Self-adaptive expansion real-time unmanned aerial vehicle flight abnormal state identification method and system

Abstract

The invention discloses a self-adaptive expansion real-time unmanned aerial vehicle flight abnormal state recognition method and system, and the method comprises the steps: obtaining a baseline feature group from historical unmanned aerial vehicle flight log data, and building an anomaly detection model; data features of the unmanned aerial vehicle sensor are collected in real time, and the real-time data features are used to carry out adaptive expansion updating on the anomaly detection model; evaluating whether the flight state of the unmanned aerial vehicle is normal or abnormal according to the matching condition of the real-time data features and the baseline feature group; when the abnormal flight state is recognized, attribution analysis is carried out, and a disposal instruction is issued. According to the method, the flying unmanned aerial vehicle can be detected in real time, the expansibility is good, the adaptive expansion capability is provided for unmanned aerial vehicles of similar models, the algorithm complexity and the model space occupation are low, direct deployment at a terminal is easy, various types of abnormal flight states can be accurately detected, and the abnormal reasons can be accurately analyzed.

Description

Technical Field

[0001] The present invention belongs to the field of UAV technology, and further relates to an adaptively expandable real-time UAV flight abnormal state identification method and system in the field of UAV abnormality detection technology. The present invention detects and identifies the abnormal state of the UAV during flight by real-time detection of the UAV flight state. Background Art

[0002] Drones have been proven to be vulnerable to various forms of attacks, which will seriously affect the flight safety of drones, leading to mission failures or even crashes. Generally, drone systems can estimate their own posture and surrounding environment based on sensor data, and make control decisions based on mission objectives. At the same time, many natural interferences are considered during the design of drones, so drones can operate smoothly in complex and changing unknown physical environments. Limited by current technical conditions and the computing power of drones, drones must rely on the data reported by sensors for state estimation, and unconditionally assume that the control instructions they issue are accurately executed. Anomaly detection, as a common data analysis method, is widely used in the analysis of various high-dimensional data. During the flight of drones, the accuracy of the detection results and the detection delay are crucial to the smooth and continuous normal operation of drones.

[0003] Shaanxi Qianshan Avionics Co., Ltd. disclosed a method for identifying abnormal aircraft states based on flight parameter data in its patent application "A method for identifying abnormal aircraft states based on flight parameter data" (application number: 202010821230.X, application publication number: CN 112085866A, application date: August 14, 2020). The implementation steps of this method include: constructing an initial state space; reconstructing the state space and generating state sequence fragments corresponding to a single flight data: merging consecutive repeated states in the state sequence; using a sliding window to process the state sequence and construct a state transition model training data set; training the state transition model; combining the state space and the state transition model to perform single flight data anomaly detection. This method can effectively locate the number of abnormal frames of single flight data, which is of great significance to ensuring aircraft performance and safety. However, this method still has some shortcomings: the state transition model constructed by this method to identify abnormal states has a complex structure and high computational complexity, and is not easy to deploy on UAV equipment with limited computing resources; this method is designed for anomaly detection of single-flight flight data, and its detection object is a section of already generated flight data, and it is impossible to perform real-time anomaly detection of flight data for a UAV that is in flight.

[0004] Xidian University disclosed a real-time online drone multi-fault anomaly detection method and device in its patent application "A real-time online drone multi-fault anomaly detection method and device" (application number: 2020107609317, application publication number: CN 111907730 A, application date: July 31, 2020). The detection method includes: obtaining drone sensor control data and measurement data, establishing an anomaly detection model and iteratively updating the model, and after the update, judging whether the model has reached stability based on whether the update step is less than a given threshold within a given time; after the detection model is stable, calculating the progressive fault threshold, log-likelihood ratio and Z value of the real-time error; judging whether a fault has occurred based on the progressive fault threshold, log-likelihood ratio and Z value. The invention is easy to transplant, can be detected online in real time, has a simple calculation process, and can accurately detect multiple types of faults. However, this method still has some shortcomings: it needs to use the control data of the sensor when performing real-time anomaly detection. The additional collection of such data will increase the processing time and affect the real-time detection efficiency; after detecting a fault, this method cannot perform a more detailed attribution analysis of the anomaly type, and it is also impossible to take targeted measures against the drone after detecting the anomaly.

[0005] Guizhou University disclosed a neural network-based quadcopter attack detection method in its patent document "An adaptive anomaly detection method for drone flight data based on encoding-decoding" (application number: 2024104960719, application publication number: CN 118094447 A, application date: April 24, 2024). The steps implemented by the method include: data reconstruction and adaptive anomaly detection; data reconstruction includes model architecture establishment and model training; model architecture establishment uses one-dimensional CNN-BiLSTM as a feature extractor to capture the basic feature data of temporal features and local features, and introduces attention mechanism selection and weighting of basic feature data; model architecture establishment includes encoding and decoding; adaptive anomaly detection includes modeling the residual sequence, and matching it with the SVR model input, and evaluating and testing the SVR model. The invention uses one-dimensional CNN and BiLSTM, combined with the attention mechanism, to enable the model to better understand the characteristics of the data and achieve more accurate data representation, thereby establishing an accurate data reconstruction model. At the same time, an adaptive threshold is used to better meet the adaptive anomaly detection under the condition of dynamic data changes. However, this method still has some shortcomings: it uses the "encoding-decoding" model of deep learning as the core detection algorithm, which has high computational complexity and is not easy to deploy on drones; and a large amount of basic data needs to be collected for model training before detection, which has high implementation cost and difficulty; the adaptability of this method can only improve detection accuracy, and when detecting different drones, the anomaly detection model needs to be retrained and cannot be adaptively expanded.

[0006] In summary, the existing technology has the following five shortcomings in the real-time abnormal flight status detection of drones:

[0007] 1. The anomaly detection model is established based on machine learning methods. The amount of basic data required for training is large, the collection cost is high, and the labeling of this data is also expensive.

[0008] 2. The algorithm used for anomaly detection has high computational complexity and is not easy to deploy directly on drone equipment with limited computing power;

[0009] 3. Lack of real-time performance. When performing anomaly detection, it is impossible to perform anomaly detection on drones flying in real time online;

[0010] 4. Lack of anomaly attribution analysis. It can only detect anomalies but cannot analyze the causes of anomalies, which limits the ability to deploy more detailed and targeted anomaly handling measures after anomalies are detected.

[0011] 5. Insufficient scalability. The existing anomaly detection model cannot be directly transplanted and expanded for different drones, and a new detection model needs to be re-established. Summary of the invention

[0012] The purpose of the present invention is to address the deficiencies in the above-mentioned prior art and propose an adaptively scalable real-time UAV flight abnormal state identification method and system to solve the problems of the prior art requiring a large amount of basic data, high computational complexity, insufficient real-time performance, lack of abnormal attribution analysis, and poor scalability of the detection model.

[0013] The technical idea for achieving the purpose of the present invention is: the present invention uses the detection method based on data feature matching as the core of the algorithm, and attempts to solve the defects and shortcomings in the current technology of real-time drone anomaly detection. The acquisition algorithm designed by the present invention to establish baseline features requires a small amount of basic data samples and is easy to collect, and the amount of manual annotation work required is very small, and the overall acquisition cost is low and the consumption is small. The core of the feature matching mechanism used in the real-time detection of the present invention is similarity measurement calculation, which has low computational complexity, low additional overhead when running on drone equipment with limited computing resources, and does not affect the real-time operation of the drone flight control system, so it can be directly deployed on drone equipment with limited computing power. The present invention is designed specifically for the real-time flight of drones, so the present invention can perform anomaly detection online for drones in real-time flight. The present invention uses the key concept of data features as the basic element for building an anomaly detection model, which has stronger interpretability than the basic elements of other black box models, so it can infer and analyze the cause of the anomaly based on the feature pattern generated when the anomaly is detected. The adaptive expansion algorithm adopted in the present invention updates and modifies the baseline features used in anomaly detection through new data generated in real time, so that the initial baseline features can be specifically expanded to the currently monitored drone instance during the real-time monitoring process without the need to re-extract the baseline features, and has good scalability and portability.

[0014] The implementation steps of the real-time UAV flight abnormal state recognition method of the present invention are:

[0015] Step 1: Use a feature extraction algorithm based on similarity measurement and clustering to extract the baseline feature group corresponding to each monitoring data channel from the historical flight logs that meet the conditions of the drone to be identified, and add normal / abnormal labels and related additional information to each baseline feature in the baseline feature group, thereby creating an anomaly detection model;

[0016] Step 2: Using feature picking method, collect real-time data features of each monitoring data channel of the drone to be identified;

[0017] Step 3: Use an adaptive expansion algorithm to perform feature comparison operations on the real-time data features of each monitoring data channel and the baseline feature group to obtain the normal / abnormal performance of the data channel, and use the performance to adaptively expand and update the anomaly detection model;

[0018] Step 4: Evaluate whether the real-time flight status of the drone is normal; if the real-time flight status of the drone is found to be abnormal, use the abnormal attribution method to identify the attack model that causes the abnormal flight status of the drone, and issue a disposal instruction to the drone according to the predefined disposal plan.

[0019] An adaptively expandable real-time unmanned aerial vehicle flight abnormal state recognition system is implemented using the recognition method of the present invention. The system includes: an abnormal detection model establishment module, a data feature picking module, a feature comparison and adaptive baseline feature update module, a flight stability evaluation module, and an abnormal state attribution module; wherein:

[0020] The anomaly detection model building module is used to extract normal and abnormal features from historical flight logs, establish an initial baseline feature group, and establish an anomaly detection model based on this;

[0021] The data feature picking module is used to extract feature vectors from multi-channel real-time sensor data streams;

[0022] The feature comparison and adaptive baseline feature update module is used to compare the real-time features with the baseline features and dynamically update the baseline feature records;

[0023] The flight stability assessment module is used to assess the overall flight status of the drone based on the status of each data channel and the degree of instability of the drone, and identify potential abnormalities or attacks;

[0024] The abnormal state attribution module is used to derive an attack model that causes the abnormal state based on the abnormal state information.

[0025] Compared with the prior art, the present invention has the following advantages:

[0026] First, the method of the present invention uses a data feature extraction algorithm based on similarity measurement and clustering to extract the baseline feature group corresponding to each monitoring data channel in the historical flight log of the drone to be identified. Since the algorithm has low computational complexity and small space occupation when the model is deployed, it overcomes the problem of large computational resources and storage overhead in the prior art during anomaly detection, so that the present invention can be directly deployed on the drone device.

[0027] 2. The method of the present invention adds a normal / abnormal label to each baseline feature, and can establish an effective anomaly detection model while using a small amount of basic data and limited manual annotation. Compared with the large amount of basic data collection and high data annotation costs required to establish a detection model in the prior art, the overall steps of establishing a detection model in the present invention are simpler, data is easier to collect, and the overall cost is lower.

[0028] 3. The method of the present invention adopts an adaptive expansion algorithm, which adaptively expands and updates the anomaly detection model based on the baseline features of anomaly detection through the collected data features generated in real time by the drone to be identified, thereby overcoming the problem that the prior art is difficult to expand the anomaly detection model between similar drones and the need to re-establish the anomaly detection model for each new drone instance, making the method of the present invention have the advantage of high portability.

[0029] 4. The method of the present invention extracts abnormal data feature patterns based on the results of data feature matching, and provides attribution analysis of related anomalies based on the processed feature patterns, which overcomes the problem of insufficient explainability of identified abnormal states in current technologies. Through abnormal attribution analysis, operators can deal with identified abnormal conditions in a more targeted manner, which is more practical. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a flow chart for implementing the present invention. DETAILED DESCRIPTION

[0031] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0032] Reference Figure 1 , the implementation steps of the real-time UAV flight abnormal state identification method in the present invention are further described in detail.

[0033] Step 1: Establish an anomaly detection model.

[0034] Using a feature extraction algorithm based on similarity measurement and clustering, the baseline feature group corresponding to each monitoring data channel is extracted from the historical flight logs that meet the conditions of the drone to be identified, and a normal / abnormal label is added to each baseline feature in the baseline feature group to create an anomaly detection model.

[0035] The steps of extracting the baseline feature group corresponding to each monitoring data channel are as follows:

[0036] In the first step, the monitoring data channels are divided according to the set of drone sensor types to be identified and the differences in the physical meaning of the measurement data generated by each type of sensor.

[0037] The drone to be identified in the embodiment of the present invention is a quad-rotor drone, and the sensors present in the onboard equipment are: an inertial measurement unit sensor, a GPS data information sensor, and four actuators. According to the drone to be identified in the embodiment of the present invention, the set of sensor types of the monitoring data source is determined to be: {inertial measurement unit sensor, GPS data information sensor, actuator speed sensor}. The different physical quantity data generated by each type of sensor in the sensor type set are divided into independent data channels, and the determined monitoring data channels are divided into the following thirteen channels:

[0038] x-axis acceleration of the inertial measurement unit body coordinate system; y-axis acceleration of the inertial measurement unit body coordinate system; z-axis acceleration of the inertial measurement unit body coordinate system; roll angular velocity of the inertial measurement unit body coordinate system; pitch angular velocity of the inertial measurement unit body coordinate system; yaw angular velocity of the inertial measurement unit body coordinate system; x-axis acceleration of the GPS-Earth center coordinate system; y-axis acceleration of the Earth center coordinate system; z-axis acceleration of the Earth center coordinate system; x-axis angular velocity of the GPS-Earth center coordinate system; y-axis angular velocity of the Earth center coordinate system; z-axis angular velocity of the Earth center coordinate system; actuator speed.

[0039] In the second step, the original time series data stream of each data channel is extracted from the historical flight log of the drone to be identified.

[0040] In the third step, at each sampling point of the original time series data stream of each monitoring data channel, a data segment of a time window is intercepted forward. After each intercepted data segment is resampled and normalized, it is recorded as a data feature in the form of a vector to obtain a set of data feature records corresponding to the monitoring data channel.

[0041] The fourth step is to measure the similarity between all data feature records, record the minimum similarity of each feature, and mark the features whose minimum similarity measurement results exceed the preset threshold p as potential abnormal data features.

[0042] In the fifth step, a clustering algorithm is used to cluster all data feature records of each channel, and the average vector of all data feature records contained in each cluster after clustering and the cluster size are used as baseline features to form a baseline feature group for the data channel.

[0043] The historical flight logs that meet the conditions for the drone to be identified have the following characteristics:

[0044] 1) The drone that generates this group of logs should have a similar physical structure to the drone in real-time anomaly monitoring, with the same number of rotors and a volume and weight difference of no more than 40%;

[0045] 2) This group of logs shall contain at least one log data of a random mission actual flight experiment in a non-attack environment and one log data of a random mission flight experiment in an attack environment, and the log data in the attack environment shall record the attack model used.

[0046] Adding a normal / abnormal label to each baseline feature in the baseline feature group refers to determining whether the cluster of each baseline feature contains potential abnormal data feature records. If so, adding an abnormal label to the baseline feature, and adding corresponding attack model information to the baseline feature based on the data source of the potential abnormal data feature records contained therein. Otherwise, adding a normal label.

[0047] The historical flight log of the unmanned aerial vehicle to be identified obtained in the embodiment of the present invention originates from a four-rotor unmanned aerial vehicle.

[0048] The normal flight log of the drone obtained in the embodiment of the present invention is a sensor data log obtained from the drone flying for 5 minutes under normal circumstances, and the log contains data information of all the detection data channels determined in step 1.

[0049] The abnormal flight log of the drone obtained in the embodiment of the present invention is a sensor data log obtained when the drone is attacked externally during flight, and the log contains data information of all detection data channels determined in step 1.

[0050] Manually annotate abnormal flight logs. Since external attacks are initiated proactively, it is possible to determine the time period in which the attack occurred and annotate the attack type for the data in the log during the time period in which the attack occurred.

[0051] According to the determined data channel division, the time series data stream of each data channel is extracted from the normal or abnormal flight log, and the following operations are performed on each data channel:

[0052] The first step is to extract the time series data stream in the data channel as a set of data feature records. In the embodiment of the present invention, the preset time window size is 1s and the preset sampling frequency is 10Hz. According to the sampling frequency, at each sampling point of the time series data stream, a data segment with a time window size of 1s is intercepted forward, and each intercepted data segment is recorded as a data feature in the form of a vector after resampling and normalization.

[0053] In the second step, all the extracted data feature records are subjected to pairwise similarity measurement, the minimum similarity of each feature is recorded, and based on the minimum similarity measurement results of all features, the features exceeding the preset threshold p are marked as potential abnormal data features.

[0054] In the embodiment of the present invention, Euclidean distance is used as a similarity measurement method, and the preset threshold p is selected as the 95% quantile of the highest similarity measurement results of all features sorted from the most similar to the least similar.

[0055] In the third step, a clustering algorithm is used to cluster all data feature records of each channel. In the embodiment of the present invention, an affinity propagation algorithm is used as the clustering algorithm. The average vector and cluster size of all data feature records contained in each cluster after clustering are used as baseline features to form a baseline feature group of the data channel.

[0056] The fourth step is to add normal / abnormal labels to the baseline features. If the cluster forming the baseline vector contains potential abnormal data feature records, an abnormal label is added to the baseline feature, and the corresponding attack model information is added to the baseline feature based on manual annotation. Otherwise, a normal label is added.

[0057] Perform the first to fourth steps for each data channel to obtain the baseline feature group corresponding to each data channel and establish an anomaly detection model.

[0058] Step 2: Pick up real-time data features.

[0059] Step 2.1, starting from the take-off moment of the drone to be identified as the detection start moment, according to the preset detection frequency, the real-time data features generated by each data channel when arriving at each monitoring moment are picked up and recorded.

[0060] The preset detection frequency is set according to the real-time monitoring requirements and the computing power of the drone equipment.

[0061] Step 2.2, for the time series data stream generated in real time by each monitoring data channel, according to the preset sampling frequency, intercept the data segment of the preset time window size from the current monitoring moment forward, and after the intercepted data segment is resampled and normalized, it is recorded in the form of a vector as the real-time data feature of the data monitoring channel.

[0062] The sampling frequency refers to selecting the lowest operating frequency from the operating frequencies of all sensors carried by the drone as the preset sampling frequency.

[0063] The preset time window size is to repeatedly calculate the accuracy and false alarm rate of the created baseline feature group multiple times while only changing the preset time window size, to obtain the corresponding F1 score, and select the time window size setting value with the highest F1 score as the preset time window size.

[0064] In the embodiment of the present invention, according to the real-time requirements of the detection and the computing power of the drone equipment, a preset detection frequency of 10Hz is adopted. The detection starts from the drone take-off time. According to the preset detection frequency, when each detection time is reached, the real-time data features generated by each data channel are picked up and recorded. The feature picking method here is similar to step 2.1, that is: for the time series data stream generated in real time by each data channel, according to the sampling frequency, a data segment with a time window size of 1s is intercepted from the current detection time forward. After the intercepted data segment is resampled and normalized, it is recorded in the form of a vector as the real-time data feature of the data channel.

[0065] Step 3: Real-time feature comparison and baseline feature adaptive update.

[0066] By carrying out this step, the baseline data features used can be expanded in a targeted and adaptive manner according to the currently monitored drone instance.

[0067] Step 3.1, calculate the similarity measurement between the real-time data features of each monitoring data channel and all baseline feature records in the data baseline feature group corresponding to the channel.

[0068] Step 3.2, based on all similarity measurement results, select the baseline feature record with the minimum similarity measurement with the real-time data feature of this data channel in the data baseline feature group.

[0069] Step 3.3, if the normal / abnormal mark of the baseline feature selected in step 3.2 is normal, then the performance of the current monitoring data channel is determined to be normal; otherwise, the performance of the current monitoring data channel is determined to be abnormal, and the information of the real-time data feature is updated and added to the selected baseline feature record with the minimum similarity measurement, and the baseline feature record to be updated and the real-time data feature are used to recalculate the vector value of the baseline feature.

[0070] The steps of adaptively extending and updating the anomaly detection model are as follows:

[0071] The first step is to determine whether the similarity measurement result is greater than or equal to the maximum similarity measurement value recorded in the current baseline feature group: if so, execute the second step; otherwise, execute the third step;

[0072] The second step is to add the real-time data feature as a new abnormal baseline feature in the baseline feature group; this new baseline feature record is initially marked as abnormal, and the real-time performance of the current data channel is recorded as abnormal;

[0073] In the third step, the selected baseline features with the highest similarity are expanded using the real-time data features, and the number of data features included in the expanded baseline features is checked:

[0074] If the number of data features included in the expanded baseline feature is greater than or equal to the minimum number of features included in all baseline features with normal marks when creating the baseline feature group, the mark of the expanded baseline feature is changed to normal;

[0075] If the baseline feature size is larger than the smallest range size of all initial normal baseline features, the label of the updated baseline feature is modified to normal, and the real-time performance of the current data channel is recorded as normal; otherwise, the label is not updated, and the real-time performance of the current data channel is recorded as abnormal.

[0076] The detection starts from the moment when the drone takes off. According to the preset detection frequency, 10 Hz is used in the embodiment of the present invention. When the detection moment is reached, the following steps are performed on each data channel:

[0077] In the first step, the real-time data features generated by each data channel are obtained, and the similarity measurement is calculated by using the Euclidean distance between the real-time data features and all baseline feature records in the data baseline feature group corresponding to the channel.

[0078] In the second step, based on all similarity measurement results, a baseline feature record having the minimum similarity measurement with the real-time data feature of this data channel is selected from the data baseline feature group.

[0079] In the third step, compare the minimum similarity measurement obtained in the second step with the maximum similarity measurement recorded when creating the baseline feature:

[0080] i) If the minimum similarity measurement result obtained in step 3.2 is greater than the maximum similarity measurement value recorded when creating the baseline feature, then the real-time data feature is added as a new baseline feature record, and this new baseline feature record is initially marked as abnormal, and the real-time performance of the current data channel is recorded as abnormal;

[0081] ii) Otherwise, the information of the real-time data feature is updated and added to the baseline feature record with the minimum similarity measurement selected in step 3.2, the vector value of the baseline feature is recalculated using the baseline feature record to be updated and the real-time data feature, and the label of the baseline feature is updated according to the following rules:

[0082] If the original label of the updated baseline feature is normal, the updated baseline feature is still marked as normal, and the real-time performance of the current data channel is recorded as normal;

[0083] Otherwise, check the range size of the updated baseline feature: if the baseline feature size is larger than the smallest range size of all initial normal baseline features, modify the label of the updated baseline feature to normal, and record the real-time performance of the current data channel as normal; otherwise, do not update the label, and record the real-time performance of the current data channel as abnormal.

[0084] The first to third steps are performed for each data channel, the real-time data feature information generated by each data channel is updated to the baseline feature group corresponding to the data channel, and the real-time normal / abnormal performance of the data channel is obtained.

[0085] Step 4: UAV flight status assessment and abnormal status handling.

[0086] This step evaluates the stability of the drone's flight status in real time, detects abnormal flight status, identifies the cause of the abnormal status and takes appropriate measures.

[0087] Evaluate whether the real-time flight status of the drone is normal; if the real-time flight status of the drone is found to be abnormal, use the abnormal attribution method to identify the attack model that causes the abnormal flight status of the drone, and issue disposal instructions to the drone according to the predefined disposal plan.

[0088] The steps of the anomaly attribution method are as follows:

[0089] The first step is to obtain the real-time data features generated by each monitoring data channel when the abnormal state of the drone is detected.

[0090] In the second step, the similarity between the real-time data features generated by each monitoring data channel and each baseline feature in the baseline feature group corresponding to the channel is measured.

[0091] The third step is to find the baseline feature with the highest similarity to the real-time data feature and record the attack model information carried by the baseline feature.

[0092] The fourth step is to select the attack model information with the most occurrences from all attack model information as the most likely abnormal attribution for the abnormal state.

[0093] The predefined handling plan refers to the drone action instructions pre-set according to the identified cause of the drone abnormality. If the operator has not pre-defined relevant operation instructions for a certain abnormal cause, the drone will perform the default operation instructions, that is, switch to fail-safe mode.

[0094] The detection starts from the moment when the drone takes off. According to the preset detection frequency, 10hz is used in the embodiment of the present invention. Every time the detection moment is reached, observe the normal / abnormal performance of all data channels from the current detection moment T to the historical moment T-Tn within the preset time window length Tn. The preset time window length is 1s in the embodiment of the present invention. The overall instability degree of the drone is calculated according to the stable / unstable state of each channel to determine whether the drone is in an abnormal or potential attack state.

[0095] If the drone is found to be in an abnormal state, an alarm will be generated with relevant information about the abnormal flight state, and the following abnormal attribution analysis will be performed:

[0096] The first step is to capture the relevant data features that produce the abnormal state within the time window.

[0097] In the second step, each data feature is tested for similarity with the records in the data baseline feature group of its channel, and the attack model information carried by the data baseline feature record with the highest similarity is found.

[0098] The third step is to select the attack model with the highest number of occurrences as the most likely cause of the abnormal state.

[0099] Based on the attribution results of the abnormal state, the drone will take action according to the preset disposal plan.

[0100] The predefined handling plan refers to the drone action instructions pre-set according to the identified cause of the drone abnormality. If the operator has not pre-defined relevant operation instructions for a certain abnormal cause, the drone will perform the default operation instructions, that is, switch to fail-safe mode.

[0101] Based on the above method, the present invention also provides an adaptively expandable real-time UAV flight abnormal state identification system, which includes: an abnormal detection model establishment module, a data feature picking module, a feature comparison and adaptive baseline feature update module, a flight stability evaluation module, and an abnormal state attribution module.

[0102] The system of the present invention is a system example implemented in a manner of combining computer software with circuit hardware in combination with the algorithm steps described in the embodiments disclosed in the implementation method of the present invention.

Claims

1. A real-time unmanned aerial vehicle flight abnormal state recognition method that can be adaptively expanded, characterized in that: The steps of the identification method include the following: Step 1: Use a feature extraction algorithm based on similarity measurement and clustering to extract the baseline feature group corresponding to each monitoring data channel from the historical flight logs that meet the conditions of the drone to be identified, and add normal / abnormal labels and related additional information to each baseline feature in the baseline feature group, thereby creating an anomaly detection model; Step 2: Using feature picking method, collect real-time data features of each monitoring data channel of the drone to be identified; Step 3: Use an adaptive expansion algorithm to perform feature comparison operations on the real-time data features of each monitoring data channel and the baseline feature group corresponding to the channel to obtain the normal / abnormal performance of the data channel, and use the real-time data features to adaptively expand and update the anomaly detection model; Step 4: Evaluate whether the real-time flight status of the drone is normal; If the real-time flight status of the drone is found to be abnormal, the abnormal attribution method is used to identify the attack model that causes the abnormal flight status of the drone, and a disposal instruction is issued to the drone according to the predefined disposal plan.

2. The adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition method according to claim 1 is characterized in that: The steps for extracting the baseline feature group corresponding to each monitoring data channel described in step 1 are as follows: In the first step, the monitoring data channels are divided according to the set of drone sensor types to be identified and the difference in the physical meaning of the measurement data generated by each type of sensor; The set of drone sensor types to be identified must at least include an actuator speed sensor, an inertial measurement unit sensor, and a GPS data information sensor; The second step is to extract the original time series data stream of each data channel from the historical flight log of the drone to be identified; The third step is to intercept a data segment of a predetermined time window size at each inspection time point of the original time series data stream of each monitoring data channel. After resampling and normalization, each intercepted data segment is recorded as a data feature in the form of a vector to obtain a set of data feature records corresponding to the monitoring data channel; The preset time window size is to repeat the steps of claim 1 multiple times while only changing the preset time window size, calculate the accuracy and recall rate of the created baseline feature group, obtain the corresponding F1 score, and select the time window size setting value with the highest F1 score as the preset time window size; The fourth step is to measure the similarity between all data feature records, and record the highest similarity of each feature in this measurement. The feature whose highest similarity measurement result is lower than the preset threshold p is marked as a potential abnormal data feature. The preset threshold value p is to repeat step 1 of claim 1 multiple times while only changing the preset threshold value p, calculate the accuracy and recall rate of the created baseline feature group, obtain the corresponding F1 score, and select the threshold value p setting value with the highest F1 score as the preset threshold value p; The accuracy and recall rate of creating the baseline feature group when the preset time window size and the preset threshold p are obtained means that after creating the baseline feature group, the actual normal / abnormal situation of each data feature is compared with the normal / abnormal mark of the baseline feature group to which it belongs, and the number of true positive examples, true negative examples, false positive examples, and false negative examples is determined according to general principles, and the accuracy and recall rate are calculated; In the fifth step, a clustering algorithm is used to cluster all data feature records of each channel, and the average vector of all data feature records contained in each cluster after clustering and the cluster size are used as baseline features to form a baseline feature group for the data channel.

3. The adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition method according to claim 1 is characterized in that: The historical flight logs that meet the conditions for the drone to be identified in step 1 should have the following characteristics: 1) The drone that generates this group of logs should have similar physical appearance and structure and similar physical characteristics to the drones in real-time anomaly monitoring; The drones having similar physical characteristics means that the flight logs of two different drones are collected respectively under the same flight mission setting and in a non-attack environment, and each data channel is processed according to the third step of claim 2 to obtain corresponding data features and the similarity between these data features is measured two by two. If the similarity of all features of each data channel is higher than the preset threshold p of the data channel in the fourth step of claim 2, then it is considered that the two drones have similar physical characteristics; 2) Each set of logs shall contain at least one log data of a random mission actual flight experiment in a non-attack environment and one log data of a random mission flight experiment in an attack environment, and the log data in the attack environment shall record the attack model used.

4. The adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition method according to claim 1 is characterized in that: Adding a normal / abnormal label to each baseline feature in the baseline feature group in step 1 refers to determining whether the cluster of each baseline feature contains a potential abnormal data feature record. If so, adding an abnormal label to the baseline feature, and adding corresponding attack model information to the baseline feature based on the data source of the potential abnormal data feature record contained therein, otherwise, adding a normal label.

5. The adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition method according to claim 1 is characterized in that: The steps of the feature picking method described in step 2 are as follows: The first step is to start the detection from the take-off moment of the drone to be identified, and pick up and record the real-time data features generated by each data channel at each monitoring moment according to the preset detection frequency; The preset detection frequency is set according to the real-time monitoring requirements and the computing power of the drone equipment; The second step is to intercept data segments of a preset time window size from the current monitoring moment forward for the time series data stream generated in real time by each monitoring data channel according to the preset sampling frequency. After resampling and normalization, the intercepted data segments are recorded in the form of vectors as the real-time data features of the data monitoring channel. The sampling frequency refers to selecting the lowest operating frequency from the operating frequencies of all sensors carried by the drone as the preset sampling frequency.

6. The adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition method according to claim 1 is characterized in that: The steps of the feature comparison operation described in step 3 are as follows: In the first step, the real-time data features of each monitoring data channel are measured against all baseline feature records in the data baseline feature group corresponding to the channel. The second step is to select the baseline feature record with the minimum similarity measurement with the real-time data feature of this data channel from the data baseline feature group according to all similarity measurement results; In the third step, if the normal / abnormal mark of the baseline feature selected in the second step is normal, the performance of the current monitoring data channel is determined to be normal. Otherwise, the performance of the current monitoring data channel is determined to be abnormal, and the information of the real-time data feature is updated and added to the selected baseline feature record with the minimum similarity measurement, and the baseline feature record to be updated and the real-time data feature are used to recalculate the vector value of the baseline feature.

7. The adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition method according to claim 1 is characterized in that: The steps for adaptively expanding and updating the anomaly detection model described in step 3 are as follows: The first step is to determine whether the similarity measurement result is greater than or equal to the maximum similarity measurement value recorded in the current baseline feature group: if so, execute the second step; otherwise, execute the third step; In the second step, the real-time data feature is added as a new abnormal baseline feature in the baseline feature group; This new baseline feature record is initially marked as abnormal, and the real-time performance of the current data channel is recorded as abnormal; In the third step, the selected baseline features with the highest similarity are expanded using the real-time data features, and the number of data features included in the expanded baseline features is checked: If the number of data features included in the expanded baseline feature is greater than or equal to the minimum number of features included in all baseline features with normal marks when creating the baseline feature group, the mark of the expanded baseline feature is changed to normal; If the baseline feature size is larger than the smallest range size of all initial normal baseline features, the label of the updated baseline feature is modified to normal, and the real-time performance of the current data channel is recorded as normal; otherwise, the label is not updated, and the real-time performance of the current data channel is recorded as abnormal.

8. The adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition method according to claim 1 is characterized in that: The steps of the anomaly attribution method described in step 4 are as follows: The first step is to obtain the real-time data features generated by each monitoring data channel when the abnormal state of the drone is detected; The second step is to measure the similarity between the real-time data features generated by each monitoring data channel and each baseline feature in the baseline feature group corresponding to the channel; The third step is to find the baseline feature with the highest similarity to the real-time data feature and record the attack model information carried by the baseline feature; The fourth step is to select the attack model information with the most occurrences from all attack model information as the most likely abnormal attribution for the abnormal state.

9. The adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition method according to claim 1 is characterized in that: The predefined handling plan described in step 4 refers to the drone action instructions pre-set according to the identified drone abnormality reasons. If the operator does not pre-define the relevant operation instructions for a certain abnormal reason, the drone will perform the default operation instructions, that is, switch to fail-safe mode.

10. An adaptively scalable real-time unmanned aerial vehicle flight abnormal state recognition system implemented by the recognition method of claim 1, characterized in that: The system includes: anomaly detection model building module, data feature picking module, feature comparison and adaptive baseline feature update module, flight stability assessment module, and abnormal state attribution module; among which: The anomaly detection model building module is used to extract normal and abnormal features from historical flight logs, establish an initial baseline feature group, and establish an anomaly detection model based on this; The data feature picking module is used to extract feature vectors from multi-channel real-time sensor data streams; The feature comparison and adaptive baseline feature update module is used to compare the real-time features with the baseline features and dynamically update the baseline feature records; The flight stability assessment module is used to assess the overall flight status of the drone based on the status of each data channel and the degree of instability of the drone, and identify potential abnormalities or attacks; The abnormal state attribution module is used to derive an attack model that causes the abnormal state based on the abnormal state information.

Images