A satellite network traffic anomaly detection method based on track Doppler dynamic context

Abstract

The application relates to a satellite network traffic anomaly detection method based on an orbital Doppler dynamic context, which comprises the following steps: acquiring satellite orbit parameters, receiver position information and communication carrier frequency information, and determining a time window; based on the position vector and the velocity vector of the satellite, a relative radial velocity sequence is determined, and a Doppler frequency shift sequence and a Doppler change rate sequence are calculated in combination with the communication carrier frequency information to form an orbital Doppler dynamic context; the satellite network traffic data is subjected to windowing processing, and a traffic feature vector is extracted; the Doppler frequency shift sequence and the Doppler change rate sequence are aggregated according to the time window to obtain a window-level Doppler context vector, the traffic feature vector is subjected to conditional fusion, and a joint feature representation enhanced by a physical context is generated to perform anomaly detection. Compared with the prior art, the application realizes adaptive adjustment of anomaly determination with dynamic changes of a physical environment by introducing the orbital Doppler dynamic context for scoring.

Description

Technical Field

[0001] This invention relates to the field of satellite network traffic anomaly detection technology, and in particular to a satellite network traffic anomaly detection method based on orbital Doppler dynamic context. Background Technology

[0002] With the development of low-Earth orbit satellite constellations, inter-satellite links, and integrated space-ground networks, satellite networks are undertaking an increasing number of services such as broadband access, emergency communication, remote sensing data backhaul, and IoT access. Compared with traditional terrestrial networks, satellite networks have characteristics such as wide coverage, long link distances, high-speed node movement, and topology changes over time, making their network performance and service traffic behavior more dynamic and non-stationary.

[0003] Existing network traffic analysis and anomaly detection methods typically model based on packet or flow-level characteristics, such as packet length distribution, arrival interval, throughput, session duration, and protocol flag statistics. They then use rule-based, statistical learning, or deep learning models to identify attack traffic, faulty traffic, or abnormal behavior. These methods often implicitly assume that the network environment is relatively stable or that its changes can be fully learned from historical data, thus achieving good results in scenarios such as terrestrial fixed networks and data center networks.

[0004] However, the orbital motion of nodes in satellite networks brings about significant dynamic changes at the physical and data link layers. Doppler shift and its rate of change are key physical phenomena determined by the relative radial velocity between the satellite and the receiver. Doppler dynamics affect frequency synchronization and channel stability in signal reception, and may induce changes in communication behavior such as retransmissions, latency jitter, and throughput fluctuations at the data link layer. These changes are further reflected in the statistical characteristics of the network and traffic layers, causing the same type of traffic to exhibit different "normal behavior patterns" at different orbital altitudes, relative velocity segments, or time periods. In this situation, methods that rely solely on traffic fields and statistical characteristics without considering the orbital physical context are prone to misjudging normal fluctuations caused by orbital motion as abnormalities, or experiencing decision boundary mismatches under different orbital conditions, leading to increased false alarm rates and decreased generalization ability.

[0005] Therefore, there is an urgent need for an anomaly detection method that can represent orbital Doppler dynamic information and align and fuse it with traffic characteristics, so as to enable anomaly judgment to have physical context awareness, thereby improving the robustness and reliability of anomaly detection in the dynamic environment of satellite networks. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art by providing a satellite network traffic anomaly detection method based on orbital Doppler dynamic context, which can represent orbital Doppler dynamic information and align and fuse it with traffic features.

[0007] The objective of this invention can be achieved through the following technical solutions: A method for detecting anomalies in satellite network traffic based on orbital Doppler dynamic context includes the following steps: S1: Obtain the satellite orbit parameters, receiver position information, and communication carrier frequency information of the satellite under test, and determine the time window for analyzing satellite network traffic; S2: Based on the satellite orbit parameters, perform orbit propagation to obtain the position vector and velocity vector of the satellite under test at each moment; calculate the relative radial velocity sequence according to the position vector, velocity vector and the receiver position information, and calculate the Doppler frequency shift sequence and Doppler rate of change sequence by combining the relative radial velocity sequence with the communication carrier frequency information to form the orbital Doppler dynamic context; S3: The satellite network traffic data of the satellite under test is windowed according to the time window, and a traffic feature vector is extracted for each time window; S4: Aggregate the Doppler frequency shift sequence and the Doppler rate of change sequence according to the time window to obtain a window-level Doppler context vector, and conditionally fuse the flow feature vector with the window-level Doppler context vector as a condition to generate a joint feature representation with enhanced physical context. S5: Perform anomaly detection based on the joint feature representation enhanced by the physical context, calculate the anomaly score for the corresponding time window, and obtain the anomaly determination result.

[0008] Furthermore, the satellite orbital parameters are two rows of element-length ephemeris (TLE) or ephemeris data; The receiver location information is the latitude, longitude and altitude information of the ground station, and / or the position vector information of the receiver in a unified coordinate system; The time window can be a fixed-length window or a sliding window.

[0009] Furthermore, the orbital propagation includes: Based on the satellite orbit parameters, the SGP4 orbit propagation model or the orbit propagation model based on Kepler orbit parameters is used for propagation to output the position vector and velocity vector of the satellite under test at each time.

[0010] Furthermore, the relative radial velocity in the relative radial velocity sequence is the projection of the satellite velocity vector onto the satellite-receiver line-of-sight direction; The expression for calculating the Doppler frequency shift in the Doppler frequency shift sequence is as follows: In the formula, For Doppler frequency shift, The relative radial velocity, At the speed of light, The communication carrier frequency; The Doppler rate of change in the Doppler rate of change sequence is obtained by differential or gradient calculation of the Doppler frequency shift sequence.

[0011] Furthermore, the traffic feature vector includes two or more of the following features: mean and variance of packet arrival intervals, mean and variance of packet lengths, number of packets per unit window, number of bytes per unit window, throughput, burstiness, protocol flag statistics, retransmission count, round-trip time (RTT) statistics, and traffic entropy features.

[0012] Furthermore, in the process of obtaining the window-level Doppler context vector aggregation, aggregation is performed at least based on the mean and contrast of the Doppler frequency shift in the Doppler frequency shift sequence, and the mean of the Doppler rate of change in the Doppler rate of change sequence.

[0013] Furthermore, the conditional fusion is adaptive modulation fusion; The adaptive modulation fusion process includes: inputting the window-level Doppler context vector into the modulation parameter generation function to generate a scaling vector. With bias vector According to the scaling vector With bias vector The traffic feature vector is transformed to generate a joint feature representation with enhanced physical context; The computational expression for generating the physical context-enhanced joint feature representation is as follows: In the formula, A joint feature representation enhanced with physical context. For flow feature vectors, This represents element-wise multiplication. and Dimensions and They have the same dimensions.

[0014] Furthermore, the modulation parameter generation function is a first multilayer perceptron network, which takes a window-level Doppler context vector as input and generates a scaling vector through a nonlinear activation function. With bias vector , where the scaling vector The value is constrained to a positive range by using a nonlinear activation function.

[0015] Furthermore, the method employs an anomaly detection multilayer perceptron model to perform anomaly detection based on the joint feature representation enhanced by the physical context. The anomaly detection multilayer perceptron model is a second multilayer perceptron network, including an input layer, at least one hidden layer, and an output layer. The input layer is used to receive the joint feature representation enhanced by the physical context; the hidden layer is used to perform nonlinear mapping on the joint feature representation through a fully connected layer and a nonlinear activation function; and the output layer is used to output an anomaly score.

[0016] Furthermore, the method compares the anomaly score of the corresponding time window with the corresponding anomaly threshold to obtain the anomaly determination result; The anomaly threshold is a dynamic threshold that changes with the window-level Doppler context vector. This dynamic threshold is output by the window-level Doppler context vector input threshold generation function.

[0017] Compared with the prior art, the present invention has the following advantages: (1) This invention constructs the Doppler frequency shift and its rate of change caused by orbital motion into a time-dependent dynamic context, and aligns and integrates it with the flow characteristics within a unified time window, enabling anomaly detection to explicitly express the dynamics and non-stationarity of the satellite network over time. Therefore, anomaly determination is no longer equivalent to applying a uniform threshold or model to the flow under a static background, but rather to conditional judgment under the physical conditions corresponding to different relative velocity segments, different coverage areas, and different orbital altitudes, thereby alleviating the problem of mismatch in decision boundaries over time.

[0018] (2) This invention uses physical context-based fusion as a key step: Under the condition of window-level Doppler context vectors, the flow feature representation within the same window is adaptively modulated (e.g., scaling and bias parameters are generated to adjust the flow features dimensionally), so that the model can automatically adjust the feature weights and discrimination thresholds as the Doppler changes dynamically. This mechanism enables the scenario of "the same set of flow patterns having different normality under different orbits / different physical conditions" to be handled consistently: when some flow patterns can be considered normal under high-orbit conditions, but may be judged as abnormal in low-orbit high-speed segments or segments with rapid Doppler changes, the model can use the context to complete the differential discrimination, improve the robustness and reliability under cross-orbit and cross-time period condition changes, and provide an explanation basis related to the physical environment for abnormal results.

[0019] (3) Without changing the existing network protocol stack or relying on the original IQ signal acquisition at the physical layer, this invention can generate and use the orbital Doppler dynamic context using only the available orbital parameters, receiver location information, and traffic observation data. It features a clear implementation path and strong compatibility. Through the time windowing alignment mechanism, this invention can establish a unified time reference between orbital calculation results and traffic data at different sampling granularities. This facilitates integration with existing statistical learning or deep learning anomaly detection processes and can be extended to various satellite network scenarios such as satellite-to-ground links or inter-satellite links. It has good implementability and portability in engineering deployment and operation and maintenance. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating a satellite network traffic anomaly detection method based on orbital Doppler dynamic context provided in an embodiment of the present invention. Figure 2 This is a schematic diagram illustrating the conditional fusion of orbital Doppler dynamic context and flow characteristics provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a multilayer perceptron model structure for anomaly detection provided in an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0023] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0024] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of this invention is usually placed during use. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0025] It should be noted that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0026] Furthermore, terms such as "horizontal" and "vertical" do not imply that components must be absolutely horizontal or suspended, but rather that they can be slightly tilted. For example, "horizontal" simply means that its direction is more horizontal than "vertical," and does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0027] Example 1 like Figure 1 As shown, this embodiment provides a satellite network traffic anomaly detection method based on orbital Doppler dynamic context, including the following steps: S1: Obtain the satellite orbit parameters, receiver position information, and communication carrier frequency information of the satellite under test, and determine the time window for analyzing satellite network traffic; Specifically, in this step, the satellite orbit parameters can be two lines of element-wise linear ephemeris (TLE) data or ephemeris data; the receiver position information can be the latitude, longitude, and altitude information of the ground station, or the position vector information of the receiver in a unified coordinate system; the time window can be a fixed-length window or a sliding window, and the window length and step size can be set according to the flow sampling granularity. Through this step, the subsequent orbit calculation results and flow data can be aligned under the same time reference.

[0028] S2: Based on the satellite orbit parameters in step S1, orbit propagation is performed to obtain the position vector and velocity vector of the satellite under test at each time. The relative radial velocity sequence is calculated based on the position vector, velocity vector and receiver position information. The Doppler frequency shift sequence and Doppler rate of change sequence are calculated by combining the relative radial velocity sequence with the communication carrier frequency information to form the orbital Doppler dynamic context. Orbit propagation uses the SGP4 orbit propagation model or an orbit propagation model based on Kepler orbital parameters to output the satellite's position and velocity vectors at each moment.

[0029] Specifically, let the satellite position vector be... The velocity vector is The receiver position vector is Then the unit vector of the line of sight direction is: relative radial velocity The projection of the satellite velocity vector onto the line-of-sight direction between the satellite and the receiver is calculated using the following formula: The Doppler frequency shift is: in, At the speed of light, Carrier frequency; Doppler rate of change It can be obtained by performing differential or gradient calculations on the Doppler frequency shift sequence.

[0030] This step yields a time-varying physical dynamic context, which characterizes the current orbital motion state and its changing trends.

[0031] S3: Divide the satellite network traffic data of the satellite under test into segments according to the time window set in step S1 to obtain the traffic segments corresponding to each time window; extract the traffic feature vector for each traffic segment; Specifically, traffic feature vectors may include packet arrival interval statistics, packet length statistics, number of packets / bytes per unit window, throughput, burstiness, protocol flag statistics, retransmission count, RTT statistics, or traffic entropy, so that the traffic behavior of each window is quantified into a vector representation that can be used for subsequent discrimination.

[0032] S4: Align and aggregate the Doppler frequency shift sequence and the Doppler rate of change sequence obtained in step S2 according to the time window of step S1 to obtain a window-level Doppler context vector. Using the window-level Doppler context vector as a condition, conditionally fuse the flow feature vectors within the same window to generate a joint feature representation with enhanced physical context. The window-level Doppler context vector is obtained by aggregating the Doppler frequency shift sequence and the Doppler rate of change sequence within the time window. The aggregation includes at least the mean and variance of the Doppler frequency shift and the mean of the Doppler rate of change.

[0033] Conditional fusion is transformed into adaptive modulation fusion; The adaptive modulation fusion process includes: inputting the window-level Doppler context vector into the modulation parameter generation function to generate a scaling vector. With bias vector According to the scaling vector With bias vector The traffic feature vector is transformed to generate a joint feature representation with enhanced physical context; The modulation parameter generation function is a first multilayer perceptron network, which differs from the anomaly detection multilayer perceptron model in step S5. It uses a window-level Doppler context vector as input and generates a scaling vector through a nonlinear activation function. With bias vector , where the scaling vector By constraining the nonlinear activation function to a positive range, stable scaling of the flow feature vector can be achieved.

[0034] Specifically, this step does not simply concatenate Doppler and flow rate, but rather uses the Doppler context to modulate the flow rate characteristics, enabling the same flow rate to exhibit different normality criteria under different orbital / velocity segments. For example... Figure 2 As shown, step S4 can be further specified as the following process: (1) Window-level context construction: constructing the window-level context. and Aggregate into context vector For example, using the mean of Doppler frequency shift within the window. ,variance Mean of Doppler rate of change constitute .

[0035] (2) Modulation parameter generation: Input modulation parameter generation function (For example, a multilayer perceptron) outputs a scaled vector consistent with the dimension of the traffic feature. With bias vector .

[0036] (3) Conditional modulation fusion: for flow feature vectors Element-wise modulation is performed to obtain the joint feature representation. : in, For element-wise multiplication, and Dimensions and The dimensions are the same. Through the above method, the flow characteristics can be recalibrated in different ways under different Doppler dynamic conditions, thereby supporting differentiated judgments such as "the same flow is normal in high orbit and abnormal in low orbit".

[0037] S5: Perform anomaly detection based on the joint feature representation enhanced by physical context, calculate the anomaly score for the corresponding time window, and obtain the anomaly determination result.

[0038] like Figure 3 As shown, this embodiment uses an anomaly detection multilayer perceptron model to score the joint feature representation.

[0039] Specifically, an anomaly detection multilayer perceptron model may include an input layer, at least one hidden layer, and an output layer, with the input layer receiving joint feature representations. The hidden layer performs a non-linear mapping of the joint feature representation through a fully connected layer and a non-linear activation function (such as ReLU), and the output layer outputs a scalar anomaly score. This is used to characterize the degree of anomaly in the current time window.

[0040] During the training phase, traffic samples labeled as normal or abnormal can be used to supervise the training of the multilayer perceptron model. Loss functions such as mean squared error or cross-entropy can be used to make normal and abnormal samples form a separable distribution in terms of abnormal scores.

[0041] During the inference phase, the joint feature representation of the traffic window to be detected is calculated. The corresponding anomaly score is obtained by forward calculation using the anomaly detection multilayer perceptron model. .

[0042] The anomaly score is then input into the threshold comparison module and compared with the anomaly threshold to obtain the anomaly determination result. The anomaly threshold can be a fixed threshold or determined by the window-level Doppler context vector. A dynamic threshold is generated by inputting a threshold generation function to adapt to changes in background behavior caused by orbital motion. When the anomaly score is greater than the threshold, the window is determined to be abnormal; otherwise, it is determined to be normal, thus outputting the anomaly detection results for each time window.

[0043] Example 2 This embodiment also discloses a satellite network traffic anomaly detection method based on orbital Doppler dynamic context. The difference from Embodiment 1 is that, without changing the overall idea of ​​constraining anomaly determination with orbital Doppler dynamic context, some sub-modules can be replaced.

[0044] (1) Regarding orbit propagation and Doppler dynamic context generation, in Example 1, orbit propagation can use SGP4 or a propagation model based on Kepler orbital parameters. In this example, ephemeris interpolation or a simplified two-body dynamics model can also be used to directly calculate the satellite position and velocity, and then the Doppler frequency shift sequence and its rate of change sequence can be calculated from the relative radial velocity. Although this type of alternative implementation can generate Doppler dynamic context, when the orbital parameters are incomplete or the time span is large, it may lead to the Doppler change trend being inconsistent with the actual orbital segment, thereby weakening the ability to characterize dynamic physical constraints.

[0045] (2) Regarding the window-level Doppler context aggregation method, in Example 1, statistical measures such as mean, variance, and mean rate of change are used to construct the window-level context vector; in this example, the maximum / minimum value, quantile statistics, sliding slope, or mean absolute value of frequency shift can also be used to construct the context vector. This type of alternative method can enhance the sensitivity to certain local fluctuations, but if there is a lack of stable characterization of the changing trend, context jumps between windows are likely to occur, making the conditional fusion modulation of the decision boundary not stable enough, thus causing false alarms.

[0046] (3) Regarding the fusion structure of physical context and flow characteristics, in Example 1, adaptive modulation fusion is adopted, that is, scaling parameters and bias parameters are generated from the context vector and the flow characteristics are modulated dimension by dimension; in this example, a simple splicing method can also be adopted, that is, the context vector and the flow characteristic vector are directly spliced ​​and then input into the anomaly detection process, or a linear weighting method is adopted to map the context vector into a scalar weight to scale the flow characteristics as a whole. This type of alternative structure is simple to implement, but it usually cannot achieve differentiated modulation of different flow characteristic dimensions under different physical conditions, and it is difficult to effectively handle the situation where the normality of the same flow is different under different track conditions. Therefore, it is more likely to cause discrimination boundary mismatch when migrating across tracks and across time periods.

[0047] (4) Regarding the anomaly detection model, in Example 1, an anomaly detection model based on a multilayer perceptron is used to perform forward computation on the joint feature representation enhanced by the physical context and output an anomaly score. A fixed threshold or a dynamic threshold can be used for judgment. In this example, anomaly detection can also be achieved by using autoencoder reconstruction error, temporal prediction residual, or density-based anomaly scoring. For example, an autoencoder can be used to reconstruct the joint feature representation and the reconstruction error can be used as the anomaly score; or a temporal model can be used to predict the joint feature representation of the next window and the prediction residual can be used as the anomaly score; or the probability density of the joint features under the normal distribution can be calculated using Gaussian mixture or kernel density estimation as the anomaly score. Such alternative strategies can provide different anomaly characterization methods in some scenarios, but when the Doppler dynamics of the satellite network change significantly, if the discrimination threshold or scoring scale is not adjusted in combination with the Doppler context, it is easy to misjudge normal fluctuations caused by orbital motion as anomalies or reduce the sensitivity to real anomalies.

[0048] In summary, the alternative implementation of Example 2 is either insufficient in characterizing the stability of Doppler dynamic trends or lacks specificity in the dimension-wise conditional modulation of flow characteristics in the physical context. Therefore, its overall detection robustness in dynamic orbital environments is generally not as good as the method of Example 1, but it still has advantages over the prior art.

[0049] The implementation principle of this invention is as follows: This invention discloses a satellite network traffic anomaly detection method based on orbital Doppler dynamic context. It explicitly introduces the most typical dynamic physical factors of the satellite network into the traffic anomaly detection process through a link of orbital propagation, Doppler dynamic context construction, window alignment, conditional fusion, and anomaly determination. Regarding physical context construction, this invention calculates the relative radial velocity based on satellite orbital parameters and receiver position information, and obtains the Doppler frequency shift and its rate of change sequence, thereby simultaneously characterizing the current relative motion state and the trend of motion state changes. This allows physical dynamics to be quantitatively expressed and established with a time correlation with traffic observation. Regarding feature fusion, this invention generates modulation parameters based on window-level Doppler context vectors, and performs dimension-wise adaptive modulation on the traffic feature vectors within the same window, thus adjusting the anomaly determination boundary according to changes in the Doppler dynamic context. Regarding anomaly determination, this invention uses a multilayer perceptron model to perform nonlinear mapping on the joint feature representation enhanced by the physical context, outputting a scalar anomaly score, and combining it with a fixed threshold or a dynamic threshold determined by the Doppler context for determination. This avoids the discrimination bias caused by relying solely on static traffic features and improves the stability and reliability of anomaly detection in the dynamic operating environment of the satellite network.

[0050] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A method for detecting anomalies in satellite network traffic based on orbital Doppler dynamic context, characterized in that, Includes the following steps: S1: Obtain the satellite orbit parameters, receiver position information, and communication carrier frequency information of the satellite under test, and determine the time window for analyzing satellite network traffic; S2: Based on the satellite orbit parameters, perform orbit propagation to obtain the position vector and velocity vector of the satellite under test at each moment; calculate the relative radial velocity sequence according to the position vector, velocity vector and the receiver position information, and calculate the Doppler frequency shift sequence and Doppler rate of change sequence by combining the relative radial velocity sequence with the communication carrier frequency information to form the orbital Doppler dynamic context; S3: The satellite network traffic data of the satellite under test is windowed according to the time window, and a traffic feature vector is extracted for each time window; S4: Aggregate the Doppler frequency shift sequence and the Doppler rate of change sequence according to the time window to obtain a window-level Doppler context vector, and conditionally fuse the flow feature vector with the window-level Doppler context vector as a condition to generate a joint feature representation with enhanced physical context. S5: Perform anomaly detection based on the joint feature representation enhanced by the physical context, calculate the anomaly score for the corresponding time window, and obtain the anomaly determination result.

2. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 1, characterized in that, The satellite orbit parameters are two rows of element TLE or ephemeris data; The receiver location information is the latitude, longitude and altitude information of the ground station, and / or the position vector information of the receiver in a unified coordinate system; The time window can be a fixed-length window or a sliding window.

3. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 1, characterized in that, The orbital propagation includes: Based on the satellite orbit parameters, the SGP4 orbit propagation model or the orbit propagation model based on Kepler orbit parameters is used for propagation to output the position vector and velocity vector of the satellite under test at each time.

4. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 1, characterized in that, The relative radial velocity in the relative radial velocity sequence is the projection of the satellite velocity vector onto the satellite-receiver line-of-sight direction; The expression for calculating the Doppler frequency shift in the Doppler frequency shift sequence is as follows: In the formula, For Doppler frequency shift, The relative radial velocity, At the speed of light, The communication carrier frequency; The Doppler rate of change in the Doppler rate of change sequence is obtained by differential or gradient calculation of the Doppler frequency shift sequence.

5. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 1, characterized in that, The traffic feature vector includes two or more of the following features: mean and variance of packet arrival interval, mean and variance of packet length, number of packets per unit window, number of bytes per unit window, throughput, burstiness, protocol flag statistics, retransmission count, round-trip time (RTT) statistics, and traffic entropy features.

6. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 1, characterized in that, In the process of obtaining the window-level Doppler context vector aggregation, aggregation is performed based at least on the mean and contrast of the Doppler frequency shift in the Doppler frequency shift sequence, and the mean of the Doppler rate of change in the Doppler rate of change sequence.

7. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 1, characterized in that, The conditional fusion is an adaptive modulation fusion; The adaptive modulation fusion process includes: inputting the window-level Doppler context vector into the modulation parameter generation function to generate a scaling vector. With bias vector According to the scaling vector With bias vector The traffic feature vector is transformed to generate a joint feature representation with enhanced physical context; The computational expression for generating the physical context-enhanced joint feature representation is as follows: In the formula, A joint feature representation enhanced with physical context. For flow feature vectors, This represents element-wise multiplication. and Dimensions and They have the same dimensions.

8. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 7, characterized in that, The modulation parameter generation function is a first multilayer perceptron network, which takes a window-level Doppler context vector as input and generates a scaling vector through a nonlinear activation function. With bias vector , where the scaling vector The value is constrained to a positive range by using a nonlinear activation function.

9. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 1, characterized in that, The method employs an anomaly detection multilayer perceptron model, and performs anomaly detection based on the joint feature representation enhanced by the physical context. The anomaly detection multilayer perceptron model is a second multilayer perceptron network, including an input layer, at least one hidden layer, and an output layer. The input layer is used to receive the joint feature representation enhanced by the physical context; the hidden layer is used to perform nonlinear mapping on the joint feature representation through a fully connected layer and a nonlinear activation function; and the output layer is used to output an anomaly score.

10. The satellite network traffic anomaly detection method based on orbital Doppler dynamic context according to claim 1, characterized in that, The method compares the anomaly score for the corresponding time window with the corresponding anomaly threshold to obtain the anomaly determination result. The anomaly threshold is a dynamic threshold that changes with the window-level Doppler context vector. This dynamic threshold is output by the window-level Doppler context vector input threshold generation function.

Images