A behavior analysis method and system for satellite internet terminal users

Abstract

The application belongs to the technical field of network security, and discloses a behavior analysis method and system for satellite internet terminal users, the behavior analysis method for satellite internet terminal users comprising: S1: feature extraction, extracting the behavior features of satellite internet terminal users; S2: feature data preprocessing, processing the missing values and abnormal values in the original behavior data obtained in step S1, aligning and fusing the behavior feature data, and completing standardization processing; S3: feature weight calculation, determining the weight coefficients of each behavior feature by using a combination weighting method combining the analytic hierarchy process and the entropy weight method; S4: using a lightweight behavior analysis algorithm based on improved K-means clustering to identify abnormal values; and S5: realizing the identification of composite attack threats by correlatively analyzing multi-dimensional weak abnormal signals.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and particularly relates to a behavior analysis method and system for satellite Internet terminal users. BACKGROUND

[0002] With the rapid development of satellite Internet, the scale of satellite Internet terminals is gradually expanding. These terminals will be widely used in scenarios such as marine communication, aviation networking, emergency communication, and broadband access in remote areas. Satellite Internet terminals have strong mobility and complex behaviors. Traditional security mechanisms such as identity authentication and access control are suitable for the static management of terminals, but cannot solve the trust problem of the dynamic behavior of satellite Internet terminals. Especially in the case where satellite Internet terminals have obtained a legal identity and access rights, their actual behavior may still have untrusted risks. Therefore, the behavior analysis of satellite Internet terminals is of great significance to realize continuous trust evaluation and enhance the reliability and security protection capability of the system.

[0003] The existing behavior analysis technology for wireless terminals mostly focuses on mobile terminal users and wifi terminal users. In recent years, although some researches on behavior modeling of satellite terminal users have appeared, there are still two deficiencies: first, the correspondence of behavior feature extraction is insufficient and the dimension is relatively single. Satellite Internet terminals may perform diversified businesses in different geographical locations and network environments, and the existing behavior feature extraction method is difficult to effectively correspond to the dynamic behavior change of satellite terminals; second, the behavior analysis algorithm lacks multi-dimensional fusion and lightweight design. Especially in the case of limited satellite bandwidth and limited computing resources of satellite terminals, it is difficult to realize efficient and accurate analysis. SUMMARY

[0004] The purpose of the present application is to overcome the problems of the prior art. A behavior analysis method and system for satellite Internet terminal users are disclosed. The present application improves the efficiency and accuracy of abnormal behavior analysis of satellite Internet terminal users through two optimization mechanisms of multi-dimensional feature extraction and multi-dimensional fusion of satellite Internet terminal user behavior and lightweight behavior analysis, and improves the network availability and security in the application scenario of satellite Internet.

[0005] In one aspect, the purpose of the present application is achieved by the following technical solutions:

[0006] A behavior analysis method for satellite Internet terminal users, the behavior analysis method for satellite Internet terminal users comprising:

[0007] S1: feature extraction, extracting behavior features of satellite Internet terminal users;

[0008] S2: feature data preprocessing, processing missing values and outliers in the original behavior data obtained in step S1, aligning and fusing the behavior feature data, and completing standardization processing;

[0009] S3: feature weight calculation, using a combination weighting method combining analytic hierarchy process and entropy weight method to determine the weight coefficients of each behavior feature;

[0010] S4: using a lightweight behavior analysis algorithm based on improved K-means clustering to identify outliers;

[0011] S5: through the correlation analysis of multi-dimensional weak abnormal signals, the identification of complex attack threats is realized.

[0012] According to a preferred embodiment, step S1 includes extracting behavior features from three dimensions of terminal user's network communication behavior, application operation behavior and location jump behavior.

[0013] According to a preferred embodiment, the network communication behavior is obtained based on connection logs, including connection frequency, duration, destination address and port scanning rate;

[0014] The application operation behavior is obtained based on application usage logs, including application startup time, usage time, operation frequency and application type;

[0015] The location jump behavior is obtained based on location sensors, including displacement speed, location change frequency, displacement distance and stationary state persistence.

[0016] According to a preferred embodiment, step S2 includes processing missing values and outliers in three types of original behavior data of network communication behavior, application operation behavior and location jump behavior, respectively completing threat detection according to the security threat labels of three types of behavior features, and if there is security threat data, it is automatically identified as abnormal behavior;

[0017] Again, align the three types of behavior feature data through timestamp, complete fusion; finally, standardize the data in different dimensions and ranges.

[0018] According to a preferred embodiment, step S3 includes constructing a satellite Internet scene feature hierarchical structure model through analytic hierarchy process to determine the subjective weight of each feature; secondly, calculating the information entropy of each feature based on historical normal behavior data through entropy weight method to determine the objective weight; finally, using additive synthesis method to calculate the combined weight to obtain the weight coefficient of each behavior feature.

[0019] According to a preferred embodiment, step S4 comprises: firstly, using the received pre-processed and weighted fused multi-dimensional behavior feature dataset, an initial clustering is performed using Manhattan distance to form an initial clustering model, and the initial centroid of each cluster is determined;

[0020] Secondly, when new behavior data arrives, the Manhattan distance of the new data point to the centroid of all existing clusters is calculated, and it is assigned to the nearest cluster, and only the centroid of the cluster and its adjacent clusters is recalculated;

[0021] Finally, the Manhattan distance of the new data point to the centroid of its belonging cluster is calculated, and the distance is compared with the set dynamic threshold value, if the distance of the new data point exceeds the threshold value, it is marked as abnormal behavior.

[0022] According to a preferred embodiment, step S5 comprises: receiving the abnormal points obtained in step S4, performing correlation analysis on the weak abnormal points of each dimension, if there is a significant correlation between the abnormal points of each dimension, it is determined as a composite attack, otherwise, it is determined as an independent abnormal event, and the satellite internet terminal score is updated according to the output result.

[0023] On the other hand, the application also discloses:

[0024] A behavior analysis system for satellite internet terminal users, which uses the above-mentioned behavior analysis method to analyze user behavior;

[0025] The behavior analysis system for satellite internet terminal users comprises a feature extraction module, a feature data preprocessing module, a feature weight calculation module, a lightweight K-means processing module and a multi-dimensional behavior analysis module, and each module is connected through an internal interface;

[0026] The feature extraction module is configured to extract the behavior features of satellite internet terminal users; the feature data preprocessing module is configured to process the missing values and abnormal values in the original behavior data, and to align and fuse the behavior feature data, and to complete the standardization processing; the feature weight calculation module is configured to obtain the weight coefficients of each behavior feature; the lightweight K-means processing module is configured to identify abnormal values through an algorithm; and the multi-dimensional behavior analysis module is configured to perform correlation analysis and identify threats.

[0027] The above-mentioned main scheme of the application and each further selected scheme can be freely combined to form multiple schemes, all of which are the schemes that can be adopted and claimed by the application. Those skilled in the art can understand that there are many combinations according to the existing technology and common knowledge after understanding the schemes of the application, all of which are the technical schemes claimed by the application, and are not listed here.

[0028] The application has the following beneficial effects:

[0029] (1) Adopting the multi-dimensional feature extraction mechanism of satellite internet terminal user behavior, aiming at the application scenario of satellite internet terminal, a behavior feature extraction model covering three dimensions of network communication behavior, application operation behavior and location jump behavior is constructed, and the feature extraction points of each dimension are formulated, which provides effective data support for behavior analysis.

[0030] (2) Adopting the multi-dimensional fusion lightweight behavior analysis mechanism, first, the combination weighting method is used to determine the weight coefficient of each behavior feature, taking into account the expert experience and actual data law, which guarantees the rationality of the feature weight system; secondly, the lightweight behavior analysis algorithm based on improved K-means clustering is adopted, which uses Manhattan distance and incremental updating mechanism to reduce the calculation overhead, and is suitable for resource limited satellite internet terminal environment.

[0031] (3) Through the fusion and correlation analysis of multi-dimensional behavior features, the detection ability of complex attacks and advanced threats is enhanced, and the overall security of the system is improved. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 is the flowchart of the behavior analysis method of satellite internet terminal user of the present application;

[0033] Figure 2 is the feature extraction process schematic diagram of the present application;

[0034] Figure 3 is the feature data preprocessing process schematic diagram of the present application;

[0035] Figure 4 is the feature weight calculation process schematic diagram of the present application;

[0036] Figure 5 is the lightweight K-means processing process schematic diagram of the present application;

[0037] Figure 6 is the multi-dimensional behavior analysis process schematic diagram of the present application;

[0038] Figure 7 is the flowchart of the behavior analysis system of satellite internet terminal user of the present application. DETAILED DESCRIPTION

[0039] Following specific embodiments of the present application are illustrated by way of specific examples, and other advantages and effects of the present application can be easily understood by those skilled in the art from the description. The present application can also be implemented or applied by way of other different specific embodiments, and various modifications or changes can be made to the details in the description based on different views and applications without departing from the spirit of the present application. It should be noted that the following examples and features in the examples can be combined with each other without conflict.

[0040] It should be noted that similar reference numerals and letters refer to similar items throughout the accompanying drawings, and thus, once an item is defined in one drawing, it is not necessary to further define and explain it in subsequent drawings.

[0041] In the description of the present application, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the product of the present application is usually placed during use, and are merely for the convenience of describing the present application and simplifying the description, and thus, cannot be construed as indicating or implying that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and thus, cannot be construed as limiting the present application. In addition, the terms "first", "second", "third", and the like are merely used to distinguish the description and cannot be construed as indicating or implying relative importance.

[0042] In addition, the terms "horizontal", "vertical", "overhang", and the like do not mean that the components must be absolutely horizontal or overhanging, but can be slightly inclined. For example, "horizontal" only means that it is more horizontal relative to "vertical", and does not mean that the structure must be completely horizontal, but can be slightly inclined.

[0043] In the description of the present application, it should also be noted that, unless otherwise explicitly specified and limited, the terms "provided", "mounted", "connected", "linked" should be understood broadly, for example, can be fixedly connected, can be detachably connected, or integrally connected; can be mechanically connected, or electrically connected; can be directly connected, or indirectly connected through an intermediate medium; can be connected inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0044] In addition, the present application points out that, in the present application, unless a specific structure, connection relationship, positional relationship, power source relationship, etc. is specifically written, the structure, connection relationship, positional relationship, power source relationship, etc. involved in the present application are all known by those skilled in the art on the basis of the prior art, without the need for creative labor.

[0045] Example 1

[0046] Referring to Figure 1 The embodiment shown discloses a behavior analysis method for satellite Internet terminal users, which comprises the following steps.

[0047] Step S1: feature extraction, extracting the behavior features of satellite Internet terminal users.

[0048] Specifically, referring to Figure 2 As shown in the figure, when the behavior features of satellite Internet terminal users are extracted, the behavior features are divided into three dimensions: network communication behavior, application operation behavior, and location jump behavior.

[0049] The network communication behavior data is mainly derived from connection logs, and the specific feature indicators include connection frequency, duration, destination address, and port scanning rate. The security threat markers include high-frequency short connections and sudden changes in port scanning rate.

[0050] For example, the security threat markers of the network communication behavior of terminal users can be: 1) high-frequency short connections, more than 50 connections in one minute and each connection lasting less than 1 second, which may be DDoS attack detection; 2) sudden change in port scanning rate, scanning rate greater than 50 times per second, which may be the network probing behavior of an attacker.

[0051] The application operation behavior data is mainly derived from application usage logs, and the specific feature indicators include start time, usage duration, operation frequency, and application type. The security threat markers can be the start of three or more sensitive application clusters.

[0052] The location jump behavior data is mainly derived from location sensors, and the specific feature indicators include displacement speed, location change frequency, displacement distance, and stationary state persistence. The security threat markers include non-continuous location jumps and terminal physical stationary time exceeding a certain time.

[0053] For example, the security threat markers of the location jump behavior of terminal users can be: 1) non-continuous location jump, displacement distance greater than 1000 kilometers within 10 minutes, which means that the terminal identity may be hijacked; 2) terminal physical stationary time exceeding a certain time, which means that the terminal may be hijacked.

[0054] The application adopts a multi-dimensional feature extraction mechanism for satellite Internet terminal user behavior, and constructs a behavior feature extraction model covering three dimensions of network communication behavior, application operation behavior, and location jump behavior for satellite Internet terminal application scenarios, and formulates the feature extraction points of each dimension, providing effective data support for behavior analysis.

[0055] Step S2: Feature data preprocessing, processing missing values ​​and outliers in the original behavioral data obtained in step S1, and aligning and fusing the behavioral feature data to complete the standardization process.

[0056] Specifically, refer to Figure 3 As shown, during feature data preprocessing, firstly, missing values ​​and outliers in the three types of original behavioral data are processed separately, and threat detection is completed according to the security threat tags of the three types of behavioral features. If there is security threat data, it is automatically identified as abnormal behavior. Secondly, the three types of behavioral feature data are aligned and fused by timestamps. Finally, data of different dimensions and ranges are standardized.

[0057] Step S3: Feature weight calculation. The weight coefficients of each behavioral feature are determined by a combination of the analytic hierarchy process (AHP) and the entropy weighting method.

[0058] Specifically, refer to Figure 4 As shown, when calculating feature weights, firstly, a hierarchical structure model of satellite internet scene features is constructed using the analytic hierarchy process (AHP) to determine the subjective weights of each feature; secondly, the information entropy of each feature is calculated based on historical normal behavior data using the entropy weight method to determine the objective weights; finally, the combined weights are calculated using the additive synthesis method to obtain the weight coefficients of each behavioral feature.

[0059] Step S4: Use a lightweight behavior analysis algorithm based on improved K-means clustering to identify outliers.

[0060] Specifically, such as Figure 5 As shown, in the lightweight K-means processing, firstly, after initialization, the received preprocessed and weighted multi-dimensional behavioral feature dataset is used to perform initial clustering using Manhattan distance to form an initial clustering model and determine the initial centroid of each cluster. Secondly, when new behavioral data arrives, the Manhattan distance from the new data point to the centroid of all existing clusters is calculated, and it is assigned to the nearest cluster. Only the centroid of this cluster and its neighboring clusters are recalculated, thus reducing the amount of computation. Finally, the Manhattan distance from the new data point to the centroid of its cluster is calculated, and this distance is compared with a set dynamic threshold (e.g., the median distance of all points in the cluster plus three times the standard deviation). If the distance of the new data point exceeds this threshold, it is marked as abnormal behavior.

[0061] Step S5: Identify complex attack threats by performing correlation analysis on weak anomaly signals across multiple dimensions.

[0062] Specifically, such as Figure 6As shown, the multi-dimensional behavior analysis module receives the abnormal points from the lightweight K-means processing module, performs correlation analysis on the weak abnormal points in multiple dimensions, and if there is a significant correlation between the abnormal points in multiple dimensions, it is determined as a composite attack, otherwise, it is determined as an independent abnormal event, and the satellite internet terminal score is updated according to the output result.

[0063] The application adopts a multi-dimensional fusion lightweight behavior analysis mechanism. First, the combined weighting method is used to determine the weight coefficient of each behavior feature, taking into account expert experience and actual data rules to ensure the rationality of the feature weight system. Second, the lightweight behavior analysis algorithm based on improved K-means clustering is used, which uses Manhattan distance and incremental update mechanism to reduce the calculation overhead, and is suitable for resource-limited satellite internet terminal environment. Through the fusion and correlation analysis of multi-dimensional behavior features, the detection capability of composite attacks and advanced threats is enhanced, and the overall security of the system is improved.

[0064] Embodiment 2

[0065] Reference Figure 7 As shown, based on embodiment 1, the embodiment also discloses a behavior analysis system for satellite internet terminal users, which uses the behavior analysis method of embodiment 1 to analyze user behavior.

[0066] The behavior analysis system for satellite internet terminal users in this embodiment includes a feature extraction module, a feature data preprocessing module, a feature weight calculation module, a lightweight K-means processing module and a multi-dimensional behavior analysis module, and each module is connected through an internal interface.

[0067] The feature extraction module is configured to extract the behavior features of the satellite internet terminal users; the feature data preprocessing module is configured to process the missing values and abnormal values in the original behavior data, and align and fuse the behavior feature data to complete the standardization processing; the feature weight calculation module is configured to obtain the weight coefficient of each behavior feature; the lightweight K-means processing module is configured to identify abnormal values through algorithm; and the multi-dimensional behavior analysis is configured to perform correlation analysis and identify threats.

[0068] The above is only a preferred embodiment of the application and does not limit the application. Any modification, equivalent replacement and improvement made within the spirit and principle of the application shall be included in the protection scope of the application.

Claims

1. A behavior analysis method for a satellite internet terminal user, characterized by, The behavior analysis method for satellite Internet terminal users comprises: S1: feature extraction, extracting the behavior features of satellite Internet terminal users; S2: feature data preprocessing, processing the missing values and abnormal values in the original behavior data obtained in step S1, aligning and fusing the behavior feature data, and completing standardization processing; S3: feature weight calculation, using a combination weighting method combining the analytic hierarchy process and the entropy weight method to determine the weight coefficients of each behavior feature; S4: using a lightweight behavior analysis algorithm based on improved K-means clustering to identify abnormal values; S5: through correlation analysis of multi-dimensional weak abnormal signals, the identification of composite attack threats is realized; Step S1 comprises extracting behavior features from three dimensions of terminal user network communication behavior, application operation behavior and location jump behavior; Step S3 comprises: constructing a satellite Internet scene feature hierarchical structure model by the analytic hierarchy process to determine the subjective weight of each feature; secondly, calculating the information entropy of each feature based on historical normal behavior data by the entropy weight method to determine the objective weight; finally, using the additive synthesis method to calculate the combined weight to obtain the weight coefficient of each behavior feature; Step S4 comprises: Firstly, using the received multi-dimensional behavior feature data set after preprocessing and weighted fusion, Manhattan distance is used for initial clustering to form an initial clustering model and determine the initial centroid of each cluster; Secondly, when new behavior data arrives, calculate the Manhattan distance of the new data point to all existing cluster centroids, and assign it to the nearest cluster, and only recalculate the centroid of the nearest cluster and its adjacent clusters; Finally, calculate the Manhattan distance of the new data point to the centroid of its belonging cluster, and compare this distance with the set dynamic threshold value, if the distance of the new data point exceeds the threshold value, it is marked as abnormal behavior.

2. The method of claim 1, wherein the behavior analysis of the satellite internet terminal user is performed by the satellite internet service provider. The network communication behavior is obtained based on connection logs, including connection frequency, duration, destination address and port scanning rate; The application operation behavior is obtained based on application usage logs, including application startup time, usage time, operation frequency and application type; The location jump behavior is obtained based on location sensors, including displacement speed, location change frequency, displacement distance and stationary state persistence.

3. The method of claim 1, wherein the behavior analysis of the satellite internet terminal user is performed by the satellite internet service provider. Step S2 comprises: processing the missing values and abnormal values in the three types of original behavior data of network communication behavior, application operation behavior and location jump behavior, respectively completing threat detection according to the security threat labels of the three types of behavior features, if there is security threat data, it is automatically identified as abnormal behavior; Thirdly, aligning and fusing the three types of behavior feature data through time stamp; finally, standardizing the data in different dimensions and ranges.

4. The method of claim 1, wherein the behavior analysis of the satellite internet terminal user is performed by the satellite internet service provider. Step S5 comprises: receiving the abnormal points obtained in step S4, correlating the weak abnormal points in each dimension, if there is a significant correlation between the abnormal points in each dimension, it is determined as a composite attack, otherwise, it is determined as an independent abnormal event, and updating the satellite Internet terminal score according to the output result.

5. A behavior analysis system for satellite internet end users, characterized by, The behavior analysis system for satellite Internet terminal users uses the behavior analysis method of any one of claims 1 to 4 for user behavior analysis. The behavior analysis system for the satellite Internet terminal user comprises a feature extraction module, a feature data preprocessing module, a feature weight calculation module, a lightweight K-means processing module and a multi-dimensional behavior analysis module, and each module is connected through an internal interface. The feature extraction module is configured to extract the behavior features of the satellite Internet terminal user; the feature data preprocessing module is configured to process the missing values and abnormal values in the original behavior data, align and fuse the behavior feature data, and complete the standardization processing; the feature weight calculation module is configured to obtain the weight coefficients of each behavior feature; the lightweight K-means processing module is configured to identify the abnormal values through an algorithm; and the multi-dimensional behavior analysis is configured to be correlation analysis and identify threats.

Images