Aviation internet service state monitoring and safety operation and maintenance system based on multi-source data

Abstract

The invention relates to an aviation internet service state monitoring and safety operation and maintenance system based on multi-source data, and belongs to the technical field of aviation internet safety operation and maintenance. The system comprises a data acquisition and association module for acquiring and processing multi-source network behavior data in an aeronautical satellite network and generating a structured behavior log; the multi-dimensional query and analysis module is used for receiving combined query conditions and carrying out real-time retrieval and multi-dimensional cross analysis on the logs; the application identification and strategy matching module is used for integrating a tree-shaped application library, extracting and identifying application features in user access behaviors, combining strategy library matching and marking a final access control state for a log; and the exception monitoring and visualization interaction module is used for carrying out real-time monitoring, exception warning and visualization display on the logs and exporting a structured file containing all query conditions and data fields. And deep correlation analysis, precise strategy management and control and real-time safe operation and maintenance of network behaviors of aviation fleet users are realized.

Description

Technical Field

[0001] This invention belongs to the field of aviation internet security operation and maintenance technology, specifically relating to an aviation internet service status monitoring and security operation and maintenance system based on multi-source data. Background Technology

[0002] With the deep integration of air transport and communication technologies, in-flight internet has evolved from an optional value-added service to a core component for enhancing flight competitiveness. The network architecture of in-flight internet is also becoming increasingly complex, forming a multi-level link structure of "satellite link - airborne communication gateway - cabin LAN - terminal equipment," with data sources encompassing various heterogeneous data sources such as satellite communication logs, cabin access point operational data, terminal equipment behavior records, and ground maintenance platform instructions.

[0003] Business expansion and increased architectural complexity place high demands on operations and maintenance, requiring both high reliability and high security. This includes ensuring stable communication at altitudes of 10,000 meters and preventing security risks such as malicious programs, while also achieving full-process control of "early warning, in-process handling, and post-event traceability" to reduce the impact of failures and security incidents.

[0004] However, the current operation and maintenance system has significant bottlenecks and is difficult to adapt to the requirements, specifically manifested in the following ways: Fragmented multi-source data leads to a lack of monitoring dimensions: Existing operation and maintenance systems mostly adopt a "single-point monitoring" mode, with satellite link data being collected independently by ground stations and cabin terminal data being stored locally by the airborne system, and the two lack an effective correlation mechanism.

[0005] Insufficient application identification accuracy and lagging policy matching: Existing systems rely heavily on simple port matching or domain name whitelist mechanisms for application identification, without establishing a refined feature library, resulting in low application identification accuracy. At the same time, access control policies are mostly statically configured and cannot be matched in real time according to the dynamic updates of application classification, which easily leads to "policy misjudgment" or "missed judgment" problems.

[0006] The anomaly monitoring mechanism is rigid and the alarm effectiveness is low: Current anomaly monitoring mostly adopts a fixed threshold trigger mode, without considering the differences in traffic characteristics at different stages of flight takeoff, cruising, and landing. In addition, the alarm information only includes basic traffic data and does not associate it with key information such as application type and policy matching results, requiring maintenance personnel to spend a lot of time to find the root cause of the alarm.

[0007] Weak operational interaction and data traceability capabilities: The visualization of existing systems is mostly based on single-dimensional data lists, lacking cross-dimensional statistical views, making it difficult for operations and maintenance personnel to quickly grasp the overall network operation status; the data export function can only output raw logs, without including metadata information such as query filtering conditions, so when it is necessary to trace and analyze historical faults, it is impossible to reproduce the query scenario at that time, resulting in low audit efficiency. Summary of the Invention

[0008] To address the aforementioned problems in the existing technology, this invention provides an aviation internet service status monitoring and security operation and maintenance system based on multi-source data. The objective of this invention can be achieved through the following technical solutions: A system for monitoring and maintaining the status of aviation internet services based on multi-source data, including: The data acquisition and association module acquires multi-source network behavior data from the satellite network of the aircraft fleet, and cleans, standardizes, and associates the multi-source network behavior data to generate a structured behavior log with a unified timestamp and association identifier. The multi-source network behavior data includes login information, device IP address, accessed domain name, terminal type, application type, original access control results, and policy association information. The multidimensional query and analysis module is connected to the data acquisition and association module. It receives the input combined query conditions and performs real-time retrieval and multidimensional cross-analysis based on the structured behavior log. The combined query conditions include time range, device IP address or address range, terminal type, application category and access control status. The access control status includes record, deny or warning. The application identification and policy matching module integrates a predefined tree-structured application library; it extracts application features from user access behavior from the structured behavior logs, identifies and classifies the application features through the tree-structured application library, and automatically matches them with the access control policy library to label the structured behavior logs with the corresponding access control status. The anomaly monitoring and visualization interaction module performs real-time monitoring and visualization interaction of the structured behavior logs; identifies and alerts on traffic anomalies or policy violations based on preset rules, and displays the query results in list form; responds to the triggered operations of the operation items in the list, and generates a structured file containing all current filter conditions and all data fields based on the export command.

[0009] As a preferred embodiment of the present invention, the cleaning, standardization, and correlation processing of multi-source network behavior data specifically includes: Perform format parsing and field mapping on heterogeneous data from different log sources; Perform validity checks and outlier repairs on IP addresses, timestamps, and device identifiers; Cluster disparate network behavior events into complete session flows based on session identifiers, user IDs, or device fingerprints; For session logs from satellite links of different flights, a unified flight identifier is appended by parsing the mapping relationship between flight number and satellite IP.

[0010] Specifically, the original access control result and policy association information include: the original access control result is a preliminary interception or permission record from the network gateway and firewall; the policy association information includes the policy code, policy name, and policy effective time of the policy that was hit.

[0011] Specifically, the real-time retrieval and multi-dimensional cross-analysis include: establishing an inverted index of the structured behavior log in memory or cache, performing Boolean combination queries and second-level responses on time, IP, application type, and status dimension conditions, and generating cross-dimensional statistical analysis views.

[0012] Specifically, the tree-structured application library is a predefined knowledge base containing at least three levels of nodes: application category, application subcategory, and specific application. The leaf nodes are associated with the protocol characteristics, domain name characteristics, or traffic behavior characteristics of the specific application.

[0013] Specifically, the application features in the user access behavior include: features extracted through deep packet inspection or traffic behavior analysis techniques, including at least the domain name or IP address accessed, the transport layer or application layer protocol used, specific identifiers in the payload, and the connection mode.

[0014] Specifically, the identification and classification includes: matching the extracted application features with the features pre-stored in the leaf nodes of the tree-structured application library, classifying them into the most matching specific application node based on the matching degree, and inheriting the corresponding application category and sub-category information.

[0015] Specifically, the automatic matching with the access control policy library includes: traversing all effective policy rules in the access control policy library based on the identified application category, the target address of the access, and the user identity; executing the first matching or optimal matching logic, and using the matched policy decision as the basis for access control.

[0016] Specifically, the policy rules in the access control policy library are defined by at least the following elements: rule priority, matching conditions, and execution actions; wherein, the matching conditions may include application category, target address, user group, and time period; and the execution actions include allow, deny, and alarm.

[0017] Specifically, the identification and alerting of traffic anomalies based on preset rules includes: Set a dynamic traffic alarm baseline for each device IP or flight; By associating all device IPs under the same flight number, flight-level aggregated traffic analysis is performed, and the traffic alarm baseline is dynamically adjusted based on the flight stage. The system monitors uplink and downlink traffic rates in real time. When the real-time traffic rate continuously exceeds the traffic alarm baseline within a preset time window, a traffic anomaly alarm is triggered.

[0018] Specifically, the identification and alerting of policy violations based on preset rules includes: setting global or group access bans for preset high-risk application categories; monitoring all access records, and triggering a policy violation alert when an access behavior that matches the ban category and whose access control status is not denied is detected.

[0019] Specifically, the structured file adopts a composite document structure, which includes: the first part is the metadata area, which records in the form of key-value pairs or natural language descriptions each combined query condition and its specific value that takes effect in the interactive interface when the file is generated; the second part is the main data area, which organizes all data field contents corresponding to the current query result in a table format by rows and columns.

[0020] The beneficial effects of this invention are as follows: Deep integration of multi-source data builds a fully traceable operational data foundation: The data collection and association module uniformly collects login information, device IPs, and other types of data. After format parsing, verification and repair, session clustering, and flight identifier appending, standardized logs are generated. By associating "session identifier - device fingerprint - flight identifier," a complete "device - flight - application - behavior" link is constructed, helping operations personnel quickly trace from a single anomaly to the flight link status and historical device operations, while improving data accuracy and providing reliable support for subsequent work.

[0021] Second-level multidimensional query response significantly improves operational and maintenance analysis efficiency: The multidimensional query module builds inverted indexes in memory / cachate to achieve second-level combined queries of multidimensional conditions, solving the problem of long query times in traditional systems. Operations and maintenance personnel can quickly locate target data (such as access denial records of a certain type of terminal during the cruising phase of a specific flight), generate cross-dimensional statistical views, and upgrade analysis from "single-point troubleshooting" to "global insight," significantly shortening fault location time and reducing operation and maintenance costs.

[0022] Precise application identification and dynamic policy matching enhance security control capabilities: The application identification module relies on a three-level tree-structured application library and deep feature extraction technology to extract multi-dimensional features such as domain names and protocols and match them with features in the library, significantly improving the identification accuracy of encrypted and niche applications. Combining multi-condition policy matching based on "application category - target address - user identity" and priority logic, dynamic policy adaptation is achieved, avoiding misjudgments due to static policies. Based on the initial interception results from the gateway, secondary matching and labeling are used to accurately control the status, strengthening security control and meeting the high security requirements of aviation.

[0023] Dynamic anomaly alerts and convenient interaction enable end-to-end operation and maintenance management: The anomaly monitoring module abandons the fixed threshold alert mode, setting dynamic traffic baselines for devices and flights based on flight phases to reduce false alarm rates; combined with high-risk application prohibition monitoring, it quickly identifies violations and pushes complete alerts containing "anomaly cause-device-evidence". The visualization module provides multiple display formats and supports exporting files containing query condition metadata and complete fields, solving the problem of "unreproducible scenarios" in traditional data, improving audit efficiency, and meeting compliance requirements. Attached Figure Description

[0024] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0025] Figure 1 This is a flowchart illustrating an aviation internet service status monitoring and security operation and maintenance system based on multi-source data, according to the present invention. Figure 2 This is an architecture diagram of the tree-structured application library of the present invention; Figure 3 This is a schematic diagram of the filtering panel on the main interface of the system of the present invention; Figure 4 This is a schematic diagram of the list interface of the data display area of ​​the system of the present invention; Figure 5 This is a schematic diagram of the interface of the time range filtering component in the system of the present invention. Detailed Implementation

[0026] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided.

[0027] Please see Figure 1-5 A system for monitoring and maintaining the status of aviation internet services based on multi-source data, including: The data acquisition and association module acquires multi-source network behavior data from the satellite network of the aircraft fleet, and cleans, standardizes, and associates the multi-source network behavior data to generate a structured behavior log with a unified timestamp and association identifier. The multi-source network behavior data includes login information, device IP address, accessed domain name, terminal type, application type, original access control results, and policy association information. The multidimensional query and analysis module is connected to the data acquisition and association module. It receives the input combined query conditions and performs real-time retrieval and multidimensional cross-analysis based on the structured behavior log. The combined query conditions include time range, device IP address or address range, terminal type, application category and access control status. The access control status includes record, deny or warning. The application identification and policy matching module integrates a predefined tree-structured application library; it extracts application features from user access behavior from the structured behavior logs, identifies and classifies the application features through the tree-structured application library, and automatically matches them with the access control policy library to label the structured behavior logs with the corresponding access control status. The anomaly monitoring and visualization interaction module performs real-time monitoring and visualization interaction of the structured behavior logs; identifies and alerts on traffic anomalies or policy violations based on preset rules, and displays the query results in list form; responds to the triggered operations of the operation items in the list, and generates a structured file containing all current filter conditions and all data fields based on the export command.

[0028] This embodiment uses the satellite network operation and maintenance scenario of an airline fleet as an example to illustrate the specific implementation process of this system.

[0029] This system is deployed on the airline's ground operations and maintenance center server cluster. It establishes connections with equipment such as the fleet's satellite communication gateway, cabin access points (APs), and airborne firewalls through communication interfaces, and receives multi-source network behavior data in real time. Terminal operations and maintenance equipment accesses the system through a browser, supporting access control for roles such as administrators and security auditors. The "data export" function is only available to administrators.

[0030] Implementation process of each module (I) Data Acquisition and Correlation Module Data Acquisition: Through distributed acquisition nodes, multi-source network behavior data from the aircraft fleet satellite network is acquired synchronously, including user login account and login time, device IP address, accessed domain name (e.g., quic.msf.qq.com), terminal type, application type, original access control results (allow / block) output by satellite gateway and firewall, policy code of hit policy (e.g., KD-01-F10-UB), policy name and effective time, etc.

[0031] Data processing: Format parsing and field mapping: JSON format parsing is performed on heterogeneous data such as satellite gateway logs and cabin AP logs, and fields such as "terminal identifier" and "access address" from different log sources are uniformly mapped to system standard fields; Validity verification and repair: The IPv4 address format verification rules are used to verify the legality of the device IP. IPs with incorrect formats are marked as "invalid", and missing timestamps are filled in according to the synchronization time of the collection node. Session clustering and association: Based on session identifier, user ID, or device fingerprint, dispersed access events of the same terminal are clustered into complete session streams, and an association identifier (composed of session ID and device fingerprint) is generated. Flight Identifier Attachment: By using a preset flight number and satellite IP mapping table, a uniform aircraft tail number (e.g., B-6099) and flight number (e.g., MU538) are attached to each session log to achieve "device-flight" data association.

[0032] Log generation: Finally, a structured behavior log with ISO 8601 standard unified timestamp (format: year-month-day hour:minute:second) and associated identifier is generated and stored in the system database.

[0033] (II) Multidimensional Query and Analysis Module Index building: An inverted index is built in the system memory for structured behavior logs. The index fields include core fields such as timestamp, device IP, terminal type, application category, and access control status, and incremental updates are supported.

[0034] Combined query condition configuration: Operations personnel can enter query conditions through the filter panel at the top of the system's main interface, specifically including: Time range: Supports selection of any start and end time within 31 days, with time precision up to hours:minutes:seconds. The default query range is from 00:00:00 to 23:59:59 of the current day (same as the date filtering interface in the uploaded file). Device IP: Supports up to 10 IP addresses or IP ranges, separated by commas (e.g., "10.181.108.116,192.168.1.0 / 24"). Terminal type: Select from the drop-down menu. The available types include seven categories: mobile terminal, personal computer, shared terminal, dumb terminal, medical device, network device, and customized terminal. Application Categories: Use the "Application Filter" button to access a tree-like application library for selection; Access control status: Select from three statuses: "Log", "Deny", and "Warning".

[0035] Real-time retrieval and analysis: After receiving the query conditions, the system performs a Boolean combination query through the inverted index to achieve a real-time response and generate a multi-dimensional cross-analysis view of "device IP-flight number-application category-access status", which is displayed in the data display area in the middle of the main interface.

[0036] (III) Application Identification and Strategy Matching Module Tree-structured application library configuration: Integrates AC's predefined three-level tree-structured application library. The first-level node is the application category (such as download tool, communication tool), the second-level node is the application subclass, the third-level node is the specific application (such as download tool / Baidu Assistant), and the leaf nodes are associated with the protocol characteristics, domain name characteristics and traffic behavior characteristics of the specific application.

[0037] Application Feature Extraction: From structured behavior logs, application features of user access behavior are extracted using deep packet inspection (DIP) technology. These features include the domain name or IP address accessed, the transport layer (TCP / UDP) or application layer (HTTP / HTTPS) protocol used, specific identifiers in the payload, and the connection mode.

[0038] Application identification and classification: The extracted application features are matched with the pre-stored features of the leaf nodes in the tree-structured application library. Based on the matching results, the application is classified into the corresponding specific application node, inheriting its major category and sub-category information; applications that are not matched are marked as "unknown type".

[0039] Policy matching and status labeling: Based on the identified application category, target IP and user identity, the effective rules in the access control policy library are traversed from high to low priority. The "first match" logic is executed, and the matching result is labeled as the access control status in the structured behavior log. The labeling result is "record", "deny" or "warning", and the corresponding policy code and name are associated.

[0040] (iv) Anomaly Monitoring and Visual Interaction Module Real-time monitoring and alerts: Traffic anomaly monitoring: Based on preset rules, a dynamic traffic baseline is set for each device IP and flight. The baseline is dynamically adjusted in combination with the traffic characteristics of the three stages of flight takeoff, cruising, and landing. Uplink and downlink traffic rates are monitored in real time. When the traffic continuously exceeds the baseline, an anomaly alarm is triggered. Policy violation monitoring: Pre-set global access bans for high-risk application categories (such as malicious programs), monitor all access records, and trigger a policy violation alert if behavior that matches the category and the access control status is not "denied".

[0041] Visual presentation: The data display area presents the query results in a list format, including fields such as device IP, terminal type, aircraft tail number, flight number, target IP, access domain name, URL address, and DNS. The access domain field supports automatic truncation of excessively long content, displaying the first twenty characters by default, and showing the full domain name when the mouse hovers over it. Access control status is distinguished by visual indicators: a green circle indicates "recorded", a red circle indicates "denied", and a yellow circle indicates "warning".

[0042] Detailed query and data export: Detailed Inquiry: Click the "Details" action item in the list to bring up a details pop-up window, displaying complete information including fifteen fields such as website category, decryption status, and policy association; Data Export: Click the "Export" button on the right side of the interface to generate a structured file in Excel format. The file contains two parts: the first part is the metadata area, which records all effective combined query conditions and their specific values; the second part is the main data area, which organizes all field contents of the query results in a table format.

[0043] Specifically, the cleaning, standardization, and correlation processing of multi-source network behavior data includes: Perform format parsing and field mapping on heterogeneous data from different log sources; Perform validity checks and outlier repairs on IP addresses, timestamps, and device identifiers; Cluster disparate network behavior events into complete session flows based on session identifiers, user IDs, or device fingerprints; For session logs from satellite links of different flights, a unified flight identifier is appended by parsing the mapping relationship between flight number and satellite IP.

[0044] This embodiment uses a transcontinental flight (flight number MU588, tail number B-5948) of an A330 fleet belonging to a major domestic airline as the application scenario. The system is deployed at the Shanghai Pudong Airport ground operations and maintenance center, and the data collection covers the entire link from "satellite communication gateway - cabin AP - airborne firewall - ground operations and maintenance platform". The specific processing procedure is as follows: I. Prerequisites for Implementation 1. Clear source of multi-source logs: including three types of core heterogeneous logs: Syslog format access logs output by the satellite communication gateway, JSON format terminal connection logs output by the cabin Wi-Fi access point (AP), and CSV format access control logs output by the airborne firewall; 2. Basic configuration complete: Pre-configured "flight number-satellite IP" mapping table, device identifier rule base, and system standard field dictionary (including 18 required fields such as device identifier, access address, and operation time).

[0045] II. Specific Processing Procedure 1: Heterogeneous data format parsing and field mapping The system synchronously receives three types of heterogeneous logs from the target flight through the distributed nodes of the data acquisition and association module, and performs targeted parsing and field alignment based on different format characteristics: Satellite gateway Syslog logs: After parsing the raw content, the fields "source IP, destination IP, protocol type (, access port, collection time)" are extracted and mapped to the system standard fields "device IP", "destination IP", "transmission protocol", "access port" and "raw timestamp" respectively. Cabin AP JSON log: After parsing the original content, extract the fields "Terminal MAC, Connection Time, Terminal Type" and map them to the system standard fields "Device Identifier", "Terminal Connection Time", and "Terminal Type"; Airborne firewall CSV logs: After parsing the original content, extract the fields "access time, terminal IP, control result, and policy ID" and map them to the system standard fields "access time", "device IP", "original access control result", and "policy code".

[0046] 2: Verification of IP address, timestamp, and device identifier validity and repair of outliers Validation is performed on the parsed key fields based on a pre-built rule base, and repair operations are performed on abnormal data. IP address verification: IPv4 address regular expression verification is used. When an invalid IP is found in a log, it is marked as "IP format error" and associated with the corresponding AP node for easy manual verification later. Timestamp verification and repair: The original timestamps in the satellite gateway logs are in UTC time zone, and the system automatically converts them to East 8 time zone; a cabin AP log is missing a connection time, which is supplemented according to the NTP synchronization time of the acquisition node; Device identifier verification: If the last two digits of the MAC address of a terminal log are missing, the last two digits are missing. The MAC address is then repaired by matching the historical MAC information of the same IP segment with the connection records of the cabin AP.

[0047] 3: Clustering based on association keys to form a complete session stream The system uses "device IP + terminal MAC" as the core association key, combined with session identifiers, to aggregate scattered network behavior events into a complete session stream: 4: Add a unified flight identifier The system calls the pre-set "flight number-satellite IP" mapping table, parses the network segment to which the source IP of the satellite gateway log in the session stream belongs, matches the corresponding flight information, and uniformly adds the flight identifier to all logs in the session stream, ultimately generating a structured behavior log.

[0048] After the above processing, the originally scattered heterogeneous logs are transformed into structured behavior logs containing unified timestamps, flight identifiers, and session identifiers. The data integrity is improved compared to the original logs, and can directly support subsequent business calls from multi-dimensional queries, application identification, and anomaly monitoring modules.

[0049] Specifically, the original access control result and policy association information include: the original access control result is a preliminary interception or permission record from the network gateway and firewall; the policy association information includes the policy code, policy name, and policy effective time of the policy that was hit.

[0050] Specifically, the real-time retrieval and multi-dimensional cross-analysis include: establishing an inverted index of the structured behavior log in memory or cache, performing Boolean combination queries and second-level responses on time, IP, application type, and status dimension conditions, and generating cross-dimensional statistical analysis views.

[0051] In this embodiment, the inverted index is an indexing method that associates the specific value of each "key field" in the dataset with the "original data record containing that value". In this system, the "original data record" is the structured behavior log (each log entry corresponds to a unique log ID), and the "key field" is the core field supporting multi-dimensional queries (timestamp, device IP, application type, access control status, etc.). Through this index, when operations personnel input query conditions such as "a certain IP range + denial status", the system does not need to traverse all logs; it can directly locate the log set that meets the conditions through the index, achieving a rapid response.

[0052] The system builds and maintains an inverted index in memory or cache to ensure that retrieval speed is not limited by disk I / O. Its construction process is fully adapted to the characteristics of structured behavior logs. To meet multi-dimensional query requirements, four core fields were selected as index keys and standardized preprocessing was performed to ensure the accuracy of query matching: Timestamps: uniformly converted to "YYYY-MM-DD HH:MM:SS" format, supporting aggregated indexing at the minute granularity; Device IP: Standardized according to IPv4 format, supporting IP segment indexing (e.g., for the 192.168.1.0 / 24 network segment, the index key is "192.168.1" and it is associated with all specific IPs within that network segment). Application type: Serialized according to the classification criteria of the tree-structured application library (e.g., download tools / Baidu Assistant corresponding to the index key "DOWNLOAD_BAIDU_ASSISTANT"); Access control status: uniformly mapped to three fixed index keys: “RECORD”, “REJECT”, and “WARNING” to avoid ambiguity.

[0053] The combined query conditions entered by the operations and maintenance personnel will be transformed into multiple rounds of index queries and result intersection operations through the inverted index. The specific process is as follows: Field splitting: The combined conditions are split into four independent query sub-conditions: timestamp, device IP (192.168.3), application type, and access control status; Single-field index query: Query the log ID set corresponding to each sub-condition to obtain the result set of time dimension, IP dimension, application type dimension, and status dimension; Boolean intersection: Perform an AND operation on the four result sets to obtain a set of log IDs that simultaneously satisfy all conditions; Log retrieval and display: Quickly locate the original structured behavior logs by log ID, generate cross-dimensional statistical views (such as "access denial statistics for this IP within the target time period") and return them to the front end.

[0054] Throughout the process, index queries and Boolean operations are performed in memory, avoiding the time-consuming operations of traditional disk retrieval and ultimately achieving a response time in seconds. Considering the real-time generation characteristics of aviation internet logs, the system adopts an "incremental update" mechanism to maintain the inverted index: every 5 minutes, newly generated structured behavioral logs are used to build index fragments according to field rules and merged with the original index; at the same time, historical indexes older than 31 days are cleaned up periodically (matching the system's time range filtering limit) to ensure efficient use of memory resources and maintain stable retrieval performance.

[0055] Specifically, the tree-structured application library is a predefined knowledge base containing at least three levels of nodes: application category, application subcategory, and specific application. The leaf nodes are associated with the protocol characteristics, domain name characteristics, or traffic behavior characteristics of the specific application.

[0056] Specifically, the application features in the user access behavior include: features extracted through deep packet inspection or traffic behavior analysis techniques, including at least the domain name or IP address accessed, the transport layer or application layer protocol used, specific identifiers in the payload, and the connection mode.

[0057] Specifically, the identification and classification includes: matching the extracted application features with the features pre-stored in the leaf nodes of the tree-structured application library, classifying them into the most matching specific application node based on the matching degree, and inheriting the corresponding application category and sub-category information.

[0058] This embodiment is based on the cabin internet operation and maintenance scenario of a domestic airline fleet. The system's application identification and policy matching module is deployed on the edge computing node of the ground operation and maintenance center. It realizes the whole process from feature extraction to accurate classification for communication, office, and entertainment applications commonly used by onboard users. The specific implementation process is as follows: I. Prerequisites for Implementation 1. Hardware support: Deploy network probes with deep packet inspection (DPI) capabilities, connect to the link between the cabin AP and the satellite gateway, and capture data packets accessed by users in real time; 2. Basic Configuration: Complete the predefined configuration of the three-level tree structure application library, with leaf nodes in the library associated with the feature parameters of various applications; configure feature extraction rules, and clarify the field range of deep packet inspection and the indicators for traffic behavior analysis.

[0059] II. Core Implementation Process 1: Build a three-level tree-structured application library The application library adopts a three-level node architecture of "application category - application subclass - specific application". It is predefined by XML files and loaded into the system. The leaf nodes (specific applications) have characteristics that include at least two of the following: protocol, domain name, and traffic behavior. The application library supports dynamic updates. When a new aviation-specific application (such as an in-flight shopping platform) is added, new third-level nodes and associated features can be added through the operation and maintenance interface, and the changes will take effect without restarting the system.

[0060] 2: Extract application characteristics of user access behavior The system uses deep packet inspection and traffic behavior analysis techniques to extract features from the access behavior of a cabin terminal. A network probe captures network data packets from the terminal, covering both TCP and UDP protocols; it analyzes the application layer payload and protocol header of the data packets to extract key features—the access domain name, transport layer protocol, and partial data packet payload; through traffic statistics analysis, it discovers that the terminal uses a high-frequency interaction mode, with single connections lasting 1-3 seconds, lacking long-term stable transmission traffic characteristics, significantly different from the traffic patterns of file downloads and video playback; finally, the extracted application feature set is summarized.

[0061] 3: Application of Feature Matching and Classification The system calls the tree-structured application library to match the extracted feature set with the pre-stored features of the leaf nodes in the library. Based on the traffic characteristics of "high-frequency short connections" and the feature tags of the "social communication" subclass, it prioritizes matching all leaf nodes under the "instant messaging - social communication" branch, excluding irrelevant categories such as office collaboration and online entertainment to reduce the amount of matching calculations. The cosine similarity algorithm was used to calculate the matching degree between the extracted features and the pre-stored features of each leaf node. The matching degree with "WeChat (mobile)" was the highest, with the three core features of domain name, protocol, and payload identifier matching completely, the connection mode feature matching degree reaching 90%, and the overall matching degree being 95%. The matching degree with "WeChat for Business" was only 30% (only the protocol part matched, the domain name and payload identifier did not match). Because the overall matching degree was higher than the system's preset threshold of 80%, the access behavior of this terminal was classified into the "Instant Messaging - Social Communication - WeChat (mobile)" node, and automatically inherited the major category identifier of "Instant Messaging" and the subcategory identifier of "Social Communication". After application identification and classification are completed, the system writes the classification results to a structured behavior log, adding three new fields: "Application Category," "Application Subcategory," and "Specific Application," with corresponding values ​​of "Instant Messaging," "Social Communication," and "WeChat (Mobile)." This result will be synchronized to the multi-dimensional query module and the policy matching module, supporting subsequent operational operations such as "filtering logs by application type" and "matching access control policies based on WeChat applications."

[0062] Specifically, the automatic matching with the access control policy library includes: traversing all effective policy rules in the access control policy library based on the identified application category, the target address of the access, and the user identity; executing the first matching or optimal matching logic, and using the matched policy decision as the basis for access control.

[0063] Specifically, the policy rules in the access control policy library are defined by at least the following elements: rule priority, matching conditions, and execution actions; wherein, the matching conditions may include application category, target address, user group, and time period; and the execution actions include allow, deny, and alarm.

[0064] Based on the application identification results of "Instant Messaging - Social Communication - WeChat (Mobile)" mentioned above, this embodiment enters the access control policy matching stage. This stage focuses on the cabin terminal, traversing the effective rules in the policy library and executing the initial matching logic to determine the final access control decision. The specific implementation process is as follows: 1. Prerequisites for implementation The application identification results (application category: instant messaging, application subcategory: social communication, specific application: WeChat (mobile)), access target address, and user identity information (login account associated with "ordinary passenger group" via cabin Wi-Fi) have been obtained. The access control policy library is deployed on the ground operation and maintenance node in the form of a relational database, which supports traversing rules in "priority descending order". All effective rules are marked as "enabled", and invalid rules are marked as "disabled" and excluded from the traversal scope.

[0065] 2. Core Implementation Process The policy rules are sorted from highest to lowest priority, with lower priority values ​​indicating higher priority. Each rule element includes "rule priority, matching conditions, execution action, and rule description," covering typical scenarios such as high-risk blocking, allowing office applications, and managing specific user groups. The system iterates through the effective rules in descending order of priority, and performs the initial matching logic based on the terminal's matching elements (application category, target address, user group). The specific process is as follows: Determine matching elements: Clarify the core matching parameters of the current terminal -- application category (major category: instant messaging, subcategory: social communication), target address (wx.qq.com, domestic domain name), user group (ordinary passenger group), and current time period (flight cruising phase 10:15-10:20). Traversal rule POL-001 (priority 1): The matching condition is "Application Category: Malicious Program". If it does not match the current "Instant Messaging" application category, skip this rule. Traversal rule POL-002 (priority 2): The matching condition is "Application Category: Office Collaboration", which does not match the "Instant Messaging" application category, so this rule is skipped; Traversal rule POL-003 (priority 3): The matching condition is "Application subclass: social communication + user group: ordinary passenger + target address: domestic domain name", which is completely consistent with all matching elements of the current terminal. The first matching logic is triggered, and subsequent rule traversal is stopped. Determine the action to be taken: Based on the definition of the POL-003 rule, generate an access control decision of "allow access + record access log", and associate the rule ID (POL-003) with the rule name ("Ordinary Passenger Social Communication Allow Rule").

[0066] If the current terminal is accessing an overseas social application (the target address is an overseas domain name), then the POL-003 rule does not match, and the process continues to the POL-005 fallback rule, executing the "warning + logging" action.

[0067] 3. Implementation Output Results After policy matching is completed, the system writes the following information to the structured behavior log: access control status (allowed), matching rule ID (POL-003), rule name (social communication permission rule for ordinary passengers), and execution action details (allowing access to wx.qq.com, which has been recorded in the log). This result is synchronized to the anomaly monitoring module (without triggering alarms) and the visualization interaction module. Operations personnel can quickly trace the matching basis through the "rule ID" to support compliance auditing of access behavior.

[0068] Specifically, the identification and alerting of traffic anomalies based on preset rules includes: Set a dynamic traffic alarm baseline for each device IP or flight; By associating all device IPs under the same flight number, flight-level aggregated traffic analysis is performed, and the traffic alarm baseline is dynamically adjusted based on the flight stage. The system monitors uplink and downlink traffic rates in real time. When the real-time traffic rate continuously exceeds the traffic alarm baseline within a preset time window, a traffic anomaly alarm is triggered.

[0069] Specifically, the identification and alerting of policy violations based on preset rules includes: setting global or group access bans for preset high-risk application categories; monitoring all access records, and triggering a policy violation alert when an access behavior that matches the ban category and whose access control status is not denied is detected.

[0070] Specifically, the structured file adopts a composite document structure, which includes: the first part is the metadata area, which records in the form of key-value pairs or natural language descriptions each combined query condition and its specific value that takes effect in the interactive interface when the file is generated; the second part is the main data area, which organizes all data field contents corresponding to the current query result in a table format by rows and columns.

[0071] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. An aviation internet service status monitoring and security operation and maintenance system based on multi-source data, characterized in that, include: The data acquisition and association module acquires multi-source network behavior data from the satellite network of the aircraft fleet, and cleans, standardizes, and associates the multi-source network behavior data to generate a structured behavior log with a unified timestamp and association identifier. The multi-source network behavior data includes login information, device IP address, accessed domain name, terminal type, application type, original access control results, and policy association information. The multidimensional query and analysis module is connected to the data acquisition and association module. It receives the input combined query conditions and performs real-time retrieval and multidimensional cross-analysis based on the structured behavior log. The combined query conditions include time range, device IP address or address range, terminal type, application category and access control status. The access control status includes record, deny or warning. The application identification and policy matching module integrates a predefined tree-structured application library; it extracts application features from user access behavior from the structured behavior logs, identifies and classifies the application features through the tree-structured application library, and automatically matches them with the access control policy library to label the structured behavior logs with the corresponding access control status. The anomaly monitoring and visualization interaction module performs real-time monitoring and interactive visualization of the structured behavior logs; Based on pre-defined rules, abnormal traffic or policy violations are identified and alerted, and the query results are displayed in list form. Respond to triggered operations on the list items and, based on the export instructions, generate a structured file containing all current filter conditions and all data fields.

2. The system according to claim 1, characterized in that, The cleaning, standardization, and correlation processing of multi-source network behavior data specifically includes: Perform format parsing and field mapping on heterogeneous data from different log sources; Perform validity checks and outlier repairs on IP addresses, timestamps, and device identifiers; Cluster disparate network behavior events into complete session flows based on session identifiers, user IDs, or device fingerprints; For session logs from satellite links of different flights, a unified flight identifier is appended by parsing the mapping relationship between flight number and satellite IP.

3. The system according to claim 1, characterized in that, The original access control results and policy association information specifically include: the original access control results are preliminary interception or permission records from the network gateway and firewall; the policy association information includes the policy code, policy name, and policy effective time of the policy that was hit.

4. The system according to claim 1, characterized in that, The real-time retrieval and multi-dimensional cross-analysis specifically include: establishing an inverted index for the structured behavior log in memory or cache, performing Boolean combination queries and receiving second-level responses for time, IP, application type, and status dimension conditions, and generating cross-dimensional statistical analysis views.

5. The system according to claim 1, characterized in that, The tree-structured application library is a predefined knowledge base containing three levels of nodes: application category, application subcategory, and specific application. The leaf nodes are associated with the protocol characteristics, domain name characteristics, or traffic behavior characteristics of the specific application.

6. The system according to claim 1, characterized in that, The application features in the user access behavior specifically include those extracted through deep packet inspection or traffic behavior analysis techniques. The extracted features include at least the domain name or IP address accessed, the transport layer or application layer protocol used, specific identifiers in the payload, and the connection mode.

7. The system according to claim 1, characterized in that, The identification and classification process specifically includes: matching the extracted application features with the features pre-stored in the leaf nodes of the tree-structured application library, classifying them according to the matching degree to the most matching specific application node, and inheriting the corresponding application category and sub-category information.

8. The system according to claim 1, characterized in that, The automatic matching with the access control policy library specifically includes: traversing all effective policy rules in the access control policy library based on the identified application category, the target address of the access, and the user identity; executing the optimal matching logic, and using the matched policy decision as the basis for access control.

9. The system according to claim 8, characterized in that, The policy rules in the access control policy library are defined by at least the following elements: rule priority, matching conditions, and execution actions; wherein, the matching conditions may include application category, target address, user group, and time period; the execution actions include allow, deny, and alarm.

10. The system according to claim 1, characterized in that, The method of identifying and alerting on abnormal traffic based on preset rules specifically includes: Set a dynamic traffic alarm baseline for each device IP or flight; By associating all device IPs under the same flight number, flight-level aggregated traffic analysis is performed, and the traffic alarm baseline is dynamically adjusted based on the flight stage. Real-time monitoring of uplink and downlink traffic rates; triggering a traffic anomaly alarm when real-time traffic continuously exceeds the traffic alarm baseline within a preset time window.

11. The system according to claim 1, characterized in that, The identification and alerting of policy violations based on preset rules includes: setting global or group access bans for preset high-risk application categories; monitoring all access records, and triggering a policy violation alert when an access behavior that matches the ban category and whose access control status is not denied is detected.

12. The system according to claim 1, characterized in that, The structured file adopts a composite document structure, specifically including: the first part is the metadata area, which records in the form of key-value pairs or natural language descriptions each combined query condition and its specific value that takes effect in the interactive interface when the file is generated; the second part is the main data area, which organizes all data field contents corresponding to the current query result in a table format by rows and columns.

Images