A hierarchical classification anomaly detection method for satellite information behavior

Abstract

This invention relates to the field of space information security technology, specifically a method for hierarchical classification and anomaly detection of satellite information behavior, comprising the following steps: Step 1, establishing a set of main elements B and a set of action elements A by referring to the satellite system; Step 2, establishing a set of onboard information security threat behaviors M; Step 3, analyzing satellite information behavior M... i Decompose; Step 4, analyze satellite information behavior M i Step 5: Calculate the distribution attributes of the k behaviors in the data; Step 6: Calculate the satellite information behavior M. i Step 6: Calculate the anomaly detection probability of k behaviors in the data; Step 7: Calculate the satellite information behavior M. i The invention first establishes a satellite behavior model and a mathematical description of satellite information behavior. Based on this model, a hierarchical classification-based joint detection model for behavioral anomalies is proposed. By dividing joint behavior into multi-level, multi-class single behavior classifications, the performance of single behavior detection is analyzed to obtain the joint detection performance. An anomaly detection method and process are then proposed.

Description

Technical Field

[0001] This invention relates to the field of space information security technology, specifically a method for hierarchical classification and anomaly detection of satellite information behavior. Background Technology

[0002] With the development of satellite information systems, the information system characteristics of satellite systems are becoming increasingly prominent. How to quantitatively describe, model, and process satellite behavior from the perspective of information behavior is one of the fundamental and key research areas that the industry needs to explore in the current and future development of satellite information systems.

[0003] Current satellite information systems vary considerably, having progressed through different stages including data management subsystems, satellite operations subsystems, integrated electronic subsystems, and information subsystems. With the installation of operating systems like HarmonyOS on the "Dalian-1-Lianli Satellite" commercial satellite, the information behavior characteristics of satellite systems are becoming increasingly prominent, highlighting their transformation from traditional on-orbit actuators to on-orbit information systems. During satellite information behavior operations, disturbances or anomalies may occur. Furthermore, satellite information behavior is complex and diverse, yet possesses certain probabilistic and statistical characteristics. Therefore, key issues in satellite information behavior control include how to model satellite information behavior, implement hierarchical and categorized control of satellite information behavior, and conduct comprehensive anomaly detection based on different categories of satellite information behavior. Summary of the Invention

[0004] The purpose of this invention is to provide a hierarchical classification anomaly detection method for satellite information behavior to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: A hierarchical classification anomaly detection method for satellite information behavior includes the following steps: Step 1: By referring to the satellite system, establish the main element set B and the action element set A; Step 2: Establish a set of spaceborne information security threat behaviors, M; Step 3, analyze satellite information behavior M i Decompose; Step 4: Analyze satellite information behavior M i Determine the distribution attributes of the k items in the data; Step 5: Calculate satellite information behavior M i The probability of anomaly detection for k behaviors in the dataset; Step 6: Calculate the satellite information behavior M i The probability of joint anomaly detection.

[0006] Preferably, step 1 specifically includes: The main element set B is represented as follows: (1); In equation (1), Let N represent the i-th type of main element, where N is a natural number; The action element set A is represented as follows: (2); In equation (2), This represents the i-th action element.

[0007] Preferably, step 2 specifically includes: The satellite information behavior set M is represented as follows: M=B A (3); In equation (2), B represents the connector symbol. A represents the set of main elements, while B represents the set of action elements. For the element M in the set of spaceborne information security threat behaviors i It is obtained by calculation using the following formula: (4); In equation (4), M i This represents the i-th type of satellite information behavior. Indicates main element B i Action Element A i .

[0008] Preferably, step 3 specifically includes: M i Further decomposed into the joint behavior of J items: (5); In equation (4), express The k-th behavior after decomposition.

[0009] Preferably, step 4 specifically includes: right Perform anomaly detection and test statistic. : (6); If the statistic If the following formula is satisfied, then It conforms to the characteristics of a Gaussian distribution: (7); Equation (7), This represents the k-th action that follows a Gaussian distribution. The mean is The variance is Gaussian distribution; If the statistic If the following formula is satisfied, then It conforms to the characteristics of uniform distribution: (8); Equation (8), Let U(a,b) represent the k-th behavior that conforms to a uniform distribution, where U(a,b) represents a uniform distribution in the interval [a,b], where a represents the lower limit of the interval and b represents the upper limit of the interval. If the statistic If the following formula is satisfied, then It conforms to the characteristics of a Poisson distribution: (9); In equation (9), Let represent the k-th action that follows a Poisson distribution. This means that the mean is The Poisson distribution.

[0010] Preferably, step 5 specifically includes: The judgment criteria for hypothesis testing are: (10); In equation (10), , This indicates a special code for hypothesis testing; like It conforms to the characteristics of a Gaussian distribution and is calculated according to the following formula. Anomaly detection probability: (11); In equation (11), M represents the Gaussian distribution k The probability of anomaly detection. Let denote the decision threshold of the Gaussian distribution. Indicates intermediate variables. Represents the Q function; like It conforms to the characteristics of a uniform distribution and is calculated according to the following formula. Anomaly detection probability: (12); In equation (12), M represents a uniform distribution k The probability of anomaly detection. This represents the lower limit of the decision threshold for a uniform distribution. This represents the upper limit of the decision threshold for a uniform distribution; like It conforms to the characteristics of a Poisson distribution and is calculated according to the following formula. Anomaly detection probability: (13); In equation (13), M represents the Poisson distribution k The probability of anomaly detection. This represents the decision threshold of the Poisson distribution. Represents natural numbers.

[0011] Preferably, step 6 specifically includes: Satellite Information Behavior M i The joint anomaly detection probability P Mi The calculation is as follows: (14); In equation (14), The variance represents the Gaussian distribution that the location follows; Representative: If the k-th action follows a Gaussian distribution, then retain... If the k-th behavior follows a uniform distribution, then retain... If the k-th action follows a Poisson distribution, then retain... .

[0012] Compared with the prior art, the beneficial effects of the present invention are: This invention addresses the problem of detecting anomalies in satellite information behavior. Combining the probabilistic and statistical characteristics of satellite information behavior, it first establishes a satellite behavior model and a mathematical description of satellite information behavior. Based on this model, a hierarchical classification-based joint detection model for behavioral anomalies is proposed. By dividing the joint behavior into multi-level, multi-category single behavior classifications, the performance of single behavior detection is analyzed, thereby obtaining the joint detection performance. An anomaly detection method and process are also proposed. This invention provides a solution for detecting anomalies in satellite behavior from an information perspective, offering technical support for the future development of space information security. Compared with existing technologies, this invention performs behavioral-level detection of operational anomalies in spaceborne information systems. It can operate independently of the technical structure of the spaceborne information system, performing anomaly detection and localization at the application layer. Furthermore, it is the first to apply a probabilistic hierarchical classification method to the detection of satellite information behavior anomalies, providing a new detection method for operational anomalies in spaceborne information systems. Attached Figure Description

[0013] Figure 1 This is a flowchart of the satellite information behavior hierarchical classification anomaly detection method in an embodiment of the present invention; Figure 2 This is a model block diagram of the satellite information behavior hierarchical classification anomaly detection method in this embodiment of the invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] Figure 1 The flowchart of the satellite information behavior hierarchical classification anomaly detection method in an embodiment of the present invention is shown. Figure 2 A model block diagram of a satellite information behavior hierarchical classification anomaly detection method according to an embodiment of the present invention is shown. The embodiments of the present invention provide a satellite information behavior hierarchical classification anomaly detection method, such as... Figure 1 and Figure 2 As shown, it includes the following steps: Step 1: By referring to the satellite system, establish the main element set B and the action element set A; Step 2: Establish a set of spaceborne information security threat behaviors, M; Step 3, analyze satellite information behavior M i Decompose; Step 4: Analyze satellite information behavior M i Determine the distribution attributes of the k items in the data; Step 5: Calculate satellite information behavior M i The probability of anomaly detection for k behaviors in the dataset; Step 6: Calculate the satellite information behavior M i The probability of joint anomaly detection.

[0016] This invention addresses the problem of anomaly detection in satellite information behavior. Combining the probabilistic and statistical characteristics of satellite information behavior, it first establishes a satellite behavior model and a mathematical description of satellite information behavior. Based on this model, a hierarchical classification-based joint detection model for anomalies is proposed. By dividing the joint behavior into multi-level, multi-category single behavior classifications, the performance of single behavior detection is analyzed to obtain the joint detection performance. Furthermore, anomaly detection methods and processes are proposed, thus providing a solution for anomaly detection of satellite behavior from an information perspective and offering technical support for the future development of space information security.

[0017] In one embodiment of the present invention, step 1 specifically includes: The main element set B is represented as follows: (1); In equation (1), Let N represent the i-th type of main element, where N is a natural number; The action element set A is represented as follows: (2); In equation (2), This represents the i-th action element.

[0018] Furthermore, in one embodiment of the present invention, step 2 specifically includes: The satellite information behavior set M is represented as follows: M=B A (3); In equation (2), B represents the connector symbol. A represents the set of main elements, while B represents the set of action elements. For the element M in the set of spaceborne information security threat behaviors i It is obtained by calculation using the following formula: (4); In equation (4), M i This represents the i-th type of satellite information behavior. Indicates main element B i Action Element A i .

[0019] Regarding satellite information behavior, from an information system perspective, based on the idea that "a subject generates an action and obtains a behavior," and combined with the functional division and information flow of the onboard information system, we distinguish the subject elements. and action elements Establish a satellite information behavior model based on the equation "behavior = subject + action".

[0020] Preferably, step 3 specifically includes: M i Further decomposed into the joint behavior of J items: (5); In equation (4), express The k-th behavior after decomposition.

[0021] In one embodiment of the present invention, step 4 specifically includes: right Perform anomaly detection and test statistic. : (6); If the statistic If the following formula is satisfied, then It conforms to the characteristics of a Gaussian distribution: (7); Equation (7), This represents the k-th action that follows a Gaussian distribution. The mean is The variance is Gaussian distribution; If the statistic If the following formula is satisfied, then It conforms to the characteristics of uniform distribution: (8); Equation (8), Let U(a,b) represent the k-th behavior that conforms to a uniform distribution, where U(a,b) represents a uniform distribution in the interval [a,b], where a represents the lower limit of the interval and b represents the upper limit of the interval. If the statistic If the following formula is satisfied, then It conforms to the characteristics of a Poisson distribution: (9); In equation (9), Let represent the k-th action that follows a Poisson distribution. This means that the mean is The Poisson distribution.

[0022] Furthermore, in an embodiment of the present invention, step 5 specifically includes: The judgment criteria for hypothesis testing are: (10); In equation (10), , This indicates a special code for hypothesis testing; like It conforms to the characteristics of a Gaussian distribution and is calculated according to the following formula. Anomaly detection probability: (11); In equation (11), M represents the Gaussian distribution k The probability of anomaly detection. Let denote the decision threshold of the Gaussian distribution. Indicates intermediate variables. Represents the Q function; like It conforms to the characteristics of a uniform distribution and is calculated according to the following formula. Anomaly detection probability: (12); In equation (12), M represents a uniform distribution k The probability of anomaly detection. This represents the lower limit of the decision threshold for a uniform distribution. This represents the upper limit of the decision threshold for a uniform distribution; like It conforms to the characteristics of a Poisson distribution and is calculated according to the following formula. Anomaly detection probability: (13); In equation (13), M represents the Poisson distribution k The probability of anomaly detection. This represents the decision threshold of the Poisson distribution. Represents natural numbers.

[0023] like Figure 2 As shown, based on the "subject + action" behavior modeling concept, a satellite information behavior set Mi is established. Then, after passing through a classifier, Gaussian, uniform, and Poisson distribution characteristics are distinguished, and anomaly detection thresholds are applied to each. A joint decision is then made on the three distribution behaviors to obtain the anomaly detection result. Specifically, in one embodiment of the present invention, step 6 specifically includes: Satellite Information Behavior M i The joint anomaly detection probability P Mi The calculation is as follows: (14); In equation (14), The variance represents the Gaussian distribution that the location follows; Representative: If the k-th action follows a Gaussian distribution, then retain... If the k-th behavior follows a uniform distribution, then retain... If the k-th action follows a Poisson distribution, then retain... .

[0024] In an embodiment of the present invention, satellite information behavior M i Anomaly detection requires the joint detection of J behaviors; if any behavior is found to be abnormal, it is judged as an anomaly.

[0025] This invention addresses the problem of detecting anomalies in satellite information behavior. Combining the probabilistic and statistical characteristics of satellite information behavior, it first establishes a satellite behavior model and a mathematical description of satellite information behavior. Based on this model, a hierarchical classification-based joint detection model for behavioral anomalies is proposed. By dividing the joint behavior into multi-level, multi-category single behavior classifications, the performance of single behavior detection is analyzed, thereby obtaining the joint detection performance. An anomaly detection method and process are also proposed. This invention provides a solution for detecting anomalies in satellite behavior from an information perspective, offering technical support for the future development of space information security. Compared with existing technologies, this invention performs behavioral-level detection of operational anomalies in spaceborne information systems. It can operate independently of the technical structure of the spaceborne information system, performing anomaly detection and localization at the application layer. Furthermore, it is the first to apply a probabilistic hierarchical classification method to the detection of satellite information behavior anomalies, providing a new detection method for operational anomalies in spaceborne information systems.

[0026] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for hierarchical classification and anomaly detection of satellite information behavior, characterized in that, Includes the following steps: Step 1: By referring to the satellite system, establish the main element set B and the action element set A; Step 2: Establish a set of spaceborne information security threat behaviors, M; Step 3, analyze satellite information behavior M i Decompose; Step 4: Analyze satellite information behavior M i Determine the distribution attributes of the k items in the data; Step 5: Calculate satellite information behavior M i The probability of anomaly detection for k behaviors in the dataset; Step 6: Calculate the satellite information behavior M i The probability of joint anomaly detection.

2. The satellite information behavior hierarchical classification anomaly detection method as described in claim 1, characterized in that, Step 1 specifically includes: The main element set B is represented as follows: （1）； In equation (1), Represents the i-th type of main element, where N is a natural number; The action element set A is represented as follows: （2）； In equation (2), This represents the i-th action element.

3. The satellite information behavior hierarchical classification anomaly detection method as described in claim 2, characterized in that, Step 2 specifically includes: The satellite information behavior set M is represented as follows: M=B A (3); In equation (2), B represents the connector symbol. A represents the set of main elements, while B represents the set of action elements. For the element M in the set of spaceborne information security threat behaviors i It is obtained by calculation using the following formula: （4）； In equation (4), M i This represents the i-th type of satellite information behavior. Indicates main element B i Action Element A i .

4. The satellite information behavior hierarchical classification anomaly detection method as described in claim 3, characterized in that, Step 3 specifically includes: M i Further decomposed into the joint behavior of J items: （5）； In equation (4), express The k-th behavior after decomposition.

5. The satellite information behavior hierarchical classification anomaly detection method as described in claim 4, characterized in that, Step 4 specifically includes: right Perform anomaly detection and test statistic. : （6）； If the statistic If the following formula is satisfied, then It conforms to the characteristics of a Gaussian distribution: （7）； Equation (7), This represents the k-th action that follows a Gaussian distribution. The mean is The variance is Gaussian distribution; If the statistic If the following formula is satisfied, then It conforms to the characteristics of uniform distribution: （8）； Equation (8), Let U(a,b) represent the k-th behavior that conforms to a uniform distribution, where U(a,b) represents a uniform distribution in the interval [a,b], where a represents the lower limit of the interval and b represents the upper limit of the interval. If the statistic If the following formula is satisfied, then It conforms to the characteristics of a Poisson distribution: （9）； In equation (9), Let represent the k-th action that follows a Poisson distribution. This indicates that the mean is The Poisson distribution.

6. The satellite information behavior hierarchical classification anomaly detection method as described in claim 5, characterized in that, Step 5 specifically includes: The judgment criteria for hypothesis testing are: （10）； In equation (10), , This indicates a special code for hypothesis testing; like It conforms to the characteristics of a Gaussian distribution and is calculated according to the following formula. Anomaly detection probability: （11）； In equation (11), M represents the Gaussian distribution k The probability of anomaly detection. Let represent the decision threshold of the Gaussian distribution. Indicates intermediate variables. Represents the Q function; like It conforms to the characteristics of a uniform distribution and is calculated according to the following formula. Anomaly detection probability: （12）； In equation (12), M represents a uniform distribution k The probability of anomaly detection. This represents the lower limit of the decision threshold for a uniform distribution. This represents the upper limit of the decision threshold for a uniform distribution; like It conforms to the characteristics of a Poisson distribution and is calculated according to the following formula. Anomaly detection probability: （13）； In equation (13), M represents the Poisson distribution k The probability of anomaly detection. This represents the decision threshold of the Poisson distribution. Represents natural numbers.

7. The satellite information behavior hierarchical classification anomaly detection method as described in claim 6, characterized in that, Step 6 specifically includes: Satellite Information Behavior M i The joint anomaly detection probability P Mi The calculation is as follows: （14）； In equation (14), The variance represents the Gaussian distribution that the location follows; Representative: If the k-th action follows a Gaussian distribution, then retain... If the k-th behavior follows a uniform distribution, then retain... If the k-th action follows a Poisson distribution, then retain... .

Images