A quadrotor drone attack tracing method based on data flow analysis

Abstract

The present invention discloses a method for tracing the source of attacks on a quad-rotor drone based on data stream analysis, belonging to the field of drone security technology. The method comprises: establishing a topological network between sensors and the states of each order of the drone; parsing the normal flight log of the quad-rotor drone to obtain motor PWM control signal strength information, state information of each order, and output information of each sensor, resampling and synchronizing preprocessing, and training an LSTM neural network; using the trained neural network to detect abnormal states of each order in the flight log to be tested, locating suspicious sensors and available redundant sensors, and using the available redundant sensors to deduce predicted values of abnormal states, reversely processing to obtain predicted information of suspicious sensors, and comparing it with the actual output of the suspicious sensors to obtain detection results. The present invention can successfully detect abnormal states and determine the time when the abnormality occurs, and can accurately trace back to the sensor with data distortion, thereby achieving the tracing of the source of quad-rotor drone safety accidents.

Description

Technical Field

[0001] The present invention relates to the technical field of drone security, and in particular to a quad-rotor drone attack tracing method based on data stream analysis. Background Art

[0002] An unmanned aerial vehicle (UAV) is an unmanned aerial vehicle operated by a radio remote control device or an autonomous program-controlled device. As technological innovation plays an increasingly important role in enhancing overall competitiveness, the technological innovation and technical level of UAVs are gradually improving, and their scale and number are also increasing.

[0003] Quadcopter drones are robust to natural interference, but malicious attempts to spoof their sensors can cause physical failures and even serious safety incidents. For example, malicious attackers can use GPS simulators to impersonate satellites, sending false GPS signals and achieving GPS spoofing. They can also forge optical flow information to provide false image information to drones, causing them to misperceive objects. Ultrasonic waves can also interfere with a drone's MEMS gyroscope, rendering it unable to control its attitude. These sensors play a crucial role in a drone's navigation and control loops. Attackers can attack or interfere with drone sensors without the user's knowledge, causing the device to be hijacked or lose control, leading to a range of security issues, including privacy breaches, property damage, and major safety incidents. Therefore, tracing and analyzing the source of drone safety incidents is of great research significance and value. This research can reveal the attacker's methods and strategies, thereby helping businesses and individuals strengthen their understanding and awareness of drone safety and take appropriate preventative measures.

[0004] To address drone safety incidents, existing technologies have proposed an attack detection framework based on the control invariant method. This framework combines the physical characteristics of the unmanned vehicle with its dynamic model to extract control invariants and represents them in a state space. Within this detection framework, external attacks are detected by checking whether the actual physical state perceived by the vehicle is consistent with the state predicted by the model. This technology successfully detects common sensor attacks. The specific operation is as follows:

[0005] Step 1: The target drone performs a set of flight missions, and researchers measure and record the system status during operation to derive unknown parameters in system identification.

[0006] The second step is to create a control template for the target UAV. This template includes equations with uninstantiated parameters determined by the UAV's dynamics model. The most suitable parameters are determined using system identification methods. The instantiated equations serve as control invariants, reflecting the vehicle's control model.

[0007] Step 3: Determine the error threshold and monitoring window size, calculate the accumulated transient error in each monitoring window, and then detect whether it is under external attack.

[0008] The shortcomings of the attack detection scheme based on control invariants proposed by this technology are:

[0009] 1. Detection accuracy is highly dependent on the modeling effect of system identification and extraction of control invariants.

[0010] 2. The dynamic behavior of drones is often complex and nonlinear. Furthermore, the internal parameters of drone flight control systems are not fixed and their variations can lead to errors. These errors can cause deviations between predicted results and actual flight behavior.

[0011] 3. This technology can successfully detect attacks in attack samples, but cannot trace them back to the attacked sensor. Summary of the Invention

[0012] In order to realize the traceability research of quadrotor drone safety accidents, this paper proposes a quadrotor drone attack tracing method based on data stream analysis. This method can successfully detect abnormal states in samples and determine the time when the anomaly occurs. It can accurately trace back to the sensor that distorts the data, and finally realize the traceability analysis of quadrotor drone safety accidents.

[0013] The technical solutions of the present invention are as follows:

[0014] Step 1: Based on the data stream of the quadrotor UAV sensor system, a topological network is established between the sensor and each order state of the UAV;

[0015] Step 2: Extract time series data from the normal flight log of the quadrotor drone, parse it to obtain the quadrotor drone motor PWM control signal strength information, the quadrotor drone's various order status information, and the output information of each quadrotor drone's sensors, and resample and synchronize the preprocessing.

[0016] Step 3: Use the normal samples obtained from the preprocessing to train the LSTM neural network, establish the time series mapping relationship between the PWM control signal strength of the quadrotor UAV motor and the state of each order, and use the trained LSTM neural network to detect abnormal states of each order in the flight log of the quadrotor UAV to be tested;

[0017] Step 4: Based on the topological network between the sensors and the UAV states of each order and the detected abnormal state, locate the suspicious sensors and available redundant sensors, and use the available redundant sensors to infer the predicted value of the abnormal state;

[0018] Step 5: The predicted value of the abnormal state obtained in step 4 is reversely processed to obtain the predicted information of the suspicious sensor, which is compared with the actual output of the suspicious sensor to obtain the detection result, thereby tracing the distorted sensor that caused the safety accident of the quadrotor drone.

[0019] Preferably, step 1 includes the following sub-steps:

[0020] Step 1-1: Obtain the physical quantities and signal types of each sensor in the quadrotor drone and its observations. According to the linear motion state, attitude state, and order of physical quantities, define the quadrotor drone's linear position and attitude angle as zero-order state, linear velocity and angular velocity as first-order state, and linear acceleration and angular acceleration as second-order state;

[0021] Step 1-2: Build a topological network between sensors and drones at each order state, with each order state value as a state node and the sensor as a sensor node. Use arrows to connect each sensor node with the corresponding state node. The direction of the arrow indicates the direction of data flow, from the sensor node to the corresponding state node, as shown in the attached figure. Figure 2 As shown, it provides a reference for the subsequent selection of redundant sensors and reverse prediction of sensor information.

[0022] Furthermore, step 2 includes the following sub-steps:

[0023] Step 2-1: Obtain the normal flight log of the quadcopter and cut out the log segments before takeoff and after landing;

[0024] Step 2-2, extracting the quadrotor drone motor PWM control signal strength information, the quadrotor drone's various order status information, and the output information of each quadrotor drone sensor from the cropped log data;

[0025] Step 2-3: resample the extracted dimensional information at the same frequency to ensure that the length and frequency of the dimensional information sequence are consistent; synchronize the resampled dimensional information to prevent time stamp misalignment.

[0026] Furthermore, step S3 includes the following sub-steps:

[0027] Step 3-1: Use Keras to build an LSTM neural network model. The LSTM layer effectively solves the problems of gradient vanishing and gradient exploding in traditional RNNs by introducing a gating mechanism. It can model the time dependency of the input quadcopter motor PWM control signal intensity sequence and capture the long-term dependencies in the sequence. In this embodiment, the model includes four LSTM layers, two fully connected layers, and one Reshape layer.

[0028] Step 3-2, the forward propagation process, inputs the data sequentially according to the time step. LSTM gradually processes the input data of each time step while maintaining and updating the internal state information;

[0029] Step 3-3, use the loss function MSE to calculate the drone state prediction error, calculate the gradient through the back propagation algorithm, and update the weights and biases of the LSTM network based on the gradient information. This embodiment uses the mean square error MSE, and the calculation formula is:

[0030]

[0031] Where: For the The actual status of the samples, For the The predicted status of the samples.

[0032] According to the mean square error MSE, the gradient of the output layer is first calculated:

[0033]

[0034] in, is the gradient of the output layer, is the activation value of the output layer, is the weighted input to the output layer, is the derivative of the output layer activation function, Represents element-wise multiplication.

[0035] Calculate the hidden layer gradient layer by layer starting from the output layer:

[0036]

[0037] in, It is The gradient of the hidden layer, It is from Layer to The weight matrix of the layer, It is The weighted input of the layer, It is The derivative of the layer's activation function.

[0038] Finally, the weight matrix and bias vector are updated based on the gradient information:

[0039]

[0040]

[0041] in, is the learning rate, which is used to control the parameter update step size.

[0042] When the loss function reaches a value that meets the requirements, the training process is terminated, and the time-series mapping relationship between the PWM control signal strength of the quadcopter motor and the drone state is obtained;

[0043] In step 3-4, the model is used to take the PWM control signal strength of the quadcopter motor in the sample to be tested as input, and the output is the predicted value of the drone state, which is compared with the actual value of the drone state in the sample to be tested to detect abnormal states in the accident sample; preferably, when the difference between the predicted value of the drone state and the actual state value of each order of the quadcopter is greater than the threshold, it is marked as abnormal.

[0044] Furthermore, step 4 includes the following sub-steps:

[0045] Step 4-1: Based on the topological network between sensors and each order state of the drone, the sensor group that can indirectly infer the abnormal state is marked as a "redundant" sensor for observing the order state; the sensor group that can directly infer the abnormal state is marked as a suspicious sensor;

[0046] In step 4-2, based on the coordinate transformation and posture solution, the predicted value of the abnormal state is calculated using the physical quantities observed by the "redundant" sensors.

[0047] Furthermore, in step 5, the predicted value of the abnormal state obtained in step 4 is reversely processed to obtain the predicted information of the suspicious sensor, which is compared with the actual output information of the suspicious sensor through the accumulation and error. The test results were obtained, and the distorted sensor that caused the safety accident of the quadrotor drone was traced back.

[0048] First, calculate the residual between the predicted information and the actual output information of each suspicious sensor:

[0049]

[0050] Then, calculate Cumulative Sum , monitor the accumulation of deviations:

[0051]

[0052] in, It is a pre-set threshold used to control the growth rate of the cumulative sum; express The predicted value of the suspicious sensor at the moment, express The true value of the suspicious sensor at any moment, express The difference between the predicted value and the true value of the suspicious sensor at that moment.

[0053] if , it means that the suspicious sensor may have an abnormality or attack, where is a pre-set discrimination threshold.

[0054] The beneficial effects of the present invention are as follows: the present invention can successfully detect abnormal states of various orders and determine the time when the abnormality occurs through the flight log data of the quadrotor drone, accurately trace back to the sensor with data distortion, and realize the traceability analysis of the quadrotor drone safety accidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a flow chart of a method for tracing the source of a quadrotor drone attack based on data stream analysis according to an embodiment of the present invention.

[0056] Figure 2 It is a topological diagram of the relationship between sensor system data and status according to an embodiment of the present invention.

[0057] Figure 3 1 is a diagram of an LSTM neural network model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0058] The following describes the specific implementation of the present invention in conjunction with the accompanying drawings and examples. These examples are only used to illustrate the present invention and should not be construed as limiting the present invention.

[0059] A quadrotor drone attack tracing method based on data flow analysis, the specific steps are as follows:

[0060] S1: Analyze the data flow topology of the quadrotor UAV sensor system and establish a topological network between the sensors and the UAV's various order states.

[0061] The quadrotor drone is equipped with a variety of sensors to sense the surrounding environment and flight status. The following sensors are included in the quadrotor drone sensing system in this embodiment:

[0062] Gyroscope: used to measure the angular velocity of the drone in space;

[0063] Accelerometer: used to measure the acceleration of the drone;

[0064] Magnetometer: used to measure the Earth's magnetic field;

[0065] Global Positioning System (GPS): provides global positioning information;

[0066] Barometer: measures atmospheric pressure and can be used to determine altitude;

[0067] Optical Flow Sensor: measures the horizontal speed of the drone;

[0068] Ultrasonic Sensor: measures the distance between the drone and the ground or obstacles;

[0069] Tilt Sensor: measures the tilt angle of the drone relative to the direction of gravity;

[0070] Sonar Sensor: measures the linear relative position of the drone;

[0071] Laser ranging sensor (Lidar): measures the height of obstacles and terrain in the environment;

[0072] Other sensors: infrared sensor, camera, lidar, radio altimeter, electronic compass;

[0073] Among them, laser ranging sensors, GPS, sonar sensors, and barometers can be used for linear position observation; tilt sensors and magnetometers can be used for attitude angle observation; optical flow sensors can be used for linear velocity observation; gyroscopes can be used for angular velocity observation; and accelerometers can be used for linear acceleration observation.

[0074] According to the physical quantities and signal types observed by the sensors in the quadrotor drone, and in accordance with the linear motion state, attitude state and the order of physical quantities, the linear position and attitude angle of the quadrotor drone are defined as the zero-order state, the linear velocity and angular velocity are defined as the first-order state, and the linear acceleration and angular acceleration are defined as the second-order state.

[0075] Based on the corresponding relationship between the physical quantity observed by each sensor and the state of each order of the quadrotor drone, the state value of each order is the state node, the sensor is the sensor node, and the arrow is used to connect each sensor node with the corresponding state node. The direction of the arrow represents the direction of data flow, from the sensor node to the corresponding state node, as shown in the attached figure. Figure 2 As shown, a topological network between sensors and UAV states of each order is constructed;

[0076] S2: Collect normal samples from the quadrotor drone flight log, extract the required time series data, and perform data preprocessing.

[0077] In this example, 200 quadcopter flight samples were generated using the Gazebo simulation environment. Sensor spoofing was achieved by injecting a bias attack into the quadcopter's gyroscope, leading to a safety incident. These served as accident samples for this example.

[0078] Using the MATLAB Flight Log Analysis toolbox, we analyze the sample to obtain a total of 66 data entries, from which we select the required quadrotor drone state information for each order, four-dimensional rotor PWM control signal strength information, and sensor output information. For ease of illustration, this example uses typical 13-dimensional sensor information as an example, including three-dimensional GPS position information, three-dimensional accelerometer information, three-dimensional gyroscope information, three-dimensional magnetometer information, and one-dimensional barometer information.

[0079] Each log sample is cropped, removing the log segments before takeoff and after landing. Each dimension of information is resampled at the same frequency to ensure consistent feature lengths within the sample. In this embodiment, the motor PWM control signal (actuator_output) with a moderate sampling frequency is selected, with its 50 Hz sampling frequency used as the reference frequency. Log entries with a higher sampling frequency are resampled at equal intervals, while log data with a lower sampling frequency is resampled using linear interpolation. Each dimension of log entries is synchronized using a specified timestamp to prevent timestamp misalignment.

[0080] S3: Build an LSTM neural network model. This example uses Keras to build the LSTM neural network model, which consists of four LSTM layers, two fully connected layers, and a Reshape layer. The model inputs the PWM timing control signals of the four-dimensional rotor motors and outputs the six-degree-of-freedom timing state information of the quadcopter. The model is trained using normal samples to establish a time-series mapping relationship.

[0081] The PWM control signal strength of the quadcopter motor in the test sample is used as input, and the output is the predicted value of the drone state. Combined with the actual value of the drone state in the test sample, a comparative analysis is performed to detect abnormal states in the test sample. In this embodiment, the first-order state angular velocity roll axis state of the quadcopter is detected to be abnormal.

[0082] S4: Based on the topological network between sensors and the drone's various order states, the three-axis gyroscope is directly connected to the first-order state angular velocity node, marking the three-axis gyroscope as a suspicious sensor. The remaining sensors, including the accelerometer, magnetometer, and tilt sensor, are indirectly connected to the first-order state angular velocity node. The physical quantities output by these sensors can be converted into attitude angular velocity states through attitude solution and differential integration. They are considered "redundant" sensors for observing attitude angular velocity states. In this embodiment, the accelerometer and magnetometer are taken as examples:

[0083] The transformation from geographic coordinates to body coordinates requires the use of a rotation matrix:

[0084]

[0085] When the quadrotor drone is at rest horizontally in the geographic coordinate system, the accelerometer measurement is:

[0086]

[0087] When the quadrotor drone is in any posture, the accelerometer measurement in the body coordinate system is:

[0088]

[0089] Coordinate conversion between geographic coordinate system and body coordinate system:

[0090]

[0091] The roll angle and pitch angle are obtained as:

[0092]

[0093] The magnetic induction intensity of the quadrotor drone in the geographic coordinate system is:

[0094]

[0095] When the drone is level, the direction relative to the magnetic north obtained by the magnetometer can be used to obtain the yaw angle using trigonometric functions:

[0096]

[0097] When the drone body is not level, the rotation matrix can be used to convert the magnetic induction intensity data in the body coordinate system into the geographic coordinate system. The magnetic induction intensity of the quadcopter in the body coordinate system is:

[0098]

[0099] The rotation matrix is:

[0100]

[0101] in:

[0102]

[0103] Through rotation transformation, we can get:

[0104]

[0105] The yaw angle is obtained as:

[0106]

[0107] At this point, the zero-order attitude angle state of the quadrotor drone is calculated. After further differential processing, the first-order angular velocity state value of the drone can be calculated.

[0108] S5: The angular velocity prediction state value obtained by S4 is reversely processed to calculate the output information of the predicted gyroscope, and the output information of the real gyroscope is compared with the cumulative error. Obtain the detection results, determine the abnormal or attacked sensor and its attacked dimension, take the three-axis gyroscope as an example, determine the attacked axis, and realize the tracing of the distorted sensor that caused the safety accident of the quadrotor drone.

[0109] It should be understood that the above description of the examples is not intended to limit the scope of protection of the present invention. It should be noted that those skilled in the art can make improvements and enhancements without departing from the principles of the present invention, and such improvements should also be considered within the scope of protection of the present invention.

Claims

1. A quadrotor drone attack tracing method based on data flow analysis, characterized in that: include: Step 1: Based on the data stream of the quadrotor UAV sensor system, a topological network is established between the sensor and each order state of the UAV; Step 2: Extract time series data from the normal flight log of the quadrotor drone, parse it to obtain the quadrotor drone motor PWM control signal strength information, the quadrotor drone's various order status information, and the output information of each quadrotor drone's sensors, and resample and synchronize the preprocessing. Step 3: Use the normal samples obtained from the preprocessing to train the LSTM neural network, establish the time series mapping relationship between the PWM control signal strength of the quadrotor UAV motor and the state of each order, and use the trained LSTM neural network to detect abnormal states of each order in the flight log of the quadrotor UAV to be tested; Step 4: Based on the topological network between the sensors and the UAV states of each order and the detected abnormal state, locate the suspicious sensors and available redundant sensors, and use the available redundant sensors to infer the predicted value of the abnormal state; Step 5: The predicted value of the abnormal state obtained in step 4 is reversely processed to obtain the predicted information of the suspicious sensor, which is compared with the actual output of the suspicious sensor to obtain the detection result, thereby tracing the distorted sensor that caused the safety accident of the quadrotor drone.

2. The method for tracing the attack source of a quadrotor drone based on data flow analysis according to claim 1 is characterized in that: The step 1 comprises: Step 1-1: Obtain the physical quantities and signal types of each sensor in the quadrotor drone and its observations, and define the quadrotor drone's linear position and attitude angle as zero-order states, linear velocity and angular velocity as first-order states, and linear acceleration and angular acceleration as second-order states; Steps 1-2: Build a topological network between sensors and drone states of each order, with each order state value as a state node and the sensor as a sensor node. Use arrows to connect each sensor node with the corresponding state node. The direction of the arrow indicates the direction of data flow, from the sensor node to the corresponding state node.

3. The method for tracing the attack source of a quadrotor drone based on data flow analysis according to claim 1 is characterized in that: The step 2 includes: Step 2-1: Obtain the normal flight log of the quadcopter and cut out the log segments before takeoff and after landing; Step 2-2, extracting the quadrotor drone motor PWM control signal strength information, the quadrotor drone's various order status information, and the output information of each quadrotor drone sensor from the cropped log data; Step 2-3: resample the extracted dimensional information at the same frequency to ensure that the length and frequency of the dimensional information sequence are consistent; synchronize the resampled dimensional information to prevent time stamp misalignment.

4. The method for tracing the attack source of a quadrotor drone based on data flow analysis according to claim 1 is characterized in that: The LSTM neural network consists of four LSTM layers, two fully connected layers and one Reshape layer. It takes the PWM control signal strength information of the quadcopter motor as input and outputs the state information of each order of the quadcopter.

5. The method for tracing the source of a quadrotor drone attack based on data stream analysis according to claim 4 is characterized in that: The method of using the trained LSTM neural network to detect abnormal states of various orders in the flight log of the quadrotor drone to be tested includes: Extract the quadcopter UAV motor PWM control signal strength information, the quadcopter UAV state information of each order, and the output information of each quadcopter UAV sensor from the quadcopter UAV flight log to be tested, resample and synchronize preprocessing; The quadrotor UAV motor PWM control signal strength is used as input, and the output is the drone state prediction value, which is compared with the actual quadrotor UAV state values of each order, and the abnormal state of each order is marked.

6. The method for tracing the source of a quadrotor drone attack based on data stream analysis according to claim 5 is characterized in that: When the difference between the predicted drone state value and the actual quadcopter state value of each order is greater than the threshold, it is marked as abnormal.

7. The method for tracing the attack source of a quadrotor drone based on data flow analysis according to claim 1 is characterized in that: The step 4 includes: Step 4-1: Based on the topological network between sensors and each order state of the drone, the sensor group that can indirectly infer the abnormal state is marked as a redundant sensor observing the order state; the sensor group that can directly infer the abnormal state is marked as a suspicious sensor; In step 4-2, based on the coordinate transformation and posture calculation, the predicted value of the abnormal state is calculated using the physical quantities observed by the redundant sensors.

8. The method for tracing the attack source of a quadrotor drone based on data flow analysis according to claim 1 is characterized in that: In step 5, the prediction information of the suspicious sensor and the actual output of the suspicious sensor are accumulated and the error is added to obtain the detection result.

9. The method for tracing the source of a quadrotor drone attack based on data stream analysis according to claim 8 is characterized in that: The cumulative error calculation process includes: Calculate the deviation between the predicted information and the actual output information of each suspicious sensor at each order: ； Calculate cumulative sum , monitor the accumulation of deviations: ； in, It is a pre-set threshold used to control the growth rate of the cumulative sum; express The predicted value of the suspicious sensor at the moment, express The true value of the suspicious sensor at the moment, express The difference between the predicted value and the true value of the suspicious sensor at that moment; if , judge that the suspicious sensor has an abnormality or attack, is a pre-set discrimination threshold.

Images