavior of different surveying platforms and present it in a visual format.

[0013] This method measures and discovers mapping nodes distributed in cyberspace, but does not involve the discovery and identification of Starlink ground-based critical infrastructure such as POP nodes and IXP nodes.

[0014] Therefore, in terms of discovering important nodes in low-Earth orbit satellite networks, existing technologies lack the ability to identify ground-based critical infrastructure such as POP nodes and IXP nodes, which are the ground-side nodes of low-Earth orbit satellite networks.

[0015] Therefore, how to better identify ground-side nodes of low-Earth orbit satellite networks has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0016] The purpose of this invention is to provide a method, apparatus, device, and medium for identifying ground-side nodes in a low-Earth orbit satellite network, in order to solve the aforementioned technical problems in the prior art.

[0017] On the one hand, in order to achieve the above objectives, the present invention provides a method for identifying ground-side nodes of a low-orbit satellite network.

[0018] The method for identifying ground-side nodes of a low-Earth orbit (LEO) satellite network includes: obtaining a list of IP addresses of the LEO satellite network; constructing a fingerprint seed for the LEO satellite network's ground-side nodes, wherein the fingerprint seed includes several fingerprint fields; performing RDNS reverse lookup on the IP addresses in the IP address list to obtain a PTR record corresponding to each IP address; extracting feature fields from the PTR records to construct a node fingerprint corresponding to the IP address; obtaining external multi-source information of the LEO satellite network; determining the node type and trust level corresponding to the node fingerprint based on the fingerprint seed and the external multi-source information; generating a node fingerprint database based on the node fingerprint, the node type, and the trust level; and identifying whether a target IP address is a ground-side node of the LEO satellite network based on the node fingerprint database.

[0019] Furthermore, the fingerprint field includes a semantic field, a structural field, and an address field; the step of extracting the feature fields from the PTR record includes: extracting the semantic information, naming structure, and associated IP segment information from the PTR record, respectively, as feature fields.

[0020] Further, the step of determining the node type and confidence level corresponding to the node fingerprint based on the fingerprint seed and the external multi-source information includes: performing a field-level matching operation on the fingerprint seed and the node fingerprint; determining whether the node fingerprint is matched by the fingerprint seed based on the field matching result, wherein when the node fingerprint is matched by the fingerprint seed, the node type of the fingerprint seed is the node type corresponding to the node fingerprint; constructing a fingerprint entry using the PTR record, the node fingerprint, the field matching result, the match result, and the node type corresponding to the node fingerprint; verifying the fingerprint entry using the external information and generating a verification result; calculating the confidence score of the fingerprint entry based on the field matching result, the match result, and the verification result to obtain the confidence level corresponding to the node fingerprint.

[0021] Further, the PTR record of the fingerprint entry is the first record, and the IP address corresponding to the first record is the first address; the external information includes public PDNS data, and the step of using the external information to verify the fingerprint entry and generate a verification result includes: obtaining the resolution records within a preset time period from the public PDNS data, extracting the FQDN and the first address from the first record of the fingerprint entry, and calculating the proportion of the FQDN being resolved to the first address in the resolution records within the preset time period; the external information includes BGP route monitoring data, and the step of using the external information to verify the fingerprint entry and generate a verification result includes: obtaining the ASN_bgp currently advertised by the first address and its prefix Prefix_bgp from the BGP route monitoring data; extracting the ASN field and ip_prefix field from the fingerprint entry, and verifying the ASN_bgp... The steps for verifying the fingerprint entry and generating a verification result include: checking if the bgp is in a preset whitelist, verifying whether the ASN_bgp is consistent with the ASN field, and verifying whether the Prefix_bgp is consistent with the ip_prefix field; the external information includes GeoIP data, and the steps for using the external information to verify the fingerprint entry and generate a verification result include: parsing the country code and city coordinates corresponding to the first address using the GeoIP data; extracting the country_iso and city_code fields from the fingerprint entry, verifying whether the country code corresponding to the first address is consistent with the country_iso field, and verifying whether the distance between the city coordinates and the city center point represented by the city_code field is less than a preset distance; the external information includes data from multiple data sources, and verifying whether the data from each data source represents supporting evidence or conflicting evidence for the node type in the fingerprint entry.

[0022] Furthermore, the step of generating a node fingerprint database based on the node fingerprint, the node type, and the trust level includes: when the confidence score is greater than a preset threshold, writing the fingerprint entry into the node fingerprint database.

[0023] Furthermore, the step of determining whether the node fingerprint is matched by the fingerprint seed based on the field matching results includes: when the number and degree of matching fields between the fingerprint seed and the node fingerprint meet the preset matching requirements, it is determined that the node fingerprint is matched by the fingerprint seed.

[0024] Further, the steps for obtaining the IP address list of the low-Earth orbit satellite network include: obtaining the IPv4 and IPv6 addresses related to the low-Earth orbit satellite network through official public data, open-source community intelligence, AS prefix mapping, and Whois registration information to obtain a candidate address set; obtaining the DNS records in public PDNS data that match the keywords of the low-Earth orbit satellite network; and performing validity verification on the candidate address set based on the matching DNS records to obtain the IP address list.

[0025] On the other hand, in order to achieve the above objectives, the present invention provides an identification device for ground-side nodes of a low-orbit satellite network.

[0026] The identification device for ground-side nodes of the low-Earth orbit satellite network includes: a first acquisition module for acquiring a list of IP addresses of the low-Earth orbit satellite network; a construction module for constructing fingerprint seeds for the ground-side nodes of the low-Earth orbit satellite network, wherein the fingerprint seeds include several fingerprint fields; a parsing module for performing RDNS reverse lookup on the IP addresses in the IP address list to obtain a PTR record corresponding to each IP address; an extraction module for extracting feature fields from the PTR records to construct a node fingerprint corresponding to the IP address; a second acquisition module for acquiring external multi-source information of the low-Earth orbit satellite network; a determination module for determining the node type and trust level corresponding to the node fingerprint based on the fingerprint seeds and the external multi-source information; a generation module for generating a node fingerprint database based on the node fingerprint, the node type, and the trust level; and an identification module for identifying whether a target IP address is a ground-side node of the low-Earth orbit satellite network based on the node fingerprint database.

[0027] On the other hand, to achieve the above objectives, the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above method.

[0028] On the other hand, to achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above method.

[0029] The present invention provides a method, apparatus, device, and medium for identifying ground-side nodes of a low-Earth orbit (LEO) satellite network. First, a list of IP addresses of the target LEO satellite network is obtained. Then, a node fingerprint seed containing multiple fingerprint fields is constructed. Next, RDNS reverse lookup is performed on each IP address in the list to obtain the corresponding PTR record. Feature fields are extracted from the PTR record to generate the node fingerprint for that IP address. Then, external multi-source information related to the LEO satellite network is further obtained, and the node fingerprint is compared with the fingerprint seed and the external multi-source information to determine the type and trustworthiness of the node corresponding to the fingerprint. A node fingerprint database is generated based on the node fingerprint, node type, and trustworthiness. Finally, by querying this fingerprint database, it can be determined whether any IP address to be tested belongs to a ground-side node of the LEO satellite network. This invention enables automated identification of ground-side nodes in low-Earth orbit satellite networks at the IP-level granularity. By combining publicly available RDNS records with multi-source external information, this method ensures the accuracy of node type determination and provides a quantitative basis for node trustworthiness, thereby constructing a continuously updated node fingerprint database. This fingerprint database can be used to quickly and in batches identify key ground-side nodes in the network, improving the completeness and timeliness of node identification. Attached Figure Description

[0030] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a schematic diagram of the Starlink network structure in the existing technology; Figure 2 A flowchart of a method for identifying ground-side nodes in a low-Earth orbit satellite network provided in Embodiment 1 of the present invention; Figure 3 This is a block diagram of the identification device for ground-side nodes of a low-orbit satellite network provided in Embodiment 2 of the present invention; Figure 4 This is a hardware structure diagram of a computer device provided in Embodiment 3 of the present invention. Detailed Implementation

[0031] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0032] Example 1 This invention provides a method for identifying ground-side nodes in a low-Earth orbit satellite network. This method constructs a node fingerprint database to quickly and in batches identify key ground-side nodes in the network, improving the completeness and timeliness of node identification. Specifically, Figure 1 This is a flowchart of the method for identifying ground-side nodes in a low-Earth orbit satellite network provided in Embodiment 1 of the present invention, as follows: Figure 1 As shown, the method for identifying ground-side nodes of a low-orbit satellite network provided in this embodiment includes the following steps S101 to S108.

[0033] Step S101: Obtain a list of IP addresses for the low-Earth orbit satellite network.

[0034] The IP address list is a collection of addresses from low-Earth orbit (LEO) satellite networks that has been filtered and collected. Optionally, when obtaining the IP address list of LEO satellite networks, relevant IPv4 and IPv6 addresses of LEO satellite networks are widely collected from multiple sources of intelligence, including official releases, open-source communities, Autonomous System (AS) information (such as websites like IPIP, bgp.tools, and HurricaneElectric), and Whois information. This list is then combined with relevant log records of LEO satellite networks from PDNS data to construct the IP address list. Further, optionally, hierarchical management and pre-screening can be performed based on the reliability of its sources. This IP address list is set to be updated periodically to ensure its timeliness.

[0035] Optionally, taking Starlink Network as an example, when obtaining the IP address list, the official Starlink API, open source list, AS14593 / 36492 prefix table, and Whois matching of "SpaceX" registration entries are used to summarize candidate IP addresses. Then, the public PDNS is called to query the resolution record of the keyword "starlink" to verify, deduplicate, and supplement the candidate set, forming the final IP address list.

[0036] Step S102: Construct fingerprint seeds for ground-side nodes of the low-Earth orbit satellite network.

[0037] The fingerprint seed comprises several fingerprint fields and is a node template for ground-side nodes in a low-Earth orbit satellite network constructed from prior knowledge. Optionally, taking the Starlink network as an example, a set of representative fingerprint seeds for important ground nodes is initially screened and constructed based on limited information publicly available from the SpaceX official website or other trusted sources. These seeds include naming features, address features, service features, etc., and are used as the basic template for subsequent identification. Further optionally, the fingerprint fields specifically include the semantic field role_token, the structural field template_id, and the address field asn_whitelist. Further optionally, taking the Starlink network as an example, fingerprint seeds are created for three types of nodes: POPSeed, GWSeed, and IXPSeed, and field templates, their respective ASN whitelists, and initial confidence levels are set for each type.

[0038] Step S103: Perform RDNS reverse lookup on the IP addresses in the IP address list to obtain the PTR record corresponding to each IP address.

[0039] RDNS, or Reverse Domain Name System, is used to resolve IP addresses into domain names; it's the reverse process of DNS resolution. In this step, RDNS reverse lookup is performed on each IP address in the IP address list. The returned data is recorded as a PTR record. A PTR record includes the information needed to reverse-map an IP address to a fully qualified domain name (FQDN), including: Ownername (the reversed domain appended to the IP address, ending with .in-addr.arpa. for IPv4 and .ip6.arpa. for IPv6); TTL (Time to Live), indicating the record's lifespan; Class (usually IN, i.e., Internet Class); Type (always PTR); and RDATA, including the FQDN associated with that IP, such as fra-deu-pop01.starlink.com.

[0040] Step S104: Extract the feature fields from the PTR record to construct the node fingerprint corresponding to the IP address.

[0041] Optionally, in this step, FQDNs are split using regular expressions to extract semantic information, structural rules, and association attributes from PTR records. Based on the extracted information, a unique fingerprint for each different PTR record is constructed to obtain the node fingerprint corresponding to the IP address.

[0042] Step S105: Obtain external multi-source information of the low-Earth orbit satellite network.

[0043] Optionally, external information may include data from multiple sources such as official data from low-Earth orbit satellite networks, open-source community intelligence, Whois information, BGP / ASN attribution, and IP geodatabases.

[0044] Step S106: Determine the node type and trust level corresponding to the node fingerprint based on the fingerprint seed and external multi-source information.

[0045] Optionally, by combining the fingerprint seed constructed in step S102 above with external multi-source information, cross-validation is performed on the node fingerprints, different node types are functionally classified, and trusted verification is conducted to determine the fingerprint type and reliability of the node fingerprints. Taking the Starlink network as an example, this enables the classification and construction of fingerprints for multiple types of nodes, such as PoP points, ground stations, and IXPs.

[0046] Step S107: Generate a node fingerprint database based on node fingerprints, node types, and trust levels.

[0047] Optionally, fingerprint entries in the node fingerprint database can be generated using node fingerprints and node types. When the trust level is high enough to meet the requirements, these entries can be directly used as samples to identify whether other IP addresses are ground-side nodes of the low-Earth orbit satellite network. When the trust level is low enough to not meet the requirements, the node type can be marked as pending and queued for incremental review.

[0048] Step S108: Identify whether the target IP address is a ground-side node of the low-Earth orbit satellite network based on the node fingerprint database.

[0049] Specifically, when an external system submits an IP address to be identified, it queries the node fingerprint database. If a fingerprint entry with high confidence exists and the node type is definite, it is determined to be a ground-side node of the low-Earth orbit (LEO) satellite network, and the corresponding node type is returned. Optionally, based on the constructed node fingerprint database, a global scanning of IPv4 addresses by / 24 network segment is performed for node fingerprint matching. Simultaneously, IPv6 addresses in some autonomous systems related to the LEO satellite network are sampled for identification, achieving coordinated coverage of IPv4 and IPv6. This comprehensively discovers important ground-side nodes of the LEO satellite network. Furthermore, based on the identification results, the geographic affiliation information of the nodes is automatically extracted, generating corresponding tags and functional attributes to construct a complete node identity profile. In addition, a dynamic monitoring mechanism is established to support continuous updates to the node fingerprint database and periodic evolution tracking of node information.

[0050] In the method for identifying ground-side nodes of a low-Earth orbit (LEO) satellite network provided in this embodiment, a list of IP addresses of the target LEO satellite network is first obtained. Then, a node fingerprint seed containing multiple fingerprint fields is constructed. Next, RDNS reverse lookup is performed on each IP address in the list to obtain the corresponding PTR record. Feature fields are extracted from the PTR record to generate a node fingerprint for that IP address. Then, external multi-source information related to the LEO satellite network is further obtained, and the node fingerprint is compared with the fingerprint seed and the external multi-source information to determine the type and trustworthiness of the node corresponding to the fingerprint. A node fingerprint database is generated based on the node fingerprint, node type, and trustworthiness. Finally, by querying this fingerprint database, it can be determined whether any IP address to be tested belongs to a ground-side node of the LEO satellite network. The method for identifying ground-side nodes in low-Earth orbit satellite networks provided in this embodiment achieves automated identification of ground-side nodes in low-Earth orbit satellite networks at the IP-level granularity. This method combines publicly available RDNS records with multi-source external information, ensuring the accuracy of node type determination and providing a quantitative basis for node trustworthiness, thereby constructing a continuously updated node fingerprint database. Using this fingerprint database, key ground-side nodes in the network can be identified quickly and in batches, improving the completeness and timeliness of node identification.

[0051] Optionally, in one embodiment, the fingerprint field includes a semantic field, a structural field, and an address field; the step of extracting feature fields from the PTR record includes: extracting semantic information, naming structure, and associated IP segment information from the PTR record, respectively, as feature fields.

[0052] Specifically, semantic fields are text fragments parsed from the FQDN of the PTR record that directly reflect the meaning of the node, such as: city_code="fra", country_iso="deu", role_token="pop"; structural fields are used to describe the structured information of the FQDN naming pattern and delimiter rules, such as: template=" <city> - <iso> - <role> <num>",delimiter="-",token_count=4; The address field is the network address attribute derived from the IP corresponding to the PTR, for example: ip_prefix="185.230.168.0 / 22",ip_version="IPv4".

[0053] The PTR records obtained in step S103 are analyzed one by one, and feature fields from the FQDN semantic fragments, naming structures (such as area codes, PoP numbers, and function identifiers), and associated IP segment information are extracted to form an original feature set including multiple feature fields. Specifically, several feature fields can be extracted from the semantic fragments, naming structures, and associated IP segment information. For example, the semantic fragments are segmented word by word (token), and the strings that express meaning are retained as feature fields; the hostname hierarchy, separators, and field positions are recorded from the naming structure as feature fields; and the associated IP segment information is mapped to its prefix / ASN as an address attribution feature, forming a feature field.

[0054] For example, the input PTR record is 185.230.168.12↦fra-deu-pop01.starlink.com; separating the FQDN by "-", we get fra,deu,pop01, which is then parsed to obtain city_code="fra",country_iso="deu",role_token="pop",serial_no="01"; the record separator "-" and the total number of tokens (4) are used to summarize the template based on the sequence pattern. <city> - <iso> - <role> <num>and write; with IP 185.230.168.12 as a seed, calculate the network segment 185.230.168.0 / 22 according to the given mask / 22, mark ip_version="IPv4" and store, and finally, aggregate the semantic field, the structure field and the address field according to categories, that is, complete the construction of the three types of fingerprint fields.

[0055] In the low-orbit satellite network ground-side node identification method provided in this embodiment, for the fingerprint seed, the fingerprint field includes the semantic field, the structure field and the address field, and accordingly, for the node fingerprint, the semantic information, the naming structure and the associated IP segment information are extracted from each PTR record in sequence, which ensures the mutual correspondence of the node fingerprint and the fingerprint seed field categories, so that when the node type and the trust degree corresponding to the node fingerprint are determined according to the fingerprint seed and the external multi-source information, semantic matching can be performed through the semantic field, template comparison can be performed through the structure field, and route verification can be performed through the address field, which provides a fine-grained feature basis for subsequent node type determination and trust degree calculation, thereby improving the accuracy of node identification and the efficiency of automatic processing.

[0056] Optionally, in an embodiment, the step of determining the node type and the trust degree corresponding to the node fingerprint according to the fingerprint seed and the external multi-source information includes: performing a field-level matching operation on the fingerprint seed and the node fingerprint; determining whether the node fingerprint is hit by the fingerprint seed according to the field matching result, wherein when the node fingerprint is hit by the fingerprint seed, the node type of the fingerprint seed is the node type corresponding to the node fingerprint; constructing a fingerprint entry by using the PTR record, the node fingerprint, the field matching result, the hit result and the node type corresponding to the node fingerprint; verifying the fingerprint entry by using the external information and generating a verification result; and calculating the confidence score of the fingerprint entry according to the field matching result, the hit result and the verification result to obtain the trust degree corresponding to the node fingerprint.

[0057] Specifically, the fingerprint seed includes three fingerprint fields: semantic, structural, and address fields. The node fingerprint includes feature fields extracted from the semantic information, naming structure, and associated IP segment information of the PTR record. The fingerprint seed and the node fingerprint are compared field by field using Boolean or regular expressions, with each field outputting a matching result. For example, if two fields match, `match=1` is output; otherwise, `match=0` is output. If the field matching result meets a preset hit condition, such as all fields matching or other fields matching in addition to the main field matching, then the node fingerprint is considered to have been matched by the fingerprint seed, and the node type in the fingerprint seed is directly inherited as the node type of the node fingerprint. Then, the PTR record, node fingerprint, field matching result, hit result, and the node type corresponding to the node fingerprint are encapsulated as a fingerprint entry. External information such as public PDNS, BGP snapshots, RDAP / Whois, GeoIP, TLSBanner, and OSINT tags are used to verify fingerprint entries. This verifies whether the information content of the fingerprint entry is supported by external information, such as PTR-IP consistency, field consistency, and functional tag consistency. It determines which external information supports the fingerprint or conflicts with it, generating verification results. Finally, a weighted sum is calculated based on the field matching results, hit results, and verification results to obtain a comprehensive confidence score, which represents the node's trustworthiness.

[0058] In the low-Earth orbit satellite network ground-side node identification method provided in this embodiment, a field-level matching operation is first performed on the node fingerprint and fingerprint seed to determine whether a match is found and directly identify the node type. Subsequently, the PTR, node fingerprint, and matching result are encapsulated into fingerprint entries. Independent external information is introduced to cross-validate the fingerprint entries, and a confidence score is calculated using a weighted formula to quantify the credibility of the node fingerprint. Using the matching-verification-scoring process provided in this embodiment, single-node type assignment and credibility calculation can be achieved quickly and accurately. External verification avoids misjudgment from a single data source, ensuring high accuracy and low false recognition rate in ground-side node identification in real network environments.

[0059] Optionally, in one embodiment, the PTR record of a fingerprint entry is a first record, and the IP address corresponding to the first record is a first address. Specifically, verifying fingerprint entries based on external information can include the following aspects. In this embodiment, taking any fingerprint entry as an example, its PTR record is defined as the first record, and the corresponding IP address is defined as the first address.

[0060] Firstly, the external information includes public PDNS data. The steps of using external information to verify fingerprint entries and generate verification results include: obtaining the resolution records within a preset time period from the public PDNS data, extracting the FQDN and the first address from the first record of the fingerprint entry, and calculating the proportion of the FQDN being resolved to the first address in the resolution records within the preset time period.

[0061] Public PDNS data, as external information, can be obtained through a self-built passive collection system or by calling existing public PDNS services (such as FarsightDNSDB, SecurityTrailsAPI, SpamhauspDNS, etc.). PDNS data may include domain names, DNS records (A / AAAA / CNAME, etc.), first-view timestamps, and most recently seen timestamps. When using public PDNS data to verify fingerprint entries, DNS records within a certain time period are retrieved from the public PDNS data. Records with FQDNs in the first set of records are identified, and the proportion of FQDNs resolved to the first address is calculated. For example, if the total number of FQDN resolution records is N within a preset time period, and the number of records whose resolution result corresponds to the first address is n, then the proportion of records resolved to the first address is n / N. Furthermore, the verification result can be set based on the proportion of records resolved to the first address. For example, if the proportion is ≥0.7, the ptr_consistency field in the verification result is set to Pass; 0.4 ≤ proportion <0.7 is set to Weak; and proportion <0.4 is set to Fail.

[0062] The public PDNS data verification scheme adopted in this embodiment provides a source-independent and quantifiable resolution consistency indicator for each fingerprint entry by statistically analyzing the proportion of target FQDNs resolved to their corresponding IP addresses within a preset time period. A high proportion objectively proves the stability and reliability of the IP↔FQDN binding relationship, while a low proportion promptly exposes resolution drift or forgery risks. Therefore, it significantly improves the accuracy and confidence of ground-side node identification, and avoids misjudgments caused by short-term polling resolution or malicious hijacking, laying a reliable data foundation for subsequent confidence score calculation and node fingerprint database maintenance.

[0063] Secondly, external information includes BGP route monitoring data. The steps of using external information to verify fingerprint entries and generate verification results include: obtaining the ASN_bgp currently advertised by the first address and its prefix Prefix_bgp from the BGP route monitoring data; extracting the ASN field and ip_prefix field from the fingerprint entry; verifying whether ASN_bgp is in the preset whitelist; verifying whether ASN_bgp is consistent with the ASN field; and verifying whether Prefix_bgp is consistent with the ip_prefix field.

[0064] BGP route monitoring data, as external information, can be retrieved via RouteViews or RIPERISAPI using IP_addr as the key to find the most recent update, returning ASN_bgp and Prefix_bgp. ASN_bgp is the Autonomous System Number (ASN) of the currently advertised IP_addr, obtained in real-time from the BGP route monitoring platform. Prefix_bgp is the prefix returned along with ASN_bgp. When using BGP route monitoring data to verify fingerprint entries, ASN_bgp and Prefix_bgp are retrieved from the BGP route monitoring data. The ASN and ip_prefix fields are extracted from the fingerprint entry. First, it is verified whether ASN_bgp is in the preset whitelist. If it is, it indicates that the current route belongs to a trusted operational domain. Further verification is made to ensure that ASN_bgp and the ASN field are consistent, and to check if the ASN saved in the fingerprint entry is outdated. Finally, it is verified that Prefix_bgp and the ip_prefix field are consistent, and that Prefix_bgp and ip_prefix_fp are identical or have an inclusion relationship. Output the verification results for whitelist matching, ASN consistency, and prefix consistency respectively.

[0065] This BGP consistency verification scheme can detect anomalies such as route ownership changes or prefix drift in real time. When all three verifications pass, the confidence of the node fingerprint can be significantly improved. If inconsistencies occur, the confidence score will be reduced or a review will be triggered in a timely manner. Thus, without relying on private network probes, highly reliable and low-latency automatic verification of the address field of ground-side nodes is achieved.

[0066] Thirdly, external information includes GeoIP data. The steps of using external information to verify fingerprint entries and generate verification results include: using GeoIP data to parse the country code and city coordinates corresponding to the first address; extracting the country_iso and city_code fields from the fingerprint entry; verifying whether the country code corresponding to the first address is consistent with the country_iso field; and verifying whether the distance between the city coordinates and the city center point represented by the city_code field is less than a preset distance.

[0067] GeoIP data, as external information, originates from public or commercial geographic databases (such as MaxMindGeoLite2 and IP2Location) that map IP addresses to country codes, city names, and their central coordinates. The GeoIP API can be used with IP_addr as the key to parse and obtain `country_geo` (country code) and `(lat_geo, lon_geo)` (city coordinates). When using GeoIP data to verify fingerprint entries, the GeoIP data is used to check if the `country_geo` corresponding to the first address matches the `country_iso` field in the fingerprint entry. The benchmark database is then queried to obtain the central coordinates (lat_city, lon_city) corresponding to the `city_code`. The distance between these two coordinates (lat_city, lon_city) and (lat_geo, lon_geo) is calculated and checked against a preset distance. Using the country code consistency verification results and the example judgment results, a geographic verification result is generated.

[0068] The geolocation verification scheme in this embodiment can add independent geospatial evidence to node fingerprints by utilizing publicly available GeoIP resources without relying on dedicated probes. When both levels of matching pass, the fingerprint confidence level can be significantly improved; if a mismatch occurs in country or city, the confidence score is promptly reduced or marked as pending, effectively avoiding geographical misjudgments caused by IP drift, proxy, or data expiration, and further improving the accuracy and reliability of ground-side node identification.

[0069] Optionally, in one embodiment, the step of generating a node fingerprint database based on node fingerprints, node type, and trust level includes: writing fingerprint entries into the node fingerprint database when the confidence score is greater than a preset threshold.

[0070] In this embodiment, for each fingerprint entry, the confidence score obtained after comprehensive field matching and external verification is compared with the set minimum confidence score threshold. For fingerprint entries with qualified confidence scores, the database interface insert(entry) is called to write them into the node fingerprint database, thereby ensuring that the data in the database are all high-confidence nodes. For fingerprint entries with unqualified confidence scores, they are marked as pending and stored in a temporary queue for further judgment, avoiding noise or misjudgment from affecting the subsequent recognition accuracy, and significantly improving the effectiveness and maintainability of the ground-side node database.

[0071] Optionally, in one embodiment, the step of determining whether a node fingerprint is matched by a fingerprint seed based on the field matching result includes: when the number and degree of matching fields between the fingerprint seed and the node fingerprint meet a preset matching requirement, it is determined that the node fingerprint is matched by the fingerprint seed.

[0072] In this embodiment, when determining whether a node fingerprint is matched by a fingerprint seed, the fingerprint seed and the node fingerprint are compared field by field, the number of matching fields is counted to obtain the number of matching fields, the similarity score is calculated for some fuzzy fields, the matching degree is set, and finally, the node fingerprint is determined to be matched by the fingerprint seed by judging whether the number and degree of matching fields meet the hit requirements.

[0073] The hit determination method in this embodiment can achieve rapid and quantitative discrimination of the consistency between node fingerprints and fingerprint seeds through dual constraints of quantity threshold and similarity threshold. This effectively reduces false matching caused by missing or partially ambiguous fields, ensures the reliability of the hit results, and lays an accurate foundation for subsequent node type assignment.

[0074] Optionally, in one embodiment, the step of obtaining the IP address list of a low-Earth orbit satellite network includes: obtaining IPv4 and IPv6 addresses related to the low-Earth orbit satellite network through official public data, open-source community intelligence, AS prefix mapping, and Whois registration information to obtain a candidate address set; obtaining DNS records in public PDNS data that match keywords of the low-Earth orbit satellite network; and performing validity verification on the candidate address set based on the matching DNS records to obtain the IP address list.

[0075] In this embodiment, official announcements, open-source community intelligence, ASN prefix mappings, and Whois registration information are parsed to collect all IPv4 and IPv6 related to low-Earth orbit satellite networks. An IPv4 / IPv6 list is compiled to form a candidate address set. Resolution records containing keywords such as low-Earth orbit satellite network brand identifiers are retrieved from the public PDNS database to obtain the IP set PDNS_IPs. Finally, the intersection of the candidate address set and the set PDNS_IPs can be used as the IP address list, or the IP address list can be further filtered by the number of times the IP addresses in the candidate address set appear in the set PDNS_IPs.

[0076] The address list construction method adopted in this embodiment first obtains candidate addresses with the largest coverage using multi-source information from official sources and the community, and then performs cross-validation through public PDNS resolution records, retaining only IPs that appear in the actual resolution history. This combined strategy not only ensures the comprehensiveness of address collection, but also filters irrelevant or outdated entries through PDNS, significantly improving the accuracy and comprehensiveness of the IP list of low-Earth orbit satellite networks.

[0077] Example 2 Corresponding to Embodiment 1 above, Embodiment 2 of the present invention provides an identification device for ground-side nodes of a low-orbit satellite network. The technical features and corresponding technical effects can be referred to Embodiment 1 above, and will not be repeated in this embodiment. Figure 3 This is a block diagram of the identification device for ground-side nodes of a low-Earth orbit satellite network provided in Embodiment 2 of the present invention, as shown below. Figure 3 As shown, the device includes: a first acquisition module 201, a construction module 202, a parsing module 203, an extraction module 204, a second acquisition module 205, a determination module 206, a generation module 207, and an identification module 208.

[0078] The first acquisition module 201 is used to acquire a list of IP addresses of the low-Earth orbit satellite network; the construction module 202 is used to construct fingerprint seeds for the ground-side nodes of the low-Earth orbit satellite network, wherein the fingerprint seeds include several fingerprint fields; the parsing module 203 is used to perform RDNS reverse resolution on the IP addresses in the IP address list to obtain the PTR record corresponding to each IP address; the extraction module 204 is used to extract feature fields from the PTR records to construct the node fingerprint corresponding to the IP address; the second acquisition module 205 is used to acquire external multi-source information of the low-Earth orbit satellite network; the determination module 206 is used to determine the node type and trust level corresponding to the node fingerprint based on the fingerprint seeds and the external multi-source information; the generation module 207 is used to generate a node fingerprint database based on the node fingerprint, the node type and the trust level; and the identification module 208 is used to identify whether the target IP address is a ground-side node of the low-Earth orbit satellite network based on the node fingerprint database.

[0079] Optionally, in one embodiment, the fingerprint field includes a semantic field, a structural field, and an address field; the extraction module is used to extract the semantic information, naming structure, and associated IP segment information from the PTR record, which are respectively used as feature fields.

[0080] Optionally, in one embodiment, the determining module includes: a matching unit, configured to perform field-level matching operations on the fingerprint seed and the node fingerprint; a determining unit, configured to determine whether the node fingerprint is matched by the fingerprint seed based on the field matching result, wherein when the node fingerprint is matched by the fingerprint seed, the node type of the fingerprint seed is the node type corresponding to the node fingerprint; a constructing unit, configured to construct a fingerprint entry using the PTR record, the node fingerprint, the field matching result, the match result, and the node type corresponding to the node fingerprint; a first verification unit, configured to verify the fingerprint entry using the external information and generate a verification result; and a calculation unit, configured to calculate the confidence score of the fingerprint entry based on the field matching result, the match result, and the verification result, to obtain the credibility level corresponding to the node fingerprint.

[0081] Optionally, in one embodiment, the PTR record of the fingerprint entry is a first record, and the IP address corresponding to the first record is a first address; the external information includes public PDNS data, and the steps performed by the first verification unit when verifying the fingerprint entry using the external information include: obtaining the resolution records within a preset time period from the public PDNS data, extracting the FQDN and the first address from the first record of the fingerprint entry, and calculating the proportion of the FQDN being resolved to the first address in the resolution records within the preset time period. The external information includes BGP route monitoring data, and the steps performed by the first verification unit when verifying the fingerprint entry using the external information include: obtaining the ASN_bgp currently advertised by the first address and its prefix Prefix_bgp from the BGP route monitoring data; extracting the ASN field and ip_prefix field from the fingerprint entry, verifying whether the ASN_bgp is in a preset whitelist, verifying whether the ASN_bgp is consistent with the ASN field, and verifying whether the Prefix_bgp is consistent with the ip_prefix field. The external information includes GeoIP data. When the first verification unit verifies the fingerprint entry using the external information, the steps performed include: parsing the country code and city coordinates corresponding to the first address using the GeoIP data; extracting the country_iso field and city_code field from the fingerprint entry; verifying whether the country code corresponding to the first address is consistent with the country_iso field; and verifying whether the distance between the city coordinates and the city center point represented by the city_code field is less than a preset distance.

[0082] Optionally, in one embodiment, the generation module is used to write the fingerprint entry into the node fingerprint database when the confidence score is greater than a preset threshold.

[0083] Optionally, in one embodiment, the determination unit root is used to determine that the node fingerprint is hit by the fingerprint seed when the number and degree of matching fields between the fingerprint seed and the node fingerprint meet a preset hit requirement.

[0084] Optionally, in one embodiment, the first acquisition module includes: a first acquisition unit, configured to acquire IPv4 addresses and IPv6 addresses related to the low-Earth orbit satellite network through official public data, open-source community intelligence, AS prefix mapping, and Whois registration information of the low-Earth orbit satellite network, to obtain a candidate address set; a second acquisition unit, configured to acquire DNS records in public PDNS data that match the keywords of the low-Earth orbit satellite network; and a second verification unit, configured to perform validity verification on the candidate address set based on the matching DNS records, to obtain the IP address list.

[0085] Example 3 This embodiment also provides a computer device, such as a smartphone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server, or cabinet server (including a standalone server or a server cluster composed of multiple servers), etc., capable of executing programs. Figure 4 As shown, the computer device 01 in this embodiment includes, but is not limited to, a memory 012 and a processor 011 that can be interconnected via a system bus, such as... Figure 4 As shown. It should be noted that, Figure 4 Only a computer device 01 with component memory 012 and processor 011 is shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0086] In this embodiment, the memory 012 (i.e., the readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 012 may be an internal storage unit of the computer device 01, such as the hard disk or memory of the computer device 01. In other embodiments, the memory 012 may also be an external storage device of the computer device 01, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the computer device 01. Of course, the memory 012 may include both the internal storage unit and the external storage device of the computer device 01. In this embodiment, the memory 012 is typically used to store the operating system and various reference software installed on the computer device 01, such as the program code of the identification device for the ground-side node of the low-Earth orbit satellite network in Embodiment 2. In addition, memory 012 can also be used to temporarily store various types of data that have been output or will be output.

[0087] In some embodiments, processor 011 may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. Processor 011 is typically used to control the overall operation of computer device 01. In this embodiment, processor 011 is used to run program code stored in memory 012 or process data, such as a method for identifying ground-side nodes in a low-Earth orbit satellite network.

[0088] Example 4 This embodiment also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, app reference store, etc., which stores a computer program. When the program is executed by a processor, it implements the corresponding function. The computer-readable storage medium of this embodiment is used to store an identification device for ground-side nodes of a low-Earth orbit satellite network. When executed by a processor, it implements the identification method for ground-side nodes of a low-Earth orbit satellite network as described in Embodiment 1.

[0089] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0090] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0091] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0092] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.< / num> < / role> < / iso> < / city> < / num> < / role> < / iso> < / city>

Claims

1. A method for identifying ground-side nodes in a low-Earth orbit satellite network, characterized in that, include: Obtain a list of IP addresses for low-Earth orbit satellite networks; Construct a fingerprint seed for the ground-side nodes of the low-Earth orbit satellite network, wherein the fingerprint seed includes several fingerprint fields; Perform RDNS reverse lookup on the IP addresses in the IP address list to obtain the PTR record corresponding to each IP address; Extract the feature fields from the PTR record to construct the node fingerprint corresponding to the IP address; Obtain external multi-source information of the low-Earth orbit satellite network; The node type and trust level corresponding to the node fingerprint are determined based on the fingerprint seed and the external multi-source information. A node fingerprint database is generated based on the node fingerprint, the node type, and the level of trust; and Based on the node fingerprint database, it can be identified whether the target IP address is a ground-side node of a low-Earth orbit satellite network.

2. The method for identifying ground-side nodes in a low-Earth orbit satellite network according to claim 1, The fingerprint field includes a semantic field, a structural field, and an address field; The steps for extracting feature fields from the PTR record include: The semantic information, naming structure, and associated IP segment information of the PTR record are extracted and used as feature fields.

3. The method for identifying ground-side nodes in a low-Earth orbit satellite network according to claim 2, characterized in that, The steps for determining the node type and trust level corresponding to the node fingerprint based on the fingerprint seed and the external multi-source information include: Perform field-level matching operations on the fingerprint seed and the node fingerprint; The node fingerprint is determined to be matched with the fingerprint seed based on the field matching result. When the node fingerprint is matched with the fingerprint seed, the node type of the fingerprint seed is the node type corresponding to the node fingerprint. A fingerprint entry is constructed using the PTR record, the node fingerprint, the field matching result, the hit result, and the node type corresponding to the node fingerprint. The fingerprint entry is verified using the external information, and a verification result is generated. The confidence score of the fingerprint entry is calculated based on the field matching result, the hit result, and the verification result to obtain the credibility level corresponding to the node fingerprint.

4. The method for identifying ground-side nodes in a low-Earth orbit satellite network according to claim 3, The PTR record of the fingerprint entry is the first record, and the IP address corresponding to the first record is the first address; The external information includes public PDNS data. The steps of using the external information to verify the fingerprint entry and generate a verification result include: Obtain the resolution records within a preset time period from the public PDNS data, extract the FQDN and the first address from the first record of the fingerprint entry, and count the proportion of the FQDN being resolved to the first address in the resolution records within the preset time period; The external information includes BGP route monitoring data. The steps of using the external information to verify the fingerprint entry and generate a verification result include: obtaining the ASN_bgp and its prefix Prefix_bgp currently advertised by the first address from the BGP route monitoring data; extracting the ASN field and ip_prefix field from the fingerprint entry; verifying whether the ASN_bgp is in a preset whitelist; verifying whether the ASN_bgp is consistent with the ASN field; and verifying whether the Prefix_bgp is consistent with the ip_prefix field. The external information includes GeoIP data. The steps of using the external information to verify the fingerprint entry and generate a verification result include: parsing the country code and city coordinates corresponding to the first address using the GeoIP data; extracting the country_iso and city_code fields from the fingerprint entry; verifying whether the country code corresponding to the first address is consistent with the country_iso field; and verifying whether the distance between the city coordinates and the city center point represented by the city_code field is less than a preset distance.

5. The method for identifying ground-side nodes in a low-Earth orbit satellite network according to claim 3, characterized in that, The step of generating a node fingerprint database based on the node fingerprint, the node type, and the confidence level includes: when the confidence score is greater than a preset threshold, writing the fingerprint entry into the node fingerprint database.

6. The method for identifying ground-side nodes in a low-Earth orbit satellite network according to claim 3, wherein the step of determining whether the node fingerprint is matched by the fingerprint seed based on the field matching result includes: When the number and degree of matching fields between the fingerprint seed and the node fingerprint meet the preset hit requirements, it is determined that the node fingerprint is hit by the fingerprint seed.

7. The method for identifying ground-side nodes in a low-Earth orbit satellite network according to claim 1, characterized in that, The steps to obtain a list of IP addresses for a low-Earth orbit satellite network include: By using the official public data, open source community intelligence, AS number prefix mapping, and Whois registration information of the low-Earth orbit satellite network, the IPv4 and IPv6 addresses related to the low-Earth orbit satellite network are obtained, and a candidate address set is obtained. Obtain the DNS records in the public PDNS data that match the keywords of the low-Earth orbit satellite network; The candidate address set is validated based on the matching DNS records to obtain the IP address list.

8. A device for identifying ground-side nodes in a low-Earth orbit satellite network, characterized in that, include: The first acquisition module is used to acquire a list of IP addresses of low-Earth orbit satellite networks; A construction module is used to construct the fingerprint seed of the ground-side node of the low-orbit satellite network, wherein the fingerprint seed includes several fingerprint fields; The resolution module is used to perform RDNS reverse resolution on the IP addresses in the IP address list to obtain the PTR record corresponding to each IP address; An extraction module is used to extract feature fields from the PTR record in order to construct the node fingerprint corresponding to the IP address; The second acquisition module is used to acquire external multi-source information of the low-orbit satellite network; The determination module is used to determine the node type and trust level corresponding to the node fingerprint based on the fingerprint seed and the external multi-source information; A generation module is used to generate a node fingerprint database based on the node fingerprint, the node type, and the trust level; and The identification module is used to identify whether the target IP address is a ground-side node of a low-Earth orbit satellite network based on the node fingerprint database.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images