Time delay attack detection method based on ICEEMDAN and INFORMER

Abstract

The invention provides a time delay attack detection method based on ICEEMDAN and INFORMER, and aims to solve the problem of a detection blind area existing in an existing time delay attack detection algorithm, comprehensively cover various complex detection scenes and provide a correction result after an attack is detected. According to the method, time offset is recorded in the periodic time synchronization process, a time offset sequence is constructed, abnormal values are eliminated by using a data processing technology, feature extraction is performed by using an ICEEMDAN technology, an INFORMER model is trained to perform time sequence prediction, a prediction link is added in the time synchronization process, and the actual time offset and the predicted time offset are compared, so that the time sequence prediction accuracy is improved. And judging whether attack occurs or not and performing corresponding processing. According to the method, the detection accuracy is improved, the anti-attack capability of the system is enhanced, the influence of attacks on the system is reduced, and the reliability and stability of the system are improved.

Description

Technical Field

[0001] A time delay attack detection method based on ICEEMDAN and INFORMER is proposed, which belongs to the field of time synchronization system anomaly detection. Background Technology

[0002] With the rapid development of science and technology, human society is accelerating towards a new era of high digitalization and networking. Today, modern society has formed a vast network ecosystem interwoven with massive computer systems, complex network devices, and diverse applications. In this highly complex network environment, maintaining time consistency is crucial for the collaborative operation of different machines. The accuracy of time synchronization not only affects the efficient operation of the system but also directly impacts many key aspects such as data transmission, transaction processing, and network security.

[0003] Currently, Network Time Protocol (NTP) is the most widely used time synchronization technology, while Precision Time Protocol (PTP) offers the highest synchronization accuracy. Both achieve time synchronization through bidirectional message transmission, ensuring that the time of each node in the network remains highly consistent. However, while providing accurate time synchronization services for the modern network ecosystem, message-based time synchronization systems also face numerous security threats. Among these, time delay attacks, due to their high degree of concealment and difficulty in defense, have become one of the most challenging security problems. This type of attack maliciously extends the transmission time of messages to compromise the accuracy of time synchronization and can cleverly circumvent conventional defenses such as encryption and integrity verification, thus posing a serious threat to the normal operation of the network system.

[0004] Researchers have proposed various detection methods to combat time delay attacks, but each has its shortcomings. Algorithms based on network reference nodes cannot effectively detect attacks when synchronization and verification messages pass through the same attacked node; algorithms based on multiple network paths disrupt the original network structure, making them difficult to implement and unable to detect multi-point attacks; and algorithms based on trusted nodes may misclassify correct data as erroneous if more than half of the nodes are attacked.

[0005] In summary, current time delay attack detection algorithms generally suffer from blind spots. Therefore, it is particularly necessary to research a time delay attack detection algorithm without blind spots. Summary of the Invention

[0006] The purpose of this invention is to propose a detection method for time delay attacks, which aims to comprehensively cover various complex detection scenarios and provide corresponding correction results after detecting time delay attacks.

[0007] The objective of this invention is achieved as follows:

[0008] Most existing time delay attack detection algorithms rely on secondary verification using third-party nodes. However, this method has limitations; if the channel to the third party is attacked, the algorithm fails, making it unable to accurately detect time delay attacks and posing a potential threat to system security and stability. This invention proposes an innovative time delay attack detection method that effectively addresses this deficiency in existing algorithms. The method first precisely extracts time offsets during periodic time synchronization, constructing a unique and representative time series. Then, leveraging the power of deep learning technology, it accurately predicts the results of the constructed time series. During the operation of the time synchronization system, when a significant deviation occurs between the offset calculated in three consecutive time synchronization processes and the time offset predicted by deep learning, a time synchronization attack can be accurately determined. This detection mechanism not only improves detection accuracy but also enhances the system's resistance to attacks. More importantly, this invention possesses a unique function: when a time synchronization attack is detected, it can directly use the accurate value predicted by deep learning technology to replace the calculated value affected by the attack for result correction, without relying on external correction methods. This not only enables the timely restoration of the time synchronization system to normal operation, but also effectively reduces the impact of attacks on the system, improving the system's reliability and stability.

[0009] The specific method is as follows:

[0010] A time delay attack detection method based on ICEEMDAN and INFORMER includes the following steps:

[0011] Step 1: In the periodic time synchronization process, accurately record the time offset calculated from the clock each time, and string these continuously obtained time offsets together to construct a complete and ordered time offset sequence.

[0012] Step 2: Use data processing techniques to accurately analyze and filter the time-off series, effectively removing obvious outliers caused by network fluctuations, thereby ensuring the accuracy and reliability of the time-off series and providing a high-quality data foundation for subsequent analysis and processing.

[0013] Step 3: Use ICEEMDAN technology to perform in-depth feature extraction on the data, fully explore the key information and inherent patterns in the data, and lay a solid foundation for subsequent model training and optimization.

[0014] Step 4: Using high-quality preprocessed data, conduct a rigorous and efficient training process on the INFORMER model, aiming to build a time series prediction model with excellent performance.

[0015] Step 5: Add a prediction step to the time synchronization process. Compare the actual time offset with the predicted time offset. If the difference between the two is less than a preset threshold, it is determined that the time synchronization process has not been attacked; otherwise, it is determined that the time synchronization process may be attacked. Use the predicted value to correct the time synchronization and start the next round of time synchronization.

[0016] Step 6: If anomalies are detected multiple times in a row, the system is deemed to be under attack and an alarm is issued.

[0017] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 The diagram illustrates the structure of the time series prediction model in the implementation method of this invention. Detailed Implementation

[0020] Time synchronization systems typically operate periodically, with each synchronization operation precisely calculating the time offset of the slave clock relative to the master clock. By concatenating these consecutively obtained time offsets, a complete and ordered time offset sequence can be constructed, which clearly reflects the dynamic changes during the time synchronization process.

[0021] Because the Precision Time Protocol (PTP) relies on bidirectional message transmission, and message transmission speed is easily affected by network jitter, the collected time offset data contains many anomalies. To remove these anomalies, this invention employs a statistical method based on the mean and standard deviation to perform outlier detection. This method is not only simple and efficient but also particularly suitable for processing relatively regularly distributed data, effectively identifying and marking data points that deviate from the normal range. The specific process of the detection algorithm is as follows:

[0022] Calculate the average value of time series data:

[0023]

[0024] Calculate the standard deviation of the time series:

[0025]

[0026] Calculate the distance between each data point and the mean. If the difference between the two is greater than 5 times the standard deviation, the data is considered outlier.

[0027] |x i -Mean|>5*Standard Deviation

[0028] Outlier handling is crucial for maintaining data quality and the integrity of time series data. Common methods include outlier removal and mean replacement. To ensure the continuity and trend of the original time series remain undisturbed, the data processing module employs a mean replacement-based outlier handling strategy. Specifically, when a data point is identified as an outlier, the nearest non-outlier data point is selected, and the mean of these two points is calculated to replace the outlier. This method not only avoids information loss due to data point deletion but also effectively preserves the overall characteristics and trends of the time series.

[0029] Furthermore, since the raw data is measured in nanoseconds, its volume is large and its variation is small, which may pose a challenge for subsequent feature extraction. Therefore, after completing outlier detection and processing of the raw data, further data normalization is needed to optimize its distribution characteristics and provide a more suitable data foundation for subsequent analysis and modeling. The data processing module selected the max-min normalization method, the mathematical expression of which is:

[0030] x norm =(xx) min ) / (x max -x min )

[0031] Where x represents the current data, x max and x min Then, x represents the maximum and minimum values ​​in the dataset, respectively. norm This is the result after normalizing the current data. It's important to note that the algorithm proposed in this chapter requires comparison and detection based on the original data values. However, the prediction results of the model trained using normalized data are also normalized data. Therefore, to facilitate subsequent data comparison operations, the prediction model needs to add an inverse normalization operation in the final step. The inverse normalization formula is as follows:

[0032] x = x norm *(x max -xmin )+x min

[0033] Based on the above formula, the algorithm needs to retain the corresponding x. max With x min This makes it convenient for subsequent use.

[0034] The eigenvalues ​​of time-shifted sequences are one-dimensional. Insufficient eigenvalues ​​when inputting into the prediction model can lead to inaccurate prediction results. To improve prediction accuracy, the prediction framework proposed in this invention adds a mode decomposition module to obtain more dimensional eigenvalues. Specifically, the mode decomposition module uses the Improved Complete Ensemble Empirical Mode Decomposition with Adaptive Noise algorithm. Its core lies in iteratively decomposing complex signals into several intrinsic mode functions (IMFs). These IMFs can accurately capture the local features of the original signal at different time scales, thereby revealing the signal's intrinsic dynamic structure.

[0035] Introducing the ICEEMDAN feature extraction module can significantly reduce the error between the predicted time-shifted data and the real data, thereby improving the overall prediction performance of the model. Meanwhile, decomposing the data into 5 IMFs is an ideal choice. This number can fully utilize feature information while effectively avoiding overfitting, thus achieving the best prediction results.

[0036] The time series forecasting module uses the Informer model. To ensure the accuracy of the forecast results, it is necessary to determine the past time step and the future time step.

[0037] Time series forecasting relies on historical data, but the length of the required historical data needs to be determined based on the specific scenario. In some scenarios, the future trend of the data is influenced by long-term change patterns, and a longer time step can yield better results. In other scenarios, the data mainly depends on recent trends, and a shorter time step may be more suitable. Furthermore, the ICEEMDAN feature extraction module relies on data change trends for modal decomposition; if the time step is too short, it may fail to accurately extract feature data. Experiments show that in this scenario, a historical step size of 36 steps yields the best results.

[0038] In time series forecasting, the accuracy of multi-step prediction is crucial. For time-shifted sequences, the number of future steps a system can accurately predict directly determines its ability to detect and correct synchronization attacks. For example, if a system can accurately predict the time shift of the next 5 steps, it can perform time synchronization based on these predictions when a synchronization attack is detected. An alarm will only be triggered if an anomaly is detected five consecutive times. Furthermore, when the time synchronization system becomes inaccurate due to network jitter, the attack detection system can use the prediction results to correct the data, thereby significantly reducing the false positive rate. Experiments have shown that using a future step size of 5 steps yields the best results in this scenario.

[0039] After the prediction model is built, the workflow of the time delay attack detection algorithm is as follows:

[0040] Time synchronization and drift calculation: The slave clock completes a time synchronization with the master clock based on the time synchronization protocol, and the actual time drift t of the slave clock relative to the master clock is calculated. offset .

[0041] Drift Prediction: The time drift prediction model uses data from a past period to predict the possible time drift t during the next three time synchronization processes. offset '.

[0042] Drift Comparison and Judgment: Calculate the actual time drift t offset With the predicted time drift t offset The time synchronization process is considered to be unaffected by network jitter or under attack if the difference between the actual time drift and the predicted value is less than a pre-set threshold. Conversely, if the difference exceeds the threshold, the time synchronization process is considered to be affected by network jitter or under attack. Upon detecting an anomaly, the system will use the predicted value for time synchronization and then start the next round of time synchronization.

[0043] If an anomaly is detected in three consecutive time synchronization attempts, it can be determined that the cause of the anomaly is not network jitter, but rather a possible attack on the time synchronization network. In this case, the system will immediately suspend the time synchronization operation and report the error so that relevant personnel can conduct further investigation and handling.

Claims

1. A method for detecting latency attacks based on ICEEMDAN and INFORMER, characterized in that, Includes the following steps: Step 1: During the periodic time synchronization process, record the time offset of the slave clock relative to the master clock to construct a time offset sequence: Step 2: Process the time-offset sequence by removing outliers and normalizing it. Step 3: Use ICEEMDAN technology to extract features from the processed data; Step 4: Train the INFORMER model based on the extracted features to build a time series prediction model; Step 5: During time synchronization, compare the actual time offset with the predicted time offset to determine whether a time delay attack has occurred, and use the predicted value to correct the time delay if an attack is detected.

2. The method according to claim 1, characterized in that, The data processing steps include: Step 1: Calculate the mean and standard deviation of the time series data; Step 2: Mark and remove outliers that deviate from the mean by more than 5 standard deviations; Step 3: Use the mean substitution method to handle outliers, preserving the continuity and overall characteristics of the time series; Step 4: Perform max-min normalization on the data.

3. The method according to claim 1, characterized in that, The ICEEMDAN technology is used to decompose the time-shifted sequence into several intrinsic mode functions (IMFs) to extract multi-dimensional feature values ​​and improve prediction accuracy.

4. The method according to claim 1, characterized in that, The training of the INFORMER model involves determining the past time step and the future time step, with a historical step of 36 steps and a future step of 5 steps, in order to optimize the prediction performance.

5. The method according to claim 1, characterized in that, The criterion for judging the time delay attack is whether the difference between the actual time offset and the predicted time offset is less than a preset threshold. If an anomaly is detected in three consecutive time synchronization processes, the system is judged to be under attack and an alarm is issued.

Images