ADS-B data anomaly detection method based on deep learning

Abstract

The invention discloses an ADS-B (Automatic Dependent Surveillance-Broadcast) data anomaly detection method based on deep learning, and relates to the technical field of ADS-B data security. Comprising the following steps: acquiring an ADS-B data set; the ADS-B data set is preprocessed, and a processed ADS-B data set is obtained; dividing the processed ADS-B data set into a training set and a test set according to a preset proportion; constructing a deep learning model fusing the convolutional bidirectional LSTM and an attention mechanism; training a deep learning model by using the training set data to obtain a trained deep learning model; and based on the trained deep learning model, performing ADS-B data anomaly detection according to the test set data. According to the method, only time domain sampling data is needed, complex or multi-dimensional features are not needed, the features of the ADS-B signals and the spatial relation between the signals on one route can be better extracted, spoofing attacks can be detected, and the complexity of airborne application is not increased.

Description

Technical Field

[0001] The present invention relates to the field of ADS-B data security technology, and in particular to an ADS-B data anomaly detection method based on deep learning. Background Art

[0002] With the significant increase in airspace density, traditional surveillance technologies, such as primary surveillance radar (PSR), secondary surveillance radar (SSR) and multilateration positioning (MLAT) technology, will become increasingly difficult to meet the development needs of future air traffic management (ATM) systems. Due to the advantages of high accuracy, wide coverage, support for data sharing and air surveillance, ADS-B technology has become an important part of the next generation air transportation system.

[0003] However, the extensive application of data-driven technologies in cloud computing, the Internet of Things, service recommendations, blockchain, and other fields has provided attackers with powerful hardware and software support and more abundant means of attack, which has caused the aviation industry to lose considerable technical advantages in protecting its communications. Due to the open and shared characteristics of the ADS-B protocol, which broadcasts messages without any authentication and encryption, attackers can launch various wireless attacks on the system, such as interference, eavesdropping, modification, message injection, and message deletion. With the widespread use of the ADS-B system in the civil aviation field, its security faces huge challenges.

[0004] A lot of research has been conducted at home and abroad on the problem of deceptive interference of the ADS-B system. The first is a method based on cryptographic encryption, but this method requires modifying the existing ADS-B protocol and is incompatible with the current ADS-B system, so it is difficult to implement and the cost is high. The second type is a method based on position detection. This type of method usually uses the arrival time difference or arrival time and the position information sent by the aircraft for secondary verification. This type of method has certain requirements for the installation location of the receiving base station and is relatively complex. The third type is a method based on array antennas. This type of method uses a single data source and requires spatial search and direction finding, but the calculation is relatively complex and is sensitive to array amplitude and phase errors. The fourth type is a method that uses a single antenna to measure whether the Doppler frequency change of the actual signal is consistent with the Doppler frequency change calculated by the information in the message. This type of method is simple, but requires a relatively complex coordinate position calculation, and after calculating the correlation coefficient, a threshold is artificially set to identify deceptive signals, resulting in certain deviations.

[0005] Therefore, it is an urgent problem for those skilled in the art to propose an ADS-B data anomaly detection method based on deep learning to solve the difficulties existing in the prior art. Summary of the invention

[0006] In view of this, the present invention provides an ADS-B data anomaly detection method based on deep learning, which only needs to use time domain sampling data and does not require complex or multi-dimensional features. It can better extract the characteristics of ADS-B signals and the spatial relationship between signals on a route, and can detect deception attacks without increasing the complexity of airborne applications.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] A method for detecting anomalies in ADS-B data based on deep learning, comprising:

[0009] S1. Obtain ADS-B data set;

[0010] S2, preprocessing the ADS-B data set to obtain a processed ADS-B data set;

[0011] S3, dividing the processed ADS-B data set into a training set and a test set according to a preset ratio;

[0012] S4. Build a deep learning model that integrates convolutional bidirectional LSTM and attention mechanism;

[0013] S5. Use the training set data to train the deep learning model to obtain a trained deep learning model;

[0014] S6. Based on the trained deep learning model, ADS-B data anomaly detection is performed according to the test set data.

[0015] In the above method, optionally, in S1, an ADS-B data set is generated by MATLAB simulation, including real ADS-B signals and different spoofing attack signals;

[0016] The ratio of real ADS-B signals to spoof attack signals is 1:1;

[0017] Deception attack signal types include: eavesdropping, improvisation, message injection, message deletion, and message modification.

[0018] In the above method, optionally, in S2, the ADS-B data set is preprocessed as follows:

[0019] S201, extracting features related to aircraft operation status information from the ADS-B data, including: longitude, latitude, altitude, speed, heading, and climb rate of the aircraft;

[0020] S202, sorting the data according to the ICAO code of the International Civil Aviation Organization;

[0021] S203, standardize ADS-B data;

[0022] S204: Process the data into a window form according to the time correlation relationship between the ADS-B data features.

[0023] In the above method, optionally, in S203, the method for standardizing the ADS-B data set includes:

[0024] Min-max normalization is used to make the ADS-B data in the range of [0, 1], and the sequence x1, x2, x3, ..., x n ;

[0025] The formula for min-max normalization is:

[0026]

[0027] Among them, x i represents the input i-th ADS-B signal, min{x j} represents the minimum value in the ADS-B signal sequence, max{x j} represents the maximum value in the ADS-B signal sequence.

[0028] In the above method, optionally, in S4, the deep learning model includes, from left to right, a convolutional neural network layer, a bidirectional long short-term memory network layer, an attention layer, a fully connected layer, and an output layer;

[0029] Convolutional neural network layers are used for feature extraction;

[0030] The bidirectional long short-term memory network layer captures the forward and reverse dependencies in the time series data, and processes the input sequence through the forward and reverse LSTM networks to obtain global context information;

[0031] The attention layer is used to assign different attention weights to enhance the model's attention to key temporal information;

[0032] The fully connected layer is used to summarize and transform the output of the attention layer;

[0033] The output layer is used to map the output of the fully connected layer to the final classification result.

[0034] In the above method, optionally, the convolutional neural network layer includes multiple convolutions, multiple ReLU activation functions and pooling layers;

[0035] Among them, each convolutional layer is followed by a ReLU activation function for nonlinear transformation;

[0036] The pooling layer is responsible for reducing the spatial size of the convolutional layer output, extracting the main features through maximum pooling and reducing the computational complexity while controlling overfitting.

[0037] In the above method, optionally, in the bidirectional long short-term memory network layer:

[0038]

[0039] where P t is the output of the pooling layer at time step t, and represent the hidden states of the forward and backward LSTM at time step t respectively, and the final output h t is the concatenation of the hidden states in both directions.

[0040] In the above method, optionally, in the attention layer, the attention weight is:

[0041]

[0042] where e t is a scoring function used to measure the importance of h t , and T is the total number of time steps

[0043] In the above method, optionally, the output of the fully connected layer is:

[0044]

[0045] where W f and b f represent the weight and bias of the fully connected layer respectively;

[0046] The output of the fully connected layer is mapped to class labels through a softmax classifier for classification, and the final detection result of the spoofing attack signal is output;

[0047] The output y of the Softmax layer is expressed as:

[0048]

[0049] where j represents the class label index, K is the total number of class labels, and K = 2; the output y contains two elements [y1; y2], where y1 is the probability of the real ADS-B signal and y2 is the probability of the spoofing attack signal; if y1 > y2, the detection result is the real ADS-B signal, and if y1 < y2, the detection result is the spoofing attack signal.

[0050] It can be seen from the above technical solution that compared with the prior art, the present invention provides an ADS-B data anomaly detection method based on deep learning, which has the following beneficial effects: the present invention not only greatly improves the accuracy of identifying deception attack signals, but also speeds up the processing speed, ensuring that real signals and deception signals can be quickly and effectively distinguished in complex signal environments; it does not require complex feature engineering, additional node participation, and modification of existing protocols, and has strong operability in future practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0052] Figure 1 A flowchart of an ADS-B data anomaly detection method based on deep learning provided by the present invention;

[0053] Figure 2 A schematic diagram of sorting data according to the International Civil Aviation Organization (ICAO) code provided by the present invention;

[0054] Figure 3 This is a structural diagram of the deep learning model that integrates convolutional bidirectional LSTM and attention mechanism provided by the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprise one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0057] Reference Figure 1 As shown, the present invention discloses a method for detecting anomalies in ADS-B data based on deep learning, comprising:

[0058] S1. Obtain ADS-B data set;

[0059] S2, preprocessing the ADS-B data set to obtain a processed ADS-B data set;

[0060] S3, dividing the processed ADS-B data set into a training set and a test set according to a preset ratio;

[0061] S4. Build a deep learning model that integrates convolutional bidirectional LSTM and attention mechanism;

[0062] S5. Use the training set data to train the deep learning model to obtain a trained deep learning model;

[0063] S6. Based on the trained deep learning model, ADS-B data anomaly detection is performed according to the test set data.

[0064] Furthermore, in S1, an ADS-B data set is generated by MATLAB simulation, including real ADS-B signals and different deception attack signals; because ADS-B deception attack signals do not exist in large quantities in real life, the sample data set used in the network training experiment is simulated by the MATLAB platform, wherein the sample data set includes real ADS-B signals and deception attack signals with different track lengths;

[0065] The ratio of real ADS-B signals to spoof attack signals is 1:1;

[0066] Deception attack signal types include: eavesdropping, improvisation, message injection, message deletion, and message modification.

[0067] Furthermore, in S2, the ADS-B data set is preprocessed as follows:

[0068] S201, extracting features related to aircraft operation status information from the ADS-B data, including: longitude, latitude, altitude, speed, heading, and climb rate of the aircraft;

[0069] S202. Sort the data according to the ICAO code of the International Civil Aviation Organization, so that the data set can be sorted according to different flights, in the form of Figure 2 As shown;

[0070] S203, standardizing the ADS-B data so that scaling transformations of different feature dimensions make the features comparable between different metrics without changing the distribution of the original data;

[0071] S204: Process the data into a window form according to the time correlation relationship between the ADS-B data features.

[0072] Define an n-dimensional time series S = {S1, S2, ..., Sc} to represent the ADS-B sequence window, which consists of a series of n-dimensional vectors, where C is the length of the time series; Si = {s1, s2, ..., sn} is an n-dimensional vector, each dimension corresponds to a feature, specifically, S represents a window consisting of C consecutive ADS-B messages, and each vector Si contains the features extracted from the corresponding ADS-B message, namely longitude, latitude, altitude, speed, heading and climb rate.

[0073] Furthermore, in S203, the method for standardizing the ADS-B data set includes:

[0074] Min-max normalization is used to make the ADS-B data in the range of [0, 1], and the sequence x1, x2, x3, ..., x n ;

[0075] The formula for min-max normalization is:

[0076]

[0077] Among them, x i represents the input i-th ADS-B signal, min{x j} represents the minimum value in the ADS-B signal sequence, max{x j} represents the maximum value in the ADS-B signal sequence.

[0078] Further, see Figure 3 As shown, in S4, the deep learning model includes, from left to right: a convolutional neural network layer, a bidirectional long short-term memory network layer, an attention layer, a fully connected layer, and an output layer;

[0079] Convolutional neural network layers are used for feature extraction;

[0080] The bidirectional long short-term memory network layer captures the forward and reverse dependencies in the time series data, and processes the input sequence through the forward and reverse LSTM networks to obtain global context information;

[0081] In fact, the LSTM unit is a storage unit for learning long-term patterns, including the current state and three nonlinear gates: forget gate, input gate and output gate. The forget gate is responsible for deciding how much information to remember, which is determined by a nonlinear function.

[0082] The attention layer is used to assign different attention weights to enhance the model's attention to key temporal information;

[0083] The fully connected layer is used to summarize and transform the output of the attention layer;

[0084] The output layer is used to map the output of the fully connected layer to the final classification result.

[0085] Furthermore, the convolutional neural network layer includes multiple convolutions, multiple ReLU activation functions, and pooling layers;

[0086] The convolutional layer extracts the key time-frequency features of the deceptive interference signal by applying multiple filters. Each filter automatically learns a specific pattern or feature in the signal, and then enhances the nonlinear processing capability through activation functions such as ReLU.

[0087] The operation of each convolutional layer can be expressed as:

[0088] H i =f(W i *X+b i )

[0089] In the formula, the symbol * represents the convolution operation, W i and b i Represent the weight and bias of the convolutional layer respectively, X is the input deception interference signal, and f represents the activation function ReLU. The specific form is:

[0090] f(x)=max(0,x).

[0091] The pooling layer is responsible for reducing the spatial size of the convolutional layer output, extracting the main features and reducing the computational complexity through maximum pooling, while controlling overfitting. The maximum pooling operation can be expressed as:

[0092] P i =pool(H i )

[0093] In the formula, pool is the pooling function, which represents the maximum value in the area, Hi is the output of the convolutional layer.

[0094] Furthermore, in the bidirectional long short-term memory network layer:

[0095]

[0096] In the formula, P t is the output of the pooling layer at time step t, and represent the hidden states of the forward and backward LSTM at time step t respectively, and the final output h t is the concatenation of the hidden states in both directions.

[0097] Furthermore, in the attention layer, the attention weights are:

[0098]

[0099] In the formula, e t is a scoring function used to measure the importance of h t , and T is the total number of time steps

[0100] Furthermore, the output of the fully connected layer is:

[0101]

[0102] In the formula, W f and b f represent the weight and bias of the fully connected layer respectively;

[0103] The output of the fully connected layer is mapped to class labels through a softmax classifier for classification, and the final detection result of the spoofing attack signal is output;

[0104] The output y of the Softmax layer is expressed as:

[0105]

[0106] In the formula, j represents the class label index, K is the total number of class labels, and K = 2; the output y contains two elements [y1; y2], where y1 is the probability of the true ADS-B signal and y2 is the probability of the spoofing attack signal; if y1 > y2, the detection result is the true ADS-B signal, and if y1 < y2, the detection result is the spoofing attack signal.

[0107] In a specific embodiment, it is assumed that the ground ADS-B receiver is located at 118.3549 east longitude and 39.1128 north latitude, 2000 tracks are randomly generated near the receiver, the aircraft altitude is 10km, and the horizontal range from the receiver is 30km. The generated track duration is 5s; then each track sends a total of 10 ADS-B signals. It is assumed that the jammer is stationary on the ground or moves within 5km of the receiver. The direction may be random, and a deceptive signal is sent to the receiver. The real signal and the deceptive attack signal are generated respectively using the randomly generated 2000 track information. The signal-to-noise ratio is 20dB and the sampling rate is 30MHz; the deceptive attack signal includes: random noise, fixed offset (+), fixed offset (-), route replacement, altitude offset (+), altitude offset (-), speed offset (+), speed offset (-), heading change and climb rate change.

[0108] Before statistically analyzing all attack detection results, the effects of different sliding window lengths on detection results were first studied. Five representative types of abnormal data (random noise, fixed offset, path replacement, height offset, and speed offset) were selected to test the effects of sliding window length on detection results. For the data set used in this embodiment, when the sliding window length was 9, the detection results were optimal. As the window length continued to increase, the detection effect gradually deteriorated because longer windows would mask time changes in a short period of time.

[0109] In the test set composition, 20 flight segments were selected, and attacks were injected into different flight stages in two sequence segments [100,105] and [140,145]. A training model with a window length of 9 was selected to test various attack types, using precision, recall and F1 score as the measurement criteria.

[0110] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0111] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting anomalies in ADS-B data based on deep learning, characterized in that: include: S1. Obtain ADS-B data set; S2, preprocessing the ADS-B data set to obtain a processed ADS-B data set; S3, dividing the processed ADS-B data set into a training set and a test set according to a preset ratio; S4. Build a deep learning model that integrates convolutional bidirectional LSTM and attention mechanism; S5. Use the training set data to train the deep learning model to obtain a trained deep learning model; S6. Based on the trained deep learning model, ADS-B data anomaly detection is performed according to the test set data.

2. The ADS-B data anomaly detection method based on deep learning according to claim 1, characterized in that: In S1, an ADS-B data set is generated through MATLAB simulation, including real ADS-B signals and different spoofing attack signals; The ratio of real ADS-B signals to spoof attack signals is 1:1; Deception attack signal types include: eavesdropping, improvisation, message injection, message deletion, and message modification.

3. The ADS-B data anomaly detection method based on deep learning according to claim 1, characterized in that: In S2, the ADS-B data set preprocessing is as follows: S201, extracting features related to aircraft operation status information from the ADS-B data, including: longitude, latitude, altitude, speed, heading, and climb rate of the aircraft; S202, sorting the data according to the ICAO code of the International Civil Aviation Organization; S203, standardize ADS-B data; S204: Process the data into a window form according to the time correlation relationship between the ADS-B data features.

4. The ADS-B data anomaly detection method based on deep learning according to claim 3 is characterized in that: In S203, the method for standardizing the ADS-B data set includes: Min-max normalization is used to make the ADS-B data in the range of [0, 1], and the sequence x1, x2, x3, ..., x n ; The formula for min-max normalization is: Among them, x i represents the input i-th ADS-B signal, min{x j } represents the minimum value in the ADS-B signal sequence, max{x j } represents the maximum value in the ADS-B signal sequence.

5. The ADS-B data anomaly detection method based on deep learning according to claim 1, characterized in that: In S4, the deep learning model includes, from left to right: convolutional neural network layer, bidirectional long short-term memory network layer, attention layer, fully connected layer, and output layer; Convolutional neural network layers are used for feature extraction; The bidirectional long short-term memory network layer captures the forward and reverse dependencies in the time series data, and processes the input sequence through the forward and reverse LSTM networks to obtain global context information; The attention layer is used to assign different attention weights to enhance the model's attention to key temporal information; The fully connected layer is used to summarize and transform the output of the attention layer; The output layer is used to map the output of the fully connected layer to the final classification result.

6. The ADS-B data anomaly detection method based on deep learning according to claim 5, characterized in that: The convolutional neural network layer includes multiple convolutions, multiple ReLU activation functions, and pooling layers; Among them, each convolutional layer is followed by a ReLU activation function for nonlinear transformation; The pooling layer is responsible for reducing the spatial size of the output of the convolutional layer, extracting the main features through max pooling and reducing the computational complexity, while controlling overfitting.

7. A method for anomaly detection of ADS-B data based on deep learning according to claim 5, characterized in that In the bidirectional long short-term memory network layer: Where P t is the output of the pooling layer at time step t, and Represent the hidden states of the forward and backward LSTM at time step t, and finally output h t It is the concatenation of the hidden states in two directions.

8. A method for anomaly detection of ADS-B data based on deep learning according to claim 5, characterized in that In the attention layer, the attention weight is: In the formula, e t is a scoring function used to measure h t The importance of , T is the total number of time steps.

9. A method for anomaly detection of ADS-B data based on deep learning according to claim 5, characterized in that The output of the fully connected layer is: Where W f and b f Represent the weight and bias of the fully connected layer respectively; The output of the fully connected layer is mapped to class labels through a softmax classifier for classification, and the final detection result of the spoofing attack signal is output; The output y of the Softmax layer is expressed as: In the formula, j represents the class label index, K is the total number of class labels, and K = 2 is taken; the output y contains two elements [y1; y2], where y1 is the probability of the real ADS-B signal and y2 is the probability of the spoofing attack signal; if y1 > y2, the detection result is the real ADS-B signal, and if y1 < y2, the detection result is the spoofing attack signal.

Images