A method for detecting network intrusion of FC-AE-ASM based on time sequence characteristics and message mode

Abstract

The present application relates to the technical field of avionics network communication security, and provides an FC-AE-ASM network intrusion detection method based on timing characteristics and message mode.The method comprises the following steps: deploying a bypass monitoring probe on an FC-AE-ASM network link; extracting ASM message characteristics to obtain time characteristics, identification characteristics, load characteristics and sequence characteristics of ASM messages, and then constructing a multi-dimensional feature vector; establishing a normal communication behavior baseline model for each ASM channel; identifying ASM message interval abnormality, message injection attack, flooding attack and slow tampering attack; correlating and grading the multi-dimensional abnormality detection results, outputting different levels of alarms according to the number of abnormal dimensions, executing corresponding security responses, and recording all alarm events and correlation analysis results in a security event log.The present application solves the problem of the lack of intrusion detection capability in the existing FC-AE-ASM network.

Description

Technical Field

[0001] This invention relates to the technical field of avionics network communication security, and more specifically, to an FC-AE-ASM network intrusion detection method based on timing characteristics and message patterns. Background Technology

[0002] The FC-AE-ASM protocol, as the core protocol of the next-generation fighter jet's airborne backbone communication network, carries real-time communication services between avionics system processors, sensors, and displays. The FC-AE-ASM protocol adopts an anonymous subscription message model. Each ASM channel is identified by a triplet of Message ID, SID, and DID. Messages are sent according to a fixed period, exhibiting strict time-series determinism and predictable message patterns.

[0003] However, the FC-AE-ASM protocol lacks security mechanisms—it lacks message authentication, integrity verification, and network intrusion detection capabilities. Attackers can exploit these vulnerabilities to inject forged ASM messages into the network (i.e., message injection attack), send messages at an abnormal frequency to create network congestion (i.e., flooding attack), or slowly tamper with the payload content of normal messages (i.e., slow tampering attack). These attacks may cause avionics equipment to receive incorrect control commands or sensor data, jeopardizing flight safety.

[0004] Meanwhile, FC-AE-ASM messages possess strict temporal determinism—fixed message cycles, predictable message ID distribution, and stable load sizes. This temporal determinism provides a natural foundation for behavioral baseline-based intrusion detection techniques. By establishing a baseline model of normal communication behavior and detecting abnormal behaviors deviating from the baseline in real time, various attacks can be effectively discovered.

[0005] The closest existing technologies to this invention mainly include two types of solutions: CN105515866A and CN115086192A. CN105515866A discloses an event and time monitoring method based on the FC-AE-ASM protocol communication. This solution monitors the FC-AE-ASM protocol communication data link through time-triggered and event-triggered methods, starting or stopping data capture when trigger conditions are met, thus achieving monitoring of the communication process. However, this solution only achieves data capture and monitoring of the communication process and lacks security analysis capabilities. It cannot identify abnormal messages, detect intrusion behavior, or trigger security alarms; it is only used for communication quality assessment.

[0006] CN115086192A discloses a data processing method, apparatus, system, and monitoring card. This solution acquires data frames in FC-AE-ASM format, parses them to obtain communication data, determines the frame type (correct frame or incorrect frame), reassembles the communication data, and sends it, thereby achieving data monitoring of the FC-AE-ASM communication board. However, although this solution achieves the parsing of FC-AE-ASM frames and the identification of frame types (correct / incorrect frames), it only focuses on frame transmission errors (such as CRC errors) and does not involve intrusion detection at the security level, thus failing to identify security threats that are correctly formatted but contain malicious content.

[0007] In summary, existing FC-AE-ASM monitoring technologies do not possess the security intrusion detection capability of FC-AE-ASM networks, and cannot detect security threats such as message injection, flooding attacks, and slow tampering, thus failing to meet the security protection requirements of next-generation airborne avionics networks. Summary of the Invention

[0008] This invention aims to solve the problem of the lack of intrusion detection capabilities in existing FC-AE-ASM networks.

[0009] Therefore, in view of the shortcomings of the existing technology, the purpose of this invention is to provide an FC-AE-ASM network intrusion detection method based on time sequence characteristics and message patterns.

[0010] To achieve the above objectives, the present invention provides a method for FC-AE-ASM network intrusion detection based on time-series characteristics and message patterns. The FC-AE-ASM network intrusion detection method based on time-series features and message patterns includes: Step S1: Deploying bypass monitoring probes on the FC-AE-ASM network links to upload the ASM message features of each ASM message generated by the bypass monitoring probes to the intrusion detection analysis engine; Step S2: Extracting the ASM message features through the intrusion detection analysis engine to obtain the time features, identification features, load features, and sequence features of the ASM messages, and then constructing a multi-dimensional feature vector based on the time features, identification features, load features, and sequence features of the ASM messages; Step S3: During the stable operation of the FC-AE-ASM network after initialization, establishing a normal communication behavior baseline model for each ASM channel through the intrusion detection analysis engine; Step S4: Using the intrusion detection analysis engine, performing time-series anomaly detection on the arrival time interval between the current ASM message and the previous ASM message in each ASM channel using the CUSUM algorithm to identify abnormal ASM message intervals; Step S5: Using the intrusion detection analysis engine, identifying illegal messages based on the preset normal Message ID set ID_set and corresponding legal SIDs for each FC domain. Step S6: Using an intrusion detection analysis engine, based on a sliding time window, the frequency of ASM messages in the channel and the total rate of ASM messages across the entire network are statistically analyzed to identify flooding attacks. Step S7: Using an intrusion detection analysis engine, the load of each ASM channel is divided into several data blocks according to a fixed offset, and the statistical characteristics of each data block are calculated to form a load pattern fingerprint. The load pattern fingerprint is then used to identify slow tampering attacks. Step S8: Using an intrusion detection analysis engine, the multi-dimensional anomaly detection results from steps S4 to S7 are correlated and graded. Different levels of alarms are output according to the number of anomaly dimensions, and corresponding security responses are executed. All alarm events and correlation analysis results are recorded in the security event log to support post-event traceability and analysis.

[0011] Preferably, in step S1, the bypass monitoring probe uploads the ASM message features of each ASM message it generates to the intrusion detection analysis engine, specifically including: Step S11: The bypass monitoring probe captures the FC frames of each ASM message in a non-intrusive manner and generates a corresponding timestamp for each FC frame; Step S12: The bypass monitoring probe parses the FC frames to obtain the ASM frame header and payload information; Step S13: The bypass monitoring probe parses the ASM frame header and payload information to obtain Message ID, SID, DID, SEQ_ID, ASM message transmission priority, and payload length; Step S14: The bypass monitoring probe generates ASM message features based on Message ID, SID, DID, SEQ_ID, ASM message transmission priority, payload length, and timestamp, and then uploads the ASM message features to the intrusion detection analysis engine in real time; wherein, the bypass monitoring probe adopts a passive listening method and does not have the ability to send; the bypass monitoring probe is deployed on the mirror port of the FC switch; the ASM message features include: Message ID, SID, DID, SEQ_ID, ASM message transmission priority, payload length, and timestamp; where SID and DID are obtained by parsing the ASM frame header in step S13.

[0012] Preferably, in step S2, the time features include: the ASM message arrival timestamp and the arrival time interval between the ASM message and the previous ASM message on the same channel; the identification features include: Message ID, SID, and DID; the load features include: load length and load hash value; the sequence features include: SEQ_ID value and SEQ_ID increment; in step S3, the normal communication behavior baseline model includes the following statistics: ASM message cycle mean. ASM message cycle standard deviation Message ID distribution set ID_set, average load length Standard deviation of load length And ASM message interval distribution parameters.

[0013] Preferably, in step S4, the CUSUM algorithm is used to perform timing anomaly detection on the arrival time interval between the current ASM message and the previous ASM message in each ASM channel, in order to identify abnormal ASM message intervals. Specifically, this includes: Step S41: Defining the upper-bias detection statistics and lower-bias detection statistics of the current ASM message as follows:

[0014] ;

[0015] ;

[0016] Where k is the allowance for the CUSUM algorithm, which indicates the minimum drift amplitude that needs to be detected; The time interval between the arrival of an ASM message on the same channel; This is the upper bias detection statistic of the previous ASM message; This is the down-biased detection statistic of the previous ASM message; This represents the average ASM message cycle.

[0017] Step S42: Determine Does it exceed the threshold h and Does it exceed the threshold h? Step S43: When When the threshold h is exceeded, the ASM message interval is determined to have increased abnormally, which may indicate message loss or link interference; when When the threshold h is exceeded, the ASM message interval is determined to be abnormally reduced, which may indicate a message injection or flooding attack.

[0018] Preferably, in step S5, the intrusion detection analysis engine identifies message injection attacks, specifically including: Step S51: Maintaining a preset normal Message ID set ID_set for each FC domain using the intrusion detection analysis engine; Step S52: When a preset normal Message ID of an ASM message is detected not in ID_set, it is determined to be a message injection attack, and step S54 is executed; Step S53: When a preset normal Message ID of an ASM message is detected in ID_set, but there is an abnormal source SID, that is, the normal sender SID of the preset normal Message ID is inconsistent with the SID of the current message, it is also determined to be a message injection attack, and step S54 is executed; Step S54: Immediately trigger a security alarm, record the complete characteristics of the injected message, and then report the complete characteristics of the injected message to the network security management center.

[0019] Preferably, step S6 specifically includes: Step S61: Maintaining a message counter for each ASM channel and each FC node through the intrusion detection analysis engine, and counting the number of ASM messages within a sliding time window; Step S62: Counting the frequency of ASM messages in the channel based on the number of ASM messages, and determining a flooding attack when the frequency of ASM messages exceeds three times the standard deviation of the baseline mean, and then executing step S64; Step S63: Counting the total rate of ASM messages in the entire network, and determining a flooding attack when the total rate of ASM messages in the entire network exceeds the baseline threshold of the entire network, and then executing step S64; Step S64: When a flooding attack is detected, identifying the flooding source SID through the intrusion detection analysis engine, and issuing a traffic limiting command to the FC switch through the management network to limit the sending rate of the flooding source.

[0020] Preferably, in step S7, the statistical characteristics of each data block are calculated to form a load pattern fingerprint, and then the slow tampering attack is identified by the load pattern fingerprint. Specifically, this includes: Step S71: Calculate the mean, variance, and entropy of each data block to form a load pattern fingerprint; Step S72: When the load pattern fingerprint is detected to deviate from the baseline by more than a threshold m, it is determined to be a slow tampering attack, and then step S73 is executed; Step S73: When the temporal pattern of the load hash value of consecutive messages is different from the inherent pattern during normal operation, that is, when the change pattern of the load hash value of consecutive messages deviates from the normal pattern, it is also determined to be a slow tampering attack, and then step S74 is executed; Step S74: Trigger a slow tampering alarm.

[0021] Preferably, in step S8, different levels of alarms are output according to the number of abnormal dimensions, and corresponding security responses are executed. Specifically, this includes: Step S81: When a single dimension is abnormal, a low-level alarm is triggered, i.e., a concern-level alarm is triggered, and no corresponding security response is executed; Step S82: When two dimensions are abnormal, a medium-level alarm is triggered, i.e., a warning-level alarm is triggered, and no corresponding security response is executed; Step S83: When three or more dimensions are abnormal, a high-level alarm is triggered, i.e., an emergency-level alarm is triggered, and a corresponding security response is automatically triggered, so that the intrusion detection analysis engine reports to the network security management center through the management network, and the network security management center decides whether to execute response measures such as channel isolation, key update, or network reconstruction.

[0022] The beneficial technical effects of this invention are as follows:

[0023] This invention provides an intrusion detection method for FC-AE-ASM networks based on temporal characteristics and message patterns. This invention utilizes the temporal deterministic characteristics of ASM messages to establish a baseline model of normal behavior, including message period, message ID distribution, load size, and message interval. Furthermore, it employs the CUSUM anomaly detection algorithm to detect abnormal behaviors deviating from the baseline in real time, thereby achieving automatic identification and alerting for message injection attacks, flooding attacks, and slow tampering attacks.

[0024] Compared to traditional signature matching detection methods, the false alarm rate of this invention is expected to be reduced to below 5%; compared to traditional threshold alarm methods, the false alarm rate is expected to be reduced to below 3%. Through the non-intrusive deployment of bypass monitoring probes, this invention achieves real-time security monitoring of network traffic without affecting the original FC-AE-ASM network communication performance, effectively improving the security protection capabilities of avionics networks.

[0025] Additional aspects and advantages of the invention will become apparent from the description which follows, or may be learned by practice of the invention. Attached Figure Description

[0026] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0027] Figure 1 A schematic flowchart of an embodiment of the FC-AE-ASM network intrusion detection method based on timing features and message patterns is shown.

[0028] Figure 2 A flowchart illustrating the bypass monitoring probe deployment and feature extraction according to an embodiment of the present invention is shown;

[0029] Figure 3 This illustrates a flowchart of the normal communication behavior baseline model establishment and CUSUM anomaly detection according to an embodiment of the present invention;

[0030] Figure 4 This diagram illustrates a multi-dimensional alarm association and security response decision-making process according to an embodiment of the present invention. Detailed Implementation

[0031] To better understand the above-mentioned objects, features, and advantages of the present invention, such as Figures 1 to 4 As shown in the accompanying drawings and specific embodiments, the present invention will be further described in detail below. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0032] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and therefore the scope of protection of the invention is not limited to the specific embodiments disclosed below.

[0033] Figure 1 A schematic flowchart of an embodiment of the FC-AE-ASM network intrusion detection method based on timing characteristics and message patterns is shown. Figure 1 As shown, the FC-AE-ASM network intrusion detection method based on time-series characteristics and message patterns includes:

[0034] Step S01: Deploy bypass monitoring probes on the FC-AE-ASM network link so that the ASM message characteristics of each ASM message generated by the bypass monitoring probes can be uploaded to the intrusion detection analysis engine.

[0035] Step S02: Extract ASM message features through the intrusion detection analysis engine to obtain the time features, identification features, load features and sequence features of ASM messages. Then, construct a multi-dimensional feature vector based on the time features, identification features, load features and sequence features of ASM messages.

[0036] Step S03: During the stable operation of the FC-AE-ASM network after initialization, establish a baseline model of normal communication behavior for each ASM channel through the intrusion detection analysis engine;

[0037] Step S04: Using the intrusion detection analysis engine, the CUSUM algorithm is used to perform timing anomaly detection on the arrival time interval between the current ASM message and the previous ASM message in each ASM channel, so as to identify abnormal ASM message intervals.

[0038] Step S05: Using the intrusion detection and analysis engine, based on the preset normal Message ID set ID_set and corresponding legitimate SID for each FC domain, identify messages with illegal Message IDs and abnormal source SIDs to identify message injection attacks;

[0039] Step S06: Using the intrusion detection analysis engine, based on a sliding time window, statistically analyze the frequency of ASM messages in the channel and the total rate of ASM messages across the entire network to identify flooding attacks;

[0040] Step S07: Using the intrusion detection analysis engine, the load of each ASM channel is divided into several data blocks according to a fixed offset, and the statistical characteristics of each data block are calculated to form a load pattern fingerprint. Then, the load pattern fingerprint is used to identify slow tampering attacks.

[0041] Step S08: Through the intrusion detection analysis engine, the multi-dimensional anomaly detection results from steps S4 to S7 are correlated and classified. Different levels of alarms are output according to the number of anomaly dimensions, and corresponding security responses are executed. All alarm events and correlation analysis results are then recorded in the security event log to support post-event traceability and analysis.

[0042] In this embodiment, the present invention provides an FC-AE-ASM network intrusion detection method based on temporal characteristics and message patterns. This invention utilizes the temporal deterministic characteristics of ASM messages to establish a baseline model of normal behavior, including message period, message ID distribution, load size, and message interval. Furthermore, it employs the CUSUM anomaly detection algorithm to detect abnormal behaviors deviating from the baseline in real time, thereby achieving automatic identification and alerting for message injection attacks, flooding attacks, and slow tampering attacks.

[0043] Figure 2 A flowchart illustrating the deployment and feature extraction of a bypass monitoring probe according to an embodiment of the present invention is shown. Figure 2As shown, bypass monitoring probes are deployed at the FC-AE-ASM network link nodes (i.e., the mirror ports of the FC switch). Service packets in the FC-AE-ASM network link undergo traffic replication via the FC switch mirror ports; the mirrored traffic is then sent to the bypass monitoring probes and forwarded to the IDS engine. The bypass monitoring probes capture the FC frames of each ASM message in a non-intrusive manner and generate corresponding timestamps for each FC frame; then, the FC frames are parsed to obtain the ASM frame header and payload information; further parsing of the ASM frame header and payload information generates ASM message features. Further, the intrusion detection analysis engine extracts features from each ASM message, including time features, identification features, payload features, and sequence features; subsequently, these features are combined into a multi-dimensional feature vector V_n, which serves as input for subsequent anomaly detection. Figure 2 As can be seen, the present invention adopts a bypass mirroring deployment architecture, and the monitoring traffic is taken from the mirror port of the switch. The monitoring process of the bypass monitoring probe does not affect the normal communication of the FC network, and it adopts a passive listening method and does not have the ability to send, thus avoiding the bypass monitoring probe itself becoming an attack entry point.

[0044] Figure 3 A flowchart illustrating the establishment of a baseline model for normal communication behavior and CUSUM anomaly detection according to an embodiment of the present invention is shown. Figure 3 As shown, firstly, ASM messages are collected during normal network operation; based on the collected ASM messages, corresponding statistical characteristics are calculated, including the message period average. with standard deviation Information such as Message ID distribution and load patterns is collected; a sliding window mechanism containing the most recent 10,000 samples is used to construct a baseline model of normal communication behavior. After the baseline model is completed, the system enters the online detection phase, i.e., receiving new ASM messages in real time; for each new message, the CUSUM statistic is calculated. and Statistics and The iterative calculation formula is:

[0045]

[0046] Here, dev represents the deviation of the current sample from the baseline.

[0047] Subsequently, the CUSUM statistic (i.e. and The CUSUM statistic S is compared with a preset threshold h; if the CUSUM statistic S (i.e. and If the value of the statistic S is greater than the threshold h, an anomaly is determined to have occurred, triggering an anomaly alarm. The alarm types include message injection attacks, flooding attacks, and slow tampering attacks. If the statistic S is less than or equal to the preset threshold h, it is determined to be normal. The baseline model is updated using the current normal samples to achieve dynamic iteration of the baseline.

[0048] Figure 4 This diagram illustrates a multi-dimensional alarm correlation and security response decision-making process according to an embodiment of the present invention. Figure 4 As shown, four types of detection modules are set up: timing anomaly detection, message injection attack detection, flooding attack detection, and slow tampering attack detection. Each detection module outputs corresponding alarm information, which is then input into the multi-dimensional alarm correlation analysis engine. The alarm correlation analysis engine integrates and analyzes multiple alarm information, classifying alarms into three levels based on the number of dimensions that simultaneously trigger anomalies: a low-level alarm with only a single-dimensional anomaly is marked as "attention"; a medium-level alarm with two-dimensional anomalies is marked as "warning"; and a high-level alarm with three or more-than-average anomalies is marked as "urgent". Low-level and medium-level alarms are only logged in security event logs and no security response is executed. When a high-level alarm is triggered, the intrusion detection analysis engine reports the alarm information to the network security management center via the management network. The network security management center then makes a decision and, based on the analysis results, executes security response measures such as channel isolation, key updates, and network reconstruction, thereby achieving a closed-loop process from alarm analysis to security handling.

[0049] The following specific embodiment will illustrate the FC-AE-ASM network intrusion detection method based on time-series features and message patterns of the present invention. This specific embodiment of the FC-AE-ASM network intrusion detection method based on time-series features and message patterns is implemented through the following steps:

[0050] (1) Step S1: Deploy bypass monitoring probes on the FC-AE-ASM network link.

[0051] Specifically, bypass monitoring probes are deployed at key link nodes of the FC-AE-ASM network (such as mirror ports of FC switches). The bypass monitoring probes capture FC frames in a non-intrusive manner and parse and extract ASM frame header and load information.

[0052] Furthermore, the bypass monitoring probe does not affect the normal communication of the FC network. It adopts a passive listening method and does not have the ability to send data, thus preventing the bypass monitoring probe itself from becoming an attack entry point.

[0053] Furthermore, the bypass monitoring probe will report the extracted ASM message features (Message ID, SID, DID, SEQ_ID, ASM message transmission priority, payload length, and timestamp) to the intrusion detection analysis engine in real time.

[0054] (2) Step S2: Extract the multidimensional feature vector of ASM message.

[0055] Specifically, the intrusion detection analysis engine extracts the following features for each ASM message: time features (message arrival timestamp, time interval with the previous message in the same channel), identification features (Message ID, SID, DID), load features (load length, load hash value), and sequence features (SEQ_ID value, SEQ_ID increment).

[0056] Furthermore, the above features are combined into a multidimensional feature vector. As input for anomaly detection;

[0057] Furthermore, the payload hash value uses a fast hash function (such as xxHash) to calculate a 32-bit hash for the ASM payload, which is used to detect slow changes in the payload content.

[0058] (3) Step S3: Establish a baseline model of normal communication behavior.

[0059] Specifically, during normal network operation (stable state after initialization), the intrusion detection analysis engine establishes a baseline model of normal communication behavior for each ASM channel. This baseline model includes the following statistics: mean message cycle time. and message cycle standard deviation Message ID distribution set ID_set (i.e., the list of normally occurring Message IDs), average load length and load length standard deviation Message interval distribution parameters;

[0060] Furthermore, the baseline model for normal communication behavior is established using a sliding window approach, with the window size set by default to the 10,000 most recent messages, ensuring that the baseline can adapt to the slow evolution of communication patterns.

[0061] Furthermore, after the baseline model of normal communication behavior is established, the model parameters are continuously updated with new data to achieve adaptive tracking of the baseline.

[0062] (4) Step S4: Timing anomaly detection based on CUSUM algorithm.

[0063] Specifically, for each ASM channel, the intrusion detection analysis engine monitors the message arrival interval ∆t and uses the CUSUM algorithm to detect timing anomalies; an upper-biased detection statistic is defined. and underbiased detection statistic Where k is the allowance for the CUSUM algorithm, indicating the minimum drift amplitude to be detected; (default) );

[0064] Furthermore, when Exceeding the threshold h (default) When the message interval increases abnormally, it may indicate message loss or link interference; when When the threshold h is exceeded, the message interval is determined to be abnormally reduced, which may indicate a message injection or flooding attack.

[0065] Furthermore, the CUSUM algorithm is highly sensitive to progressive anomalies and can detect slow attack patterns that cannot be detected by a single threshold detection.

[0066] (5) Step S5: Perform Message ID anomaly detection to identify message injection attacks.

[0067] Specifically, the intrusion detection analysis engine maintains a normal Message ID set ID_set for each FC domain. When an ASM message's Message ID is detected to be outside the ID_set, it is determined to be an illegal message injection.

[0068] Furthermore, for cases where the Message ID is in the ID_set but the source SID is abnormal (i.e., the normal sender SID of the Message ID is inconsistent with the SID of the current message), it is also determined to be a message injection attack—the attacker impersonates a legitimate Message ID but cannot impersonate a legitimate SID;

[0069] Furthermore, upon detecting message injection, the intrusion detection and analysis engine immediately triggers a security alert, records the complete characteristics of the injected message, and reports it to the network security management center via the management network.

[0070] (6) Step S6: Perform message frequency anomaly detection to identify flooding attacks.

[0071] Specifically, the intrusion detection analysis engine maintains a message counter for each ASM channel and each FC node, counts the number of messages within a sliding time window (default 1 second), and determines a flooding attack when the message frequency exceeds 3 times the standard deviation of the baseline mean.

[0072] Furthermore, flood attack detection also monitors total network traffic—when the total rate of ASM messages across the entire network exceeds the baseline threshold, it is determined to be a distributed flood attack even if the frequency of a single channel does not exceed the limit.

[0073] Furthermore, when a flood attack is detected, the intrusion detection analysis engine identifies the flood source SID and sends a traffic limiting command to the FC switch through the management network to limit the sending rate of the flood source.

[0074] (7) Step S7: Perform load pattern anomaly detection to identify slow tampering attacks.

[0075] Specifically, the intrusion detection analysis engine establishes a normal mode model for the load of each ASM channel—dividing the load into data blocks with a fixed offset, calculating statistical characteristics (mean, variance, entropy) for each data block, and forming a load mode fingerprint.

[0076] Furthermore, when the load pattern fingerprint is detected to deviate from the baseline by more than a threshold, it is determined that the message load has been slowly tampered with—the attacker modifies a small amount of data in each message. A single modification is not enough to trigger a threshold alarm, but the cumulative changes cause the overall load pattern to shift.

[0077] Furthermore, load hash value mutation detection serves as an auxiliary means—when the load hash value change pattern of consecutive messages deviates from the normal pattern, a slow tampering alarm is triggered.

[0078] (8) Step S8: Perform multi-dimensional alarm association and security response.

[0079] Specifically, the intrusion detection analysis engine performs correlation analysis on the detection results from steps S4 to S7. When anomalies in multiple dimensions occur simultaneously or consecutively, the alarm level is increased—a single-dimensional anomaly triggers a low-level alarm (attention level), two-dimensional anomalies trigger a medium-level alarm (warning level), and three or more-dimensional anomalies trigger a high-level alarm (urgent level).

[0080] Furthermore, advanced alerts automatically trigger security responses—the intrusion detection and analysis engine reports to the network security management center through the management network, and the center decides whether to implement response measures such as channel isolation, key updates, or network reconstruction.

[0081] Furthermore, all alarm events and correlation analysis results are recorded in the security event log, supporting post-event traceability and analysis.

[0082] In this specific embodiment, the present invention utilizes the time-series deterministic characteristics of ASM messages to establish a normal behavior baseline model that includes message period, message ID distribution, load size, and message interval. It uses the CUSUM algorithm to detect abnormal behaviors that deviate from the baseline in real time, thereby realizing the identification and alarm of message injection attacks, flooding attacks, and slow tampering attacks.

[0083] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for FC-AE-ASM network intrusion detection based on temporal characteristics and message patterns, characterized in that, include: Step S1: Deploy bypass monitoring probes on the FC-AE-ASM network link so that the ASM message characteristics of each ASM message generated by the bypass monitoring probes can be uploaded to the intrusion detection analysis engine. Step S2: Extract the features of the ASM message through the intrusion detection analysis engine to obtain the time features, identification features, load features and sequence features of the ASM message, and then construct a multi-dimensional feature vector based on the time features, identification features, load features and sequence features of the ASM message; Step S3: During the stable operation of the FC-AE-ASM network after initialization, establish a baseline model of normal communication behavior for each ASM channel using the intrusion detection analysis engine; Step S4: Using the intrusion detection analysis engine, the CUSUM algorithm is used to perform timing anomaly detection on the arrival time interval between the current ASM message and the previous ASM message in each ASM channel, so as to identify abnormal ASM message intervals. Step S5: Using the intrusion detection and analysis engine, based on the preset normal Message ID set ID_set and corresponding legitimate SID for each FC domain, identify messages with illegal Message IDs and abnormal source SIDs to identify message injection attacks; Step S6: Using the intrusion detection analysis engine, based on a sliding time window, the frequency of ASM messages in the channel and the total rate of ASM messages across the entire network are statistically analyzed to identify flooding attacks; Step S7: Using the intrusion detection analysis engine, the load of each ASM channel is divided into several data blocks according to a fixed offset, and the statistical characteristics of each data block are calculated to form a load pattern fingerprint. Then, the slow tampering attack is identified by the load pattern fingerprint. Step S8: Through the intrusion detection analysis engine, the multi-dimensional anomaly detection results from steps S4 to S7 are correlated and classified. Different levels of alarms are output according to the number of anomaly dimensions, and corresponding security responses are executed. All alarm events and correlation analysis results are then recorded in the security event log to support post-event traceability and analysis.

2. The FC-AE-ASM network intrusion detection method based on time-series features and message patterns according to claim 1, characterized in that, In step S1, the bypass monitoring probe uploads the ASM message characteristics of each ASM message it generates to the intrusion detection analysis engine, specifically including: Step S11: Capture the FC frames of each ASM message in a non-intrusive manner using the bypass monitoring probe, and generate corresponding timestamps for the FC frames; Step S12: Parse the FC frame using the bypass monitoring probe to obtain the ASM frame header and payload information; Step S13: Using the bypass monitoring probe, parse the ASM frame header and payload information to obtain MessageID, SID, DID, SEQ_ID, ASM message transmission priority, and payload length; Step S14: Using the bypass monitoring probe, generate ASM message features based on Message ID, SID, DID, SEQ_ID, ASM message transmission priority, payload length, and timestamp, and then upload the ASM message features to the intrusion detection analysis engine in real time; The bypass monitoring probe adopts a passive listening method and has no sending capability; the bypass monitoring probe is deployed on the mirror port of the FC switch; the ASM message characteristics include: Message ID, SID, DID, SEQ_ID, ASM message transmission priority, payload length and timestamp; wherein SID and DID are obtained by parsing the ASM frame header in step S13.

3. The FC-AE-ASM network intrusion detection method based on time-series features and message patterns according to claim 1, characterized in that, In step S2, the time features include: the arrival timestamp of the ASM message and the arrival time interval between it and the previous ASM message on the same channel; the identification features include: Message ID, SID, and DID; the load features include: load length and load hash value; and the sequence features include: SEQ_ID value and SEQ_ID increment. In step S3, the baseline model of normal communication behavior includes the following statistics: ASM message cycle mean. ASM message cycle standard deviation Message ID distribution set ID_set, average load length Standard deviation of load length And ASM message interval distribution parameters.

4. The FC-AE-ASM network intrusion detection method based on time-series features and message patterns according to claim 1, characterized in that, In step S4, the CUSUM algorithm is used to detect timing anomalies in the arrival time interval between the current ASM message and the previous ASM message in each ASM channel, in order to identify abnormal ASM message intervals. Specifically, this includes: Step S41: Define the top-biased detection statistics and bottom-biased detection statistics for the current ASM message as follows: ； ； Where k is the allowance for the CUSUM algorithm, which indicates the minimum drift amplitude that needs to be detected; The time interval between the arrival of an ASM message on the same channel; This is the upper bias detection statistic of the previous ASM message; This is the down-biased detection statistic of the previous ASM message; This represents the average ASM message cycle. Step S42: Determine Does it exceed the threshold h and Does it exceed the threshold h? Step S43: When When the threshold h is exceeded, the ASM message interval is determined to have increased abnormally, which may indicate message loss or link interference; when When the threshold h is exceeded, the ASM message interval is determined to be abnormally reduced, which may indicate a message injection or flooding attack.

5. The FC-AE-ASM network intrusion detection method based on time-series features and message patterns according to claim 1, characterized in that, In step S5, message injection attacks are identified through the intrusion detection and analysis engine, specifically including: Step S51: Maintain the preset normal Message ID set ID_set for each FC domain through the intrusion detection analysis engine; Step S52: When the default normal Message ID of an ASM message is not detected in the ID_set, it is determined to be a message injection attack, and step S54 is executed: Step S53: When it is detected that the preset normal Message ID of the ASM message is in ID_set, but there is an abnormal source SID, that is, the normal sender SID of the preset normal Message ID is inconsistent with the SID of the current message, it is also determined to be a message injection attack, and step S54 is executed. Step S54: Immediately trigger a security alarm, record the complete characteristics of the injected message, and then report the complete characteristics of the injected message to the network security management center.

6. The FC-AE-ASM network intrusion detection method based on time-series features and message patterns according to claim 1, characterized in that, Step S6 specifically includes: Step S61: Using the intrusion detection analysis engine, maintain a message counter for each ASM channel and each FC node, and count the number of ASM messages within the sliding time window; Step S62: Based on the number of ASM messages, count the frequency of ASM messages in the channel, and when the frequency of ASM messages exceeds three times the standard deviation of the baseline mean, determine it as a flooding attack, and then execute step S64; Step S63: Calculate the total ASM message rate of the entire network, and when the total ASM message rate of the entire network exceeds the baseline threshold of the entire network, determine it as a flooding attack, and then execute step S64; Step S64: When a flood attack is detected, the flood source SID is identified through the intrusion detection analysis engine, and a traffic limiting command is issued to the FC switch through the management network to limit the sending rate of the flood source.

7. The FC-AE-ASM network intrusion detection method based on time-series features and message patterns according to claim 1, characterized in that, In step S7, statistical characteristics of each data block are calculated to form a load pattern fingerprint, which is then used to identify slow tampering attacks. Specifically, this includes: Step S71: Calculate the mean, variance, and entropy of each data block to form a load pattern fingerprint; Step S72: When the load pattern fingerprint is detected to deviate from the baseline by more than the threshold m, it is determined to be a slow tampering attack, and then step S73 is executed; Step S73: When the temporal pattern of the load hash values ​​of consecutive messages differs from the inherent pattern during normal operation, i.e. When the load hash value change pattern of consecutive messages deviates from the normal pattern, it is also determined to be a slow tampering attack, and then step S74 is executed. Step S74: Trigger a slow tampering alarm.

8. The FC-AE-ASM network intrusion detection method based on time-series features and message patterns according to any one of claims 1 to 7, characterized in that, In step S8, different levels of alarms are output based on the number of anomaly dimensions, and corresponding security responses are executed, specifically including: Step S81: When a single dimension is abnormal, a low-level alarm is triggered, i.e., a concern-level alarm is triggered, and the corresponding security response is not executed; Step S82: When two dimensions are abnormal, trigger a medium-level alarm, i.e., trigger a warning-level alarm, and do not execute the corresponding security response; Step S83: When three or more dimensions are abnormal, a high-level alarm is triggered, i.e., an emergency alarm is triggered, and the corresponding security response is automatically triggered so that the intrusion detection analysis engine reports to the network security management center through the management network, and the network security management center decides whether to implement response measures such as channel isolation, key update or network reconstruction.

Images