Attack and detection method for cross-protocol communication

Abstract

The invention discloses an attack and detection method for cross-protocol communication, and the method comprises the steps: building a monitoring and detection model based on a decision tree model, taking the phase, amplitude and frequency spectrum components of each subcarrier of channel state data collected in real time as the input of the model, and taking the classification of cross-technical interference traffic and normal traffic as the output; time sequence modeling and congestion judgment are carried out based on a Transform model, a DQN network is introduced based on an MPC framework, a congestion attack defense model is constructed, a system state vector is used as the input of the model, and a selected optimal defense action is used as the output; according to the method, the DQN method is introduced to assist the rolling optimization problem of the MPC framework, so that the system can utilize the prediction and constraint processing capability of the MPC and can also utilize the rapid value estimation of the DQN in a large-scale state-action space, finally, the defense decision is efficiently completed in each time slot, and the calculation cost of attack and detection in a cross-technology communication system is reduced.

Description

Technical Field

[0001] The present invention relates to the field of communication security, and particularly to an attack and detection method for cross-protocol communication. Background Art

[0002] Cross Technology Communication (CTC) aims to establish direct communication between heterogeneous devices of communication technologies with different protocols (such as ZigBee, WiFi, Bluetooth, mobile communication). Current attack methods against CTC systems mainly include: exploiting protocol compatibility vulnerabilities, encrypted traffic stealth attacks, and hardware and network layer attacks. Among the protocol compatibility vulnerability attack methods, an attacker can utilize the multi-protocol communication characteristics of the CTC system and exploit the compatibility vulnerabilities between different protocols to carry out attacks. For example, in a dual-active architecture, an attacker can disrupt the synchronization of the primary and standby devices by forging TCP sequence numbers or interfering with the heartbeat detection mechanism, resulting in system misjudgment or service interruption. Such attacks often take advantage of the insufficient real-time monitoring of dynamic ports by the system and embed malicious instructions into regular protocol data packets. In the encrypted traffic stealth attack method, in the encrypted communication scenario of the CTC system (such as remotely controlled instructions encrypted by TLS), an attacker may forge a certificate trust chain through a man-in-the-middle attack or transmit cross-protocol malicious instructions using encrypted traffic. Since it is difficult to penetrate the encryption layer, traditional detection means are prone to failure. In the hardware and network layer attack method, the hardware loss and network architecture defects of the CTC system provide an entry point for attackers. For example, the blocking vulnerability caused by the incompatibility between the network protocol and security software in the dual-channel operation mechanism may be used to launch a DDoS attack or data tampering.

[0003] Detection technologies for attacks against CTC systems include protocol deep parsing engines, encrypted traffic fingerprint recognition, AI-driven behavior baseline models, etc. Among them, the protocol deep parsing engine performs semantic analysis of function codes on traffic, identifies unconventional write register operations, and determines anomalies by combining context timing features. However, this method has insufficient support for new and niche protocols. Encrypted traffic fingerprint recognition identifies malicious encrypted sessions by analyzing the metadata characteristics of traffic and comparing with certificate transparency logs. However, this method has a high false alarm rate in scenarios and lacks reliability. The AI-driven behavior baseline model learns the normal communication mode based on a network model and real-time detects abnormal data frames deviating from the baseline. However, this method relies on large-scale labeled data training and has a high computational cost. Summary of the Invention

[0004] The object of the present invention is to provide an attack and detection method for cross-protocol communication, which can efficiently complete the detection of cross-technology interference traffic and the selection of defense decisions in each time slot.

[0005] To achieve the above functions, the present invention designs an attack and detection method for cross - protocol communication. For a cross - technology communication system composed of multiple channels, the following steps S1 - step S3 are executed to complete the construction of the attack model, and the following steps S4 - step S6 are executed to complete the construction of the defense model:

[0006] Step S1: Real - time collect the channel state data of the cross - technology communication system, extract the phase and amplitude of the sub - carriers of each channel from it, perform Fourier transform on the channel state data, and obtain the spectral components of each sub - carrier;

[0007] Step S2: Based on the decision tree model, construct a listening and detection model. Use the phase, amplitude, and spectral components of each sub - carrier of the channel state data collected in real - time as the input of the listening and detection model, and use the classification of cross - technology interference traffic and normal traffic as the output. Train the listening and detection model to obtain a trained listening and detection model;

[0008] Step S3: Deploy the trained listening and detection model in the cross - technology communication system to detect the traffic of each channel. If cross - technology interference traffic is detected, send a congestion attack signal on the corresponding channel;

[0009] Step S4: Based on the interference index, congestion index, decision information of the cross - technology communication system, and historical context information, form a system state vector;

[0010] Step S5: Based on the Transformer model for time - series modeling and congestion judgment, introduce a deep Q - network based on the MPC framework to construct a congestion attack defense model. Use the system state vector as the input of the congestion attack defense model and the selected optimal defense action as the output. Train the congestion attack defense model to obtain a trained congestion attack defense model;

[0011] Step S6: Deploy the trained congestion attack defense model in the cross - technology communication system.

[0012] Beneficial effects: Compared with the prior art, the advantages of the present invention include:

[0013] Introduce the DQN method to assist in the rolling optimization problem of MPC. In the rolling optimization of MPC, it is not necessary to expand all scenarios for each time slot, but the DQN network can be called for value evaluation at certain stages or certain depths, thereby reducing the branches of the scenario tree.

[0014] Adopt the combination of the MPC framework and the DQN method, so that the cross - technology communication system can not only utilize the prediction and constraint processing capabilities of the MPC framework, but also rely on the fast value estimation of the DQN model in the large - scale state - action space, and finally efficiently complete the defense decision at each time slot. Description of the Drawings

[0015] Figure 1 is a flowchart of an attack model provided according to an embodiment of the present invention;

[0016] Figure 2 is a flowchart of a defense model provided according to an embodiment of the present invention. Detailed implementation manners

[0017] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention, and cannot be used to limit the protection scope of the present invention.

[0018] An attack and detection method for cross-protocol communication provided by an embodiment of the present invention, for a cross-technology communication system composed of multiple channels, referring to Figure 1 and perform the following steps S1 - S3 to complete the construction of the attack model, referring to Figure 2 and perform the following steps S4 - S6 to complete the construction of the defense model:

[0019] Step S1: Real-time collect the channel state data (Channel State Information, CSI) of the cross-technology communication system, extract the phase and amplitude of the subcarriers of each channel from it, perform Fourier transform on the channel state data, and obtain the spectral components of each subcarrier to analyze the change of specific subcarrier CSI data over time;

[0020] In the absence of the influence of other data packets, due to similar wavelengths and multipath effects, adjacent subcarriers (such as subcarrier i and i + 1) should have very similar CSI readings.

[0021] However, due to its particularity, the CTC signal can be distinguished from ordinary traffic after being processed. For example, the ZigBee signal is modulated by O-QPSK, and its phase perturbation shows periodic changes within the covered frequency band, while the CTC signal simulates ZigBee modulation by adjusting the phase modulation characteristics of WiFi data packets, which results in its phase change including both the periodic characteristics of ZigBee and the inherent phase offset of WiFi superimposed. And the influence of the CTC signal in the frequency domain has a wider coverage range, including not only the narrowband energy peak of the ZigBee signal, but also the side lobe effect that may occur in the WiFi frequency band.

[0022] Step S2: Based on the decision tree model, construct a listening and detection model, use the phase, amplitude, and spectral components of each subcarrier of the real-time collected channel state data as the input of the listening and detection model, and use the classification of cross-technology interference traffic and normal traffic as the output, and train the listening and detection model to obtain a trained listening and detection model;

[0023] In step S2, the listening and detection model includes an input layer, a convolutional layer, an LSTM layer, and a fully connected layer. The specific processing process of the input data is as follows:

[0024] Step S2.1: Combine the phase, amplitude, and spectral components of the subcarriers of each channel collected in real time to form a feature vector, and input it into the input layer of the listening and detection model.

[0025] The first stage of the attack model is listening, that is, constantly monitoring whether there is CTC traffic for communication and detecting CTC activities. Continuously sample the received CSI data and preprocess it to extract features; in one embodiment, the cross-technology communication system includes 7 channels, intercept the subcarriers of Zigbee or BLE channels covered by the WiFi band, select the CSI values of the corresponding subcarriers, and use them as a feature sequence to input into the network for training. The listening and detection model starts from a sequence input layer, which receives a twenty-one-dimensional feature input sequence, where each sample is composed of the amplitude, phase, and frequency features of the CSI of 7 subcarriers closest to the corresponding channel.

[0026] Step S2.2: Extract frequency domain features from the feature vector through two consecutive one-dimensional convolutional layers (Conv1D). Each convolutional layer contains 64 filters, and the filter size is 3. The purpose of these convolutional layers is to capture the frequency domain features between different subcarriers, such as amplitude changes, phase jumps, and frequency perturbation patterns; to prevent overfitting, a ReLU activation layer is connected after each convolutional layer to introduce non-linearity and enhance the network's ability to model complex signal features; a dropout layer with a rate of 0.3 is inserted after the convolutional layer, that is, randomly ignore 30% of the output of the convolutional units during each training.

[0027] Step S2.3: Input the frequency domain features extracted by the convolutional layer into three consecutive LSTM layers to extract time series features. Each LSTM layer contains 128 units. The LSTM layer focuses on mining the time dependence of signal features, such as the periodic change pattern of ZigBee signals or the potential jump characteristics in WiFi simulation signals. A dropout layer with a rate of 0.5 is added after each LSTM layer, that is, randomly mask half of the output of the LSTM units during each training update.

[0028] Step S2.4: Input the time - series features extracted by the LSTM layer into a fully - connected (FC) layer with 100 neurons. This fully - connected layer performs a non - linear combination of the frequency - domain features extracted by the convolutional layer and the time - series features extracted by the LSTM layer to extract high - level features. After each neuron in the fully - connected layer, there is a ReLU activation layer with a rate of 0.2 to improve the generalization ability. There is also another fully - connected layer after this fully - connected layer, which contains 50 neurons to further refine the features and help distinguish real ZigBee signals from WiFi emulation signals.

[0029] Step S3: Deploy the trained listening and detection model in the cross - technology communication system to detect the traffic on each channel. If cross - technology interference traffic is detected, a congestion attack signal is sent on the corresponding channel.

[0030] After detecting CTC activities, the WiFi attacker sends a congestion attack signal on the corresponding channel. Since the headers and FCS of Zigbee MAC frames are not encrypted, the attacker knows the source devices of the MAC frames. The interference signal is set to a pre - determined noise signal with a power more than 5 times that of the Zigbee signal, which is sufficient to interfere with Zigbee transmissions but is still much weaker than the power of the WiFi signal. After the attack, the WiFi attacker can continue to collect CSI minus the interference noise to continue detecting CTC traffic on the channel.

[0031] Step S4: Based on the interference index, congestion index, decision information of the cross - technology communication system, and historical context information, form a system state vector.

[0032] The interference index mentioned above comes from the amplitude and phase analysis of specific sub - carriers. The congestion index includes throughput and transmission success rate. The decision information of the cross - technology communication system includes the selected defense actions. The historical context information includes queue length and delay statistics to improve the prediction accuracy.

[0033] The interference index vector extracted by the physical layer, which comes from the amplitude and phase analysis of specific sub - carriers. The method of amplitude and phase analysis of specific sub - carriers in the interference index is as follows:

[0034] To quantify cross - technology interference, several interference metrics are defined at the physical layer. These metrics are based on the CSI (complex form) collected at the Wi - Fi receiver and are decomposed into amplitude (Mag) and phase (Phase) for analysis. Let CSI(k,a) represent the complex channel gain of sub - carrier k under antenna a, which is specifically expressed as the following formula:

[0035] CSI(k,a) = A(k,a)e jθ(k,a)

[0036] Among them, A(k,a) is the amplitude of subcarrier k under antenna a, and θ(k,a) is the phase of subcarrier k under antenna a;

[0037] If the cross-technology communication system collects channel state data multiple times within a time slot or a time window (such as T OFDM symbols), its average amplitude is as follows:

[0038]

[0039] Among them, AvgAmp(k,a) represents the average amplitude of subcarrier k under antenna a, and A τ (k,a) is the amplitude value of the τ-th collection of subcarrier k under antenna a, and T is the time slot;

[0040] The phase difference between different antennas for the same subcarrier is as follows:

[0041] PhaseDiff(k,a1,a2) = |θ(k,a1) - θ(k,a2)|

[0042] Among them, PhaseDiff(k,a1,a2) represents the phase difference of subcarrier k under antennas a1 and a2, and θ(k,a1) and θ(k,a2) respectively represent the phases of subcarrier k under antennas a1 and a2;

[0043] If there is strong interference or multipath perturbation, it often causes obvious fluctuations in the phase difference. After summarizing the amplitude and phase difference characteristics of the subcarriers, a feature vector f t (k) for a specific subcarrier k and antenna combination (a1,a2) is formed. Considering the high spectral overlap between the ZigBee channel and Wi-Fi subcarriers, these subcarriers are monitored keyly. Finally, at each time slot t, the features of all subcarriers and antennas are spliced or weighted and combined into an interference index vector I t for subsequent model reference.

[0044] The congestion index detects the throughput and transmission success rate within a time slot. Among them, the transmission success rate (SuccessRate, SR t ) is used to measure whether there is serious congestion or packet loss at the network level, and its calculation is as follows:

[0045]

[0046] In the formula, SR t is the transmission success rate of time slot t, N tx represents the number of data frames attempted to be sent within time slot t, and N succ represents the number of successfully transmitted data frames.

[0047] The system state vector in step S4 is defined as a set of multi-dimensional information that can reflect the current network condition and interference level, in the following form:

[0048] x t =(I t , SR t , u t-1 , h t )

[0049] Among them, x t represents the system state at time slot t, u t-1 represents the defense actions (such as channel selection, power setting) selected by the cross-technology communication system in the previous time slot, h t is optional historical context information, I t represents the interference metric vector at time slot t, and SR t is the transmission success rate at time slot t.

[0050] Step S5: Perform temporal modeling and congestion judgment based on the Transformer model, introduce a deep Q-network based on the MPC framework, construct a congestion attack defense model, use the system state vector as the input of the congestion attack defense model, and the selected optimal defense action as the output, and train the congestion attack defense model to obtain a trained congestion attack defense model;

[0051] The method for performing temporal modeling and congestion judgment based on the Transformer model in step S5 is as follows:

[0052] To better capture the changing trend of the interference metric in the time dimension, a Transformer model is introduced for temporal modeling. The interference metric sequence {I t-M , …, I t-1 , I t} of the past M time slots is used as the input of the Transformer model. First, vectorization and positional encoding are performed, and then the multi-head self-attention module is used to learn the global dependencies of different subcarrier features over time. Compared with traditional RNN or LSTM, the Transformer model has more advantages in modeling dependencies across subcarriers and time slots, especially being able to quickly focus on the corresponding feature dimensions in the event of sudden interference.

[0053] Let the output of the Transformer model be representing the predicted value of the interference condition in the next time slot; if the throughput decrease value exceeds the threshold during the observation period, or the transmission success rate SR t decreases by more than the threshold during the observation period, it is determined that the current congestion condition is severe, and defense actions such as channel switching or power increase need to be selected in subsequent decisions.

[0054] In summary, the core work in the first stage is to define an appropriate state space and interference measurement method, obtain interference indicators through CSI sub-carrier level analysis, and then perform time series modeling and congestion judgment with the help of the Transformer model.

[0055] After completing the fine-grained modeling of the system state, interference indicators, and congestion status, further combine the idea of model predictive control with the deep Q-network (DQN) to achieve rolling defense decisions in the dynamic scenario of cross-technology interference (CTC). The method for constructing a congestion attack defense model by introducing a deep Q-network based on the MPC framework in step S5 is as follows:

[0056] Based on the system state, the MPC framework continuously updates the action strategy through rolling prediction. At each step, the MPC framework predicts the system state within the future time interval based on the currently observed system state, and optimizes the control input according to the prediction result; first, based on the MPC framework, according to the system state x at the current time slot t t and the state z of the interferer t construct a rolling optimization problem with a prediction horizon of H. Assuming that the interferer may adopt different attack strategies within this prediction window, different degrees of interference will be caused to the cross-technology communication system; then, the cross-technology communication system selects the optimal defense action u for each time slot τ∈{t,…,t + H} within this window τ ; for example, which Wi-Fi channel and transmission power level to select. In the traditional MPC framework, an optimal action sequence {u t ,…,u t+H} is often obtained by explicitly solving the state transition equation for future time slots. However, in the case of a high-dimensional state space or complex and variable attacker strategies, the computational cost of directly performing multi-scenario expansion may be too high.

[0057] To clarify this process, first formally define the objective function required for rolling optimization. In the defense objective of this method, the benefit brought by the transmission success rate or throughput is denoted as S(x τ ,u τ ,z τ ), while the losses caused by communication failures, severe congestion, or cross-technology interference are represented by F(x τ ,z τ ); within the prediction window of length H, construct the following objective function:

[0058]

[0059] where w1 and w2 represent weighting coefficients to balance between benefits and losses, and respectively represent the states of the cross-technology communication system and the interferer at time slot τ in scenario k, and p k is the probability of this scenario;

[0060] Introduce a deep Q-network for the MPC framework as an efficient approximate solution method. The deep Q-network was originally a reinforcement learning method designed for discrete action spaces. It uses a deep neural network to approximate the Q-function, that is, the expected cumulative reward that can be obtained by performing action a in state x. Specifically in this method, the deep Q-network can be regarded as a Q-value estimator: when the cross-technology communication system is in system state x τ and faces the interferer state z τ at this time, the deep Q-network inputs the system state x τ (including the interference metric I τ , the congestion metric SR τ , and the historical information of past time slots), and outputs the Q-value estimation of each possible action u τ If the action space (such as channel selection, power adjustment) is discrete or discretizable, the deep Q-network can quickly evaluate the value of each action, so as to select the action with the highest Q-value. At this time, in the rolling optimization of MPC, it is not necessary to expand all scenarios for each time slot τ, but the deep Q-network can be called for value evaluation at certain stages or certain depths, thereby reducing the branches of the scenario tree. That is to say, the system can explicitly expand the scenarios in the first several steps, and for the subsequent time slots that are difficult to enumerate, the deep Q-network gives an "approximate Q-value", which is equivalent to building a bridge between MPC and RL.

[0061] Introduce the deep Q-network method to assist the rolling optimization problem of MPC, so that the system can not only utilize the prediction and constraint processing capabilities of MPC, but also rely on the fast value estimation of the deep Q-network in the large-scale state-action space, and finally efficiently complete the defense decision at each time slot.

[0062] Step S6: Deploy the trained congestion attack defense model in the cross-technology communication system.

[0063] The above has described the embodiments of the present invention in detail with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those of ordinary skill in the art, various changes can be made without departing from the gist of the present invention.​

Claims

1. An attack and detection method for cross - protocol communication, characterized in that, For a cross-technology communication system composed of multiple channels, perform the following steps S1 - S3 to complete the construction of the attack model, and perform the following steps S4 - S6 to complete the construction of the defense model: Step S1: Collect the channel state data of the cross-technology communication system in real time, extract the phase and amplitude of the subcarriers of each channel from it, and perform Fourier transform on the channel state data to obtain the spectral components of each subcarrier; Step S2: Based on the decision tree model, construct a monitoring and detection model. Use the phase, amplitude, and spectral components of each subcarrier of the channel state data collected in real time as the input of the monitoring and detection model, and use the classification of cross-technology interference traffic and normal traffic as the output. Train the monitoring and detection model to obtain a trained monitoring and detection model; Step S3: Deploy the trained monitoring and detection model in the cross-technology communication system to detect the traffic of each channel. If cross-technology interference traffic is detected, send a congestion attack signal on the corresponding channel; Step S4: Based on the interference index, congestion index, decision information of the cross-technology communication system, and historical context information, form a system state vector; Step S5: Perform time series modeling and congestion judgment based on the Transformer model. Introduce a deep Q network based on the MPC framework to construct a congestion attack defense model. Use the system state vector as the input of the congestion attack defense model, and use the selected optimal defense action as the output. Train the congestion attack defense model to obtain a trained congestion attack defense model; Step S6: Deploy the trained congestion attack defense model in the cross-technology communication system.

2. The attack and detection method for cross - protocol communication according to claim 1, characterized in that, In step S2, the monitoring and detection model includes an input layer, a convolutional layer, an LSTM layer, and a fully connected layer. The specific processing process of the input data is as follows: Step S2.1: Combine the phase, amplitude, and spectral components of the subcarriers of each channel collected in real time to form a feature vector, and input it into the input layer of the monitoring and detection model; Step S2.2: Extract frequency domain features from the feature vector through two consecutive one-dimensional convolutional layers. Each convolutional layer contains 64 filters, and the filter size is 3. After each convolutional layer, connect a ReLU activation layer, and insert a dropout layer after the convolutional layer, with a rate of 0.3; Step S2.3: Input the frequency domain features extracted by the convolutional layer into three consecutive LSTM layers to extract time series features. Each LSTM layer contains 128 units, and add a dropout layer after each LSTM layer, with a rate of 0.5; Step S2.4: Input the time series features extracted by the LSTM layer into a fully connected layer with 100 neurons. This fully connected layer performs a non-linear combination of the frequency domain features extracted by the convolutional layer and the time series features extracted by the LSTM layer; After each neuron of the fully connected layer, connect a ReLU activation layer, with a rate of 0.2; There is also another fully connected layer after this fully connected layer, which contains 50 neurons.

3. The attack method for cross - protocol communication according to claim 1, wherein The congestion attack signal sent in step S3 is set to a preset noise signal, and its power is more than 5 times that of the normal traffic signal.

4. A congestion detection method for cross - protocol communication according to claim 1, characterized in that, The interference metrics described in step S4 are derived from the amplitude and phase analysis of specific subcarriers; the congestion metrics include throughput and transmission success rate; the decision information of the cross-technology communication system includes the selected defense actions; the historical context information includes queue length and delay statistics.

5. The defense detection method for cross - protocol communication according to claim 4, wherein The method for amplitude and phase analysis of specific subcarriers in the interference metrics is as follows: Let CSI(k,a) denote the complex channel gain of subcarrier k under antenna a, which is specifically expressed as the following formula: CSI(k,a) = A(k,a)e jθ(k,a) where A(k,a) is the amplitude of subcarrier k under antenna a, and θ(k,a) is the phase of subcarrier k under antenna a; If the cross-technology communication system collects channel state data multiple times within a time slot or a time window, its average amplitude is as follows: Among them, AvgAmp(k,a) represents the average amplitude of subcarrier k under antenna a, and A τ (k,a) is the amplitude value of the τ-th acquisition of subcarrier k under antenna a, and T is the time slot; The phase difference between different antennas for the same subcarrier is as follows: PhaseDiff(k,a1,a2) = |θ(k,a1) - θ(k,a2)| where PhaseDiff(k,a1,a2) represents the phase difference of subcarrier k under antennas a1 and a2, and θ(k,a1) and θ(k,a2) respectively represent the phases of subcarrier k under antennas a1 and a2; After summarizing the amplitude and phase difference features of the subcarriers, a feature vector f(k) for a specific subcarrier k and antenna combination (a1, a2) is formed, and finally, the features of all subcarriers and antennas are concatenated or weighted and combined into an interference metric vector I at each time slot t. t (k), and finally, at each time slot t, the features of all subcarriers and antennas are concatenated or weighted and combined into an interference metric vector I. t .

6. The defense method for cross - protocol communication according to claim 4, wherein, In the congestion metrics, the throughput and transmission success rate within a time slot are detected, and the calculation of the transmission success rate is as follows: where SR t is the transmission success rate of time slot t, N tx represents the number of data frames attempted to be sent within time slot t, N succ represents the number of successfully transmitted data frames.

7. A defense method for cross - protocol communication according to claim 4, characterized in that, The form of the system state vector in step S4 is as follows: x t =(I t ,SR t ,u t-1 ,h t ) Among them, x t represents the system state at time slot t, u t-1 represents the defense action selected by the cross-technology communication system in the previous time slot, h t is the optional historical context information, I t represents the interference metric vector at time slot t, SR t is the transmission success rate at time slot t. The method for temporal modeling and congestion judgment based on the Transformer model in step S5 is as follows: Take the interference metric sequence {I t-M , …, I t-1 , I t} of the past M time slots as the input of the Transformer model. First, perform vectorization and position encoding, and then use the multi-head self-attention module to learn the global dependencies of different sub-carrier features over time. Let the output of the Transformer model be , which represents the predicted value of the interference condition in the next time slot. If the throughput decrease value exceeds the threshold during the observation time, or the transmission success rate SR t decreases by more than the threshold during the observation time, it is determined that the current congestion condition is severe, and a defense action needs to be selected in subsequent decisions. The method for constructing a congestion attack defense model by introducing a deep Q-network based on the MPC framework in step S5 is as follows: First, based on the MPC framework, according to the system state x at the current time slot t t and the state z of the interferer t construct a receding horizon optimization problem with a prediction horizon of H. Assuming that the interferer may adopt different attack strategies within this prediction window, different degrees of interference will be caused to the cross-technology communication system. Then, the cross-technology communication system selects the optimal defense action u for each time slot τ ∈ {t, …, t + H} within this window τ ; Record the benefit brought by the transmission success rate or throughput as S(x τ ,u τ ,z τ ), while the losses caused by communication failures, severe congestion or cross-technology interference are represented by F(x τ ,z τ ); within a prediction window of length H, construct the following objective function: where w1 and w2 represent weighting coefficients, and respectively represent the states of the cross - technology communication system and the interferer at time slot τ under scenario k, and p k is the probability of this scenario; Introduce the deep Q-network into the MPC framework, regarding the deep Q-network as a Q-value estimator: when the cross-technology communication system is in the system state x τ and faces the state z of the interferer τ at this time, the deep Q-network inputs the system state x τ and outputs the Q-value estimation for each defense action u τ ​

Images