Ship traffic data safety management method and system

Abstract

The invention relates to the technical field of data processing, and discloses a ship traffic data safety management method and system, and the method comprises the steps: collecting AIS data, radar data, VHF data and hydro meteorological data, obtaining an original data package, generating a digital fingerprint for the collected original data package through a block chain technology, and carrying out the chaining and evidence storage; identifying and filtering abnormal data in the original data packet through a hybrid algorithm based on an isolated forest and a variational auto-encoder to obtain processed data; based on the ship position, the navigation area risk level and the data type corresponding to the processed data, an AES-CHACha20 adaptive encryption algorithm based on spatio-temporal context perception is adopted, and an encryption key is dynamically bound with spatio-temporal information; constructing a ship traffic space-time risk portrait, and distributing data access authority in real time through a dynamic authority adjustment algorithm in combination with a user role, an operation scene and a real-time risk level; according to the invention, the ship traffic data safety protection capability is obviously improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and specifically to a method and system for managing ship traffic data security. Background Technology

[0002] With the rapid development of the global shipping industry, Vessel Traffic Services (VTS) systems integrate multi-source data such as AIS, radar, VHF, and hydro-meteorological data, becoming a core support for waterway safety monitoring and maritime decision-making. However, existing vessel traffic data security management has significant shortcomings: abnormal data detection methods are limited and cannot simultaneously adapt to structured and unstructured data, easily overlooking maliciously injected data or misjudging valid information; encryption schemes lack scenario adaptability, with unified encryption strategies either affecting real-time transmission in ordinary scenarios or providing insufficient protection in high-risk scenarios; permission allocation is mostly statically set, unable to respond to dynamic changes such as vessel navigation status and regional risks; core data lacks an immutable evidence storage mechanism, with weak traceability and anti-tampering capabilities, seriously threatening maritime data security and management reliability. Summary of the Invention

[0003] The purpose of this invention is to solve the above-mentioned problems by designing a method and system for ship traffic data security management.

[0004] The first aspect of this invention provides a method for managing the security of ship traffic data, the method comprising the following steps: Collect AIS data, radar data, VHF data, and hydrological and meteorological data to obtain raw data packets. Use blockchain technology to generate digital fingerprints for the collected raw data packets and store them on the blockchain. By using a hybrid algorithm based on isolated forest and variational autoencoder, abnormal data in the original data packets is identified and filtered to obtain processed data; Based on the ship's position, navigation area risk level, and data type corresponding to the processed data, the AES-ChaCha20 adaptive encryption algorithm based on spatiotemporal context awareness is adopted, and the encryption key is dynamically bound to spatiotemporal information. Construct a spatiotemporal risk profile of ship traffic, and allocate data access permissions in real time through a dynamic permission adjustment algorithm, combining user roles, operation scenarios and real-time risk levels.

[0005] Optionally, in a first implementation of the first aspect of the present invention, the step of collecting AIS data, radar data, VHF data, and hydrological and meteorological data to obtain raw data packets, and using blockchain technology to generate digital fingerprints for the collected raw data packets and storing them on the blockchain, includes: For each raw data packet, a fixed-length digital fingerprint is generated using the SHA-256 hash algorithm. The generated digital fingerprint, the collection time corresponding to the data packet, and the collection device identifier are packaged into a blockchain transaction and sent to the consortium blockchain node. Blockchain nodes verify transactions. Once verified, the transaction is written into a block. After the block is confirmed by the consensus mechanism, the digital fingerprint of the original data is stored on the blockchain.

[0006] Optionally, in a second implementation of the first aspect of the present invention, the step of identifying and filtering abnormal data in the original data packet using a hybrid algorithm based on isolated forest and variational autoencoder to obtain processed data includes: Structured data is filtered out from the original data packet to construct a structured dataset. A portion of the samples in the structured dataset is randomly selected as the training set. A feature dimension is randomly selected, and a split point is randomly selected between the minimum and maximum values ​​of the feature dimension to divide the samples into two parts. Repeat the segmentation process and recursively build multiple random trees until all samples are isolated individually or the preset tree depth is reached; The new structured data is input into the trained isolated forest model, the isolation path length of the structured data in each random tree is calculated, the average path length of all trees is taken, and the corresponding anomaly score is obtained. If the abnormal scores exceed the scoring threshold, they are identified as abnormal data and filtered out.

[0007] Optionally, in a third implementation of the first aspect of the present invention, the step of identifying and filtering abnormal data in the original data packet using a hybrid algorithm based on isolated forest and variational autoencoder to obtain processed data further includes: Unstructured data is filtered out from the original data packets and then input into the variational autoencoder model. The encoder maps unstructured data to a probability distribution in the latent space, randomly samples latent vectors from the probability distribution, and then reconstructs the data through the decoder. Calculate the reconstruction error between the input unstructured data and the reconstructed data. If the reconstruction error exceeds the error threshold, it is judged as abnormal data and filtered out.

[0008] Optionally, in the fourth implementation of the first aspect of the present invention, the step of employing a spatiotemporally context-aware AES-ChaCha20 adaptive encryption algorithm based on the ship's position, navigation area risk level, and data type corresponding to the processed data, and dynamically binding the encryption key with spatiotemporal information, includes: The latitude and longitude information of ships in the processed data is analyzed, matched with the preset regional risk level classification rules to determine the regional risk level, and the preset sensitivity classification standard is queried according to the data type to determine the data sensitivity. The extracted ship latitude and longitude, regional risk level, and data sensitivity are input into the decision tree model, and the decision tree model outputs an encryption strategy based on the feature path. A key is generated using the HMAC-SHA256 algorithm based on the ship's real-time latitude and longitude, data acquisition timestamp, and unique equipment identifier. The key is regenerated when the ship's position changes by more than 1 nautical mile. The encrypted data is encrypted using an encryption strategy and key determined by a decision tree model.

[0009] Optionally, in the fifth implementation of the first aspect of the present invention, if the decision tree model determines that the scenario is low-risk, the ChaCha20 stream encryption algorithm is selected for encryption; if the decision tree model determines that the scenario is high-risk, the AES-256-GCM authentication encryption algorithm is selected for encryption.

[0010] Optionally, in the sixth implementation of the first aspect of the present invention, the step of constructing a spatiotemporal risk profile of ship traffic, and allocating data access permissions in real time through a dynamic permission adjustment algorithm, in conjunction with user roles, operating scenarios, and real-time risk levels, includes: When a user initiates a data access request, the spatiotemporal risk profile of the current scenario is extracted and a comprehensive score is obtained. The user's real-time permission level is then determined based on preset mapping rules. If a vessel enters a high-risk area, the comprehensive risk score will be updated in real time, and the access permission level of the corresponding data will be lowered accordingly.

[0011] A second aspect of the present invention provides a ship traffic data security management system, the system comprising: The data acquisition module is used to collect AIS data, radar data, VHF data and hydrological and meteorological data to obtain raw data packets. It uses blockchain technology to generate digital fingerprints for the collected raw data packets and stores them on the blockchain. The identification module is used to identify and filter abnormal data in the original data packets using a hybrid algorithm based on isolated forest and variational autoencoder to obtain processed data. The encryption module is used to dynamically bind the encryption key to the spatiotemporal information based on the ship's position, navigation area risk level and data type corresponding to the processed data. The allocation module is used to construct a spatiotemporal risk profile of ship traffic. It combines user roles, operation scenarios, and real-time risk levels to allocate data access permissions in real time through a dynamic permission adjustment algorithm.

[0012] A third aspect of the present invention provides a ship traffic data security management device, the ship traffic data security management device including a memory and at least one processor, the memory storing instructions; the at least one processor invokes the instructions in the memory to cause the ship traffic data security management device to perform the various steps of the ship traffic data security management method as described in any of the preceding claims.

[0013] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed by a processor, implement the steps of the ship traffic data security management method as described in any of the preceding claims.

[0014] The technical solution provided by this invention involves collecting AIS data, radar data, VHF data, and hydrological and meteorological data to obtain raw data packets. Blockchain technology is used to generate digital fingerprints for the collected raw data packets and store them on the blockchain. Anomalies in the raw data packets are identified and filtered using a hybrid algorithm based on isolated forests and variational autoencoders, resulting in processed data. Based on the ship's position, navigation area risk level, and data type corresponding to the processed data, an AES-ChaCha20 adaptive encryption algorithm based on spatiotemporal context awareness is adopted, with the encryption key dynamically bound to spatiotemporal information. A spatiotemporal risk profile of ship traffic is constructed, and data access permissions are allocated in real time through a dynamic permission adjustment algorithm, combining user roles, operating scenarios, and real-time risk levels. This invention covers the entire lifecycle of data collection, processing, transmission, and access, significantly improving the security protection capabilities of ship traffic data and providing reliable technical support for maritime management. Attached Figure Description

[0015] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0016] Figure 1 A flowchart of a ship traffic data security management method provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the ship traffic data security management system provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of the ship traffic data security management device provided in an embodiment of the present invention. Detailed Implementation

[0017] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” or “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, apparatus, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0018] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 A flowchart of a ship traffic data security management method provided in this embodiment of the invention is shown. The method specifically includes the following steps: Step 101: Collect AIS data, radar data, VHF data and hydrological and meteorological data to obtain raw data packets. Use blockchain technology to generate digital fingerprints for the collected raw data packets and store them on the blockchain. In this embodiment, by deploying shore-based AIS receiving equipment, satellite AIS receiving terminals, and ship-borne AIS transmitting devices, structured data generated by the Automatic Identification System (AIS) is collected in real time, covering core information such as the ship's MMSI code, ship name, real-time latitude and longitude, speed, heading, navigation status, and destination. Relying on pre-set radar stations in areas such as Waigaoqiao, electromagnetic signals emitted by shore-based surveillance radar are received via radar data acquisition cards. Preliminary analysis yields radar data such as ship target trajectory, echo intensity, and range / azimuth. Network protocols such as TCP / IP are used to ensure data security. Real-time data transmission; using VHF communication receiving equipment to interface with relevant systems, collecting voice communication content and text message data between ships and shore-based traffic control centers, and between ships, supporting both real-time capture and batch archiving modes; continuously collecting meteorological data such as wind speed, wind direction, visibility, and precipitation, as well as hydrological data such as tidal height, tidal current velocity, and channel depth through meteorological sensor arrays and hydrological monitoring stations deployed along ports and waterways, setting acquisition frequencies from minutes to hours according to data real-time requirements, and finally integrating them to form multi-source heterogeneous raw data packets.

[0019] In this embodiment, a fixed-length digital fingerprint is generated for each original data packet using the SHA-256 hash algorithm. The generated digital fingerprint, the collection time corresponding to the data packet, and the collection device identifier are packaged into a blockchain transaction and sent to the consortium blockchain node. The blockchain node verifies the transaction. After successful verification, the transaction is written into a block. After the block is confirmed by the consensus mechanism, it is linked with the existing blockchain chain to complete the on-chain storage of the digital fingerprint of the original data.

[0020] In this embodiment, each original data packet is first converted into a 256-bit fixed-length digital fingerprint using the SHA-256 hash algorithm. This fingerprint uniquely corresponds to the original content of the data packet, and even if the data packet undergoes minor changes, the fingerprint will show significant differences. Subsequently, this digital fingerprint, along with the data packet's acquisition time and acquisition device identifier, is structured and packaged to form an information set conforming to the consortium blockchain transaction format. The transaction header includes the initiating node identifier, such as the blockchain account address of the data acquisition center, and the transaction body contains the serialized data of the aforementioned packaged information. Finally, the transaction is sent to a preset node cluster of the consortium blockchain through an encrypted transmission channel. The nodes include the maritime administration department's server, port operation unit nodes, and third-party regulatory agency nodes, ensuring the confidentiality of the transaction transmission process. After receiving a transaction, each node in the consortium blockchain initiates a distributed verification process: First, it verifies the legitimacy of the node initiating the transaction. Second, it verifies the correlation between the digital fingerprint and the collection time and device identifier, such as whether the device identifier is in the preset list of authorized devices and whether the collection time conforms to the normal working hours of the device. At the same time, it confirms the validity of the digital fingerprint through hash collision detection. After successful verification, the node temporarily stores the transaction in the transaction pool to be packaged. The consensus nodes select a certain number of valid transactions in the order of timestamps to form a new block. The block header includes the hash value of the previous block, the block generation timestamp, and Merkle root, which is calculated from the hash values ​​of all transactions in the block. Subsequently, each node confirms the consistency of the new block through a practical Byzantine fault-tolerant consensus mechanism. That is, the master node proposes the block, and the slave nodes vote in three stages: pre-preparation, preparation, and submission. When more than 2 / 3 of the nodes confirm the validity of the block, the block is officially written into the blockchain ledger and forms a chain link with the existing blockchain chain through the hash value of the previous block, completing the immutable notarization of the original data digital fingerprint and realizing the full traceability of data from the source of collection.

[0021] Step 102: Using a hybrid algorithm based on isolated forest and variational autoencoder, identify and filter abnormal data in the original data packets to obtain processed data; In this embodiment, structured data is filtered from the original data packet to construct a structured dataset. A portion of the samples in the structured dataset is randomly selected as the training set. A feature dimension is randomly selected, and a split point is randomly chosen between the minimum and maximum values ​​of that feature dimension to divide the samples into two parts. The splitting process is repeated, and multiple random trees are recursively constructed until all samples are isolated or a preset tree depth is reached. The new structured data is input into the trained isolated forest model, and the isolation path length of the structured data in each random tree is calculated. The average of the path lengths of all trees is taken to obtain the corresponding anomaly score. If the anomaly score exceeds the score threshold, it is determined to be abnormal data and the abnormal data is filtered out.

[0022] In this embodiment, unstructured data is filtered out from the original data packet and input into the variational autoencoder model. The encoder maps the unstructured data to a probability distribution in the latent space and randomly samples the latent vector from the probability distribution. The data is then reconstructed by the decoder. The reconstruction error between the input unstructured data and the reconstructed data is calculated. If the reconstruction error exceeds the error threshold, it is determined to be abnormal data and the abnormal data is filtered out.

[0023] In this embodiment, unstructured data is filtered out from the raw data packets integrating AIS, radar, VHF, and hydrological and meteorological data through a data format identification and type labeling mechanism. This type of data specifically includes raw audio files of VHF voice communication, unstandardized signal data of radar echoes, and non-fixed format text messages between ships. Its core characteristics are that it has no preset field structure, the dimensions are not fixed, and it is difficult to store directly in a traditional database. The filtered unstructured data is preprocessed, such as converting audio data into spectral feature sequences and digitally sampling the raw radar signals to ensure that the data format conforms to the model input specifications. Then, the preprocessed unstructured data is input into the variational autoencoder model that has been trained. The encoder part of the variational autoencoder consists of a multi-layer neural network. For the input high-dimensional unstructured data, it gradually extracts core features through operations such as convolution and fully connected mapping, and finally outputs two key parameters of the low-dimensional latent space, the mean and variance, to construct a probability distribution model that conforms to a Gaussian distribution. Based on this probability distribution, random sampling is performed to generate a latent vector of fixed dimensions. Appropriate randomness is introduced during the sampling process to improve the model's generalization ability to the data distribution. The decoder part receives the latent vector and gradually restores the data dimension through inverse transformation operations such as deconvolution and dimensionality expansion. Finally, it outputs reconstructed data that is completely consistent with the input data in terms of format and dimension, such as restoring the corresponding audio spectrum features or radar signal sequence from the latent vector. The appropriate error calculation method is selected based on the type of unstructured data. For continuous feature data such as audio and radar signals, mean square error is used to quantify the difference between the input data and the reconstructed data at the feature level. For text message data, the content difference is calculated using indicators such as edit distance, forming a reconstruction error value that characterizes the degree of deviation between the two. The error threshold is determined by the statistical results of the reconstruction error of historical normal unstructured data, and the 3σ principle is used to ensure that the reconstruction error of the vast majority of normal data is within the threshold range. The reconstruction error of the current input data is compared with the preset threshold. If the error value exceeds the threshold, the data is determined to be abnormal data, such as radar signals subject to electromagnetic interference or semantically chaotic VHF voice data, and a filtering mechanism is then activated to remove it from the dataset.

[0024] Step 103: Based on the ship's position, navigation area risk level, and data type corresponding to the processed data, adopt the AES-ChaCha20 adaptive encryption algorithm based on spatiotemporal context awareness, and dynamically bind the encryption key to spatiotemporal information; In this embodiment, the ship's latitude and longitude information in the processed data is parsed, and the regional risk level is determined by matching it with a preset regional risk level classification rule. The data sensitivity is determined by querying a preset sensitivity grading standard based on the data type. The extracted ship latitude and longitude, regional risk level, and data sensitivity are input into a decision tree model. The decision tree model outputs an encryption strategy based on the feature path. If the decision tree model determines it to be a low-risk scenario, the ChaCha20 stream encryption algorithm is selected for encryption; if the decision tree model determines it to be a high-risk scenario, the AES-256-GCM authentication encryption algorithm is selected for encryption. A key is generated using the HMAC-SHA256 algorithm based on the ship's real-time latitude and longitude, data acquisition timestamp, and unique device identifier. If the ship's position changes by more than 1 nautical mile, the key is regenerated. The processed data is encrypted based on the encryption strategy and key determined by the decision tree model. The ChaCha20 algorithm generates a stream cipher using the key and a random number, and XORs it with the data to obtain ciphertext. The AES-256-GCM algorithm generates a message authentication code while encrypting the data, ensuring the confidentiality and integrity of the ciphertext.

[0025] In this embodiment, when parsing the ship's latitude and longitude information in the processed data, real-time latitude and longitude coordinates accurate to six decimal places are extracted from the data fields and matched with preset electronic nautical chart area risk level classification rules. These rules divide waters into prohibited navigation areas, dangerous goods anchorages, busy waterways, ordinary operating areas, and open waters. The risk level corresponding to the area where the ship is located is determined by the coordinate points. At the same time, based on the type of processed data, such as basic ship identity information, ordinary navigation trajectory, dangerous goods transportation plans, emergency instructions, etc., preset sensitivity classification standards are queried: Level 1 Sensitive: Involves details of dangerous goods transportation and emergency instructions; Level 2 Sensitive: Real-time ship dynamics and operation plans; Level 3 Sensitive: Publicly verifiable static ship information, thereby determining the sensitivity level of the current data. The extracted ship latitude and longitude, regional risk level, and data sensitivity are used as input features and fed into a trained lightweight decision tree model. The root node of this model is divided based on the regional risk level. If the risk level is ≥4, it enters the high-risk branch; if it is ≤2, it enters the low-risk branch. In the high-risk branch, the AES-256-GCM algorithm is further determined based on whether the data sensitivity is level 1. In the low-risk branch, the ship traffic in the region where the latitude and longitude are located is considered. If the traffic in open water is low, it is directly determined to be low-risk, and the ChaCha20 stream encryption algorithm is finally output. For intermediate scenarios with a risk level of 3, a second determination is made based on data sensitivity. Sensitive data uses AES-256-GCM, and non-sensitive data uses ChaCha20. Based on the ship's real-time latitude and longitude, data acquisition timestamp, and unique equipment identifier, an encryption key is generated using the HMAC-SHA256 algorithm. First, the above three pieces of information are concatenated into a string in the format of latitude and longitude + timestamp + equipment identifier. Then, the master key preset by the maritime administration department is used as the HMAC key, and a hash operation is performed on the concatenated string to generate a 256-bit key. At the same time, the system calculates the latitude and longitude distance between two consecutive data acquisition times in real time. When the distance exceeds 1 nautical mile, the key update mechanism is immediately triggered, and the above process is repeated to generate a new key. The encrypted data is encrypted based on the encryption strategy determined by the decision tree model and the generated key. If the ChaCha20 stream encryption algorithm is used, a 12-byte nonce is first randomly generated. The key and the nonce are input into the algorithm to generate a pseudo-random stream cipher. Then, the stream cipher and the data to be encrypted are XORed bitwise to obtain the ciphertext. At the same time, the nonce is appended to the ciphertext header for decryption. If the AES-256-GCM authentication encryption algorithm is used, a 12-byte initial vector is first generated. The data is then encrypted in blocks using a 256-bit key. At the same time, the intermediate values ​​in the encryption process are calculated by the GMAC module to generate a 16-byte message authentication code. Finally, the IV, ciphertext, and tag are concatenated in order to ensure that the receiver can recover the original data and verify that the ciphertext has not been tampered with or forged by verifying the tag.

[0026] Step 104: Construct a spatiotemporal risk profile of ship traffic, and allocate data access permissions in real time through a dynamic permission adjustment algorithm, taking into account user roles, operation scenarios and real-time risk levels.

[0027] In this embodiment, when a user initiates a data access request, the spatiotemporal risk profile comprehensive score of the current scene is extracted, and the user's real-time permission level is determined according to the preset mapping rules; if the ship enters a high-risk area, the comprehensive risk score is updated in real time, and the access permission level of the corresponding data is lowered synchronously.

[0028] Please see Figure 2 A schematic diagram of the structure of the ship traffic data security management system provided in this embodiment of the invention. The system includes: The data acquisition module is used to collect AIS data, radar data, VHF data and hydrological and meteorological data to obtain raw data packets. It uses blockchain technology to generate digital fingerprints for the collected raw data packets and stores them on the blockchain. The identification module is used to identify and filter abnormal data in the original data packets using a hybrid algorithm based on isolated forest and variational autoencoder to obtain processed data. The encryption module is used to dynamically bind the encryption key to the spatiotemporal information based on the ship's position, navigation area risk level and data type corresponding to the processed data. The allocation module is used to construct a spatiotemporal risk profile of ship traffic. It combines user roles, operation scenarios, and real-time risk levels to allocate data access permissions in real time through a dynamic permission adjustment algorithm.

[0029] Figure 3This is a schematic diagram of the structure of a ship traffic data security management device 300 provided in an embodiment of the present invention. The ship traffic data security management device 300 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 310 (e.g., one or more processors) and a memory 320, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 333 or data 332. The memory 320 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the ship traffic data security management device 300. Furthermore, the processor 310 may be configured to communicate with the storage media 330 and execute the series of instruction operations in the storage media 330 on the ship traffic data security management device 300 to implement the method provided in the above embodiment.

[0030] The ship traffic data security management device 300 may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input / output interfaces 360, and / or one or more operating systems 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 3 The structure of the ship traffic data security management device shown does not constitute a limitation on the computer device provided by the present invention. It may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0031] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to perform the various steps of the ship traffic data security management method provided in the above embodiments.

[0032] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the above-described equipment or apparatus / unit can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0033] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0034] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for managing the security of ship traffic data, characterized in that, The method includes the following steps: Collect AIS data, radar data, VHF data, and hydrological and meteorological data to obtain raw data packets. Use blockchain technology to generate digital fingerprints for the collected raw data packets and store them on the blockchain. By using a hybrid algorithm based on isolated forest and variational autoencoder, abnormal data in the original data packets is identified and filtered to obtain processed data; Based on the ship's position, navigation area risk level, and data type corresponding to the processed data, the AES-ChaCha20 adaptive encryption algorithm based on spatiotemporal context awareness is adopted, and the encryption key is dynamically bound to spatiotemporal information. Construct a spatiotemporal risk profile of ship traffic, and allocate data access permissions in real time through a dynamic permission adjustment algorithm, combining user roles, operation scenarios and real-time risk levels.

2. The method for managing ship traffic data security as described in claim 1, characterized in that, The process involves collecting AIS data, radar data, VHF data, and hydrological and meteorological data to obtain raw data packets. Then, using blockchain technology, a digital fingerprint is generated for each raw data packet and stored on the blockchain as evidence. This includes: For each raw data packet, a fixed-length digital fingerprint is generated using the SHA-256 hash algorithm. The generated digital fingerprint, the collection time corresponding to the data packet, and the collection device identifier are packaged into a blockchain transaction and sent to the consortium blockchain node. Blockchain nodes verify transactions. Once verified, the transaction is written into a block. After the block is confirmed by the consensus mechanism, the digital fingerprint of the original data is stored on the blockchain.

3. The method for managing ship traffic data security as described in claim 1, characterized in that, The process involves using a hybrid algorithm based on isolated forests and variational autoencoders to identify and filter anomalous data in the original data packets, resulting in processed data, including: Structured data is filtered out from the original data packet to construct a structured dataset. A portion of the samples in the structured dataset is randomly selected as the training set. A feature dimension is randomly selected, and a split point is randomly selected between the minimum and maximum values ​​of the feature dimension to divide the samples into two parts. Repeat the segmentation process and recursively build multiple random trees until all samples are isolated individually or the preset tree depth is reached; The new structured data is input into the trained isolated forest model, the isolation path length of the structured data in each random tree is calculated, the average path length of all trees is taken, and the corresponding anomaly score is obtained. If the abnormal scores exceed the scoring threshold, they are identified as abnormal data and filtered out.

4. The method for managing ship traffic data security as described in claim 1, characterized in that, The process of identifying and filtering anomalous data in the original data packets using a hybrid algorithm based on isolated forests and variational autoencoders to obtain processed data also includes: Unstructured data is filtered out from the original data packets and then input into the variational autoencoder model. The encoder maps unstructured data to a probability distribution in the latent space, randomly samples latent vectors from the probability distribution, and then reconstructs the data through the decoder. Calculate the reconstruction error between the input unstructured data and the reconstructed data. If the reconstruction error exceeds the error threshold, it is judged as abnormal data and filtered out.

5. The method for managing ship traffic data security as described in claim 1, characterized in that, Based on the ship's position, navigation area risk level, and data type corresponding to the processed data, the AES-ChaCha20 adaptive encryption algorithm based on spatiotemporal context awareness is adopted, and the encryption key is dynamically bound to spatiotemporal information, including: The latitude and longitude information of ships in the processed data is analyzed, matched with the preset regional risk level classification rules to determine the regional risk level, and the preset sensitivity classification standard is queried according to the data type to determine the data sensitivity. The extracted ship latitude and longitude, regional risk level, and data sensitivity are input into the decision tree model, and the decision tree model outputs an encryption strategy based on the feature path. A key is generated using the HMAC-SHA256 algorithm based on the ship's real-time latitude and longitude, data acquisition timestamp, and unique equipment identifier. The key is regenerated when the ship's position changes by more than 1 nautical mile. The encrypted data is encrypted using an encryption strategy and key determined by a decision tree model.

6. The method for managing ship traffic data security as described in claim 5, characterized in that, If the decision tree model determines the scenario to be low-risk, the ChaCha20 stream encryption algorithm is selected for encryption; if the decision tree model determines the scenario to be high-risk, the AES-256-GCM authentication encryption algorithm is selected for encryption.

7. The method for managing ship traffic data security as described in claim 1, characterized in that, The construction of a spatiotemporal risk profile for ship traffic, combined with user roles, operational scenarios, and real-time risk levels, utilizes a dynamic permission adjustment algorithm to allocate data access permissions in real time, including: When a user initiates a data access request, the spatiotemporal risk profile of the current scenario is extracted and a comprehensive score is obtained. The user's real-time permission level is then determined based on preset mapping rules. If a vessel enters a high-risk area, the comprehensive risk score will be updated in real time, and the access permission level of the corresponding data will be lowered accordingly.

8. A ship traffic data security management system, characterized in that, The system includes: The data acquisition module is used to collect AIS data, radar data, VHF data and hydrological and meteorological data to obtain raw data packets. It uses blockchain technology to generate digital fingerprints for the collected raw data packets and stores them on the blockchain. The identification module is used to identify and filter abnormal data in the original data packets using a hybrid algorithm based on isolated forest and variational autoencoder to obtain processed data. The encryption module is used to dynamically bind the encryption key to the spatiotemporal information based on the ship's position, navigation area risk level and data type corresponding to the processed data. The allocation module is used to construct a spatiotemporal risk profile of ship traffic. It combines user roles, operation scenarios, and real-time risk levels to allocate data access permissions in real time through a dynamic permission adjustment algorithm.

9. A ship traffic data security management device, characterized in that, The ship traffic data security management device includes a memory and at least one processor, wherein the memory stores instructions; the at least one processor invokes the instructions in the memory to cause the ship traffic data security management device to perform the various steps of the ship traffic data security management method as described in any one of claims 1-7.

10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions are executed by the processor, they implement the various steps of the ship traffic data security management method as described in any one of claims 1-7.

Images