Method and system for secure interaction of ship communication data

Abstract

The present application belongs to the technical field of ship communication, and particularly relates to a ship communication data security interaction method and system, which comprises collecting real-time physical channel data and application layer data of a ship communication system, and synchronously pre-processing the data; constructing a dynamic channel stability index reflecting the quality of a communication environment; constructing a data flow logical dispersion reflecting the fluctuation characteristics of the data; based on the coupling relationship between the dynamic channel stability index and the data flow logical dispersion, calculating a security interaction anomaly index, and determining the interaction risk and executing a defense strategy when the anomaly index exceeds a preset threshold. The present application establishes a dynamic mapping relationship between the physical channel state and the data logical characteristics, solves the problem that the prior art cannot effectively identify logical layer hidden attacks and has a high false alarm rate in severe sea conditions, and significantly improves the security protection capability and robustness of the ship communication system in complex marine environments.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of ship communication. More particularly, the present application relates to a ship communication data security interaction method and system. BACKGROUND

[0002] With the development of intelligent ship technology, data interaction between ships and shores and between ships is increasingly frequent. Existing ship communication systems mainly rely on satellite communication, short wave or ultra-short wave, and fourth-generation mobile communication technology or fifth-generation mobile communication technology near-shore network construction, and their security protection mechanisms are usually limited to traditional identity authentication, data encryption, and integrity verification.

[0003] Currently, existing technologies have significant limitations in dealing with complex marine communication environments. On the one hand, it is difficult to defend against hidden attacks at the logic layer. If an attacker intercepts historical normal communication messages and replays them, or injects fake data that conforms to the protocol format using an illegally obtained key, such as forging a smooth heading data, the traditional encryption and verification mechanism cannot identify this logical anomaly because the content is compliant. On the other hand, existing mechanisms break the endogenous correlation between physical channel state and application layer data characteristics. Ship communication is deeply affected by sea conditions and weather interference, and follows specific physical laws: poor channel quality will inevitably cause data packet loss, delay jitter, or error retransmission. Existing security mechanisms operate independently of the physical layer and are difficult to perceive and identify abnormal coupling phenomena that violate physical transmission laws, such as smooth data in poor channels or discrete data in good channels.

[0004] In addition, given the ever-changing nature of the marine environment, in high dynamic sea conditions, if a fixed threshold is used, such as setting an alarm when data fluctuation exceeds a certain percentage, it is often difficult to adapt to actual changes, which may cause the alarm mechanism to malfunction. In severe sea conditions, normal physical signal fluctuations can easily trigger false alarms, thereby severely weakening the robustness and actual usability of the system. SUMMARY

[0005] To solve the technical problems of existing technologies that are difficult to defend against hidden attacks at the logic layer and have high false alarm rates due to neglecting the correlation between physical channels and data characteristics in severe sea conditions, the present application provides solutions in the following aspects.

[0006] In a first aspect, the present application provides a ship communication data security interaction method, comprising: establishing a time synchronization sampling window and synchronously collecting physical channel data and application layer data of a ship communication terminal, and carrying out denoising and normalization pretreatment on the collected data; calculating a dynamic channel stability index reflecting the current communication environment quality and stability according to the pretreated physical channel data, in combination with the motion posture information of the ship itself, the dynamic channel stability index being positively correlated with the mean value of the signal-to-noise ratio and negatively correlated with the variance of the signal-to-noise ratio; calculating the instantaneous jitter of the data by using first-order difference according to the pretreated application layer data, and constructing data flow logical dispersion reflecting the degree of data disorder based on the instantaneous jitter; calculating a security interaction anomaly index based on the coupling relationship between the dynamic channel stability index and the data flow logical dispersion, and if the security interaction anomaly index is greater than a preset security threshold, determining that there is a risk in data interaction and executing a defense strategy.

[0007] The present application realizes dynamic security protection of the environment perception type by constructing a dynamic mapping relationship between the physical channel stability and the application layer data dispersion in real time, and identifying potential data tampering or replay attacks by using the coupling deviation of the physical channel stability and the application layer data dispersion.

[0008] Preferably, the physical channel data at least includes real-time signal-to-noise ratio, and the motion posture information at least includes an environmental influence weighting factor; the calculation of the dynamic channel stability index reflecting the current communication environment quality and stability comprises: calculating the arithmetic mean value and the variance of the normalized signal-to-noise ratio data in the current time window; using the arithmetic mean value as part of the numerator, and using the product of the square root of the variance and the environmental influence weighting factor as part of the denominator, to calculate the dynamic channel stability index.

[0009] In this way, by introducing the channel stability index and the sea state influence factor, normal data degradation caused by bad sea conditions is intelligently identified, higher data dispersion is automatically tolerated when the sea conditions are bad, and normal signal fluctuations are avoided from being misjudged as attacks by the traditional fixed threshold method.

[0010] Preferably, the dynamic channel stability index satisfies the following relationship:

[0011]

[0012] In the formula, is the time, is the arithmetic mean value of the normalized signal-to-noise ratio data in the current time window, is the variance of the normalized signal-to-noise ratio data in the current time window, is a preset normal number bias term, is a preset non-zero normal number, As an environmental impact weighting factor, This represents the square root operation.

[0013] Preferably, the application layer data is a continuous numerical variable; the construction of the data flow logical dispersion reflecting the degree of data disorder includes: calculating the absolute value of the difference between adjacent data points within the sampling window as the instantaneous jitter, and calculating the sum of all instantaneous jitters within the window; based on the proportion of the instantaneous jitter of each data point in the sum, and combining the logarithmic function to calculate the entropy characteristics of the data, the data flow logical dispersion is obtained.

[0014] Thus, by using the principle of information entropy to assess the drasticness and disorder of data changes, the information entropy approaches 0 when the data changes extremely smoothly, and remains in a relatively stable range when the data exhibits random noise characteristics, thereby effectively distinguishing between normally fluctuating data and fabricated smooth data.

[0015] Preferably, the data stream logical discreteness The following relationship must be satisfied:

[0016]

[0017] In the formula, This represents the total number of data points within the sampling window. For the first The data point and the first The absolute value of the difference between the data points For all within the window The sum, For a pre-defined non-zero large constant, For a preset non-zero small constant, It is the natural logarithm function. This is the summation symbol.

[0018] Preferably, the calculation of the security interaction anomaly index includes: calculating the ratio of the data stream logical dispersion to the dynamic channel stability index at the current moment, as the channel-data coupling ratio at the current moment; obtaining the channel-data coupling ratio at the previous moment, and introducing a historical trend forgetting factor to smooth the impact of historical data; calculating the absolute value of the difference between the coupling ratio at the current moment and the previous moment, and multiplying the absolute value by the square root of the dynamic channel stability index at the current moment to obtain the security interaction anomaly index.

[0019] Thus, this invention achieves cross-layer security defense between the physical and logical layers. By introducing physical channel parameters as an environmental fingerprint for authentication, attackers can forge perfect data packet formats but cannot reproduce the physical channel jitter characteristics that perfectly match the current sea waves and weather in real time, thereby effectively identifying replay attacks and spoofing.

[0020] Preferably, the security interaction anomaly index satisfies the following relationship:

[0021]

[0022] wherein, and are the data flow logical discrete degrees at time and time respectively, and are the dynamic channel stability indexes at time and time respectively, is a historical trend forgetting factor, represents taking an absolute value, represents a square root operation, represents a dynamic channel stability index.

[0023] In this way, by quantifying the coupling deviation degree between the physical channel state and the application layer data characteristics in real time, the hidden attack that violates the physical transmission rule, such as injecting abnormal smooth false data under a poor channel, can be accurately identified, and the judgment threshold can be adaptively adjusted according to the channel quality, so that the high false alarm rate caused by the traditional fixed threshold method is significantly reduced when the sea condition is poor, and the environment-aware intelligent security defense is realized.

[0024] Preferably, the environment influence weighting factor is obtained by reading the tiltmeter data of the ship itself; when it is detected that the roll or pitch angle of the ship increases, the value of is increased.

[0025] Preferably, the defense strategy includes at least one of discarding the current data packet, sending an alarm to the control center, forcibly requiring the communication parties to rehandshake, or switching to a backup communication frequency band.

[0026] In a second aspect, the present application provides a ship communication data security interaction system, comprising a processor and a memory, wherein the memory stores computer program instructions, and when the computer program instructions are executed by the processor, the above-mentioned ship communication data security interaction method is realized.

[0027] By adopting the above technical solution, the above-mentioned ship communication data security interaction method is generated into a computer program and stored in the memory to be loaded and executed by the processor, so that a terminal device is manufactured according to the memory and the processor, and convenient use is achieved.

[0028] The present application has the following beneficial effects:

[0029] The application breaks the limitation of traditional communication security which only focuses on data content, and introduces physical channel parameters as verification environment fingerprints, so as to accurately intercept hidden attacks which conform to the protocol format but violate the physical law, thereby realizing cross-layer security defense of the physical layer and the logical layer.

[0030] Further, the scheme introduces an environmental impact weighting factor and a channel stability index, which can intelligently identify normal data degradation caused by bad sea conditions, automatically tolerate higher data dispersion when the sea conditions are bad, and avoid the traditional fixed threshold method from misjudging normal signal fluctuations as attacks, thereby significantly reducing the false alarm rate in complex marine environments. The scheme can also simultaneously use the information entropy principle to construct data stream logical dispersion, effectively distinguishing between normal fluctuation data with natural noise and fake smooth data, thereby ensuring high detection accuracy and improving the robustness and practicality of the system. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 is a flowchart schematically showing a ship communication data security interaction method in the application;

[0032] Figure 2 is a dynamic coupling monitoring diagram schematically showing channel and data characteristics in an embodiment of the application;

[0033] Figure 3 is a comparison diagram schematically showing security interaction risk judgment in bad sea conditions in an embodiment of the application. DETAILED DESCRIPTION

[0034] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, rather than all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the protection scope of the application.

[0035] The specific embodiments of the application will be described in detail below with reference to the drawings.

[0036] The embodiments of the application disclose a ship communication data security interaction method, referring to Figure 1 , including steps S1-S4:

[0037] S1, a time synchronization sampling window is established, and physical channel data and application layer data of a ship communication terminal are synchronously collected, and the collected data is denoised and normalized for pretreatment.

[0038] In an optional embodiment, a time synchronization sampling window is established when the data is received at the ship communication terminal, and the physical channel data and the application layer data are synchronously collected. The physical channel data is obtained by reading the underlying state registers of the satellite modem, VHF radio and other ship communication terminals, and can also be obtained in real time by means of the simple network management protocol or AT instruction set.

[0039] Specifically, the physical parameters of the communication link obtained in real time include real-time signal-to-noise ratio, bit error rate and received signal strength indication, and are denoted as sequence The application layer data is obtained by analyzing the received communication message load, extracting key continuous variables such as sensor values of ship speed, heading, main engine speed, exhaust temperature and time interval of message arrival, and denoted as sequence After obtaining the physical parameters of the communication link and the application layer data, the obtained data is denoised and normalized. In a specific embodiment, the invalid values generated by instantaneous power failure of the equipment in and are removed by using the Lyapunov criterion to complete the denoising of the obtained data.

[0040] In the embodiment of the application, normalization is to eliminate the influence of different dimensions on subsequent calculation. For example, the Min-Max normalization method is used to map all data to the interval [0, 1], and let be the original data, and be the historical statistical extreme values of the data of this type, be the normalized data, and the normalization calculation method is:

[0041]

[0042] If , then 1 is taken, and if , then 0 is taken.

[0043] In this way, through synchronous collection and preprocessing, noise interference and dimensional differences in the data can be eliminated, and high-quality, standardized data basis is provided for subsequent establishment of association analysis of physical channels and logical data.

[0044] S2, according to the preprocessed physical channel data, the dynamic channel stability index reflecting the current communication environment quality and stability is calculated in combination with the motion attitude information of the ship. The dynamic channel stability index is positively correlated with the mean value of the signal-to-noise ratio and negatively correlated with the variance of the signal-to-noise ratio.

[0045] In an optional embodiment, the fluctuation of the physical channel is an important benchmark for judging the authenticity of the data, and the signal-to-noise ratio is a core indicator reflecting the quality of the channel. The higher the mean value of the signal-to-noise ratio, the higher the strength of the signal. The smaller the variance of the signal-to-noise ratio, the more stable the signal. Therefore, a dynamic channel stability index is constructed based on the mean and variance of the signal-to-noise ratio data, denoted as , which is positively correlated with the mean of the signal-to-noise ratio and negatively correlated with the variance of the signal-to-noise ratio. The calculation method is as follows:

[0046]

[0047] wherein, is the time, is the arithmetic mean of the normalized signal-to-noise ratio data in the current time window, is the variance of the normalized signal-to-noise ratio data in the current time window, is a preset normal number bias, for example, the value is 1, which is used to prevent the numerator from being too small and ensure the reference value, is a preset non-zero normal number, for example, the value is 0.1, which is used to prevent the denominator from being zero to avoid calculation overflow, and at the same time, adjust the sensitivity to fluctuation.

[0048] It should be noted that, is an environmental impact weighting factor, which is obtained by reading the ship's own motion posture sensor such as a tilt meter. When the sea conditions are bad, the ship's roll or pitch angle is large, which is easy to cause communication fluctuation. At this time, is automatically increased, for example, from 1 to 1.5, to play a role in smoothing the denominator, preventing the stability index from being too low due to natural sea conditions and triggering false alarms.

[0049] For example, assume that the normalized signal-to-noise ratio mean in the current time window is 0.8 and the variance is 0.04, the preset is 1, is 0.1.

[0050] If the sea conditions are good, , then .

[0051] If the sea conditions are bad, becomes 1.5, then .

[0052] As can be seen, the environmental impact weighting factor can dynamically adjust the index, making it more able to reflect the true channel stability.

[0053] Thus, by introducing the environmental impact weighting factor and dynamic calculation mechanism, the stability of the physical channel can be accurately evaluated, and intelligent adaptation to sea state changes can be achieved to avoid misjudgment caused by natural environmental factors.

[0054] S3, according to the pre-processed application layer data, the first-order difference is used to calculate the instantaneous jitter of the data, and the data stream logical dispersion reflecting the degree of data disorder is constructed based on the instantaneous jitter.

[0055] In an optional embodiment, the real sensor data will show a natural discrete distribution during transmission due to the limitations of collection accuracy and transmission jitter, while the fake data tends to be too regular. Therefore, in this embodiment, the data stream logical dispersion is constructed to measure the degree of disorder of such changes. Specifically, the data stream logical dispersion uses the first-order difference to evaluate the degree of change of the data, and introduces a logarithmic term to measure the degree of disorder of such changes. The calculation method is as follows:

[0056]

[0057] In the formula, is the total number of data points in the sampling window, is the absolute value of the difference between the th data point and the th data point, that is, , represents the instantaneous jitter of the data, is the sum of all in the window, that is, , is a preset adjustment constant for preventing the denominator from approaching zero and controlling the normalization ratio, is a preset non-zero small constant, for example, 0.01, for preventing the denominator in the logarithmic function from being zero and ensuring the mathematical logic.

[0058] In the above calculation method of the data stream logical dispersion, by constructing the function form of , the mathematical properties of are used, so that when the first-order difference of one of the data points, that is, , approaches 0, the calculated logical dispersion will quickly converge to 0, at which time the data is considered to be smoothed, which is more sensitive than the conventional threshold determination.

[0059] If a non-zero adjustment constant is not introduced in the denominator of , then no matter how strong the signal jitter is, as long as the relative proportion of the signal jitter is the same, the calculated result will be consistent. Therefore, by introducing a preset adjustment constant ​So that the data flow logic discrete degree can distinguish the natural thermal noise at the micro scale and the numerical drift at the limit of calculation accuracy, so that the judgment of the system can maintain high accuracy.

[0060] In order to more clearly illustrate the calculation process and effect of data flow logic discrete degree, the following is illustrated by example:

[0061] Suppose there are 3 difference points in the window, , , set , .01, when ,

[0062]

[0063] Then calculate to , and add up to get , if the data is extremely smooth, all close to 0, the numerator is very small and the overall data flow logic discrete degree will also tend to 0.

[0064] In this way, by constructing the data flow logic discrete degree, the micro vibration characteristics and disorder degree of the data can be effectively quantified, so as to sensitively identify the artificially false data that is too smooth or regular.

[0065] S4, based on the coupling relationship between dynamic channel stability index and data flow logic discrete degree, calculate the security interaction anomaly index, if the security interaction anomaly index is greater than the preset security threshold, it is determined that the data interaction exists risk and executes the defense strategy.

[0066] In an optional embodiment, the obtained physical channel characteristics and data logic characteristics are coupled and analyzed. Under normal physical laws, the channel stability and the data discrete degree there is a certain anti-correlation or stable proportion relationship. If it is detected that is very low, but is extremely low, which violates the physical transmission law, with a high probability that the attacker has injected fake data locally.

[0067] Specifically, the calculation formula of the security interaction anomaly index is as follows:

[0068]

[0069] In the formula, is the interaction security risk value at time . is the channel and data coupling ratio at the current time. is the channel and data coupling ratio of the last time, the system will maintain a history state cache queue; is the history trend forgetting factor, its value range is , used to smooth the influence of historical data, pay attention to mutations, is the channel quality penalty term.

[0070] Specifically, the channel quality penalty term has the effect of adaptive weighting:

[0071] When the sea condition is good, the matching degree of system data to the channel at this time is very high, any slight logical anomaly is less affected by the environment, at this time plays a role of amplification, thereby acutely capturing attacks;

[0072] When the sea condition is bad, at this time the physical channel itself fluctuates violently, and data jitter is a normal phenomenon, so plays a role of inhibiting factor, thereby reducing the value of , which directly avoids the false high-risk warning caused by environmental noise in the prior art, and solves the technical problem of high false positive rate in bad sea conditions.

[0073] After the safe interaction anomaly index is calculated, by comparing the safe interaction anomaly index with the set safety threshold, if the safe interaction anomaly index is not greater than the set safety threshold, it is determined that the interaction is safe, and the data is normally released, if the safe interaction anomaly index is greater than the set safety threshold, it is determined that the interaction has risks, and the following defense strategies are executed: discarding the current data packet, sending an alarm to the control center, and forcibly requiring the communication parties to rehandshake or switch to a backup communication frequency band.

[0074] Referring to Figure 2 , Figure 2 shows the channel and data feature dynamic coupling monitoring effect, in the normal stage of 0 to 60 seconds, the channel stability index and the data stream logic dispersion present a coordinated corresponding relationship; at the first 30 seconds, the sea condition is stable, at this time the channel stability is high and the data dispersion is stable; in the bad sea condition of 30 to 60 seconds, the channel stability decreases and the data dispersion increases, the channel stability index and the data stream logic dispersion keep characteristic matching; in the attack stage of 60 to 80 seconds, the channel environment is still bad but the data stream logic dispersion is reduced due to the injection of false smooth data, the channel stability index curve and the data stream logic dispersion curve appear obvious characteristic decoupling, and are further recognized by the system.

[0075] Referring to Figure 3 , Figure 3The safety interaction risk judgment contrast in the bad sea state is shown, in the bad sea state stage of 30 seconds to 60 seconds, the prior art causes the risk value to soar and misfires the threshold value because of simply detecting data quality deterioration and belongs to the false alarm area, and the present scheme makes the risk value always keep below the safety line because of considering the normalization factor of channel quality;When the attack occurs in 60 seconds to 85 seconds, the risk value is extremely low and belongs to the missed alarm area because of the legal data packet format and smooth value, and the present scheme captures the mismatch between the channel and data, so that the risk value breaks through the threshold value instantaneously, and accurate interception is realized.

[0076] Therefore, by coupling the characteristics of the physical channel and the logical data, and introducing the channel quality as a penalty term, the abnormal interaction behavior contrary to the physical law can be accurately identified, the false alarm rate in the complex environment is significantly reduced, and the safety is ensured.

[0077] The embodiment of the application further discloses a ship communication data security interaction system, comprising a processor and a memory, and the memory stores computer program instructions.

[0078] The above system further comprises a communication bus and a communication interface and other components well known to those skilled in the art, the setting and function of which are known in the art, and therefore will not be described here.

[0079] In the description of the present application, the meaning of "a plurality of", "several" is at least two, for example, two, three or more, etc., unless otherwise expressly specifically limited.

Claims

1. A method for secure data exchange in ship communication, characterized in that, include: A time-synchronized sampling window is established to simultaneously collect physical channel data and application layer data from the ship's communication terminal, and the collected data is preprocessed by denoising and normalization; physical channel data includes real-time signal-to-noise ratio, motion attitude information includes environmental influence weighting factors, and application layer data are continuous numerical variables; Based on the preprocessed physical channel data and the ship's own motion attitude information, a dynamic channel stability index reflecting the current communication environment quality and stability is calculated, including: Calculate the arithmetic mean and variance of the normalized signal-to-noise ratio data within the current time window; use the arithmetic mean as part of the numerator and the product of the square root of the variance and the environmental influence weighting factor as part of the denominator to calculate the dynamic channel stability index. Based on the preprocessed application layer data, the instantaneous jitter of the data is calculated using first-order difference, and a data flow logical discreteness reflecting the degree of data disorder is constructed based on the instantaneous jitter, including: The absolute value of the difference between adjacent data points within the sampling window is calculated as the instantaneous jitter, and the sum of all instantaneous jitters within the window is calculated. Based on the proportion of the instantaneous jitter of each data point in the sum, the entropy characteristics of the data are calculated using a logarithmic function to obtain the logical discreteness of the data stream. Based on the coupling relationship between the dynamic channel stability index and the logical discreteness of the data stream, a secure interaction anomaly index is calculated, including: Calculate the ratio of the current data stream logical dispersion to the dynamic channel stability index as the current channel-data coupling ratio; obtain the channel-data coupling ratio of the previous time step, and introduce the historical trend forgetting factor to smooth the impact of historical data; calculate the absolute value of the difference between the coupling ratio of the current time step and the previous time step, and multiply the absolute value by the square root of the current dynamic channel stability index to obtain the security interaction anomaly index. If the security interaction anomaly index exceeds the preset security threshold, the data interaction is deemed to be at risk and a defense strategy is implemented.

2. The method for secure interaction of ship communication data according to claim 1, characterized in that, The dynamic channel stability index The following relationship must be satisfied: in, For a moment, This is the arithmetic mean of the normalized signal-to-noise ratio data within the current time window. The variance of the normalized signal-to-noise ratio data within the current time window. For the preset positive constant bias term, For the preset non-zero positive numbers, As an environmental impact weighting factor, This represents the square root operation.

3. The method for secure interaction of ship communication data according to claim 1, characterized in that, The data stream logical discreteness The following relationship must be satisfied: In the formula, This represents the total number of data points within the sampling window. For the first The data point and the first The absolute value of the difference between the data points For all within the window The sum, For a pre-defined non-zero large constant, For a preset non-zero small constant, It is the natural logarithm function. This is the summation symbol.

4. The method for secure interaction of ship communication data according to claim 1, characterized in that, The security interaction anomaly index The following relationship must be satisfied: In the formula, and They are time points and time Data flow logical discreteness and They are time points and time The dynamic channel stability index. As a factor of historical trend forgetting, This indicates taking the absolute value. This represents the square root operation. This represents the dynamic channel stability index.

5. The method for secure interaction of ship communication data according to claim 2, characterized in that, The environmental impact weighting factor Data is acquired by reading the ship's own inclinometer data; when an increase in the ship's roll or pitch angle is detected, the inclinometer reading is increased. The value of .

6. The method for secure interaction of ship communication data according to claim 1, characterized in that, The defense strategy includes at least one of the following: discarding the current data packet, sending an alarm to the control center, forcing both communicating parties to re-handshake, or switching to an alternative communication frequency band.

7. A secure data exchange system for ship communication, characterized in that, include: A processor and a memory, the memory storing computer program instructions that, when executed by the processor, implement the secure interaction method for ship communication data according to any one of claims 1-6.

Images