CN116248524A - Communication network situation prediction model and method for ocean vessels - Google Patents
Communication network situation prediction model and method for ocean vessels Download PDFInfo
- Publication number
- CN116248524A CN116248524A CN202211585840.XA CN202211585840A CN116248524A CN 116248524 A CN116248524 A CN 116248524A CN 202211585840 A CN202211585840 A CN 202211585840A CN 116248524 A CN116248524 A CN 116248524A
- Authority
- CN
- China
- Prior art keywords
- network
- situation
- layer
- data
- tcn
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000004891 communication Methods 0.000 title claims abstract description 45
- 238000000034 method Methods 0.000 title claims abstract description 43
- 238000012549 training Methods 0.000 claims abstract description 26
- 238000012545 processing Methods 0.000 claims abstract description 20
- 239000013598 vector Substances 0.000 claims description 28
- 230000006870 function Effects 0.000 claims description 18
- 230000001364 causal effect Effects 0.000 claims description 14
- 230000004913 activation Effects 0.000 claims description 11
- 238000004364 calculation method Methods 0.000 claims description 9
- 238000013507 mapping Methods 0.000 claims description 8
- 238000007781 pre-processing Methods 0.000 claims description 8
- 230000007787 long-term memory Effects 0.000 claims description 4
- 230000004927 fusion Effects 0.000 claims description 2
- 230000008929 regeneration Effects 0.000 claims description 2
- 238000011069 regeneration method Methods 0.000 claims description 2
- 238000012795 verification Methods 0.000 claims description 2
- 230000008569 process Effects 0.000 abstract description 12
- 210000002569 neuron Anatomy 0.000 description 12
- 238000013528 artificial neural network Methods 0.000 description 8
- 239000000284 extract Substances 0.000 description 5
- 230000007246 mechanism Effects 0.000 description 5
- 230000015654 memory Effects 0.000 description 5
- 238000004422 calculation algorithm Methods 0.000 description 4
- 238000004458 analytical method Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 230000000694 effects Effects 0.000 description 3
- 238000010606 normalization Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 230000018109 developmental process Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000011084 recovery Methods 0.000 description 2
- 230000009466 transformation Effects 0.000 description 2
- 241001123248 Arma Species 0.000 description 1
- 208000037170 Delayed Emergence from Anesthesia Diseases 0.000 description 1
- 206010063385 Intellectualisation Diseases 0.000 description 1
- 230000002159 abnormal effect Effects 0.000 description 1
- 230000002411 adverse Effects 0.000 description 1
- 238000004140 cleaning Methods 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000002790 cross-validation Methods 0.000 description 1
- 238000000354 decomposition reaction Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000007123 defense Effects 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 230000002068 genetic effect Effects 0.000 description 1
- 230000007774 longterm Effects 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 238000011176 pooling Methods 0.000 description 1
- 230000001902 propagating effect Effects 0.000 description 1
- 230000001172 regenerating effect Effects 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 238000005070 sampling Methods 0.000 description 1
- 238000004088 simulation Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/16—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using machine learning or artificial intelligence
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02A—TECHNOLOGIES FOR ADAPTATION TO CLIMATE CHANGE
- Y02A90/00—Technologies having an indirect contribution to adaptation to climate change
- Y02A90/10—Information and communication technologies [ICT] supporting adaptation to climate change, e.g. for weather forecasting or climate simulation
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- Theoretical Computer Science (AREA)
- Evolutionary Computation (AREA)
- Medical Informatics (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- General Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Life Sciences & Earth Sciences (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Biophysics (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Molecular Biology (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Databases & Information Systems (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention provides a communication network situation prediction model and a method for ocean vessels, wherein the method comprises the following steps: constructing an ocean vessel satellite communication network situation data set, wherein the data set comprises a plurality of network flow packet characteristics and attack tags corresponding to each flow; constructing a network situation prediction model; the sample training data set after data processing is sent to the network situation prediction model for training; inputting the acquired ocean vessel satellite communication network situation data set into the trained network situation prediction model, and outputting a prediction result of the ocean vessel satellite communication network situation. The communication network situation prediction model and the method for the ocean vessels provided by the invention have higher accuracy for future network situation prediction in the vessel navigation process.
Description
Technical Field
The invention relates to the technical field of network security of ocean vessels, in particular to a communication network situation prediction model and method for ocean vessels.
Background
With the continued development of ocean going, the importance of intellectualization of ships has begun to stand out. Meanwhile, by means of maritime satellites, shore base stations, mobile ship base stations and the like, ocean-going ships have the capability of real-time network communication, and it is particularly important how to ensure that the identification and analysis of the ship satellite network environment and the prediction of possible future network situations are realized in complex and changeable maritime environments.
Under a real environment, a communication network between a ship and a satellite has the characteristics of huge scale, complex dynamic characteristics, bad marine communication environment and the like, and the processing and analysis of the satellite communication network situation of the ship become a very difficult task. In order to analyze the characteristics of the network in the navigation process, accurately know the situation of the network, reduce the adverse effect caused by potential network attack, we must predict the future security situation of the network in advance so as to prepare for subsequent network defense.
The mature network situation awareness system can acquire network data of a plurality of information sources in real time, understand and analyze the data through a situation understanding link, and the feature data after the system is extracted and constructed can be used for identification and judgment by a situation assessment link, so that accurate situation analysis is provided. In addition, the situation information in a future time range can be predicted according to the situation information in a previous time unit.
The network security situation prediction is used as the last ring in the technical field of network situations, and can extract the internal time rules of situation data streams in the previous and current network spaces and predict the future situation information according to the discovered rules. This technique can provide early warning to security personnel in advance, ready for them to be faced with a possible network attack.
The prediction method of network situation awareness is many, and the prediction of a certain time step can be realized by the traditional algorithm and the machine learning method, such as ARMA algorithm, genetic algorithm and the like, and the network situation prediction can be realized to a certain extent. However, this kind of method is limited by the principle of the algorithm itself, and cannot further extract the inherent relation of longer input data and predict situation information of longer step length in the future. With the development of deep learning, the neural network can extract deep association features of data, so that a leading edge technology of input-output relations between data is mined, and a good effect is achieved in the field of situation prediction. Models such as a neural network with a convolution structure, a BP neural network, a differential WGAN, an LSTM and the like are used in the situation prediction field by related scholars, but most of the methods ignore importance differences among original data attributes, limit predicted time steps to a certain extent, only predict situation information in a very short time step, and once the time length to be predicted becomes long, the accuracy of the model prediction is greatly reduced.
Meanwhile, due to factors of offshore communication environment and hardware equipment, time delay and data packet loss of a ship satellite communication network link are unavoidable, so that certain loss exists in network flow data directly acquired from a ship, and training is difficult for subsequent situation assessment and prediction models. In summary, the problems of the prior art are: (1) The existing network security situation prediction technology is developed based on land traffic data and cannot be well adapted to the offshore network environment; (2) The existing situation prediction model can only simply predict situation information in a shorter step length range, obvious distortion and detail loss can occur when the prediction step length is increased, and the accuracy of a prediction result is obviously reduced.
Disclosure of Invention
Aiming at the defects in the prior art, the invention aims to provide a communication network situation prediction model and a communication network situation prediction method for ocean vessels, which are accurate in prediction.
In order to solve the problems, the technical scheme of the invention is as follows:
a communication network situation prediction model for ocean vessels comprises an input layer for providing samples, a TCN layer for extracting sequence features, an Attention layer for highlighting important situation features and a GRU prediction layer for realizing long-term memory output, wherein the input layer is used for constructing vessel network flow data with intrusion attack feature data, the TCN layer is used for carrying out data preprocessing and sliding window processing on the vessel network flow data transmitted by the input layer, the important situation features are extracted by the output of the TCN layer through the Attention layer, vector weights output in TCN networks at different moments are calculated by the Attention layer, larger weights are given to the features with larger network safety hazards, smaller weights are given to other features, and the feature information acquired by the Attention layer is updated and reset through the GRU prediction layer.
Preferably, the TCN structure expression formula is: tcn= 1DFCN+Casual Convolution, the nonlinear activation function, dropout and identity mapping network can effectively inhibit network overfitting, and improve network learning speed and accuracy.
Preferably, the GRU prediction layer includes an update gate and a reset gate, the reset gate is used for calculating whether to forget the previous calculation state, and the update gate decides how much information of the last step is iterated to the current step.
Further, the invention also provides a communication network situation prediction method for the ocean vessel, which comprises the following steps:
constructing an ocean vessel satellite communication network situation data set, wherein the data set comprises a plurality of network flow packet characteristics and attack tags corresponding to each flow;
constructing a network situation prediction model;
the sample training data set after data processing is sent to the network situation prediction model for training;
inputting the acquired ocean vessel satellite communication network situation data set into the trained network situation prediction model, and outputting a prediction result of the ocean vessel satellite communication network situation.
Preferably, the step of constructing the network situation prediction model specifically includes the following steps:
constructing an input layer, and preprocessing the acquired situation data;
constructing a TCN layer for processing sample input by stacking a plurality of fully connected convolution layers containing causal relationships;
extracting important situation features from the output of the TCN layer through the attribute layer;
and updating and resetting the characteristic information acquired by the attribute layer through the GRU prediction layer.
Preferably, the preprocessing the collected situation data specifically includes: the input data is normalized and sliding window processed, and the input data is converted into a form of time step x input dimension.
Preferably, the step of constructing the TCN layer for processing the sample input by stacking a plurality of fully-connected convolution layers including causal relationship specifically includes: constructing a TCN module for dynamically receiving sample data transmitted by a sliding window through linearly overlapping a plurality of causal relation-based fully-connected convolution layers, wherein the TCN structure expression formula is as follows: tcn=1 DFCN +
Casual Convolution, the nonlinear activation function, dropout and identity mapping network can effectively inhibit network overfitting, and improve network learning speed and accuracy.
Preferably, the step of extracting the important situation feature from the output of the TCN layer through the Attention layer specifically includes: the data is output T, T after the characteristics are extracted through the TCN network t The t-th feature vector output by the TCN network is input into the Attention layer to obtain an initial state vector a t After which it is given a weight coefficient alpha t Obtaining a finally output state vector Y:
e t ＝tanh(ω t a t +b t )
wherein e t Represents a t Corresponding energy value omega t 、b t Respectively representing the weight coefficient and the bias corresponding to the t characteristic vector.
Preferably, the step of updating and resetting the feature information acquired by the Attention layer through the GRU prediction layer specifically includes: the GRU prediction layer comprises an update gate and a reset gate, wherein the reset gate is used for calculating whether the state is forgotten before calculation, the update gate determines how much information of the last step is iterated to the current step, and the reset gate and the update gate perform activation operation through a sigmoid function.
Preferably, the step of sending the sample training data set after data processing to the network situation prediction model for training specifically includes: after the acquired real ship network data is recovered, malicious situation data is added to the data set participating in training, the malicious situation data and the acquired network situation data are subjected to effective data fusion and regeneration, a final data set for model training is generated and sent into the network situation prediction model for training, a defined loss function and an optimizer counter-propagate network gradient are utilized, the network performance is checked by using a cross verification method, the network is converged to an optimal state, and the trained model is stored.
Compared with the prior art, the method and the system are mainly used for predicting the situation information of the digital asset with the network communication capability on the ocean vessel on the network communication path established by the shipboard routing gateway and the maritime satellite. The method solves the problem of predicting and monitoring the future network safety of the intelligent ship in the current ocean navigation process, thereby ensuring that the digital asset on the intelligent ship is not stolen and tampered maliciously. The prediction effect of the invention for future network situation in the ship navigation process achieves higher prediction accuracy, and simultaneously, the fine-granularity and high-precision prediction result under longer time step is also realized.
Drawings
Other features, objects and advantages of the present invention will become more apparent upon reading of the detailed description of non-limiting embodiments, given with reference to the accompanying drawings in which:
FIG. 1 is a flow chart of a communication network situation prediction method for ocean vessels, which is provided by an embodiment of the invention;
fig. 2 is a schematic structural diagram of a communication network situation prediction model for ocean vessels according to an embodiment of the present invention;
fig. 3 is a schematic diagram of a residual error module structure in a TCN structure in a communication network situation prediction model for an ocean vessel according to an embodiment of the present invention;
fig. 4 is a diagram of a GRU network structure in a communication network situation prediction model for ocean vessels according to an embodiment of the present invention.
Detailed Description
The present invention will be described in detail with reference to specific examples. The following examples will assist those skilled in the art in further understanding the present invention, but are not intended to limit the invention in any way. It should be noted that variations and modifications could be made by those skilled in the art without departing from the inventive concept. These are all within the scope of the present invention.
Fig. 1 is a flow chart of a communication network situation prediction method for ocean vessels, which is provided by an embodiment of the invention, as shown in fig. 1, the method comprises the following steps:
s1: constructing an ocean vessel satellite communication network situation data set, wherein the data set comprises a plurality of network flow packet characteristics and attack tags corresponding to each flow;
specifically, an ocean vessel satellite communication network situation data set ShipNet is constructed, wherein the data set comprises various network traffic packet characteristics and attack tags corresponding to each traffic. In this embodiment, the communication traffic of the designated network card and the external internet is selected as the basic source of the data set, all the generated traffic is captured and recorded to the server by using the mirror port, and the native data is processed by means of subsequent traffic recovery and data balancing.
S2: constructing a network situation prediction model;
specifically, as shown in fig. 2, each network module of a network situation prediction model based on tcn+gru is constructed, where the network situation prediction model includes: an input layer responsible for providing samples, a TCN layer extracting sequence features, an Attention layer highlighting important situation features, and a GRU layer implementing long-term memory output.
Firstly, situation data enter a network after being preprocessed and read by a sliding window, characteristics are extracted by a plurality of residual blocks containing hole causal convolution, and then, the output of the module is obtained through two pooling operations including MaxPooling and AveragePooling.
And constructing a TCN module for dynamically receiving the sample data transmitted by the sliding window through linearly overlapping a plurality of causal relation-based fully-connected convolution layers. The repeating components of the module are composed of a plurality of residual models, as shown in FIG. 3, and the residual structure comprises a plurality of components, which are roughly divided into a hole causal convolution element for processing the logical relationship inside the data, an activation function for providing nonlinear transformation, dropout for randomly losing part of the weight enhancement model generalizing capability, and an identity mapping network for providing neuron depth.
The output of the TCN layer extracts important situation features through the Attention layer.
The elements in the Attention layer can be regarded as being formed by the data pairs of < Key, value > of the columns, at the moment, given an element Query in the Target, the weight coefficient of Value corresponding to each Key is obtained by calculating the similarity or the correlation between the Query and each Key, and then the Value is weighted and summed, so that the final Attention Value is obtained. The essential idea can be rewritten as the following formula:
the specific calculation process of the Attention mechanism can be generalized into two processes: the first process calculates the weight coefficient from the Query and Key, and the second process performs weighted summation on Value from the weight coefficient. The first process can be subdivided into two phases: the first stage calculates the similarity or correlation of the Query and the Key; the second stage normalizes the original scores of the first stage.
In the first stage, different functions and computation mechanisms can be introduced according to Query and certain key i The most common method of calculating the similarity or correlation of the two includes: vector dot product for both, vector similarity for both, or by reintroducing additional neural networks, i.e., as follows:
Similarity(Query,Key i )＝Query·Key i
Similarity(Query,Key i )＝MLP(Query,Key i i )
calculation result a of the second stage i Namely value i And (5) carrying out weighted summation on the corresponding weight coefficients to obtain the Attention value.
The data is output T, T after the characteristics are extracted through the TCN network t The t-th feature vector output by the TCN network is input into the Attention layer to obtain an initial state vector a t After which it is given a weight coefficient alpha t And obtaining a finally output state vector Y.
e t ＝tanh(ω t a t +b t )
Wherein e t Represents a t Corresponding energy value omega t 、b t Respectively representing the weight coefficient and the bias corresponding to the t characteristic vector.
The GRU prediction layer is responsible for updating and resetting the characteristic information acquired by the attribute, and aims to preserve long-term memory. As shown in fig. 4, the GRU module includes two parts, an update gate and a reset gate, the reset gate is used for calculating whether to forget the previous calculation state, and the update gate decides how much information of the last step is iterated to the current step.
Input x input ＝concat[h t-1 ,x t ]
Reset portal neuron r t ＝σ(x input W r +b r )
Memory portal neurons:
input portal neuron z t ＝σ(x input W z +b z )
Memory after input:
forgetting gate "neuron": f t ＝1-z t
The t-1 moment after forgetting is memorized as h' t-1 ＝f t ⊙h t-1
Memory at time t:
wherein x is input input By memorizing the state h at the previous time t-1 t-1 And the current time t is obtained by conducting concat of characteristic dimension through vector input x. Sigma refers to a sigmoid function, the output result of the reset gate neuron r and the input gate neuron z is a vector, and since both gate neurons use sigmoid as an activation function, each element of the output vector is between 01 for controlInformation amount of each dimension flowing through the valve; memory portal neurons
The output result of (2) is still vector and is equivalent to the output vector dimension of the reset gate and the input gate neuron, and since the activation function used by the memory gate neuron is tanh, each element of the output vector thereof is between-1 and 1. W (W) r ，b r ，W z ，b z ，W h ，b h Is a parameter of each portal neuron, which is to be learned during the training process.
The construction steps of the model are as follows:
step 21: constructing an input layer, and preprocessing the acquired situation data;
the input layer is mainly used for preprocessing the acquired situation data, respectively carrying out normalization processing and sliding window processing on the input data, and converting the input data into a form of time step length multiplied by input dimension.
And reading data, cleaning the data, and normalizing the cleaned data. The variance of the features can be reduced to a certain range by data normalization, the influence of abnormal values is reduced, and the convergence rate of the model is improved. The characteristic data is normalized to between-1 and 1 by means of min-max normalization. For characteristic data H x ＝[h x1 ,h x2 ,…,h xn ](x=1, 2,3,4, 5) (n represents the total number of samples). Will h xi Mapping to interval [ -1,1]The result of (2) is h' xi 。
Sliding window processing: in order to effectively learn the change trend of the historical data, the normalized data is processed by a sampling sliding window method. Assuming that the sliding window is set to s=m+1 and the total number of samples is n, n- (m+1) +1 samples are generated after the sliding window method.
Step 22: constructing a TCN layer for processing sample input by stacking a plurality of fully connected convolution layers containing causal relationships;
the repeating component of the module is composed of a plurality of residual models, and the residual structure comprises a plurality of functional elements, which are roughly divided into a cavity causal convolution element for processing the internal logic relation of data, an activation function for providing nonlinear transformation, dropout for randomly losing part of weight enhancement model generalization capability and an identity mapping network for providing neuron depth. Briefly, the TCN structure can be expressed by the following formula:
TCN＝1DFCN+Casual Convolution
the nonlinear activation function, dropout and identity mapping network can effectively inhibit network overfitting, and improve network learning speed and accuracy. Specifically, assume model X ε R n ，f∈R k Representing a one-dimensional hole causal convolution kernel, the result after hole causal convolution operation is shown as follows:
where d represents the expansion factor, k represents the convolution kernel size, and s-d.i represents the position point corresponding to the input sequence. It can be seen that when d=1, the hole causal convolution calculates the input data by a conventional calculation method; when d is not equal to 1, convolution operation is performed on the input data. In general, the expansion factor d will be calculated as d=o (2 with the number of network layers i i ) The manner of (a) is changed.
The change mode can ensure that the receptive field of the TCN can be rapidly increased when the size k of the convolution kernel changes, and the receptive field of the high-level convolution kernel in the network can cover all effective inputs of the input time sequence, so that information is fused better, and long-term modes in the sequence are modeled effectively.
Step 23: the output of the TCN layer extracts important situation features through the Attention layer;
the attention mechanism is used as a mechanism adopted when human processing information, and can help the model to better learn the interrelationship between different attributes, so that the neural network is prevented from giving the same weight to each predictive factor in the training process, and important information in the predictive factor is ignored. In the embodiment, by introducing an attention mechanism, vector weights output in the TCN network at different moments are calculated, and the characteristic with larger influence situation values is highlighted, so that the purpose of improving the performance of the model is realized. In the training process, the introduction of the Attention layer can make the model structure pay more Attention to the key characteristics in a weight coefficient mode. For example, when predicting the situation value of the next week, features with larger security risks to the network are given larger weights, while other features are given smaller weights, so that the predicted situation value is more real and effective.
The data is output T, T after the characteristics are extracted through the TCN network t The t-th feature vector output by the TCN network is input into the Attention layer to obtain an initial state vector a t After which it is given a weight coefficient alpha t Obtaining a finally output state vector Y:
e t ＝tanh(ω t a t +b t )
wherein e t Represents a t Corresponding energy value omega t 、b t Respectively representing the weight coefficient and the bias corresponding to the t characteristic vector.
Step 2.4: and updating and resetting the characteristic information acquired by the attribute layer through the GRU prediction layer.
The GRU prediction layer mainly comprises an update gate and a reset gate. The reset gate is used to calculate whether to forget the previous calculation state, and the update gate decides how much information of the last step is to be iterated to the current step. Both the reset gate and the update gate are activated by a sigmoid function that converts the output to a value between 0 and 1, which is forgotten when multiplied by 0But will be preserved when multiplied by 1. The GRU unit is first connected to input h t-1 And x t And the output r at t of the two gates is obtained by the following two formulas respectively t And z t . By combining the two outputs into the neural network and then using the tanh function to adjust the output of the neural network, the data is prevented from being too large or too small, and the output is prevented
The result of updating the gate is mainly used in two cases, one is sum z t Multiplying to retain and update a part of information, the other is +.>
Multiplying to retain and update some part of information, another is sum h t-1 Combining to decide which data to discard before generating the output h of the GRU unit t 。
z t ＝σ*W z ·[h t-1 ,x t ])
r t ＝σ(W r ·[h t-1 ,x t ])
Wherein W and b represent the weights and bias vectors of the neural network, r t 、z t Representing the outputs of the reset and update gates at t, h t And
state information representing a t time point and candidate state information.
S3: the sample training data set after data processing is sent to the network situation prediction model for training;
specifically, simulation research and experiments are performed by using actually obtained ship data, and due to unstable communication of maritime satellites and complex and changeable marine environments, the obtained data set has certain problems of packet loss and time delay, lost flow is recovered in a tensor expansion mode, and lost flow is recovered by extracting and integrating context characteristics.
At the data level, the total network traffic data may be characterized by periodic throughput patterns, clear statistics of packet sizes, predictable flow direction, and expected connection life. Network fluctuation caused by packet loss finally reflects the changes of flow, packet number and packet Interval Arrival Time (IAT), and four factors of flow and packet IAT are selected: the maximum value, the minimum value, the average value and the variance represent statistical information, and the low-rank tensor recovery is realized by calculating singular value decomposition.
After the ship network data is recovered, malicious situation data is added to the data set participating in training, and meanwhile, the data set is rebalanced to achieve the purpose of optimizing the training result. And generating a final data set for model training by effectively fusing and regenerating malicious situation data and the acquired network situation data.
And (3) sending the sample data with a certain batch size after data processing into the network situation prediction model for training, reversely propagating the network gradient by using a defined loss function and an optimizer, checking the network performance by using a cross-validation method, converging the network to an optimal state, and storing the trained model for direct use.
S4: inputting the acquired ocean vessel satellite communication network situation data set into the trained network situation prediction model, and outputting a prediction result of the ocean vessel satellite communication network situation.
Specifically, the model generates a prediction result within a corresponding time range according to a prediction step length set in the input parameters, and in this task, network situation data within a specified time step length in the future, namely network flow characteristics and classification results of the ship within a plurality of time units in the future, are output.
The foregoing describes specific embodiments of the present invention. It is to be understood that the invention is not limited to the particular embodiments described above, and that various changes or modifications may be made by those skilled in the art within the scope of the appended claims without affecting the spirit of the invention. The embodiments of the present application and features in the embodiments may be combined with each other arbitrarily without conflict.
Claims (10)
1. A communication network situation prediction model for ocean vessels comprises an input layer for providing samples, a TCN layer for extracting sequence features, an Attention layer for highlighting important situation features and a GRU prediction layer for realizing long-term memory output, wherein the input layer is used for constructing vessel network flow data with intrusion attack feature data, the TCN layer is used for carrying out data preprocessing and sliding window processing on the vessel network flow data transmitted by the input layer, the important situation features are extracted by the output of the TCN layer through the Attention layer, vector weights output in TCN networks at different moments are calculated by the Attention layer, larger weights are given to the features with larger network safety hazards, smaller weights are given to other features, and the feature information acquired by the Attention layer is updated and reset through the GRU prediction layer.
2. The model of claim 1, wherein the TCN structure expression formula is: tcn= 1DFCN+Casual Convolution, the nonlinear activation function, dropout and identity mapping network can effectively inhibit network overfitting, and improve network learning speed and accuracy.
3. The model of claim 1, wherein the GRU prediction layer includes an update gate and a reset gate, the reset gate being used to calculate whether to forget the previous calculation state, the update gate determining how much information to iterate to the current step.
4. A method for predicting a situation of a communication network for an ocean vessel, the method comprising the steps of:
constructing an ocean vessel satellite communication network situation data set, wherein the data set comprises a plurality of network flow packet characteristics and attack tags corresponding to each flow;
constructing a network situation prediction model;
the sample training data set after data processing is sent to the network situation prediction model for training;
inputting the acquired ocean vessel satellite communication network situation data set into the trained network situation prediction model, and outputting a prediction result of the ocean vessel satellite communication network situation.
5. The method for predicting the situation of a communication network for an ocean vessel according to claim 4, wherein the step of constructing the network situation prediction model specifically comprises the steps of:
constructing an input layer, and preprocessing the acquired situation data;
constructing a TCN layer for processing sample input by stacking a plurality of fully connected convolution layers containing causal relationships;
extracting important situation features from the output of the TCN layer through the attribute layer;
and updating and resetting the characteristic information acquired by the attribute layer through the GRU prediction layer.
6. The method for predicting situation of a communication network for an ocean vessel according to claim 5, wherein the preprocessing of the collected situation data specifically comprises: the input data is normalized and sliding window processed, and the input data is converted into a form of time step x input dimension.
7. The method for predicting situation of communication network for ocean going vessel of claim 5, wherein said step of constructing TCN layer for processing sample input by stacking a plurality of fully connected convolution layers containing causal relation specifically comprises: constructing a TCN module for dynamically receiving sample data transmitted by a sliding window through linearly overlapping a plurality of causal relation-based fully-connected convolution layers, wherein the TCN structure expression formula is as follows: tcn= 1DFCN+Casual Convolution, the nonlinear activation function, dropout and identity mapping network can effectively inhibit network overfitting, and improve network learning speed and accuracy.
8. The method for predicting situation of communication network for ocean vessels according to claim 5 wherein said step of extracting important situation features from the output of the TCN layer through the Attention layer specifically comprises: the data is output T, T after the characteristics are extracted through the TCN network t The t-th feature vector output by the TCN network is input into the Attention layer to obtain an initial state vector a t After which it is given a weight coefficient alpha t Obtaining a finally output state vector Y:
e t ＝tanh(ω t a t +b t )
wherein e t Represents a t Corresponding energy value omega t 、b t Respectively representing the weight coefficient and the bias corresponding to the t characteristic vector.
9. The method for predicting situation of communication network for ocean vessel according to claim 5, wherein the step of updating and resetting the characteristic information acquired by the Attention layer through the GRU prediction layer specifically comprises: the GRU prediction layer comprises an update gate and a reset gate, wherein the reset gate is used for calculating whether the state is forgotten before calculation, the update gate determines how much information of the last step is iterated to the current step, and the reset gate and the update gate perform activation operation through a sigmoid function.
10. The method for predicting the situation of a communication network for an ocean vessel according to claim 4, wherein the step of sending the data-processed sample training data set to the network situation prediction model for training specifically comprises: after the acquired real ship network data is recovered, malicious situation data is added to the data set participating in training, the malicious situation data and the acquired network situation data are subjected to effective data fusion and regeneration, a final data set for model training is generated and sent into the network situation prediction model for training, a defined loss function and an optimizer counter-propagate network gradient are utilized, the network performance is checked by using a cross verification method, the network is converged to an optimal state, and the trained model is stored.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211585840.XA CN116248524A (en) | 2022-12-06 | 2022-12-06 | Communication network situation prediction model and method for ocean vessels |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211585840.XA CN116248524A (en) | 2022-12-06 | 2022-12-06 | Communication network situation prediction model and method for ocean vessels |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116248524A true CN116248524A (en) | 2023-06-09 |
Family
ID=86623165
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211585840.XA Pending CN116248524A (en) | 2022-12-06 | 2022-12-06 | Communication network situation prediction model and method for ocean vessels |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116248524A (en) |
-
2022
- 2022-12-06 CN CN202211585840.XA patent/CN116248524A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111428789A (en) | Network traffic anomaly detection method based on deep learning | |
| CN111898635A (en) | Neural network training method, data acquisition method and device | |
| CN115618296A (en) | Dam monitoring time sequence data anomaly detection method based on graph attention network | |
| CN112508265A (en) | Time and activity multi-task prediction method and system for business process management | |
| Ku et al. | A study of the Lamarckian evolution of recurrent neural networks | |
| CN114462520A (en) | Network intrusion detection method based on traffic classification | |
| Dai et al. | Hybrid deep model for human behavior understanding on industrial internet of video things | |
| WO2020171904A1 (en) | Human body part segmentation with real and synthetic images | |
| CN113239897A (en) | Human body action evaluation method based on space-time feature combination regression | |
| CN114152257A (en) | Ship prediction navigation method based on attention mechanism and environment perception LSTM | |
| CN112580728A (en) | Dynamic link prediction model robustness enhancing method based on reinforcement learning | |
| CN116052254A (en) | Visual continuous emotion recognition method based on extended Kalman filtering neural network | |
| Liu et al. | Uncertainty-aware graph reasoning with global collaborative learning for remote sensing salient object detection | |
| CN112241802A (en) | Interval prediction method for wind power | |
| CN114240659A (en) | Block chain abnormal node identification method based on dynamic graph convolutional neural network | |
| Springer et al. | Robust parameter estimation of chaotic systems | |
| Badran et al. | Wind ambiguity removal by the use of neural network techniques | |
| CN115761654B (en) | Vehicle re-identification method | |
| WO2020190951A1 (en) | Neural network trained by homographic augmentation | |
| CN114401135B (en) | Internal threat detection method based on LSTM-Attention user and entity behavior analysis technology | |
| Arribas et al. | Neural architectures for parametric estimation of a posteriori probabilities by constrained conditional density functions | |
| CN116248524A (en) | Communication network situation prediction model and method for ocean vessels | |
| Colomer et al. | Forming a sparse representation for visual place recognition using a neurorobotic approach | |
| CN117011219A (en) | Method, apparatus, device, storage medium and program product for detecting quality of article | |
| CN115273814A (en) | Pseudo voice detection method, device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |