LLM-based multi-machine collaborative abnormal data detection system

Abstract

The invention relates to the technical field of unmanned aerial vehicle cluster security and collaboration, in particular to an LLM-based multi-machine collaboration abnormal data detection system, which comprises a generation module used for generating at least one abnormal detection score by using an airborne end; the processing module is used for extracting features from a first historical database in the edge server to obtain first historical features and binary classification anomaly detection tags, calculating performance index vectors and uploading the binary classification anomaly detection tags and the performance index vectors to the cloud; and the prediction and analysis module is used for performing long-time sequence prediction by using the cloud to obtain a long-time sequence prediction result, and performing security analysis by using the cloud to obtain a security analysis result. Therefore, the problems of mechanism deficiency, data processing bottleneck, insufficient threat coping, poor system expansibility and the like of the existing unmanned aerial vehicle cluster in the aspect of multi-aerial-vehicle cooperation security are solved, efficient multi-aerial-vehicle cooperation is realized, and data processing and utilization are optimized.

Description

Technical Field

[0001] The present application relates to the field of drone cluster security and collaborative technology, and in particular to a multi-machine collaborative abnormal data detection system based on LLM. Background Art

[0002] With the widespread application of unmanned aerial vehicles (UAVs) in key areas such as military reconnaissance, emergency communications, environmental monitoring, and logistics, swarming and intelligent operations have become a major development trend. Drone swarms can perform more complex and extended missions, but they also place higher demands on system security, communication efficiency, and collaborative decision-making capabilities.

[0003] However, as drone applications evolve from single-machine intelligence to multi-machine collaboration, existing technologies still have significant shortcomings in supporting the complex, dynamic, and distributed security collaboration of drone swarms. On the one hand, existing technologies lack a multi-machine collaboration mechanism, making it difficult to achieve real-time status sharing, heterogeneous data fusion, and collaborative decision-making among drones, and are unable to meet the needs of swarm missions and distributed threat response. On the other hand, centralized data processing models are difficult to adapt to the massive, high-speed, and heterogeneous data streams generated by drone swarms. Onboard and edge resources are limited, resulting in information delays and decision-making lags. In addition, existing technologies have limited ability to identify complex and changing threats, making it difficult to achieve resource-aware intelligent decision-making. Furthermore, due to the fixed architecture of the existing technology, it is difficult to adapt to changes in mission requirements, cluster size adjustments, and the emergence of new threats. It lacks modular design and dynamic expansion capabilities. These shortcomings limit the application effectiveness of drone swarms in complex mission environments and urgently need to be addressed. Summary of the Invention

[0004] This application provides a multi-machine collaborative abnormal data detection system based on LLM to solve the problems of existing drone clusters in terms of multi-machine collaborative security, such as lack of mechanism, data processing bottleneck, insufficient threat response and poor system scalability, etc., to achieve efficient multi-machine collaboration and optimize data processing and utilization.

[0005] The first embodiment of the present application provides a multi-machine collaborative abnormal data detection system based on LLM, the system comprising: a generating module, configured to generate at least one anomaly detection score using the onboard terminal; a processing module, configured to extract features from a first historical database in the edge server to obtain a first historical feature, obtain a binary anomaly detection label based on the first historical feature and the at least one anomaly detection score, calculate a performance indicator vector, and upload the binary anomaly detection label and the performance indicator vector to the cloud; The prediction and analysis module is used to use the cloud to perform long-term series prediction to obtain long-term series prediction results, and to use the cloud to perform security analysis to obtain security analysis results.

[0006] According to one embodiment of the present application, the LLM-based multi-machine collaborative abnormal data detection system is further used to: Acquire a second historical feature from a second historical database in the cloud; Uploading the at least one anomaly detection score, the binary anomaly detection label, the performance indicator vector, the first historical feature, the second historical feature, the long time series prediction result, and the security analysis result to the decision agent in the edge server; Based on a preset hybrid expert model mechanism, the decision agent is used to perform a fusion calculation on the at least one anomaly detection score, the binary anomaly detection label, the performance indicator vector, the first historical feature, the second historical feature, the long time series prediction result, and the security analysis result to obtain an optimal collaborative decision vector; Based on the optimal collaborative decision vector, the at least one target UAV is controlled to perform a multi-machine collaborative mission.

[0007] According to one embodiment of the present application, the prediction and analysis module is used to: converting the optimal collaborative decision vector into a target behavior instruction; The target behavior instruction is sent to at least one target drone through the edge server to control the at least one target drone to perform a multi-machine collaborative task.

[0008] According to one embodiment of the present application, the generating module is configured to: Acquire local data and sampling data from drone sensors, and construct a local dataset based on the local data and the sampling data; Anomaly detection processing and / or time series prediction processing are performed on the local data set to generate the at least one anomaly detection score.

[0009] According to one embodiment of the present application, after using the cloud to perform long-term series prediction and obtain long-term series prediction results, and using the cloud to perform security analysis and obtain security analysis results, the prediction and analysis module is further used to: Performing offline training and fine-tuning on the model in the cloud to obtain updated model parameters; Based on the updated model parameters, the model in the edge server and / or the model in the onboard terminal is updated.

[0010] According to one embodiment of the present application, the LLM-based multi-machine collaborative abnormal data detection system has an embedded intelligent agent.

[0011] According to the LLM-based multi-machine collaborative anomaly data detection system of the embodiment of the present application, an anomaly detection score is generated by the airborne terminal; a first historical feature is extracted from the first historical database in the edge server, and a binary anomaly detection label is obtained based on the first historical feature and the anomaly detection score, and a performance indicator vector is calculated. The binary anomaly detection label and the performance indicator vector are uploaded to the cloud; a long-term series prediction is performed on the cloud to obtain a long-term series prediction result, and a security analysis is performed to obtain a security analysis result. This solves the problems of the existing drone cluster in terms of multi-machine collaborative security, such as the lack of mechanism, data processing bottleneck, insufficient threat response, and poor system scalability, and achieves efficient multi-machine collaboration and optimizes data processing and utilization.

[0012] A second embodiment of the present application provides an LLM-based multi-machine collaborative abnormal data detection method, the method adopts an LLM architecture and an embedded intelligent agent system, the LLM architecture and the embedded intelligent agent system include an onboard terminal, an edge server, and a cloud, wherein the method includes the following steps: generating at least one anomaly detection score using the onboard terminal; Extracting features from a first historical database in the edge server to obtain a first historical feature, obtaining a binary anomaly detection label based on the first historical feature and the at least one anomaly detection score, calculating a performance indicator vector, and uploading the binary anomaly detection label and the performance indicator vector to the cloud; The cloud is used to perform long time series prediction to obtain long time series prediction results, and the cloud is used to perform security analysis to obtain security analysis results.

[0013] According to one embodiment of the present application, the LLM-based multi-machine collaborative abnormal data detection method further includes: Acquire a second historical feature from a second historical database in the cloud; Uploading the at least one anomaly detection score, the binary anomaly detection label, the performance indicator vector, the first historical feature, the second historical feature, the long time series prediction result, and the security analysis result to the decision agent in the edge server; Based on a preset hybrid expert model mechanism, the decision agent is used to perform a fusion calculation on the at least one anomaly detection score, the binary anomaly detection label, the performance indicator vector, the first historical feature, the second historical feature, the long time series prediction result, and the security analysis result to obtain an optimal collaborative decision vector; Based on the optimal collaborative decision vector, the at least one target UAV is controlled to perform a multi-machine collaborative mission.

[0014] According to one embodiment of the present application, controlling the at least one target UAV to perform a multi-machine collaborative task based on the optimal collaborative decision vector includes: converting the optimal collaborative decision vector into a target behavior instruction; The target behavior instruction is sent to at least one target drone through the edge server to control the at least one target drone to perform a multi-machine collaborative task.

[0015] According to one embodiment of the present application, generating at least one anomaly detection score using the onboard terminal includes: Acquire local data and sampling data from drone sensors, and construct a local dataset based on the local data and the sampling data; Anomaly detection processing and / or time series prediction processing are performed on the local data set to generate the at least one anomaly detection score.

[0016] According to one embodiment of the present application, after using the cloud to perform long time series prediction to obtain long time series prediction results, and using the cloud to perform security analysis to obtain security analysis results, the method further includes: Performing offline training and fine-tuning on the model in the cloud to obtain updated model parameters; Based on the updated model parameters, the model in the edge server and / or the model in the onboard terminal is updated.

[0017] According to the LLM-based multi-machine collaborative anomaly data detection method of the embodiment of the present application, an anomaly detection score is generated by the airborne terminal; a first historical feature is extracted from the first historical database in the edge server, and a binary anomaly detection label is obtained based on the first historical feature and the anomaly detection score, and a performance indicator vector is calculated. The binary anomaly detection label and the performance indicator vector are uploaded to the cloud; a long-term series prediction is performed on the cloud to obtain a long-term series prediction result, and a security analysis is performed to obtain a security analysis result. This solves the problems of the existing drone cluster in terms of multi-machine collaborative security, such as the lack of mechanism, data processing bottleneck, insufficient threat response, and poor system scalability, and achieves efficient multi-machine collaboration and optimizes data processing and utilization.

[0018] The third aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the multi-machine collaborative abnormal data detection method based on LLM as described in the above embodiment.

[0019] The fourth aspect of the present application provides a computer-readable storage medium on which a computer program is stored. The program is executed by a processor to implement the LLM-based multi-machine collaborative abnormal data detection method as described in the above embodiment.

[0020] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which: Figure 1 1 is a block diagram of a multi-machine collaborative abnormal data detection system based on LLM according to an embodiment of the present application; Figure 2 Schematic diagram of the architecture of a multi-machine collaborative abnormal data detection system based on LLM according to one embodiment of the present application; Figure 3 A schematic diagram of the internal architecture of an Agent according to an embodiment of the present application; Figure 4 Flowchart of a multi-machine collaborative abnormal data detection method based on LLM according to an embodiment of the present application; Figure 5 Schematic diagram of the structure of an electronic device according to an embodiment of the present application.

[0022] Figure numerals: 10 - a multi-machine collaborative abnormal data detection system based on LLM, 100 - generation module, 200 - processing module, 300 - prediction and analysis module; 501 - memory, 502 - processor, 503 - communication interface. DETAILED DESCRIPTION

[0023] The following describes in detail embodiments of the present application. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0024] What those skilled in the art may understand is that in related technologies, in order to cope with challenges such as system security, communication efficiency and collaborative decision-making capabilities arising from swarming and intelligent operations of drones, introducing artificial intelligence, especially large-scale language models, into drone systems to enhance their autonomous perception, understanding and decision-making capabilities has become a research hotspot in recent years.

[0025] However, existing drone systems and preliminary LLM application architectures face the following key pain points when dealing with multi-drone collaborative safety scenarios: (1) Lack of effective multi-machine collaboration mechanism: Existing systems mostly focus on single-machine intelligence and lack efficient mechanisms to handle real-time status sharing, heterogeneous data fusion, and collaborative decision-making among multiple drones. They are unable to cope with cluster tasks and distributed threats that require close coordination.

[0026] (2) Data processing and storage bottlenecks: Traditional centralized data storage and processing models are difficult to adapt to the massive, high-speed, and heterogeneous distributed data streams generated by drone clusters. Limited computing and storage resources onboard and at the edge make it impossible to effectively process and utilize real-time local and neighboring data, resulting in information delays and decision-making lags.

[0027] (3) Insufficient static threat response and knowledge utilization: The system has limited ability to identify complex and changing threats (such as GPS spoofing, network attacks, and sensor jamming combinations), and lacks a mechanism to dynamically and real-time integrate domain expert knowledge (such as specific countermeasure strategies) into the decision-making process.

[0028] (4) Difficulty in decision optimization under resource constraints: In resource-constrained environments such as airborne and edge environments, it is a major challenge to ensure the timeliness and accuracy of decisions while taking into account the consumption of computing and communication resources to achieve resource-aware intelligent decision-making.

[0029] (5) Insufficient system scalability and adaptability: The existing architecture is often relatively fixed and difficult to flexibly adapt to changes in mission requirements, adjustments to cluster size, and the emergence of new threats. It lacks good modular design and dynamic expansion capabilities.

[0030] In order to overcome the pain points in the above-mentioned prior art, this application proposes a multi-machine collaborative abnormal data detection system based on LLM.

[0031] Specifically, Figure 1 It is a block diagram of an LLM-based multi-machine collaborative abnormal data detection system in an embodiment of the present application.

[0032] like Figure 1 As shown, the LLM-based multi-machine collaborative abnormal data detection system 10 includes: a generation module 100, a processing module 200 and a prediction and analysis module 300.

[0033] Among them, the generation module 100 is used to generate at least one anomaly detection score using the airborne terminal; the processing module 200 is used to extract features from the first historical database in the edge server to obtain a first historical feature, and obtain a binary anomaly detection label based on the first historical feature and at least one anomaly detection score, and calculate a performance indicator vector, and upload the binary anomaly detection label and the performance indicator vector to the cloud; the prediction and analysis module 300 is used to perform long-term series prediction using the cloud to obtain long-term series prediction results, and perform security analysis using the cloud to obtain security analysis results.

[0034] It should be noted that the LLM-based multi-machine collaborative abnormal data detection system in the embodiment of the present application has an embedded intelligent agent.

[0035] For example, Figure 2 As shown, Figure 2 This is an architectural diagram of the LLM-based multi-machine collaborative abnormal data detection system proposed in an embodiment of the present application. The architecture integrates distributed data storage, multi-level model collaboration, and an agent-based intelligent decision-making mechanism. Small models (such as OPT-350m, OPT-125m), medium-sized models (such as OPT-1.3B, OPT-6.7B), and large models (such as Llama2-7B, Llama2-13B, TimesNet, Time-LLM) are deployed on the airborne end, medium-sized edge servers, and the cloud, respectively, to realize data collection, real-time processing, long-term time series prediction, and security mode analysis.

[0036] The LLM-based multi-machine collaborative anomaly data detection system in this embodiment of the application adopts a distributed data storage architecture. The edge server establishes a short-term history database (the first history database) for storing real-time data fragments; the cloud establishes a long-term history database (the second history database) for storing global trend and pattern data. This architecture introduces an innovative time window sliding aggregation and data validity scoring mechanism, effectively solving the problem of synchronizing and integrating multi-source asynchronous data.

[0037] Furthermore, the embodiment of the present application adds an intelligent agent at the edge server. The agent is based on the internal algorithm of MOE (Mixture of Experts), integrates task decomposition, distribution, and decision fusion functions, and introduces domain experts (such as GPS anomaly defense experts, network recovery experts, and model self-update experts).

[0038] The working principle of the LLM-based multi-machine collaborative abnormal data detection system proposed in this application is described in detail below.

[0039] Specifically, the generation module 100 is used to: obtain local data and sampling data from drone sensors, and construct a local data set based on the local data and the sampling data; perform anomaly detection processing and / or time series prediction processing on the local data set to generate at least one anomaly detection score.

[0040] Among them, the anomaly detection score refers to the score of the degree of anomaly of sensor and network data detected in real time by the small model on the airborne end.

[0041] Specifically, the onboard terminal performs data collection and preliminary processing. The drone's sensors collect real-time data and combine it with the drone's own data to form a local dataset. A small onboard model is then used to perform real-time anomaly detection and time series prediction on the local data, generating at least one preliminary anomaly detection score φ. This score is then sent to the edge server.

[0042] Furthermore, features are extracted from the first historical database in the edge server to obtain a first historical feature, and a binary anomaly detection label is obtained based on the first historical feature and at least one anomaly detection score, and a performance indicator vector is calculated, and the binary anomaly detection label and the performance indicator vector are uploaded to the cloud.

[0043] The first historical database is a short-term historical database that can store data from the last few minutes to tens of minutes. The binary anomaly detection label refers to the "normal / abnormal" judgment of the onboard or aggregated data by the medium-sized model of the edge server, which is a binary label.

[0044] Specifically, edge servers are used for data aggregation and mid-level analysis. The edge server aggregates the anomaly detection scores from one or more drones, and extracts short-term historical data, namely the first historical feature S, from the short-term historical database. The first historical feature S can be a vector composed of statistical features such as the frequency, mean, and variance of anomalies in the past few minutes to tens of minutes. The medium-sized model deployed on the edge server combines at least one anomaly detection score and the first historical feature S extracted from the short-term historical database for analysis, outputs a more accurate two-category anomaly detection label, and calculates its own performance index M. The performance index vector M = [A, P, R, F1]: Accuracy, Precision, Recall, F1-score. The first historical database of the embodiment of the present application is used to store recent data fragments for Agent query.

[0045] Furthermore, the edge server uploads the processed data to the cloud. Furthermore, through the prediction and analysis module 300, long time series prediction is performed using the cloud to obtain long time series prediction results, and security analysis is performed using the cloud to obtain security analysis results.

[0046] Furthermore, in some embodiments, the LLM-based multi-machine collaborative anomaly data detection system 10 is also used to: obtain a second historical feature from a second historical database in the cloud; upload at least one anomaly detection score, a binary anomaly detection label, a performance indicator vector, a first historical feature, a second historical feature, a long time series prediction result, and a security analysis result to a decision agent in an edge server; based on a preset hybrid expert model mechanism, use the decision agent to perform a fusion calculation on at least one anomaly detection score, a binary anomaly detection label, a performance indicator vector, a first historical feature, a second historical feature, a long time series prediction result, and a security analysis result to obtain an optimal collaborative decision vector; based on the optimal collaborative decision vector, control at least one target drone to perform a multi-machine collaborative task.

[0047] The second historical database is a long-term database that can store data spanning several hours, days, or even longer. The second historical feature L is a vector extracted from the second historical database, consisting of macro-features such as periodic trends and historical anomaly pattern statistics. The long-term series prediction result T is the trend prediction vector of sensor data spanning several minutes or longer in the future, generated by the large cloud-based model. The security analysis result K is the digital label identifying the attack pattern extracted through global data analysis.

[0048] Specifically, global analysis and model maintenance are performed in the cloud. A second historical database in the cloud is used to store global historical data, namely, second historical features L, including long-term regularities / patterns. These long-term regularities / patterns are uploaded to the decision agent through the second historical database in the cloud. A large-scale model in the cloud is then used to perform long-term series predictions, obtaining the long-term series prediction results T. Large-scale security pattern analysis is also performed to obtain the security analysis results K.

[0049] Furthermore, the decision-making agent located on the edge server is the core of the LLM architecture and embedded intelligent agent system. It aggregates information from various layers, including: the anomaly detection score φ on the airborne side (which may be indirectly obtained or directly transmitted through the edge model label), the binary anomaly detection label and performance indicator vector M of the edge model, the first historical feature S, the second historical feature L (obtained from the second historical database through data request), the long time series prediction result T and the security analysis result K on the cloud.

[0050] Furthermore, the agent is used to fuse multi-source information through the internal MoE mechanism to calculate the optimal collaborative decision vector x*. In addition, the agent is used to initiate data requests to the first historical database and the second historical database to obtain the context required for decision making.

[0051] Furthermore, in some embodiments, the prediction and analysis module 300 is used to: convert the optimal collaborative decision vector into a target behavior instruction; and send the target behavior instruction to at least one target drone through the edge server to control the at least one target drone to perform a multi-machine collaborative task.

[0052] Specifically, a decision-making agent is used to issue commands and provide closed-loop feedback. The agent converts the optimal decision vector x* into specific behavioral instructions, which are then distributed to the relevant drones via the edge server to execute the multi-drone collaborative task. Furthermore, the agent updates the weights of the medium-sized model on the edge server based on the decision results and current status. The agent also provides real-time feedback on system status and decision information to the ground control system (GCS). The drone's execution results and new status are re-entered into the system via sensor data streams, forming a closed-loop system. Simultaneously, the large-scale model in the cloud is continuously iteratively optimized based on long-term data.

[0053] Furthermore, in some embodiments, after using the cloud to perform long-term series prediction and obtain long-term series prediction results, and using the cloud to perform security analysis and obtain security analysis results, the prediction and analysis module 300 is also used to: perform offline training and fine-tuning on the model in the cloud to obtain updated model parameters; and update the model in the edge server and / or the model in the onboard terminal based on the updated model parameters.

[0054] Specifically, the cloud is responsible for offline training and fine-tuning of medium and large models in the cloud, and sends the updated model parameters to the edge server and / or airborne end, that is, sending the medium-sized model parameters fine-tuned in the cloud to the edge or airborne end, updating the model weights in the edge server, or updating the model weights in the airborne end, or updating the model weights in the edge server and the model weights in the airborne end at the same time.

[0055] The internal algorithm of the decision-making agent proposed in the embodiment of the present application is described in detail below.

[0056] Specifically, the data flow and processing process within the agent is as follows: Figure 3 As shown, it includes a data aggregation and preprocessing module with a multi-source asynchronous data synchronization mechanism , weight distribution and control module including threat identification and expert weight adjustment mechanism , expert reasoning module including dynamic expansion mechanism of expert system , decision fusion module including resource-aware decision-making mechanism , a feedback and loop adjustment module including a comprehensive confidence assessment mechanism and collaborative enhancement modules for optimized collaborative decision-making The following is a detailed description of the algorithm flow of each module.

[0057] First, we introduce the data aggregation and preprocessing module .

[0058] Specifically, construct a unified eigenvector: ; in, is a feature vector used to mathematically model the characteristics of multi-source (airborne, edge server, cloud) data for intelligent agent calculation. is the anomaly detection score, is the performance indicator vector, The first historical feature is The second historical feature is For long time series prediction results, For safety analysis results.

[0059] To ensure data timeliness, the decision agent uses timestamp alignment or the latest available data within a specified time window when aggregating data from various sources, and can include data freshness as part of the feature vector. .

[0060] Furthermore, to solve the problem of multi-source asynchronous data, this system adopts the following multi-source asynchronous data synchronization mechanism algorithm for data aggregation and synchronization.

[0061] (1) Time window sliding aggregation: For time series data (such as the first historical feature ), using the Exponentially Weighted Moving-Average (EWMA) method to give more weight to recent data: ; in, The first historical feature is is the sliding window size, is the attenuation factor, It's time data.

[0062] (2) Data validity scoring: defining a timeliness function for each data source : ; in, is the time-effectiveness function, Represents a specific data item or data point, is the local timestamp of the agent, Controlling the decay rate, The timestamp of the data, that is, the time when the data is generated or recorded. is the data "half-life" (adjustable based on data type).

[0063] (3) Data missing processing: When a data source is temporarily unavailable, historical data prediction filling (short-term missing) or degradation strategy (long-term missing) is used: ; in, is the incomplete feature vector caused by missing data, is the feature vector prediction value obtained by the time series prediction method; is the preset safety degradation value, is the timestamp of the last complete feature vector obtained, An artificially set time threshold serves as a selection criterion for filling strategies and long-term strategies.

[0064] (4) Data fusion quality assessment: defining fusion data quality metrics : ; in, is the fusion data quality metric, The weights of each specific data item are set manually and can be adjusted according to the task type. Each specific data item or data point received by the agent.

[0065] like , then trigger additional data requests or increase the decision confidence threshold .

[0066] Secondly, introduce the weight distribution and control module .

[0067] Specifically, the importance weight of each expert is calculated through the control module : ; in, is the relevance evaluation function of the i-th expert, is the relevance evaluation function of the j-th expert, is the input vector, is the total number of experts.

[0068] Furthermore, The design aims to Evaluate the relevance and reliability of each expert in the current scenario. For example, if the input vector Contains features that indicate specific network attack patterns (from security analysis results or first historical feature ), then the weight of the network recovery expert may be improved, which enables the agent to dynamically focus on the most relevant expert opinions.

[0069] The following introduces the weight distribution and control module Threat identification and expert weight adjustment mechanism involved.

[0070] The embodiment of the present application establishes a dynamic association between threat characteristics and expert knowledge through the following design: (1) Threat-Expert Correlation Matrix: Maintain a matrix ,in, is the number of possible threat types, is the number of experts. Indicates the threat type with experts degree of relevance.

[0071] (2) Threat feature extraction function: From the input vector Extract threat signature vectors : ; in, It can be implemented as a specialized feature extraction network or a rule-based mapping function.

[0072] (3) Threat probability distribution calculation: Calculate the probability distribution of various threat types based on threat characteristics: ; in, yes dimensional vector, representing the probability of each threat type, For one dimensional weight matrix, each row corresponds to a threat type, and each column corresponds to A feature in , learned through training, For one dimensional bias vector, which allows the activation value of each threat type to have a baseline offset, and each element corresponds to a threat type, which is learned by training.

[0073] (4) Threat-based expert weight adjustment: Multiply the threat probability with the correlation matrix to correct the control module output: ; in, is the modified i-th expert relevance evaluation function, To tune the intensity hyperparameter.

[0074] The final expert weight is calculated as: .

[0075] (5) Adaptive update of the correlation matrix: Based on the feedback of decision-making effects, the correlation matrix is ​​updated regularly. : ; in, is the value of row j and column i of the updated association matrix, is the value of row j and column i of the association matrix before updating, is the learning rate, A quantitative score for decision-making effectiveness. for The value of the jth item.

[0076] Furthermore, we introduce the expert reasoning module .

[0077] Specifically, the decision variable is defined as a decision vector , each component corresponds to a different control parameter (such as evacuation intensity , link switching , anti-interference wait).

[0078] Each expert (such as GPS defense, network recovery, anti-interference, model update, etc.) according to the input Output its recommended decision vector .

[0079] Experts can give non-zero recommendations for one or more decision components based on their domain expertise. For example, a GPS defense expert might recommend Network experts may recommend Anti-jamming experts may recommend .

[0080] This architecture supports the dynamic expansion of the expert system. New expert models can be registered or existing expert logic can be updated through predefined interfaces. The agent's control module and decision fusion mechanism can adapt to changes in the expert set, reflecting the modularity and scalability of the system.

[0081] The following describes in detail the dynamic expansion mechanism of the expert system in the embodiment of the present application. The embodiment of the present application adopts the following strategies to achieve the dynamic and extensible nature of the expert system: (1) Standardized expert interface: A standardized method for all expert models to receive input features, output decisions and confidence levels, report support dimensions, and update themselves based on feedback.

[0082] (2) Expert registration and uninstallation mechanism: Provides an interface for dynamically adding and removing expert modules so that the expert list can be flexibly managed at runtime.

[0083] (3) Expert ability evaluation function: Define an ability evaluation function for newly added experts : ; in, For the test scene collection, Score the similarity between the expert recommendation and the reference decision, For the expert recommendations to be evaluated, For reference decision.

[0084] (4) Expert cold start strategy: When a new expert registers, the system adopts a conservative strategy to gradually increase his influence: ; in, is the weight of the newly added expert at time t, , is the growth factor, This is the upper limit of the expert weight, which increases gradually with the ability assessment score.

[0085] (5) Expert competition mechanism: Dynamically adjust resource allocation among experts with similar functions based on historical performance: ; in, For experts The proportion of computing resources obtained, is the historical performance measure of expert i, Control the intensity of competition.

[0086] Furthermore, we introduce the decision fusion module .

[0087] Specifically, the decision fusion module Includes decision vector and cost function.

[0088] Definition Expert The cost function that measures the decision vector Rather than suggestions The weighted bias of: ; in, is an expert Decision weight Sensitivity weights (irrelevant components ).

[0089] Construct the overall cost function as the weighted sum of the costs of each expert: ; Furthermore, an optimization solution is performed.

[0090] The goal of optimization is to find the optimal solution under the constraints (For example, the value range of each component ) to minimize the overall cost function The decision vector : ; Constraints In addition to physical limitations, current resource state constraints (such as available bandwidth and computational load) can also be included to make decisions that favor resource-efficient solutions.

[0091] The optimization problem can be solved by using appropriate nonlinear programming (such as interior point method, sequential quadratic programming) or numerical optimization algorithms (such as variants of gradient descent).

[0092] Furthermore, we introduce the decision fusion module Resource-aware decision-making mechanism.

[0093] In system design, resource efficiency and decision-making effectiveness are equally important. This embodiment of the application implements resource-aware decision-making through the following algorithm: (1) Resource consumption model: define resource consumption function for each decision component , indicating the implementation decision The required resource overhead is modeled by a piecewise function: ; (2) Total resource constraints: define the system's available resource vector ,in, Indicates the The available amount of resources. Then construct the resource constraint function: ; in, is the resource constraint function, Decision weight Resources The consumption function.

[0094] (3) Multi-objective optimization: Introducing resource efficiency into the optimization problem, transforming it into multi-objective optimization: ; in, It is the weight factor of resource efficiency and can be adjusted dynamically according to the current load of the system.

[0095] (4) Constraint relaxation mechanism: When there is no solution under strict resource constraints, the system can automatically apply a relaxation strategy: ; satisfy: ; in, For the The slack variables of the constraints, is the penalty factor.

[0096] (5) Dynamic resource scheduling: Based on the degree of urgency, the system can dynamically reallocate resource limits: ; in, is the updated available quantity of the i-th resource, Under normal circumstances, the system sets the regular available amount for the i-th resource. is a measure of the urgency of the current situation, For resources The elastic coefficient.

[0097] (6) Solution algorithm selection: Based on the problem complexity and computing resources, the system adaptively selects between the following algorithms: a) In emergency situations: fast approximate solutions (such as time-limited iterations of gradient descent); b) Conventional case: exact solution (such as sequential quadratic programming); c) Idle period: global search (such as genetic algorithm).

[0098] Furthermore, the feedback and loop adjustment module of the embodiment of the present application is introduced. .

[0099] The feedback and loop adjustment module of the embodiment of the present application Includes feedback loop with integrated mechanisms for adaptive adjustment and confidence assessment.

[0100] The feedback loop and adaptive adjustment include the following steps: Evaluating optimal decisions Confidence Confidence assessment can be done by combining various methods, such as: a) Expert opinion consistency: measure the consensus of the experts’ opinions The degree of disagreement between the two (e.g., weighted variance).

[0101] b) Historical performance: Refer to similar scenarios and make similar decisions historical success rate.

[0102] c) Simulation verification: Rapid evaluation in a simplified simulation environment Possible effects.

[0103] d) Specific indicators: monitor whether certain key performance indicators (KPIs) are After implementation, it met expectations.

[0104] like (preset threshold), the latest data (S, L, T, K) is updated from the short-term / long-term database and the cloud, and the feature vector is reconstructed , and repeatedly perform weight calculation, expert reasoning, cost function construction and optimization solution steps.

[0105] This cycle continues until the decision confidence level meets the requirements, achieving closed-loop adaptation.

[0106] Furthermore, the confidence assessment comprehensive mechanism of the embodiment of the present application adopts a multi-dimensional confidence assessment system to achieve a comprehensive assessment of decision quality: Expert consensus score : Evaluate the degree of agreement among experts’ opinions: ; Among them, the higher the consistency, the closer the score is to 1.

[0107] Historical similarity score :By comparing the decision-making effects of similar historical scenarios: ; in, is a record of historical decisions, including feature vectors ,decision making and effects ; () Calculate the similarity between the current feature vector and the historical record; () Evaluate the success of historical decisions.

[0108] Simulation verification scoring : Quickly verify decision effects in a lightweight simulation environment: ; in, Decision making in a simulation environment The first KPI values, is the preset optimal value, The default worst value.

[0109] Uncertainty assessment : Evaluate the uncertainty of the current input data: ; in, is the input vector The estimated variance of each component, is the scaling factor.

[0110] Comprehensive calculation of confidence: multi-dimensional weighted integration: ; Among them, the weight It can be dynamically adjusted through methods such as reinforcement learning to optimize long-term decision quality.

[0111] Adaptive threshold: Dynamically adjust the threshold based on the urgency of the situation : ; in, is the basic threshold, Control the degree to which the threshold is lowered in emergency situations, Assess the urgency of the current scenario.

[0112] Finally, the collaborative enhancement module of the embodiment of the present application is introduced. .

[0113] Specifically, when the system involves a large number of drones, a collaborative enhancement module is introduced to achieve more efficient decision-making and execution.

[0114] Hierarchical decision-making architecture: drones are grouped into multiple clusters, with edge servers and agents in each cluster. ; Cross-cluster coordination: Clusters share summary information through a high-level coordination mechanism: ; in, It is a cluster A summary of the information shared, including key status, decision intent, and uncertainty assessment.

[0115] Discrepancy decision negotiation: When there is a conflict in the decisions of adjacent clusters, a negotiation mechanism is triggered: ; The specific negotiation process of the embodiment of the present application can use the game theory framework to seek Nash equilibrium or Pareto optimal solution.

[0116] Therefore, the agent will obtain the optimal decision vector It is sent to all relevant drones, and each drone will Each component performs corresponding operations (evacuation, communication switching, anti-interference, etc.) and feeds back the execution results to the system.

[0117] The LLM-based multi-machine collaborative abnormal data detection system 10 proposed in the present invention has the following significant effects: Achieving Efficient Multi-Drone Collaboration: By introducing intelligent agents at the edge, combined with a distributed data architecture and multi-layered model, efficient information sharing, state synchronization, and collaborative decision-making are achieved among drone clusters, effectively addressing the lack of effective multi-droneous collaboration mechanisms in related technologies. The Collaboration Enhancement Module further supports hierarchical management and conflict negotiation within large-scale clusters.

[0118] Optimize data processing and utilization: The innovative distributed short-term / long-term historical database design, combined with time window sliding aggregation, data validity scoring and other mechanisms, effectively processes multi-source asynchronous data, fully utilizes the advantages of real-time data onboard and at the edge, and alleviates the data processing and storage bottlenecks in related technologies.

[0119] Enhanced dynamic threat adaptability: The Agent's embedded MoE (Mixture of Experts) structure, combined with threat identification and a dynamic expert weight adjustment mechanism, can intelligently call upon the most relevant expert knowledge to make decisions based on real-time threat situations. This significantly improves the ability to respond to complex and new threats, overcoming the limitations of static threat response and insufficient knowledge utilization in related technologies.

[0120] Achieve resource-aware intelligent decision-making: The decision fusion module explicitly considers resource consumption models and constraints, and can optimize resource utilization efficiency while meeting task requirements. It balances decision-making effect and resource overhead through an adaptive solution algorithm, solving the problem of decision-making optimization difficulties under resource constraints in related technologies.

[0121] Excellent modularity and scalability: Based on standardized expert interfaces and dynamic registration / unloading mechanisms, the system can easily integrate new sensor data, models, expert knowledge, or decision logic. It has good scalability and can adapt to future technological developments and changes in mission requirements, alleviating the problem of insufficient system scalability and adaptability in related technologies.

[0122] Enhanced system robustness and adaptability: A multi-dimensional confidence assessment mechanism combined with a feedback loop adjustment module ensures reliable decision-making. The system can adaptively adjust based on decision confidence and environmental changes, and continuously optimize performance through closed-loop feedback, improving overall robustness in complex and dynamic environments.

[0123] Complete end-to-end solution: This invention provides a complete architecture and algorithm flow from data acquisition, multi-layer model analysis, distributed storage, intelligent agent decision fusion to collaborative command issuance, providing a systematic solution for achieving safe, efficient and intelligent multi-drone collaboration.

[0124] According to the LLM-based multi-machine collaborative anomaly data detection system 10 of the embodiment of the present application, an anomaly detection score is generated using the airborne terminal; a first historical feature is extracted from the first historical database in the edge server, and a binary anomaly detection label is obtained based on the first historical feature and the anomaly detection score, and a performance indicator vector is calculated. The binary anomaly detection label and the performance indicator vector are uploaded to the cloud; a long-term series prediction is performed on the cloud to obtain a long-term series prediction result, and a security analysis is performed to obtain a security analysis result. This solves the problems of the existing drone cluster in terms of multi-machine collaborative security, such as the lack of a mechanism, data processing bottlenecks, insufficient threat response, and poor system scalability, and achieves efficient multi-machine collaboration and optimizes data processing and utilization.

[0125] The following describes the LLM-based multi-machine collaborative abnormal data detection method proposed in this application and applied to the above-mentioned LLM-based multi-machine collaborative abnormal data detection system 10 with reference to the accompanying drawings.

[0126] Specifically, Figure 4 A flowchart of a multi-machine collaborative abnormal data detection method based on LLM provided in an embodiment of the present application.

[0127] like Figure 4 As shown, the LLM-based multi-machine collaborative abnormal data detection method includes the following steps: In step S401, at least one anomaly detection score is generated using the onboard terminal.

[0128] In step S402, features are extracted from the first historical database in the edge server to obtain a first historical feature, and a binary anomaly detection label is obtained based on the first historical feature and at least one anomaly detection score, and a performance indicator vector is calculated, and the binary anomaly detection label and the performance indicator vector are uploaded to the cloud.

[0129] In step S403, long time series prediction is performed using the cloud to obtain long time series prediction results, and security analysis is performed using the cloud to obtain security analysis results.

[0130] Furthermore, in some embodiments, at least one anomaly detection score is generated using an airborne terminal, including: obtaining local data and sampling data from drone sensors, and constructing a local data set based on the local data and the sampling data; performing anomaly detection processing on the local data set, and / or time series prediction processing, to generate at least one anomaly detection score.

[0131] Furthermore, in some embodiments, the LLM-based multi-machine collaborative anomaly data detection method also includes: obtaining a second historical feature from a second historical database in the cloud; uploading at least one anomaly detection score, a binary anomaly detection label, a performance indicator vector, a first historical feature, a second historical feature, a long time series prediction result, and a security analysis result to a decision agent in the edge server; based on a preset hybrid expert model mechanism, using the decision agent to perform a fusion calculation on at least one anomaly detection score, a binary anomaly detection label, a performance indicator vector, a first historical feature, a second historical feature, a long time series prediction result, and a security analysis result to obtain an optimal collaborative decision vector; based on the optimal collaborative decision vector, controlling at least one target drone to perform a multi-machine collaborative task.

[0132] Furthermore, in some embodiments, based on the optimal collaborative decision vector, controlling at least one target drone to perform a multi-machine collaborative task includes: converting the optimal collaborative decision vector into a target behavior instruction; and sending the target behavior instruction to at least one target drone through an edge server to control at least one target drone to perform the multi-machine collaborative task.

[0133] Furthermore, in some embodiments, after using the cloud to perform long-term series prediction to obtain long-term series prediction results, and using the cloud to perform security analysis to obtain security analysis results, it also includes: offline training and fine-tuning the model in the cloud to obtain updated model parameters; based on the updated model parameters, updating the model in the edge server and / or the model in the onboard terminal.

[0134] It should be noted that the aforementioned explanation of the LLM-based multi-machine collaborative abnormal data detection system embodiment is also applicable to the LLM-based multi-machine collaborative abnormal data detection method of this embodiment, and will not be repeated here.

[0135] According to the LLM-based multi-machine collaborative anomaly data detection method of the embodiment of the present application, an anomaly detection score is generated by the airborne terminal; a first historical feature is extracted from the first historical database in the edge server, and a binary anomaly detection label is obtained based on the first historical feature and the anomaly detection score, and a performance indicator vector is calculated. The binary anomaly detection label and the performance indicator vector are uploaded to the cloud; a long-term series prediction is performed on the cloud to obtain a long-term series prediction result, and a security analysis is performed to obtain a security analysis result. This solves the problems of the existing drone cluster in terms of multi-machine collaborative security, such as the lack of mechanism, data processing bottleneck, insufficient threat response, and poor system scalability, and achieves efficient multi-machine collaboration and optimizes data processing and utilization.

[0136] Next, the LLM-based multi-machine collaborative abnormal data detection system proposed according to an embodiment of the present application will be described with reference to the accompanying drawings.

[0137] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include: Memory 501 , processor 502 , and computer programs stored in the memory 501 and executable on the processor 502 .

[0138] When the processor 502 executes the program, the LLM-based multi-machine collaborative abnormal data detection method provided in the above embodiment is implemented.

[0139] Furthermore, the electronic device further includes: The communication interface 503 is used for communication between the memory 501 and the processor 502 .

[0140] The memory 501 is used to store computer programs that can be run on the processor 502 .

[0141] The memory 501 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0142] If the memory 501, processor 502, and communication interface 503 are implemented independently, the communication interface 503, memory 501, and processor 502 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0143] Optionally, in a specific implementation, if the memory 501, the processor 502 and the communication interface 503 are integrated on a chip, the memory 501, the processor 502 and the communication interface 503 can communicate with each other through an internal interface.

[0144] The processor 502 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0145] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned LLM-based multi-machine collaborative abnormal data detection method.

[0146] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or N embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine different embodiments or examples described in this specification and features of different embodiments or examples without contradiction.

[0147] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of such features. Throughout the description of this application, "plurality" means at least two, for example, two, three, etc., unless otherwise specifically defined.

[0148] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limitations on the present application. Ordinary technicians in this field can change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A multi-machine collaborative abnormal data detection system based on LLM, characterized by: The system comprises: A generating module, configured to generate at least one anomaly detection score using an onboard terminal; a processing module, configured to extract features from a first historical database in the edge server to obtain a first historical feature, obtain a binary anomaly detection label based on the first historical feature and the at least one anomaly detection score, calculate a performance indicator vector, and upload the binary anomaly detection label and the performance indicator vector to the cloud; The prediction and analysis module is used to use the cloud to perform long-term series prediction to obtain long-term series prediction results, and to use the cloud to perform security analysis to obtain security analysis results.

2. The LLM-based multi-machine collaborative abnormal data detection system according to claim 1 is characterized in that: The LLM-based multi-machine collaborative abnormal data detection system is also used to: Acquire a second historical feature from a second historical database in the cloud; Uploading the at least one anomaly detection score, the binary anomaly detection label, the performance indicator vector, the first historical feature, the second historical feature, the long time series prediction result, and the security analysis result to the decision agent in the edge server; Based on a preset hybrid expert model mechanism, the decision agent is used to perform a fusion calculation on the at least one anomaly detection score, the binary anomaly detection label, the performance indicator vector, the first historical feature, the second historical feature, the long time series prediction result, and the security analysis result to obtain an optimal collaborative decision vector; Based on the optimal collaborative decision vector, at least one target UAV is controlled to perform a multi-machine collaborative mission.

3. The LLM-based multi-machine collaborative abnormal data detection system according to claim 2 is characterized in that: The prediction and analysis module is used to: converting the optimal collaborative decision vector into a target behavior instruction; The target behavior instruction is sent to at least one target drone through the edge server to control the at least one target drone to perform a multi-machine collaborative task.

4. The LLM-based multi-machine collaborative abnormal data detection system according to claim 2 is characterized in that: The generating module is used to: Acquire local data and sampling data from drone sensors, and construct a local dataset based on the local data and the sampling data; Anomaly detection processing and / or time series prediction processing are performed on the local data set to generate the at least one anomaly detection score.

5. The LLM-based multi-machine collaborative abnormal data detection system according to claim 1 is characterized in that: After using the cloud to perform long-term series prediction and obtain long-term series prediction results, and using the cloud to perform security analysis and obtain security analysis results, the prediction and analysis module is further used to: Performing offline training and fine-tuning on the model in the cloud to obtain updated model parameters; Based on the updated model parameters, the model in the edge server and / or the model in the onboard terminal is updated.

6. The LLM-based multi-machine collaborative abnormal data detection system according to claim 1 is characterized in that: The LLM-based multi-machine collaborative abnormal data detection system has an embedded intelligent agent.

7. A multi-machine collaborative abnormal data detection method based on LLM, characterized in that: The method comprises the following steps: generating at least one anomaly detection score using an onboard terminal; Extracting features from a first historical database in the edge server to obtain a first historical feature, obtaining a binary anomaly detection label based on the first historical feature and the at least one anomaly detection score, calculating a performance indicator vector, and uploading the binary anomaly detection label and the performance indicator vector to the cloud; The cloud is used to perform long time series prediction to obtain long time series prediction results, and the cloud is used to perform security analysis to obtain security analysis results.

8. The LLM-based multi-machine collaborative abnormal data detection method according to claim 7 is characterized in that: Also includes: Acquire a second historical feature from a second historical database in the cloud; Uploading the at least one anomaly detection score, the binary anomaly detection label, the performance indicator vector, the first historical feature, the second historical feature, the long time series prediction result, and the security analysis result to the decision agent in the edge server; Based on a preset hybrid expert model mechanism, the decision agent is used to perform a fusion calculation on the at least one anomaly detection score, the binary anomaly detection label, the performance indicator vector, the first historical feature, the second historical feature, the long time series prediction result, and the security analysis result to obtain an optimal collaborative decision vector; Based on the optimal collaborative decision vector, at least one target UAV is controlled to perform a multi-machine collaborative mission.

9. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the multi-machine collaborative abnormal data detection method based on LLM as described in any one of claims 7 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program is executed by a processor to implement the LLM-based multi-machine collaborative abnormal data detection method as described in any one of claims 7-8.

Images