Unmanned aerial vehicle control instruction trapping method and system based on pseudo base station technology

Abstract

The invention provides an unmanned aerial vehicle control instruction trapping method and system based on a pseudo base station technology. According to the method, firstly, signal parameters and environmental electromagnetic noise characteristics of a real base station are collected, and a dynamic base station analog signal is generated and transmitted, so that the unmanned aerial vehicle initiatively initiates a detection signal; analyzing instruction coding characteristics in the detection signal to reconstruct a trapping control signal with protocol deception, and finally enabling the unmanned aerial vehicle to keep communication connection with the pseudo base station device and continuously transmit control instruction data by adaptively adjusting a protocol field parameter and a transmitting power parameter of the trapping control signal; according to the technical scheme provided by the invention, unmanned aerial vehicle counter-reconnaissance alarm caused by abnormal signal characteristics is thoroughly eliminated, and the concealment and reliability of an instruction trapping process are improved.

Description

Technical Field

[0001] The present application relates to the field of wireless communication network security technology, and in particular to a method and system for trapping drone control instructions based on pseudo base station technology. Background Art

[0002] In civil scenarios such as logistics and warehousing no-fly zones, commercial activity airspace control, and data center perimeter protection, the illegal flight of small drones may lead to equipment collision accidents or data leakage risks. It is necessary to accurately distinguish between controlled delivery drones and illegal intrusion devices to avoid interfering with normal commercial operations.

[0003] The current mainstream solution uses spectrum feature comparison interference interception technology. It collects radio frequency signals from surrounding drones through a group of monitoring base stations deployed on the top floor of a building, extracts the signal's frequency hopping pattern and modulation characteristics to generate a temporary fingerprint library; when an unregistered aircraft signal is detected, a directional antenna is used to transmit a protocol reset instruction group to the target, forcibly triggering the drone's emergency hover response.

[0004] However, this solution still has three key flaws: first, the temporary fingerprint library needs to continuously update the matching rules, which has an identification blind spot for new logistics drones that use dynamic protocols; second, the explicit broadcast of forced hovering commands can be easily recognized by the pilot's control terminal, causing the target to immediately switch the communication frequency band to escape; finally, it is impossible to obtain complete control command data, making it difficult to distinguish between equipment operation errors and malicious intrusions. Summary of the Invention

[0005] The present application provides a method and system for capturing drone control instructions based on pseudo base station technology, which is used to solve the problems in the prior art such as missed detection of new drones due to fingerprint library matching lag, target escape triggered by explicit interference instructions, and inability to continuously capture the complete control instruction stream due to physical layer blocking.

[0006] In the first aspect, the present application provides a method for trapping drone control instructions based on fake base station technology, comprising: Using pseudo base station devices deployed in a predetermined geographical area to collect signal parameters and environmental electromagnetic noise characteristics of real base stations; Generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and transmit the dynamic base station simulation signal through a pseudo base station device, so that drones entering the communication coverage area respond to the dynamic base station simulation signal and actively initiate detection signals; When the pseudo base station device receives a detection signal sent by the drone, it analyzes the command coding features in the detection signal; Reconstructing a decoy control signal with protocol deception based on the instruction coding features obtained through analysis, wherein the decoy control signal is synchronously transmitted by integrating the electromagnetic noise features of the current environment; By adaptively adjusting the protocol field parameters and the transmission power parameters of the trapping control signal, the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

[0007] Optionally, using a pseudo base station device deployed in a predetermined geographical area to collect signal parameters and environmental electromagnetic noise characteristics of a real base station includes: Performing a full-band wireless signal scan of the predetermined geographical area through the signal acquisition device of the pseudo base station device, and locating the signal transmission source of the real base station based on the scanning result; For the located signal transmitter, the system continuously captures communication signal samples transmitted by the real base station within a set time window, identifies the base station identification features and spectrum features in the communication signal samples, and generates signal parameters; At the same time, based on the scanning results, the electromagnetic radiation of non-base station signal sources in the predetermined geographical area is monitored, and the intensity fluctuation characteristics and frequency band distribution characteristics of the electromagnetic radiation are extracted to generate environmental electromagnetic noise characteristics.

[0008] Optionally, a dynamic base station simulation signal is generated based on the collected signal parameters and environmental electromagnetic noise characteristics, and the dynamic base station simulation signal is transmitted through a pseudo base station device, so that a drone entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates a detection signal, including: Mapping the base station identification feature contained in the signal parameter into a base station identity identification field; Determining carrier parameters and modulation parameters of the dynamic base station analog signal according to the spectrum characteristics, and implanting a preset handshake protocol unit into the signal framework formed by the carrier parameters and modulation parameters; Convert the environmental electromagnetic noise characteristics into background noise waveform covering the target frequency band; Integrating the base station identification field and the handshake protocol unit into the signal framework, and synchronously superimposing the background noise waveform to generate a composite analog signal as the dynamic base station analog signal; Continuously transmitting the dynamic base station simulation signal within the communication coverage area of ​​the predetermined geographical area through the pseudo base station device; When the protocol field parameter of the dynamic base station simulation signal is within the authentication interval of the target drone control protocol, the target drone is triggered to send a detection signal to the pseudo base station device.

[0009] Optionally, when the pseudo base station device receives a detection signal sent by a drone, parsing the instruction coding features in the detection signal includes: Performing physical layer demodulation processing on the detection signal to separate a data signaling unit in a communication protocol format; identifying a protocol control field and a data payload field in the data signaling unit, and extracting a core data segment containing a control identifier from the data payload field; Locating a specific parameter storage location in the core data section according to a pre-established drone control protocol structure mapping table; Reading the bit sequence structure of the specific parameter storage location to confirm that it conforms to the bit distribution characteristics and verification characteristics of the instruction encoding; The data segment content that meets the bit distribution feature and the check feature is determined as the instruction encoding feature.

[0010] Optionally, reconstructing a decoy control signal with protocol deception based on the instruction encoding features obtained through analysis includes: Generate a corresponding protocol control header structure based on the control protocol type identifier in the instruction encoding feature; Copying the operation instruction bit sequence in the instruction encoding feature as a trapping instruction basic template and inserting pseudo response content at a preset parameter position of the trapping instruction basic template to form a pseudo instruction payload; Assembling the protocol control header structure and the pseudo instruction payload into a data unit in a target communication protocol format; Determine the coverage frequency band of the transmission carrier according to the frequency band distribution characteristics of the environmental electromagnetic noise characteristics; configure the power modulation mode of the synchronization carrier according to the intensity fluctuation characteristics; Loading the data unit within the determined coverage frequency band to form an initial trapping signal; The initial trapping signal is subjected to intensity mode adaptation processing through the power modulation mode to generate the trapping control signal.

[0011] Optionally, performing intensity mode adaptation processing on the initial trapping signal through the power modulation mode to generate the trapping control signal includes: Analyzing the intensity variation period and fluctuation amplitude range recorded in the power modulation mode; Dividing the intensity variation period into a plurality of continuous adjustment windows, each continuous adjustment window corresponding to a specific amplitude adjustment proportional coefficient; Determining a basic intensity adjustment threshold range according to the fluctuation amplitude range; Reading the instantaneous intensity waveform envelope structure of the initial trapping signal; Performing waveform compression processing on the instantaneous intensity waveform envelope structure according to the amplitude adjustment proportional coefficient to form envelope adjustment parameters, and limiting the envelope adjustment parameters to within the basic intensity adjustment threshold range to generate a standard envelope structure; The standard envelope structure is loaded onto the carrier frequency band of the initial trapping signal to form a time-varying trajectory. Based on the mapping relationship between the time-varying trajectory and the intensity variation period, the signal intensity sequence of the initial trapping signal is reconstructed to output a trapping control signal.

[0012] Optionally, adaptively adjusting the protocol field parameters and the transmission power parameters of the trapping control signal so that the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data includes: Monitoring the communication maintenance features in the response signal returned by the UAV, and identifying the response interval features and data integrity features contained in the communication maintenance features; When the response interval characteristic exceeds the preset maintenance interval, the frequency of transmission of the handshake instruction in the protocol field parameter is increased; when there is a continuous packet loss mark in the data integrity characteristic, the carrier strength value in the transmission power parameter is increased according to the gradient amplitude; Calculating the deviation between the current response interval characteristic and the preset maintenance interval, synchronously correcting the transmission frequency of the handshake instruction, and obtaining an adjusted transmission power parameter; According to the distribution position of the packet loss mark of the preset periodic detection data integrity feature, the increase amplitude of the carrier strength value is reversely updated; Cross-validating the adjusted protocol field parameters and the adjusted transmit power parameters, and outputting target adjustment parameters when a preset communication maintenance condition is met; The target adjustment parameter is used to control the continuous emission of the trapping control signal so that the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

[0013] In the second aspect, the present application provides a drone control command trapping system based on fake base station technology, including: A collection module, configured to collect signal parameters and environmental electromagnetic noise characteristics of real base stations using pseudo base station devices deployed in a predetermined geographical area; The transmitting module is used to generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and transmit the dynamic base station simulation signal through the pseudo base station device, so that the drone entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates a detection signal; a parsing module, configured to parse the command coding features in the detection signal when the pseudo base station device receives the detection signal sent by the drone; A reconstruction module is used to reconstruct a decoy control signal with protocol deception based on the instruction coding characteristics obtained by parsing, wherein the decoy control signal is integrated with the current environmental electromagnetic noise characteristics for synchronous transmission; The adjustment module is used to adaptively adjust the protocol field parameters and transmission power parameters of the trapping control signal so that the drone maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

[0014] In a third aspect, the present application provides a computing device comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a drone control instruction trapping method based on pseudo base station technology as described in the first aspect above.

[0015] In a fourth aspect, the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements a drone control instruction trapping method based on pseudo base station technology as described in the first aspect.

[0016] This application uses the active induction mechanism of dynamic base station simulation signals to enable the target UAV to autonomously initiate communication connections under non-coercive conditions, effectively avoiding the risk of equipment escape caused by traditional physical interference; at the same time, with the help of the dynamic fusion of protocol deceptive trapping control signals and environmental characteristics, the complete control instruction flow is continuously captured while maintaining the communication connection, which not only avoids the indiscriminate impact on legitimate communication equipment, but also realizes the ability to accurately trace illegal operations.

[0017] Furthermore, through the precise replication of the protocol control header structure and the covert implantation of pseudo-command payloads, a deceptive signal framework that is fully compatible with the real control protocol is constructed, fundamentally penetrating the technical barriers of the encrypted frequency hopping mechanism; further combined with the dynamic adaptation technology of the environmental noise waveform and the carrier coverage frequency band, the trapping control signal presents a fluctuation characteristic that is completely consistent with the real electromagnetic environment at the physical layer, completely eliminating the drone anti-reconnaissance alarm caused by abnormal signal characteristics, and significantly improving the stealth and reliability of the command trapping process.

[0018] These and other aspects of the present application will become more readily apparent from the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0020] Figure 1 A flowchart of a method for trapping drone control instructions based on fake base station technology provided by the present application is shown; Figure 2 The present invention provides a schematic diagram of a UAV control command trapping system based on pseudo base station technology; Figure 3 A schematic structural diagram of a computing device provided by the present application is shown. DETAILED DESCRIPTION

[0021] In order to enable people skilled in the art to better understand the solution of this application, the technical solution of this application will be clearly and completely described below in conjunction with the drawings in this application.

[0022] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this document or may be executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any order of execution. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0023] The following will be combined with the accompanying drawings to clearly and completely describe the technical solutions in this application. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of this application.

[0024] Figure 1 This application provides a flowchart of a method for trapping drone control instructions based on pseudo base station technology, such as Figure 1 As shown, the method includes: Step 101: Use a pseudo base station device deployed in a predetermined geographical area to collect signal parameters and environmental electromagnetic noise characteristics of a real base station.

[0025] In this step, the pseudo base station device refers to a device deployed at the boundary of the no-fly zone and equipped with signal receiving and processing capabilities; the real base station refers to a legitimate communication base station authorized by the operator; the signal parameters include base station identification characteristics (such as the cell global identification code) and spectrum characteristics (such as carrier frequency); the environmental electromagnetic noise characteristics refer to the electromagnetic radiation intensity fluctuation characteristics and frequency band distribution characteristics generated by non-base station signal sources (such as industrial equipment and WiFi routers).

[0026] In this embodiment, the pseudo base station device first initiates a full-band wireless signal scan, capturing all radio frequency signals within a predetermined geographic area through a broadband receiver. The device then locates the signal transmitter of the real base station based on the signal energy peak. After locking onto the target base station, it collects communication signal samples within a continuous time window and uses signal demodulation and protocol analysis techniques to separate base station identification features (such as parsing the PLMN identifier in the broadcast channel) and spectrum features (such as measuring the frequency deviation characteristics of the pilot signal). A spectrum analyzer is simultaneously activated to monitor ambient electromagnetic radiation, extracting intensity fluctuation features (such as periodic fluctuations in signal amplitude) and frequency band distribution features (such as noise density in the 2.4 GHz band) through time-frequency analysis. Finally, base station-related features are classified as signal parameters, and environmental interference features are integrated into ambient electromagnetic noise features.

[0027] For example, during deployment in a no-fly zone at a logistics hub, a pseudo-base station device scanned the entire frequency band surrounding the park, identifying a China Mobile base station with a PCI code of 42. It continuously collected the SIB1 broadcast signal from sector 1 of the base station, parsed the MCC / MNC identifiers as base station identification features, and measured the carrier frequency offset in the 1800MHz band as a spectral signature. It also simultaneously monitored the pulse noise generated by electric forklift motors within the park, recording its intensity fluctuation period of three times per second and its distribution in the 2.4-2.4835GHz frequency band to form a library of environmental electromagnetic noise signatures. These signatures were subsequently used to generate dynamic base station simulation signals that matched the real environment.

[0028] Step 102: Generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and transmit the dynamic base station simulation signal through a pseudo base station device, so that the drone entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates a detection signal.

[0029] In this step, the dynamic base station simulation signal refers to a composite radio frequency signal that imitates the characteristics of a real base station signal and integrates environmental noise; the communication coverage range refers to the three-dimensional airspace range that the signal transmission of the pseudo base station device can effectively reach; the detection signal refers to the initialization request message containing identity identification and control protocol characteristics sent by the drone to the base station to establish a communication link.

[0030] In this embodiment, the pseudo base station device first maps the base station identification characteristics (such as PLMN code) in the signal parameters into the identity recognition field of the protocol specification, and simultaneously determines the carrier center frequency and QPSK modulation mode based on the spectrum characteristics; reconstructs the environmental electromagnetic noise characteristics into a time domain background noise waveform through inverse Fourier transform; then implants a handshake protocol unit (such as an RRC connection request response template) into the generated protocol framework, integrates the identity recognition field and the handshake unit into the physical layer signal structure, and superimposes the background noise waveform to form a composite signal; the signal is continuously broadcast within a preset airspace radius through a power amplifier; when the drone receiver detects a protocol field that meets its control protocol authentication interval (such as the LTE random access preamble code threshold), it actively initiates a detection signal containing the IMSI code and flight status data.

[0031] In the logistics hub case, the fake base station converted the collected China Mobile MCC / MNC identifiers into a 46000 protocol field, and used an 1800MHz carrier and π / 4-DQPSK modulation to construct a signal framework; the noise characteristics of the electric forklift in the 2.4GHz frequency band were converted into a pulse noise waveform through IFFT; the RC handshake response unit of the DJI drone was implanted in the protocol framework, and a dynamic base station simulation signal was generated after superimposing noise; the device continuously transmitted at 3dBm power covering the airspace of the park loading and unloading area; when the JD Logistics drone entered the airspace, its onboard communication module recognized that the protocol field fell into the DJI OcuSync authentication range, and actively sent a detection signal containing the fuselage serial number and GPS coordinates to the fake base station, triggering the subsequent command trapping process.

[0032] Step 103: When the pseudo base station device receives the detection signal sent by the drone, it analyzes the instruction coding features in the detection signal.

[0033] In this step, the instruction encoding feature refers to the specific bit distribution form of the UAV flight control instruction in the communication protocol, including the operation type identifier (such as the direction control bit), parameter storage location (such as the altitude value offset address) and verification rules (such as the parity bit distribution), which is used to restore the protocol layer key feature set of the original control intent.

[0034] In this embodiment, the pseudo base station device first performs physical layer demodulation on the detection signal and uses orthogonal frequency division multiplexing technology to separate the protocol data unit; identifies the control field (such as the PDCP packet header) and the data payload field through the protocol parsing engine, and locates the core data segment containing the flight instruction; determines the storage offset and length of the instruction parameters based on the preset drone protocol structure mapping table (such as the DJI OcuSync frame format table); reads the bit sequence in the area and verifies its structural integrity (such as the position matching of the checksum bit) in combination with the check bit distribution, and finally extracts the bit distribution characteristics that meet the target drone control specifications as valid instruction encoding characteristics, providing a data basis for subsequent protocol deception.

[0035] In a logistics case, after receiving a probe signal containing the aircraft's serial number, the rogue base station separated the protocol data unit (PDU) through OFDM demodulation. It identified the core segment labeled "flight control commands" in the payload field and, based on the DJI drone's protocol mapping table, located bits 24-32 as the heading angle parameter storage area. It read the bit sequence "10011010" and verified that its parity bit (bit 33 was "1") met specifications, confirming that the sequence contained the encoding signature for a 15° left turn. This signature was used to reconstruct the spoofing signal to induce a continuous right turn.

[0036] Step 104 : reconstructing a decoy control signal with protocol deception based on the instruction coding features obtained through analysis, wherein the decoy control signal is integrated with the electromagnetic noise features of the current environment and transmitted synchronously.

[0037] In this step, reconstruction refers to the reverse construction of a communication signal with a compatible logical structure but tampered content based on the instruction encoding characteristics; protocol deception refers to the trapping of control signals to maintain representational properties consistent with legitimate instructions in the protocol control header and data payload layers; the trapping control signal refers to a composite radio frequency signal that carries both forged control instructions and environmental noise characteristics, inducing the drone to respond continuously through double camouflage at the physical layer and protocol layer.

[0038] In this embodiment, the pseudo base station device first generates a corresponding protocol control header structure based on the protocol type identifier (such as the DJIOcuSync 2.0 identification code) in the instruction encoding characteristics, and uses a protocol reverse engine to copy the original operation instruction bit sequence as a basic template; implants pseudo response content (such as the reverse deflection direction instruction value) in the preset tampering bit of this template (such as the heading angle parameter area) to form a pseudo instruction payload with logical integrity; assembles the protocol control header and the pseudo instruction payload into a data unit that conforms to the target protocol format; synchronously configures the carrier frequency based on the frequency band distribution characteristics of the environmental electromagnetic noise characteristics (such as the proportion of the 2.4GHz frequency band), and generates dynamic power modulation parameters based on the intensity fluctuation characteristics (such as the periodic pulse pattern); finally, loads the data unit into the target frequency band to form a baseband signal, integrates the electromagnetic environment characteristics through the noise waveform time domain superposition technology, and outputs a trapping control signal whose physical characteristics are indistinguishable from the real environment.

[0039] Continuing with the aforementioned logistics case, the rogue base station, based on the encoding characteristics of the "deflection command," first generated a DJI OcuSync protocol control header (including the same frame sequence number and check bit). It then copied the base bit sequence "10011010" and flipped bits 25-27 to "001," generating a pseudo-command payload for "deflect left." After assembling the complete protocol unit, it set the carrier center frequency to 2412 MHz based on the noise characteristics of electric forklifts collected at the SF Express logistics hub (70% of which is in the 2.4 GHz band). Based on the noise's three-pulse-per-second intensity fluctuations, the power modulator was configured to operate in synchronous undulation mode. Finally, the forged protocol data was loaded onto the carrier, superimposed with the forklift noise waveform, and transmitted toward the target drone. The drone mistakenly recognized the signal as a legitimate "deflect 15° left" command. Furthermore, the physical layer noise perfectly matched the campus environment, triggering no anti-reconnaissance alert.

[0040] Step 105 , adaptively adjusting the protocol field parameters and the transmission power parameters of the trapping control signal so that the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

[0041] In this step, the protocol field parameters refer to a set of protocol layer variables that control the state of the communication connection, including the handshake instruction transmission frequency (such as the ACK confirmation packet sending interval) and the instruction sequence numbering characteristics (such as the incrementing sequence number of the data packet); the transmission power parameters refer to a set of physical layer signal strength dynamic adjustment rules, covering the carrier strength variation range (such as the power fluctuation range threshold) and modulation mode parameters (such as the pulse width modulation duty cycle). The two work together to ensure that the decoy signal can be continuously parsed by the target drone.

[0042] In this embodiment, the pseudo base station device first monitors the response signals returned by the drone in real time and uses a protocol analyzer to identify its response interval characteristics (such as the arrival delay of uplink ACK packets) and data integrity characteristics (such as the distribution of CRC check failure marks). When it is detected that the response interval exceeds a preset maintenance interval (such as a 150ms threshold), it increases the handshake command transmission frequency (such as shortening the RRC retransmission interval) through a dynamic protocol scheduling algorithm. When continuous packet loss marks are detected, the carrier strength value is gradually increased according to the gradient amplitude calculation model (such as increasing it by 0.5dB each time). The deviation between the current response interval and the preset value is then calculated, and the handshake command frequency is fine-tuned using a closed-loop feedback mechanism. At the same time, the distribution position of the packet loss mark is periodically scanned (such as the occurrence of consecutive odd-numbered packets) and the carrier strength increase gradient is reversed (such as from 0.5dB to 0.3dB). Finally, the adjusted protocol field parameters and transmit power parameters are cross-consistency verified (such as checking whether the carrier enhancement affects the protocol timing). When the communication continuity condition is met, the target parameters are output, and the signal transmitter is controlled to stably output the trapping signal.

[0043] Following the aforementioned logistics case, the pseudo base station detected that its response interval had expanded from 120ms to 210ms (exceeding the 180ms maintenance interval), and immediately shortened the RRC handshake command sending interval from 20ms to 10ms; it simultaneously discovered that the 7th and 9th sequence data packets were lost continuously, and activated the gradient carrier enhancement mechanism to gradually increase the transmission power from 20dBm to 23dBm; after calculating the 30ms deviation between the current 210ms delay and 180ms, it added handshake commands to 12 times per second; subsequently, it was detected that packet loss was concentrated in odd-numbered packet sequences, and the power boost gradient was reversed to 0.3dB steps; cross-validation confirmed that the communication met the requirements after adjustment (the delay was reduced to 170ms and the packet loss disappeared), and finally maintained the optimized parameters so that the drone continued to send back control command streams containing battery status and cargo weight to the pseudo base station, completing the collection of sensitive data.

[0044] In summary, this application generates a dynamic simulation signal by real-time acquisition and fusion of base station signals and environmental noise characteristics, accurately inducing the target UAV to actively initiate a communication connection; extracts key instruction coding features based on deep analysis of the protocol layer of the detection signal, and reconstructs a trapping control signal with dual deception at the physical layer and protocol layer; finally, maintains a stable communication connection through a parameter adaptive adjustment mechanism, and continuously captures the complete control instruction stream without the UAV's perception throughout the process, completely solving the four major technical defects of traditional solutions: signal feature recognition lag, physical interference triggering target escape, encryption protocol blocking failure, and fragmented control instruction capture.

[0045] As an practicable embodiment, according to step 101, using a pseudo base station device deployed in a predetermined geographical area to collect signal parameters and environmental electromagnetic noise characteristics of a real base station includes: Step 201: Scan the predetermined geographical area for full-band wireless signals through the signal acquisition device of the pseudo base station device, and locate the signal transmission source of the real base station based on the scanning result.

[0046] In this step, full-band wireless signal scanning refers to the indiscriminate signal energy detection of all available frequency bands in the target airspace; the signal transmission source refers to the physical location point of the radio frequency transmitting device whose radiation energy exceeds the preset threshold, which is achieved through the cross-positioning of the signal arrival angle and energy peak.

[0047] In this embodiment, the pseudo base station device activates a broadband RF receiver to scan the 400MHz-6GHz frequency band in a stepped frequency manner, and records the signal energy intensity at each frequency point in real time. It uses multi-channel beamforming technology to analyze the signal phase difference and calculate the arrival angle of the target signal. It combines the energy peak distribution diagram with the arrival angle data and uses a triangulation positioning algorithm to determine the three-dimensional coordinates of the signal source. When a continuous energy distribution that meets the characteristics of a base station is detected (such as periodic broadcasting at a fixed frequency point), it is marked as a real base station signal transmission source and a set of location coordinates is output.

[0048] Step 202: for the located signal transmitting source, continuously capture communication signal samples transmitted by a real base station within a set time window, identify base station identification features and spectrum features in the communication signal samples, and generate signal parameters.

[0049] In this step, the communication signal sample refers to the original signal data stream continuously sampled from the target transmitting source; the base station identification feature refers to the unique identification parameter of the operator network (such as the PLMN code); and the spectrum feature refers to the modulation method and frequency stability parameters of the carrier signal.

[0050] In this embodiment, the pseudo base station's directional receiving antenna aims at the coordinates of the located base station and collects broadcast channel signals within a continuous time window. The baseband signal is separated using an IQ demodulator, and the network identifier (e.g., MCC 460 / MNC 01) in the system information block (SIB) is parsed using a protocol analysis engine. A spectrum analyzer is used to measure the carrier center frequency offset and modulation error rate, and the modulation type (e.g., 64QAM) is recorded. The identification features and spectrum features are then encapsulated as signal parameters.

[0051] Step 203 : Based on the scanning results, the electromagnetic radiation of non-base station signal sources in the predetermined geographical area is monitored, and the intensity fluctuation characteristics and frequency band distribution characteristics of the electromagnetic radiation are extracted to generate environmental electromagnetic noise characteristics.

[0052] In this step, non-base station signal sources refer to electromagnetic radiation sources generated by non-operator authorized devices (such as WiFi routers); intensity fluctuation characteristics refer to the regular pattern of signal amplitude changes over time; frequency band distribution characteristics refer to the regularity of the proportion of noise energy in different frequency bands.

[0053] In this embodiment, the device calls full-band scanning data, filters the base station signal, and separates the environmental noise; extracts the amplitude envelope change pattern (such as periodic pulse interval) through time domain analysis; performs fast Fourier transform to calculate the energy integral value of each frequency band, and determines the main interference frequency band (such as the proportion of the 2.4GHz band); and encodes the intensity fluctuation pattern and frequency band energy distribution into an environmental noise feature vector.

[0054] As another embodiment, according to step 102, a dynamic base station simulation signal is generated based on the collected signal parameters and environmental electromagnetic noise characteristics, and the dynamic base station simulation signal is transmitted through a pseudo base station device, so that a drone entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates a detection signal, including: Step 301: Map the base station identification feature contained in the signal parameter to a base station identity identification field.

[0055] In this step, the base station identity field refers to a network identity data unit encoded according to the mobile communication protocol specification, which includes a bit sequence combination of the public land mobile network code (PLMN) and the cell global identity code (CGI), and is used to simulate the legal base station identity at the protocol layer.

[0056] In this embodiment, the pseudo base station device calls the base station identification feature in the signal parameter and splits it into country code (MCC) and network code (MNC) bit segments through the protocol conversion engine; according to the 3GPP protocol specification, the MCC / MNC field and the cell ID (CI) obtained by positioning are binary recombined, and after adding the CRC check bit, it is encapsulated into a complete identity identification field that complies with the air interface transmission specification, generating an identity authentication unit that can be directly embedded in the communication protocol.

[0057] Step 302: determining the carrier parameters and modulation parameters of the dynamic base station analog signal according to the spectrum characteristics, and embedding a preset handshake protocol unit into the signal framework formed by the carrier parameters and modulation parameters.

[0058] In this step, carrier parameters refer to the set of physical transmission characteristics of the RF signal (center frequency / bandwidth); modulation parameters refer to the baseband signal encoding rules (such as QAM order); and the signal framework refers to the physical layer transmission template that includes the carrier frequency, modulation method, and time slot structure.

[0059] In this embodiment, the pseudo base station selects the center frequency and signal bandwidth based on the carrier frequency offset and modulation error data in the spectrum characteristics; matches the corresponding modulator parameters according to the modulation type; and after constructing a signal framework containing physical resource block allocation and time slot format, extracts the target drone manufacturer's specific handshake unit (such as the DJI OcuSync connection response template) from the protocol library and writes its binary stream into the preset data area of ​​the signal framework according to the control channel mapping rules.

[0060] Step 303: Convert the environmental electromagnetic noise characteristics into a background noise waveform covering the target frequency band.

[0061] In this step, the background noise waveform refers to an electrical signal function curve that presents continuous fluctuation characteristics in the time domain, and its spectrum characteristics are consistent with the real environmental noise.

[0062] In this embodiment, the device extracts frequency band distribution data from the environmental electromagnetic noise characteristics and generates a baseband noise spectrum through inverse discrete Fourier transform. Combined with intensity fluctuation characteristics (such as periodic pulse parameters), a signal generator is used to reconstruct an analog waveform with the same amplitude fluctuation pattern in the time domain. Finally, the baseband noise is up-converted to the target frequency band through radio frequency modulation, and the output noise waveform has three-dimensional time-frequency characteristics that match the real environment.

[0063] Step 304 : Integrate the base station identification field and the handshake protocol unit into the signal framework, and synchronously superimpose the background noise waveform to generate a composite analog signal as the dynamic base station analog signal.

[0064] In this embodiment, the base station identity identification field generated in step 301 is written into the synchronization channel (PSS / SSS resource block) of the signal frame; the handshake protocol unit implanted in step 302 is stored in the data channel; a time-domain addition operation is performed on the IQ data stream of the signal frame and the background noise waveform through a composite signal generator; the amplitude of the noise signal is adjusted so that it does not exceed 30% of the protocol data power, and a composite baseband signal is output that retains the complete protocol structure and contains the actual noise characteristics.

[0065] Step 305: Continuously transmit the dynamic base station simulation signal within the communication coverage of the predetermined geographical area through the pseudo base station device.

[0066] In this embodiment, the composite baseband signal is converted into an analog signal by a DAC and amplified to a set power through an RF power amplifier link. The coverage radius of a predetermined geographical area (such as a 500-meter airspace around a venue) is calculated in conjunction with a three-dimensional propagation model. An omnidirectional antenna is used to continuously broadcast in the target airspace, and the transmission power is dynamically adjusted according to environmental characteristics (such as a 5% increase during the day to compensate for equipment interference), ensuring that the drone can receive the induction signal that meets certification requirements at any location in the no-fly zone.

[0067] Step 306: When the protocol field parameter of the dynamic base station simulation signal is within the authentication interval of the target drone control protocol, the target drone is triggered to send a detection signal to the pseudo base station device.

[0068] In this step, the authentication interval refers to the communication connection legitimacy verification range set by the target drone manufacturer (such as the valid value range of RC command codes required by DJI drones); the trigger mechanism refers to activating the drone's preset response program when the signal parameters meet the authentication interval.

[0069] In this embodiment, after receiving the dynamic base station simulation signal, the communication module of the target drone first extracts its protocol control field (such as the RRC connection request code) and reverse maps the field value through the internal pre-stored protocol database; if the value is within the manufacturer's pre-defined authentication threshold, it is judged to be a legitimate base station connection request; then the detection signal sending process is activated, and the device physical identification (such as the fuselage serial number), real-time status data (GPS coordinates and flight mode) and control protocol version number are packaged, and a wireless detection data packet is sent in the direction of the signal source at a preset response power to complete the active connection request to the pseudo base station.

[0070] As another embodiment, according to step 103, when the pseudo base station device receives a detection signal sent by a drone, parsing the instruction coding features in the detection signal includes: Step 401 , performing physical layer demodulation processing on the detection signal to separate the data signaling unit in the communication protocol format; identifying the protocol control field and the data payload field in the data signaling unit, and extracting the core data segment containing the control identifier from the data payload field.

[0071] In this step, the data signaling unit refers to a standardized data transmission block that conforms to the mobile communication protocol stack structure; the protocol control field refers to the packet header data area that carries the communication connection status identifier (such as the frame type code and sequence number); the data payload field refers to the valid data area containing the actual application layer information; the control identifier refers to the key positioning tag in the payload that marks the instruction type.

[0072] In this embodiment, the pseudo base station device first uses orthogonal frequency division multiplexing demodulation technology to process the radio frequency carrier of the detection signal, filters out the environmental noise component and separates the baseband protocol data stream; identifies the transmission block structure through the protocol parsing engine, matches the control field according to the pre-stored protocol template and strips the control information; then scans the binary sequence of the payload field, locates the control identifier preset by the manufacturer, and determines the offset and length of the core data segment according to the protocol mapping table; finally, extracts the continuous bit segment starting from the identifier as the core data area containing the flight instruction parameters.

[0073] Step 402: Locate the specific parameter storage location in the core data segment according to a pre-established drone control protocol structure mapping table.

[0074] In this step, the drone control protocol structure mapping table refers to a relational database that records the command data structures of drones from different manufacturers, including mapping rules between command type identifiers and parameter storage offsets; the specific parameter storage location refers to the precise bit range of the key operation values ​​(such as pitch angle and flight speed) in the control command within the data segment.

[0075] In this embodiment, the pseudo base station device calls a preset protocol structure database, matches the corresponding protocol template according to the control identifier extracted in step 401; based on the instruction type index recorded in the template, the parameter offset rule of the instruction is obtained by looking up the table; the parameter storage boundary is dynamically calibrated in combination with the core data segment length; and finally, based on the parity check characteristics of the timestamp field in the instruction sequence, the precise storage interval of the target parameter in the bit stream is locked.

[0076] Step 403: Read the bit sequence structure of the specific parameter storage location to confirm whether it complies with the bit distribution characteristics and verification characteristics of the instruction encoding.

[0077] In this step, the bit distribution feature refers to the standardized bit allocation rules of the parameter values ​​in the target UAV control instructions; the check feature refers to the data integrity verification mechanism preset by the manufacturer, which is used to ensure that no bit errors occur during the transmission process.

[0078] In this embodiment, the pseudo base station device first reads the specific parameter storage location located in step 402, and extracts the complete bit sequence of the segment through the binary stream parser; compares the sequence with the standardized bit distribution pattern stored in the protocol mapping library; synchronously scans the adjacent check areas to verify whether their values ​​meet the preset check algorithm; if the bit distribution conforms to the manufacturer template rule and the check bit verification passes, the instruction encoding feature is determined to be valid; if the verification fails, the drone is requested to retransmit the detection signal until legal instruction data that meets the dual feature constraints is obtained.

[0079] Step 404: Determine the data segment content that meets the bit distribution feature and the check feature as the instruction encoding feature.

[0080] In this step, the instruction encoding feature refers to the structured expression of effective control instruction data through double verification (bit distribution + verification), which includes the original parameter bit sequence, storage location metadata (such as the start bit) and associated verification rules (such as the parity bit index), providing a tamperable instruction unit carrier for protocol deception.

[0081] In this embodiment, the pseudo base station device adds a position tag and a check bit index to the bit sequence that has passed the verification in step 403; simultaneously extracts the verification rule of the check bit (such as the even parity requirement); encapsulates the bit sequence, position metadata, and check rule into a structured data object; writes it into the instruction feature database through a memory registration operation, tags it with a "verified tamper-proof" label, and associates it with the target drone model, thereby generating a complete instruction coding feature that can be directly used to reconstruct the decoy signal.

[0082] As another embodiment, according to step 104, reconstructing a decoy control signal with protocol deception based on the instruction encoding features obtained by parsing includes: Step 501: Generate a corresponding protocol control header structure based on the control protocol type identifier in the instruction encoding feature.

[0083] Step 501: Based on the control protocol type identifier in the instruction encoding feature, generate a corresponding protocol control header structure.

[0084] In this step, the protocol control header structure refers to the data packet header template used to establish a connection in the drone communication protocol. It contains a logical combination of control fields such as frame synchronization code, source device address, serial number, protocol version number, etc. Its format is defined by the communication standard of the target device manufacturer and is used to forge the identity of a legitimate instruction source at the protocol layer.

[0085] In this embodiment, the pseudo base station device extracts the protocol type identifier from the instruction encoding feature registered in step 404, queries the preset protocol template library to match the header structure specification of the corresponding manufacturer; calls the protocol generation engine to build a standard header template, and fills in the key fields according to the specification: inserts the virtual device address of the current session, increments the serial number (to prevent replay attack detection), and copies the frame synchronization code of the target drone; finally, adds the protocol feature identification field to generate a protocol control header structure that is fully compatible with the original control instruction.

[0086] Step 502: copy the operation instruction bit sequence in the instruction encoding feature as a trapping instruction basic template and insert pseudo response content at a preset parameter position of the trapping instruction basic template to form a pseudo instruction payload.

[0087] In this step, the basic template of the decoy instruction refers to a binary sequence framework (including instruction type identification and parameter placeholders) that completely replicates the original instruction structure of the target drone, which is used to maintain the integrity of the protocol; the preset parameter position refers to the bit address of the changeable numerical storage area specified in the manufacturer's agreement; the pseudo-response content refers to the operation parameter value tampered with while maintaining the logical compliance of the protocol.

[0088] In this embodiment, the pseudo base station device first completely copies the original bit sequence in the instruction encoding feature determined in step 404 to generate a baseband template with a consistent protocol data structure; locates the preset tampering bit of the instruction type according to the protocol mapping table; writes the pseudo response content into the target location according to the bit length adaptation rule; and finally performs checksum recalculation on the modified bit sequence (such as regenerating the parity check bit) to ensure that the payload passes the protocol layer verification rules, thereby forming a complete instruction payload unit with a legal structure but deceptive content.

[0089] Step 503: Assemble the protocol control header structure and the pseudo instruction payload into a data unit in the target communication protocol format.

[0090] In this step, the data unit in the target communication protocol format refers to a complete frame structure entity that complies with the target drone communication specification, including a three-segment binary combination of the protocol control header (source address / serial number), payload data (flight instructions), and a tail checksum field. Its encapsulation rules strictly follow the layered standards of the manufacturer's protocol stack.

[0091] In this embodiment, the pseudo base station device first calls the protocol control header structure (such as a 20-byte packet header) generated in step 501, and copies its fixed field area (synchronization code + address) to the start position of the data unit; splices the pseudo instruction payload (such as the tampered heading angle instruction body) output in step 502 to the end of the packet header according to the offset specified by the protocol; calculates the cyclic redundancy check value (CRC) of the combined data and writes it into the tail check field; fills the data unit according to the length rule of the target protocol (adds null bytes when it is less than the minimum length), and finally generates a three-segment complete protocol data unit that complies with the specification, ensuring that the target drone communication module can seamlessly parse the forged instruction.

[0092] Step 504: determining the coverage frequency band of the transmission carrier according to the frequency band distribution characteristics of the environmental electromagnetic noise characteristics; and configuring the power modulation mode of the synchronization carrier according to the intensity fluctuation characteristics.

[0093] In this step, the coverage frequency band refers to the main carrier frequency range selected by the pseudo base station, which needs to overlap with the dominant frequency band of environmental noise to avoid interference; the power modulation mode refers to the set of rules for dynamically adjusting the carrier intensity over time, and its fluctuation pattern needs to be synchronized with the intensity fluctuation characteristics of the environmental noise.

[0094] In this embodiment, the pseudo base station device first analyzes the frequency band distribution data of the environmental electromagnetic noise characteristics, and selects the continuous frequency band with the largest energy share as the main carrier coverage frequency band; calculates the optimal center frequency based on the frequency band width (avoiding other system protection bands); synchronously analyzes the periodic law in the intensity fluctuation characteristics (such as two intensity pulses per second), configures the power modulator to increase the carrier intensity by a preset ratio within the adjacent pulse interval, and attenuates it to the basic power during the pulse peak period (such as maintaining the noise masking effect); finally, establishes a mapping rule between the coverage frequency band and the power fluctuation, and forms a carrier parameter configuration that matches both the time-varying spectrum and the intensity.

[0095] Step 505: Load the data unit into the determined coverage frequency band to form an initial trapping signal.

[0096] In this step, the initial trapping signal refers to a baseband protocol data radio frequency carrier entity without superimposed power modulation, and its physical layer structure already includes a protocol data unit and fixed carrier parameters.

[0097] In this embodiment, the pseudo base station sends the protocol data unit generated in step 503 to the digital up-converter, configures the local oscillator parameters according to the center frequency of the coverage frequency band determined in step 504, uses orthogonal modulation technology to move the baseband IQ signal to the target RF frequency band, sets the passband range of the filter according to the signal bandwidth requirement, and finally outputs the original carrier signal without dynamic power modulation through the RF front end, forming an initial physical layer trapping signal that contains the complete deception protocol but has constant intensity.

[0098] Step 506: Perform intensity mode adaptation processing on the initial trapping signal using the power modulation mode to generate the trapping control signal.

[0099] In this step, the intensity pattern adaptation process refers to dynamically adjusting the power of the initial signal of fixed intensity according to a preset fluctuation rule so that the final signal presents intensity fluctuation characteristics consistent with the ambient noise.

[0100] In this embodiment, the power modulation rule established in step 504 is called; the initial trapping signal in step 505 is input into the digitally controlled attenuator; the attenuation ratio is adjusted in real time according to the modulation rule; the output signal envelope is synchronously monitored to ensure that it fluctuates synchronously with the noise intensity waveform; and finally, a trapping control signal is generated whose physical layer time domain characteristics are completely disguised as ambient noise.

[0101] As yet another embodiment, according to step 506, performing intensity mode adaptation processing on the initial trapping signal using the power modulation mode to generate the trapping control signal includes: Step 601: parse the intensity variation period and fluctuation amplitude interval recorded in the power modulation mode.

[0102] In this step, the intensity variation cycle refers to the complete time length of the ambient noise intensity from the starting value to the peak value and then falling back; the fluctuation amplitude range refers to the effective range between the minimum baseline value and the maximum peak value of the noise intensity within the cycle.

[0103] In this embodiment, the power modulation mode data stream configured in step 504 is called, and a time domain feature extraction engine is used to separate periodic parameters: continuous peak / trough positions are locked through peak detection, and the intervals between adjacent peaks are calculated to determine the variation period; the peak intensity sequence is synchronously extracted to calculate the average value as the reference peak, and the upper and lower bounds of the fluctuation range are determined in combination with the trough intensity; finally, the discretized period value and amplitude interval value are output as the benchmark parameters for dynamic power adjustment.

[0104] Step 602: Divide the intensity variation period into a plurality of continuous adjustment windows, each continuous adjustment window corresponding to a specific amplitude adjustment proportional coefficient.

[0105] In this step, the continuous adjustment window refers to the timing operation interval (such as the rising period / peak maintenance period / decay period) that divides a single noise fluctuation cycle according to the signal strength change law, and its duration is determined by the characteristics of the ambient noise waveform; the amplitude adjustment proportional coefficient refers to the dynamic scaling factor of the carrier power in each window relative to the basic value (such as the rising window coefficient > 1 indicates power enhancement), which is used to accurately fit the noise envelope shape.

[0106] In this embodiment, the noise intensity periodic characteristics analyzed in step 601 are first extracted, and the waveform inflection point positions are locked through envelope analysis: four key positions are identified: the starting point, the rising inflection point (slope mutation), the peak inflection point (maximum value), and the attenuation inflection point (decline start); three continuous windows (rising window / maintaining window / attenuation window) are divided based on the inflection points, and the proportional coefficient change rule is configured according to the waveform slope of each time period. The rising window adopts a linearly increasing coefficient, the maintaining window has a fixed coefficient, and the attenuation window adopts a linearly decreasing coefficient; finally, a coefficient mapping table with a timestamp is output for real-time call by the CNC power amplifier.

[0107] Step 603: Determine a basic intensity adjustment threshold range according to the fluctuation amplitude range.

[0108] In this step, the basic intensity adjustment threshold range refers to the physical boundary constraint of the dynamic change of carrier power. Its lower limit is the minimum intensity reference value of the environmental noise, and the upper limit is the peak intensity of the environmental noise. This range is generated by calculating the mapping relationship between the basic reference power and the proportional coefficient, and is used to prevent signal characteristic abnormalities caused by amplitude exceeding the limit during signal modulation.

[0109] In this embodiment, the fluctuation amplitude interval parameter (lower limit L / upper limit H) analyzed in step 601 is called to calculate the basic reference power P = (L + H) / 2 as the modulation reference point. A mapping function between the proportional coefficient K and the physical power is established: when K = 1, it corresponds to power P, and the K value range is determined by formula conversion to [L / P, H / P]. This mathematical constraint is converted into a dynamic limiting rule for the power controller: the power value K·P is calculated in real time. When the result is less than L, the output is forced to be L, and when it is greater than H, the output is forced to be H. Finally, a threshold range object is generated, which contains the basic power value, the proportional coefficient boundary, and the forced truncation rule, and is written to the signal generator configuration register.

[0110] Step 604: Read the instantaneous intensity waveform envelope structure of the initial trapping signal.

[0111] In this step, the instantaneous intensity waveform envelope structure refers to the amplitude change contour curve formed in the time domain after the initial trapping signal is output through the RF link. This curve is shaped by the inherent characteristics of the signal transmission system and the environmental coupling effect. Its morphological characteristics reflect the intensity fluctuation law of the signal during the actual physical transmission process.

[0112] In this embodiment, a small portion of the initial trapping signal is diverted from the RF output link via a directional coupler and fed into a high-speed analog-to-digital converter for time-domain sampling. An envelope detection circuit is used to extract the amplitude component of the sampled signal to generate an original voltage-time series. A digital filter bank is invoked to filter out the high-frequency component of the carrier, retaining a low-frequency envelope waveform that matches the power modulation period. Finally, a sequence of discrete envelope points in the time domain is output, where each sampling point corresponds to the normalized intensity value of the signal at a specific moment, forming a reference waveform structure for subsequent adjustment processing.

[0113] Step 605: Perform waveform compression processing on the instantaneous intensity waveform envelope structure according to the amplitude adjustment proportional coefficient to form envelope adjustment parameters, and limit the envelope adjustment parameters to within the basic intensity adjustment threshold range to generate a standard envelope structure.

[0114] In this step, the envelope adjustment parameters refer to the set of signal strength scaling factors required for each time node; the standard envelope structure refers to the time domain amplitude sequence generated after dynamic adjustment and threshold constraint, which accurately fits the target waveform within the physical intensity boundary.

[0115] In this embodiment, the original envelope discrete sequence is first imported into the processing engine; then the amplitude adjustment proportional coefficient mapping table is called to perform time-domain synchronous scaling on each sampling point of the original envelope, linearly amplifying the amplitude value by an increasing coefficient in the rising window interval, scaling the maintenance window proportionally by a fixed coefficient, and reducing the amplitude by a decreasing coefficient in the attenuation window; after generating the initial adjustment parameter sequence, an intensity boundary check is performed according to the threshold range rule: when the scaled amplitude value is lower than the lower limit, it is forced to be increased to the lower limit value; when it is higher than the upper limit, it is suppressed to the upper limit value; finally, the output discrete point intensity values ​​are all within the valid physical boundaries and the morphology matches the standard envelope structure of the ambient noise.

[0116] Step 606: Load the standard envelope structure onto the carrier frequency band of the initial trapping signal to form a time-varying trajectory. Based on the mapping relationship between the time-varying trajectory and the intensity variation period, reconstruct the signal strength sequence of the initial trapping signal to output a trapping control signal.

[0117] In this embodiment, the standard envelope structure generated in step 605 is first input into the radio frequency control unit; the carrier frequency band of the initial trapping signal is locked using a digital frequency synthesizer; a time-varying trajectory mapping mechanism is established: the timestamp and intensity value of each standard envelope point are bound to the radio frequency carrier; a clock synchronization signal is generated based on the intensity variation period, triggering the signal generator to reset the output power value at each time point in a cyclical manner; the output signal strength is monitored in real time through a power amplifier closed-loop control circuit to ensure that it strictly follows the fluctuations of the standard envelope point sequence; and finally, a trapping control signal is generated whose power value continuously varies and fully fits the characteristics of the ambient noise.

[0118] As another embodiment, according to step 105, adaptively adjusting the protocol field parameters and the transmission power parameters of the trapping control signal so that the drone maintains a communication connection with the pseudo base station device and continuously transmits control instruction data includes: Step 701: monitor the communication maintenance features in the response signal returned by the UAV, and identify the response interval feature and the data integrity feature included in the communication maintenance feature.

[0119] In this step, the communication maintenance feature refers to the status feedback signal actively sent by the UAV to maintain the communication connection; the response interval feature refers to the time difference between two consecutive status feedback signals; and the data integrity feature refers to the set of verification identifiers in the response signal that mark the integrity of data transmission.

[0120] In this embodiment, the drone response signal is first captured, and the timestamp field is extracted through the protocol parsing engine to calculate the arrival time difference of adjacent signals to generate a response interval feature. The check flag bit at the end of the data frame is synchronously scanned to detect the number of consecutive check failure flags to generate a data integrity feature. Finally, the two types of features are encapsulated into a communication status evaluation vector.

[0121] Step 702: When the response interval characteristic exceeds the preset maintenance interval, the transmission frequency of the handshake instruction in the protocol field parameter is increased; when there is a continuous packet loss mark in the data integrity characteristic, the carrier strength value in the transmission power parameter is increased according to the gradient amplitude.

[0122] In this step, the preset maintenance interval refers to the maximum allowable response interval to ensure stable communication; the gradient amplitude increase refers to the adjustment rule of gradually increasing the signal strength at a fixed ratio (such as increasing the base value by 5% each time).

[0123] In this embodiment, the response interval characteristic of step 701 is first compared with the preset maintenance interval: if the current interval is greater than the threshold, the frequency of sending handshake instructions in the protocol field parameter is increased; the data integrity characteristic is synchronously detected: if there are N consecutive verification failures (such as 3 times), the carrier strength value in the transmission power parameter is increased according to the gradient amplitude.

[0124] Step 703: Calculate the deviation between the current response interval characteristic and the preset maintenance interval, and synchronously correct the transmission frequency of the handshake instruction to obtain an adjusted transmission power parameter.

[0125] In this step, the deviation refers to the absolute time difference between the actual response interval of the drone and the preset maintenance interval.

[0126] In this embodiment, the absolute time difference between the response interval characteristic value and the preset maintenance interval is first calculated; based on the preset deviation-frequency mapping relationship, a handshake instruction frequency correction value is generated; the initial frequency adjustment result of step 702 is superimposed to output the final frequency parameter; the carrier strength value after gradient enhancement in step 702 is synchronously inherited and encapsulated into a complete transmission power parameter set including protocol layer frequency parameters and physical layer strength parameters.

[0127] Step 704: Inversely update the increase range of the carrier strength value according to the distribution position of the packet loss mark of the preset periodic detection data integrity feature.

[0128] In this step, the packet loss marker distribution position refers to the index pattern of the verification failure identifier in the data frame sequence (such as continuous appearance in odd-numbered frames); reverse update refers to the optimization process of reversely deriving the carrier strength adjustment strategy based on the packet loss distribution pattern; the increase amplitude refers to the change in the carrier strength each time it is adjusted (such as the basic increase step value).

[0129] In this embodiment, the packet loss marker sequence in the complete characteristics of the data is first scanned at a fixed time period; the concentrated packet loss interval is located through binary sequence analysis; the environmental interference pattern is inferred based on the distribution law; the amplitude adjustment attenuation coefficient is calculated based on the interference pattern matching degree; and finally, the updated gradient boost amplitude value is output and written into the transmission power parameter register.

[0130] Step 705: Cross-validate the adjusted protocol field parameters and the adjusted transmit power parameters, and output the target adjustment parameters when a preset communication maintenance condition is met; In this step, cross-validation refers to synchronously checking the co-compatibility of protocol layer parameters (handshake instruction frequency) and physical layer parameters (carrier strength); communication maintenance conditions refer to the constraint rules that the two parameters must meet.

[0131] In this embodiment, a dual-parameter joint check matrix is ​​first established: the protocol field parameters are checked to see if they exceed the channel capacity threshold; the transmit power parameters are verified to see if they exceed the upper limit of the environmental noise masking; when both parameters meet the preset threshold and are mutually exclusive, the target adjustment parameters are output as a {frequency, intensity} tuple; if the check fails, the process returns to step 702 for readjustment.

[0132] Step 706: Use the target adjustment parameter to control the continuous transmission of the trapping control signal, so that the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

[0133] In this embodiment, the target adjustment parameters are first loaded into the signal generator control unit: the protocol field parameters are written into the protocol scheduler; the transmission power parameters are input into the RF power amplifier circuit; the closed-loop power monitoring circuit is started to calibrate the signal strength in real time; and the trapping control signal that integrates protocol deception and environmental camouflage is continuously transmitted according to the parameter configuration to maintain the communication connection and command return of the target UAV.

[0134] Figure 2 This application provides a structural diagram of a UAV control command trapping system based on pseudo base station technology, such as Figure 2 As shown, the system includes: The acquisition module 21 is configured to acquire signal parameters and environmental electromagnetic noise characteristics of a real base station using a pseudo base station device deployed in a predetermined geographical area; The transmitting module 22 is used to generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and transmit the dynamic base station simulation signal through the pseudo base station device, so that the UAV entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates a detection signal; The parsing module 23 is configured to parse the command coding features in the detection signal when the pseudo base station device receives the detection signal sent by the drone; A reconstruction module 24 is configured to reconstruct a decoy control signal with protocol deception based on the instruction coding characteristics obtained by parsing, wherein the decoy control signal is synchronized with the electromagnetic noise characteristics of the current environment; The adjustment module 25 is used to adaptively adjust the protocol field parameters and the transmission power parameters of the trapping control signal so that the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

[0135] Figure 2 The UAV control command trapping system based on pseudo base station technology can execute Figure 1 The implementation principle and technical effects of the method for trapping drone control instructions based on pseudo base station technology described in the illustrated embodiment will not be elaborated on here. The specific manner in which each module and unit performs operations in the above-mentioned method for trapping drone control instructions based on pseudo base station technology has been described in detail in the embodiments of the method and will not be elaborated on here.

[0136] In one possible design, Figure 2 The UAV control instruction trapping system based on pseudo base station technology in the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32; The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0137] The processing component 32 is used for the above Figure 1 The embodiment provides a method for trapping drone control instructions based on pseudo base station technology.

[0138] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for trapping drone control instructions based on fake base station technology, characterized in that: include: Using pseudo base station devices deployed in a predetermined geographical area to collect signal parameters and environmental electromagnetic noise characteristics of real base stations; Generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and transmit the dynamic base station simulation signal through a pseudo base station device, so that drones entering the communication coverage area respond to the dynamic base station simulation signal and actively initiate detection signals; When the pseudo base station device receives a detection signal sent by the drone, it analyzes the command coding features in the detection signal; Reconstructing a decoy control signal with protocol deception based on the instruction coding features obtained through analysis, wherein the decoy control signal is synchronously transmitted by integrating the electromagnetic noise features of the current environment; By adaptively adjusting the protocol field parameters and the transmission power parameters of the trapping control signal, the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

2. The method according to claim 1, characterized in that The pseudo base station device deployed in a predetermined geographical area is used to collect the signal parameters and environmental electromagnetic noise characteristics of the real base station, including: Performing a full-band wireless signal scan of the predetermined geographical area by using the signal acquisition device of the pseudo base station device, and locating the signal transmission source of the real base station based on the scanning result; For the located signal transmitter, the system continuously captures communication signal samples transmitted by the real base station within a set time window, identifies the base station identification features and spectrum features in the communication signal samples, and generates signal parameters; At the same time, based on the scanning results, the electromagnetic radiation of non-base station signal sources in the predetermined geographical area is monitored, and the intensity fluctuation characteristics and frequency band distribution characteristics of the electromagnetic radiation are extracted to generate environmental electromagnetic noise characteristics.

3. The method according to claim 1, characterized in that Based on the collected signal parameters and environmental electromagnetic noise characteristics, a dynamic base station simulation signal is generated and transmitted through a pseudo base station device, so that drones entering the communication coverage area respond to the dynamic base station simulation signal and actively initiate detection signals, including: Mapping the base station identification feature contained in the signal parameter into a base station identity identification field; Determining carrier parameters and modulation parameters of the dynamic base station analog signal according to the spectrum characteristics, and implanting a preset handshake protocol unit into the signal framework formed by the carrier parameters and modulation parameters; Convert the environmental electromagnetic noise characteristics into background noise waveform covering the target frequency band; Integrating the base station identification field and the handshake protocol unit into the signal framework, and synchronously superimposing the background noise waveform to generate a composite analog signal as the dynamic base station analog signal; Continuously transmitting the dynamic base station simulation signal within the communication coverage area of ​​the predetermined geographical area through the pseudo base station device; When the protocol field parameter of the dynamic base station simulation signal is within the authentication interval of the target drone control protocol, the target drone is triggered to send a detection signal to the pseudo base station device.

4. The method according to claim 1, wherein When the pseudo base station device receives a detection signal sent by a drone, it analyzes the command coding features in the detection signal, including: Performing physical layer demodulation processing on the detection signal to separate a data signaling unit in a communication protocol format; identifying a protocol control field and a data payload field in the data signaling unit, and extracting a core data segment containing a control identifier from the data payload field; Locating a specific parameter storage location in the core data section according to a pre-established drone control protocol structure mapping table; Reading the bit sequence structure of the specific parameter storage location to confirm that it conforms to the bit distribution characteristics and verification characteristics of the instruction encoding; The data segment content that meets the bit distribution feature and the check feature is determined as the instruction encoding feature.

5. The method according to claim 1, wherein Reconstruct the decoy control signal with protocol deception based on the command encoding features obtained by parsing, including: Generate a corresponding protocol control header structure based on the control protocol type identifier in the instruction encoding feature; Copying the operation instruction bit sequence in the instruction encoding feature as a trapping instruction basic template and inserting pseudo response content at a preset parameter position of the trapping instruction basic template to form a pseudo instruction payload; assembling the protocol control header structure and the pseudo instruction payload into a data unit in a target communication protocol format; Determine the coverage frequency band of the transmission carrier according to the frequency band distribution characteristics of the environmental electromagnetic noise characteristics; configure the power modulation mode of the synchronization carrier according to the intensity fluctuation characteristics; Loading the data unit within the determined coverage frequency band to form an initial trapping signal; The initial trapping signal is subjected to intensity mode adaptation processing through the power modulation mode to generate the trapping control signal.

6. The method according to claim 5, characterized in that Performing intensity mode adaptation processing on the initial trapping signal through the power modulation mode to generate the trapping control signal includes: Analyzing the intensity variation period and fluctuation amplitude range recorded in the power modulation mode; Dividing the intensity variation period into a plurality of continuous adjustment windows, each continuous adjustment window corresponding to a specific amplitude adjustment proportional coefficient; Determining a basic intensity adjustment threshold range according to the fluctuation amplitude range; Reading the instantaneous intensity waveform envelope structure of the initial trapping signal; Performing waveform compression processing on the instantaneous intensity waveform envelope structure according to the amplitude adjustment proportional coefficient to form envelope adjustment parameters, and limiting the envelope adjustment parameters to within the basic intensity adjustment threshold range to generate a standard envelope structure; The standard envelope structure is loaded onto the carrier frequency band of the initial trapping signal to form a time-varying trajectory. Based on the mapping relationship between the time-varying trajectory and the intensity variation period, the signal intensity sequence of the initial trapping signal is reconstructed to output a trapping control signal.

7. The method according to claim 1, characterized in that Adaptively adjusting the protocol field parameters and the transmission power parameters of the trapping control signal so that the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data, including: Monitoring the communication maintenance features in the response signal returned by the UAV, and identifying the response interval features and data integrity features contained in the communication maintenance features; When the response interval characteristic exceeds the preset maintenance interval, the frequency of transmission of the handshake instruction in the protocol field parameter is increased; when there is a continuous packet loss mark in the data integrity characteristic, the carrier strength value in the transmission power parameter is increased according to the gradient amplitude; Calculating the deviation between the current response interval characteristic and the preset maintenance interval, synchronously correcting the transmission frequency of the handshake instruction, and obtaining an adjusted transmission power parameter; According to the distribution position of the packet loss mark of the preset periodic detection data integrity feature, the increase amplitude of the carrier strength value is reversely updated; Cross-validating the adjusted protocol field parameters and the adjusted transmit power parameters, and outputting target adjustment parameters when a preset communication maintenance condition is met; The target adjustment parameter is used to control the continuous emission of the trapping control signal so that the UAV maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

8. A UAV control command trapping system based on pseudo base station technology, characterized in that: include: A collection module, configured to collect signal parameters and environmental electromagnetic noise characteristics of a real base station using a pseudo base station device deployed in a predetermined geographical area; The transmitting module is used to generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and transmit the dynamic base station simulation signal through the pseudo base station device, so that the drone entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates a detection signal; a parsing module, configured to parse the command coding features in the detection signal when the pseudo base station device receives the detection signal sent by the drone; A reconstruction module is used to reconstruct a decoy control signal with protocol deception based on the instruction coding characteristics obtained by parsing, wherein the decoy control signal is integrated with the current environmental electromagnetic noise characteristics for synchronous transmission; The adjustment module is used to adaptively adjust the protocol field parameters and transmission power parameters of the trapping control signal so that the drone maintains a communication connection with the pseudo base station device and continuously transmits control instruction data.

9. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a drone control instruction trapping method based on pseudo base station technology as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that A computer program is stored, and when the computer program is executed by a computer, a method for trapping drone control instructions based on pseudo base station technology as described in any one of claims 1 to 7 is implemented.

Images