A method and system for detecting abnormal traffic of high-speed aircraft data link communication

Abstract

This invention relates to the field of abnormal traffic detection technology in data link communication, specifically a method and system for detecting abnormal traffic in high-speed aircraft data link communication. The method determines communication messages conforming to a preset data link communication protocol specification as protocol-layer compliant messages and parses them to obtain formation coordination instructions. It then collects multi-source mission context information from the high-speed aircraft to generate a snapshot of the mission execution scene. The formation coordination instructions are projected onto the snapshot for comparison and analysis to obtain multi-dimensional semantic comparison results. If all multi-dimensional semantic comparison results are passed, the corresponding communication traffic is determined to be mission-driven normal coordination traffic. If the multi-dimensional semantic comparison results are failed, the corresponding communication traffic is determined to be intention-masking deception abnormal traffic. This effectively identifies deception traffic that is protocol-layer compliant but has abnormal tactical intent, thereby improving the accuracy of abnormal traffic detection in high-speed aircraft data link communication.

Description

Technical Field

[0001] This invention relates to the field of abnormal traffic detection technology in data link communication, specifically a method and system for detecting abnormal traffic in data link communication of high-speed aircraft. Background Technology

[0002] The high-speed aircraft data link is the core information channel that supports real-time communication and collaborative control between multiple nodes in the formation. The reliability and security of the data link communication directly determine whether the formation's collaborative tasks can be completed smoothly. Therefore, effectively detecting abnormal traffic in the data link communication is an important prerequisite for ensuring the safe operation of the high-speed aircraft formation.

[0003] Currently, with the continuous evolution of attack methods, malicious attackers can construct fully compliant forged messages at the protocol layer by reverse engineering communication protocol specifications. These forged messages meet the specification requirements in terms of protocol format and field values, and traditional protocol layer detection methods cannot distinguish them from normal communication traffic. Even more insidiously, attackers can embed false triggering conditions inconsistent with the current environmental situation into the forged messages. For example, they can send a coordinated maneuver command claiming to be triggered due to danger avoidance when the local machine is not under danger. Once such a command is executed by a slave machine, it will cause the formation to produce incorrect coordinated response actions, seriously interfering with mission execution and even causing security incidents.

[0004] Therefore, there is a need to provide a detection method that can perform in-depth analysis of data link communication traffic, effectively identify deceptive traffic that is compliant at the protocol layer but has abnormal tactical intent, thereby improving the accuracy of abnormal traffic detection in high-speed aircraft data link communication. Summary of the Invention

[0005] (1) Technical problems to be solved

[0006] The purpose of this invention is to provide a method and system for detecting abnormal traffic in high-speed aircraft data link communication, so as to solve the problem that malicious attackers cannot effectively identify abnormal traffic that is forged in high-speed aircraft data link communication, which is compliant at the protocol layer but has unreasonable tactical semantics.

[0007] (2) Technical solution

[0008] To achieve the above objectives, on the one hand, the present invention provides a method for detecting abnormal traffic in high-speed aircraft data link communication, the method comprising:

[0009] S1. Obtain communication messages received by the high-speed aircraft data link, determine communication messages that conform to the preset data link communication protocol specifications as protocol layer compliant messages, and determine communication messages that do not conform to the preset data link communication protocol specifications as protocol layer abnormal traffic and filter them.

[0010] S2. Perform instruction semantic parsing on the protocol layer compliant message to obtain the formation coordination instruction. The formation coordination instruction includes an instruction category identifier, an instruction initiating node identifier, a description of the triggering conditions claimed by the instruction, and the coordination response parameters required by the instruction.

[0011] S3. Based on the reception time of the protocol layer compliant message, synchronously collect the multi-source mission context information of the local high-speed aircraft; generate a snapshot of the mission execution site corresponding to the reception time based on the multi-source mission context information.

[0012] S4. Project the formation coordination command onto the snapshot of the task execution site to perform a comparison analysis of the command's rationality and obtain a multi-dimensional semantic comparison result; if the judgment result of each comparison dimension in the multi-dimensional semantic comparison result is passed, then the corresponding communication traffic is judged as task-driven normal coordination traffic; if the judgment result of any comparison dimension in the multi-dimensional semantic comparison result is failed, then the corresponding communication traffic is judged as intentional spoofing deception abnormal traffic, and the detection result is output.

[0013] Furthermore, the method for generating a snapshot of the task execution context corresponding to the receiving time based on the multi-source task context information includes:

[0014] The mission flow planning data pre-installed on the local high-speed aircraft is extracted from the multi-source mission context information. The mission flow planning data includes multiple mission nodes arranged in chronological order and a set of permitted actions corresponding to each mission node. The current mission node of the local high-speed aircraft at the receiving time is determined by matching the receiving time with the preset execution time window of each mission node in the mission flow planning data, and the current mission node is marked as a mission process stage.

[0015] The hazard situation awareness results of the local high-speed aircraft are extracted from the multi-source mission context information. The external hazard exposure level of the local high-speed aircraft is obtained by comprehensive quantitative processing based on the hazard situation awareness results and the relative distance between the hazard source and the local high-speed aircraft.

[0016] Extract the node roles and corresponding command transmission and reception permissions of the local high-speed aircraft in the leader-slave formation from the multi-source mission context information, and generate the formation coordination state by combining the communication link connectivity status of each node; after timestamp-aligning and encapsulating the mission process stage, external hazard exposure level and formation coordination state, generate a mission execution scene snapshot that corresponds one-to-one with the receiving time.

[0017] Furthermore, the method for obtaining the external hazard exposure level of the high-speed aircraft by comprehensively quantifying the hazard situation perception results and the relative distance between the hazard source and the aircraft includes:

[0018] The hazard situation awareness results are analyzed to extract the hazard source type identifiers of each hazard source within the current detection coverage area and the relative distance between each hazard source and the local high-speed aircraft. Based on a preset correspondence table of hazard source types and hazard weights, a type hazard weight corresponding to its hazard source type identifier is assigned to each hazard source. The relative distance between each hazard source and the local high-speed aircraft is used to calculate the distance hazard factor corresponding to each hazard source using a distance attenuation function. The single-source hazard contribution value of each hazard source is calculated based on its type hazard weight and corresponding distance hazard factor. The single-source hazard contribution values ​​of all hazard sources are summed to obtain a comprehensive hazard quantification value. The external hazard exposure level of the local high-speed aircraft is determined based on the comprehensive hazard quantification value.

[0019] Furthermore, the method for extracting the node roles and corresponding command transmission and reception permission mapping relationships of the local high-speed aircraft in the leader-slave formation structure from the multi-source task context information, and generating the formation coordination state by combining the communication link connectivity status of each node, includes:

[0020] The pre-installed formation networking configuration table is extracted from the multi-source task context information. The formation networking configuration table records the node identifier of each node in the formation and the node role that each node plays in the leader-slave formation structure. The node role includes leader role and slave role.

[0021] The node role corresponding to the node identifier of the local high-speed aircraft is queried according to the formation networking configuration table; the set of legal instruction source nodes when the current node role of the local high-speed aircraft acts as the instruction receiver is determined according to the instruction transmission and reception permission mapping relationship of the leader-slave formation structure.

[0022] At the receiving time, the communication link connectivity status of each node in the set of legitimate instruction source nodes is obtained by detecting the communication link connectivity of each node; based on the communication link connectivity status, nodes whose current communication links are interrupted are filtered out from the set of legitimate instruction source nodes to obtain the set of actual valid instruction source nodes at the current time; the instruction sending and receiving permission mapping relationship and the set of actual valid instruction source nodes at the current time are encapsulated to obtain the formation coordination state.

[0023] Furthermore, the method for determining the set of legitimate instruction source nodes when the current node role of the local high-speed aircraft is the instruction receiver based on the instruction transmission and reception permission mapping relationship of the leader-slave formation structure includes:

[0024] The command transmission and reception permission mapping relationship of the leader-slave formation structure is read from the pre-installed formation command permission configuration data; according to the node role of the local high-speed aircraft, the source node role type authorized to receive commands when the local high-speed aircraft is the command receiver is queried in the command transmission and reception permission mapping relationship; according to the source node role type, all nodes undertaking the source node role type are traversed and retrieved in the formation networking configuration table, and the node identifier corresponding to each node is extracted; all the retrieved node identifiers are aggregated and integrated to obtain the set of legal command source nodes when the local high-speed aircraft is the command receiver.

[0025] Furthermore, the method for obtaining the communication link connectivity status of each node in the set of legitimate instruction source nodes at the receiving time through communication link connectivity detection includes:

[0026] Using the received time as the probe reference time, a link probe request message is sent to the node corresponding to each node identifier in the set of legitimate command source nodes; it records whether each node returns a link probe response message within a preset response time limit in response to the link probe request message; if a node returns a link probe response message within the preset response time limit, the communication link connectivity status of that node is marked as connected; if a node does not return a link probe response message within the preset response time limit, the communication link connectivity status of that node is marked as interrupted.

[0027] Furthermore, the method for projecting the formation coordination command onto the snapshot of the task execution site to perform comparative analysis on the rationality of the command and obtain multi-dimensional semantic comparison results includes:

[0028] Extract instruction category identifiers from the formation coordination instructions, and perform attribute determination on the coordination actions pointed to by the instruction category identifiers and the set of permitted actions corresponding to the task process stage to obtain the task stage comparison results.

[0029] Extract the instruction initiating node identifier from the formation coordination instruction, and match the instruction initiating node identifier with the set of actual valid instruction source nodes in the current moment in the formation coordination state to obtain the node authorization comparison result.

[0030] Extract the trigger condition description claimed by the formation coordination command, and verify the causal correlation between the trigger condition description and the external hazard exposure level to obtain the trigger condition comparison result.

[0031] Extract the required collaborative response parameters from the formation collaboration command, perform a feasibility check on the collaborative response parameters with the physical reachability domain defined by the real-time platform state variables of the local high-speed aircraft to obtain the response parameter comparison results; summarize the task phase comparison results, node authorization comparison results, trigger condition comparison results and response parameter comparison results to generate a multi-dimensional semantic comparison result.

[0032] Furthermore, the method for extracting instruction category identifiers from the formation coordination instructions and classifying the coordination actions pointed to by the instruction category identifiers with the set of permitted actions corresponding to the task process stage to obtain the task stage comparison result includes:

[0033] The system queries the corresponding collaborative action identifier for each instruction category identifier based on a pre-defined mapping table between instruction categories and collaborative actions. It then reads the task process phase from a snapshot of the task execution site and retrieves the set of permitted actions corresponding to that phase from the pre-installed task flow planning data on the high-speed aircraft. This set of permitted actions contains all collaborative action identifiers allowed to be executed within the current task process phase. If the collaborative action identifier exists in the set of permitted actions, the task phase comparison result is determined to be phase permitted and marked as passed. If the collaborative action identifier does not exist in the set of permitted actions, the task phase comparison result is determined to be phase prohibited and marked as failed.

[0034] Furthermore, the method for extracting the trigger condition description claimed by the formation coordination command from the command, and verifying the causal correlation between the trigger condition description and the external hazard exposure level to obtain the trigger condition comparison result includes:

[0035] Semantic parsing is performed on the trigger condition description claimed by the instruction to extract the claimed hazard type and claimed hazard level from the trigger condition description; the external hazard exposure level and the currently perceived hazard type are read from the snapshot of the task execution site, and the claimed hazard type and the currently perceived hazard type are compared for type consistency to obtain a hazard type matching result; the claimed hazard level and the external hazard exposure level are compared for level relationship to obtain a hazard level matching result. If the hazard type matching result is consistent and the hazard level matching result is achieved, the trigger condition comparison result is determined to have causal support and is marked as passed; otherwise, the trigger condition comparison result is determined to have no causal support and is marked as failed.

[0036] On the other hand, based on the same inventive concept, the present invention also provides a high-speed aircraft data link communication abnormal traffic detection system, the system comprising: a protocol layer compliance determination and filtering module, an instruction semantic parsing module, a mission execution site snapshot generation module, and a traffic abnormality detection and result output module, wherein each module is connected in a sequential communication manner;

[0037] The protocol layer compliance determination and filtering module is used to acquire communication packets received by the high-speed aircraft data link, determine communication packets that conform to the preset data link communication protocol specifications as protocol layer compliant packets, and determine communication packets that do not conform to the preset data link communication protocol specifications as protocol layer abnormal traffic and filter them.

[0038] The instruction semantic parsing module is used to perform instruction semantic parsing on the protocol layer compliant message to obtain the formation coordination instruction. The formation coordination instruction includes an instruction category identifier, an instruction initiating node identifier, a description of the triggering conditions claimed by the instruction, and the coordination response parameters required by the instruction.

[0039] The task execution scene snapshot generation module is used to synchronously collect multi-source task context information of the local high-speed aircraft based on the reception time of the protocol layer compliant message; and generate a task execution scene snapshot corresponding to the reception time based on the multi-source task context information.

[0040] The traffic anomaly detection and result output module is used to project the formation coordination command onto the task execution site snapshot to compare and analyze the rationality of the command to obtain a multi-dimensional semantic comparison result; if the judgment result of each comparison dimension in the multi-dimensional semantic comparison result is passed, the corresponding communication traffic is judged as task-driven normal coordination traffic; if the judgment result of any comparison dimension in the multi-dimensional semantic comparison result is failed, the corresponding communication traffic is judged as intentional spoofing deception anomaly traffic, and the detection result is output.

[0041] (3) Beneficial effects

[0042] Compared with the prior art, the beneficial effects of the present invention are:

[0043] 1. By placing data link communication traffic in a multi-source task context for tactical semantic level consistency verification, the high-speed aircraft is equipped with the ability to identify deceptive traffic that is compliant at the protocol layer but has abnormal tactical intent. This can effectively detect malicious attackers' carefully constructed intention-disguised deceptive abnormal traffic, fundamentally making up for the detection blind spots of existing detection methods when facing advanced deception attacks.

[0044] 2. By constructing a snapshot of the task execution site that includes the task process stage, external hazard exposure level, and formation coordination status, and by comprehensively comparing and analyzing formation coordination instructions from four dimensions—task stage attribution, node authorization legality, trigger condition causality, and response parameter feasibility—a multi-dimensional semantic comparison mechanism covering task logic, permission constraints, situational awareness, and physical limitations is formed. As long as the instruction shows contradictions in any comparison dimension, it can be identified as abnormal traffic, significantly improving the accuracy and completeness of abnormal traffic detection.

[0045] 3. It enables high-speed aircraft to quickly perform semantic-level judgment on whether the command is reasonable in the current tactical situation when receiving formation coordination commands, effectively preventing erroneous coordination response actions caused by executing forged deception commands, ensuring the safe execution of formation coordination missions, and realizing a leap from communication security to tactical decision security. Attached Figure Description

[0046] Figure 1 This is a flowchart of a method for detecting abnormal traffic in high-speed aircraft data link communication according to Embodiment 1 of the present invention.

[0047] Figure 2 This is a schematic diagram of the module composition of a high-speed aircraft data link communication abnormal traffic detection system according to Embodiment 2 of the present invention. Detailed Implementation

[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Example 1: As Figure 1 As shown in the figure, this embodiment provides a method for detecting abnormal traffic in high-speed aircraft data link communication. The method includes:

[0050] S1. Acquire communication messages received via the high-speed aircraft's data link. Messages conforming to the preset data link communication protocol specification are deemed compliant at the protocol layer, while those not conforming are classified as abnormal traffic and filtered. The preset data link communication protocol specification refers to the communication protocol standard pre-agreed and loaded by each node in the formation before mission execution. This standard clearly defines the frame structure format, field definitions, value ranges, verification algorithms, and other technical elements of the communication messages. Taking a typical formation coordination command message as an example, its protocol specification typically includes fields such as the synchronization word sequence in the message header, message type identifier, source node address, target node address, message length indicator, payload data, and cyclic redundancy check (CRC) code for integrity verification. Each field has clearly defined byte position, data type, and legal value range constraints. For example, after capturing a communication message, the high-speed aircraft's data link receiving module sequentially performs a compliance check on each field of the message. The checks include, but are not limited to: whether the synchronization word sequence matches the preset value, whether the message type identifier belongs to the defined set of legal types, whether the source node address and destination node address are valid node identifiers registered within the queue, whether the message length indicator value matches the actual message payload length, and whether the cyclic redundancy check (CRC) calculation result matches the check value carried in the message. If a communication message fails to meet the specifications in any of the above checks, such as having an undefined message type identifier, a node address outside the legal range, or a mismatch in the check value calculation result, the message is determined to be abnormal protocol layer traffic and is immediately filtered, and will not proceed to the subsequent semantic layer analysis stage. Only communication messages that meet all the specifications can be determined to be protocol layer compliant messages and proceed to the next processing stage.

[0051] S2. Perform instruction semantic parsing on the protocol layer compliant messages to obtain formation coordination instructions. These instructions include an instruction category identifier, an instruction initiating node identifier, a description of the triggering conditions claimed by the instruction, and the required coordination response parameters. For messages that pass the protocol layer compliance screening, further perform instruction semantic parsing on their payload data to extract four types of information elements crucial for subsequent tactical semantic comparison. The first type of information element is the instruction category identifier, used to indicate the specific type of the coordination instruction. In high-speed aircraft formation coordination combat scenarios, common instruction categories include formation adjustment instructions, coordinated attack instructions, coordinated evasion instructions, coordinated reconnaissance instructions, and return-to-base regrouping instructions. The instruction category identifier determines what type of coordinated action the slave aircraft is required to perform. The second type of information element is the instruction initiating node identifier, used to indicate the source node of the coordination instruction. In a leader-slave formation structure, nodes with different roles have different instruction sending permissions. The third type of information element is the description of the triggering conditions claimed by the instruction, used to explain under what situational conditions the coordination instruction was triggered. Taking a coordinated evasion command as an example, its triggering conditions typically state that the lead aircraft has detected a certain type of hazard, the hazard is within a certain hazard threshold range of the formation, and the formation needs to immediately execute evasive maneuvers. The fourth type of information element consists of the coordinated response parameters required by the command, which specify the concrete parameter objectives that the slave aircraft needs to achieve when executing the coordinated command. For example, the response parameters for a coordinated evasion command might include requiring the slave aircraft to adjust its course to a specified azimuth angle, its altitude to a specified altitude level, and its speed to a specified speed range within a specified time limit.

[0052] S3. Based on the reception time of the compliant message at the protocol layer, synchronously collect multi-source mission context information of the high-speed aircraft. Generate a mission execution snapshot corresponding to the reception time based on the multi-source mission context information. Multi-source mission context information refers to a multi-dimensional data set that can comprehensively depict the mission situation of the high-speed aircraft at the time of command reception. Its sources include mission flow data pre-installed in the mission planning system, real-time dangerous situation data perceived by airborne sensors, and formation structure and communication status data maintained by the formation networking management system. The mission execution snapshot provides an objective, complete, and time-synchronized reference benchmark for subsequent command rationality comparison and analysis. By comparing the various information claimed in the formation coordination command with the actual state recorded in the mission execution snapshot one by one, it is possible to effectively identify forged commands that are compliant at the protocol layer but have logical contradictions with the current mission situation at the tactical semantic level.

[0053] S4. Project the formation coordination command onto the snapshot of the task execution site to perform a comparative analysis of the command's rationality and obtain a multi-dimensional semantic comparison result. If the judgment results of each comparison dimension in the multi-dimensional semantic comparison result are all passed, the corresponding communication traffic is judged as task-driven normal coordination traffic. If the judgment result of any comparison dimension in the multi-dimensional semantic comparison result is failed, the corresponding communication traffic is judged as intention-masking deception abnormal traffic, and the detection result is output. The judgment results of the four comparison dimensions adopt a judgment strategy of logical summarization: only when the judgment results of the four dimensions of task stage attribution comparison, node authorization legality comparison, trigger condition causality comparison, and response parameter feasibility comparison are all passed, the communication traffic can be judged as task-driven normal coordination traffic, indicating that the command has complete logical consistency with the current task context at the tactical semantic level; if the judgment result of any one of the four comparison dimensions is failed, the communication traffic is judged as intention-masking deception abnormal traffic. By employing four dimensions and logical judgment, this system can effectively identify malicious traffic that is compliant at the protocol layer but exhibits tactical semantic anomalies. Commands determined to be normal, task-driven collaborative traffic are allowed to enter the local command execution phase; commands determined to be malicious traffic are intercepted and trigger security alerts to prevent the local machine from executing forged commands and generating erroneous collaborative response actions. The detection results output can also include detailed information such as which comparison dimension failed and the specific reason for the failure, for subsequent security posture analysis and source tracing.

[0054] The method for generating a snapshot of the task execution status corresponding to the receiving time based on the multi-source task context information includes:

[0055] The mission flow planning data pre-installed on the high-speed aircraft is extracted from the multi-source mission context information. The mission flow planning data includes multiple mission nodes arranged in chronological order and a set of permitted actions corresponding to each mission node. The current mission node of the high-speed aircraft at the receiving time is determined by matching the receiving time with the preset execution time window of each mission node in the mission flow planning data, and the current mission node is marked as a mission process stage. The mission flow planning data refers to the mission execution plan uniformly planned by the command and control system and pre-installed on each formation node before the high-speed aircraft formation executes the mission. The mission execution plan decomposes the entire mission into multiple mission nodes in a chronological order, and each mission node corresponds to a specific stage in the mission execution process. Taking a typical high-speed aircraft formation penetration and strike mission as an example, the mission flow planning data may include the following sequence of mission nodes: Mission Node 1 is the launch and ascent phase, with a preset execution time window from 0 to 120 seconds after mission initiation. The permitted actions in this phase only include basic actions such as attitude stabilization and initial navigation; Mission Node 2 is the formation assembly phase, with a preset execution time window from 120 to 300 seconds. The permitted actions in this phase include formation organization actions such as formation adjustment, altitude coordination, and speed synchronization; Mission Node 3 is the cruise penetration phase, with a preset execution time window from 300 to 900 seconds. The permitted actions in this phase are expanded to include penetration actions such as route changes, coordinated evasion, and electronic jamming; Mission Node 4 is the terminal attack phase, with a preset execution time window from 900 to 1020 seconds. The permitted actions in this phase include strike actions such as target allocation, coordinated attack, and damage assessment; Mission Node 5 is the mission termination phase, which is the state after the attack is completed. When determining the task progress stage, the reception time of the protocol layer compliant message is matched with the preset execution time window of each task node in the task flow planning data. For example, if the elapsed time between the reception time and the task start time is T, then the preset execution time windows of each task node are traversed to find the task node that satisfies the condition that the start time of the time window is less than or equal to T and the end time of the time window is greater than T. This task node is marked as the current task node of the high-speed aircraft at the reception time, and it is recorded as the task progress stage in the task execution site snapshot.

[0056] The hazard situation awareness results of the high-speed aircraft are extracted from the multi-source mission context information. Based on these hazard situation awareness results and the relative distances between hazard sources and the high-speed aircraft, a comprehensive quantitative processing is performed to obtain the external hazard exposure level of the high-speed aircraft. The hazard situation awareness results originate from various sensor systems carried by the high-speed aircraft, including but not limited to radar warning receivers, infrared warning devices, and electronic reconnaissance equipment. These sensor systems continuously monitor the hazard situation in the surrounding airspace and detect various hazard sources that may pose a threat to the aircraft in real time. The hazard situation awareness results typically include the type and location information of each hazard source within the current detection coverage area. Hazard source types may include enemy air defense radar illumination, enemy electronic jamming, etc.; the location information represents the relative distance between each hazard source and the high-speed aircraft.

[0057] The node roles and corresponding command transmission / reception permission mappings of the local high-speed aircraft in the leader-slave formation structure are extracted from the multi-source mission context information. A formation coordination state is generated by combining the communication link connectivity status of each node. After timestamp-aligned encapsulation of the mission process stage, external hazard exposure level, and formation coordination state, a mission execution snapshot corresponding one-to-one with the reception time is generated. Timestamp alignment means that all three types of information are collected and recorded using the reception time of the protocol-layer compliant message as a unified time reference, ensuring their consistency in the time dimension. The mission execution snapshot generated after timestamp alignment and encapsulation fully depicts the mission situation and state of the local high-speed aircraft at the moment it receives a specific protocol-layer compliant message.

[0058] The method for obtaining the external hazard exposure level of the high-speed aircraft by comprehensively quantifying the hazard situation perception results and the relative distance between the hazard source and the aircraft includes:

[0059] The hazard situation awareness results are analyzed to extract the hazard source type identifiers and relative distances between each hazard source and the high-speed aircraft within the current detection coverage area. Based on a pre-defined correspondence table of hazard source types and hazard weights, each hazard source is assigned a type hazard weight corresponding to its hazard source type identifier. The relative distance between each hazard source and the high-speed aircraft is used to calculate the distance hazard factor corresponding to each hazard source using a distance attenuation function. The single-source hazard contribution value of each hazard source is calculated based on its type hazard weight and corresponding distance hazard factor. The single-source hazard contribution values ​​of all hazard sources are summed to obtain a comprehensive hazard quantification value. The external hazard exposure level of the high-speed aircraft is determined based on the comprehensive hazard quantification value. Hazard source type identifiers are used to distinguish different types of hazard sources, while relative distance represents the spatial proximity of the hazard source to the aircraft. In typical scenarios where high-speed aircraft are performing missions, the types of hazard sources that may be encountered include, but are not limited to: enemy search radar illumination, indicating that the aircraft may have been detected by an enemy long-range early warning system; and enemy electronic interference, indicating that the enemy is attempting to interfere with the aircraft's navigation or communication systems through electromagnetic means. Different types of hazards pose significantly different threats to the aircraft's mission execution and survival, thus requiring different hazard weights. Based on a pre-defined table of hazard types and hazard weights, the command and control system pre-configures and loads these weights during the mission preparation phase, taking into account the characteristics of the enemy's air defense system and the aircraft's penetration strategy. The specific weight values ​​can be adjusted according to the actual combat environment and mission characteristics. For the same type of hazard, the closer it is to the aircraft, the greater the threat. The distance attenuation function should reflect the characteristic that the degree of danger decreases with increasing distance. A typical distance attenuation function can adopt a piecewise linear or exponential attenuation form. Taking the piecewise linear form as an example, close-range and long-range thresholds can be set. When the distance to the hazard is less than the close-range threshold, the distance hazard factor reaches its maximum value of 1.0, indicating that the hazard is within a high-threat range. When the distance to the hazard is between the close-range and long-range thresholds, the distance hazard factor decreases linearly with distance. When the distance to the hazard is greater than the long-range threshold, the distance hazard factor reaches its minimum value or approaches zero, indicating that the hazard has been detected but is still within a low-threat range. The individual hazard contribution value of each hazard source is calculated based on its type hazard weight and corresponding distance hazard factor. Specifically, the type hazard weight is multiplied by the distance hazard factor; that is, the individual hazard contribution value equals the type hazard weight multiplied by the distance hazard factor. The individual hazard contribution values ​​of all hazard sources are then summed to obtain a comprehensive hazard quantification value. This summation reflects the cumulative effect of hazard levels when multiple hazard sources exist simultaneously. The classification of external hazard exposure levels adopts a preset mapping rule between quantification value ranges and levels.Taking the five-level classification as an example, a comprehensive risk quantification value in the range of 0 to 0.2 corresponds to no risk level, 0.2 to 0.4 corresponds to low risk level, 0.4 to 0.6 corresponds to medium risk level, 0.6 to 0.8 corresponds to high risk level, and above 0.8 corresponds to extremely high risk level.

[0060] The method for extracting the node roles and corresponding command transmission and reception permission mappings of the local high-speed aircraft in the leader-slave formation structure from the multi-source mission context information, and generating the formation coordination state by combining the communication link connectivity status of each node, includes:

[0061] The pre-installed formation networking configuration table is extracted from the multi-source mission context information. This table records the node identifiers of each node within the formation and the node roles each node assumes in the leader-follower formation structure. These node roles include leader roles and follower roles. The formation networking configuration table is basic configuration data uniformly planned and pre-installed on each formation node during the mission preparation phase by the command and control system. It records the node identifiers of each node within the formation and the node roles each node assumes in the leader-follower formation structure. The node identifier is a unique identification code for each high-speed aircraft within the formation, used to distinguish different formation members during communication. The node role indicates the node's position in the formation command and control hierarchy. In a typical leader-follower formation structure, node roles are divided into leader roles and follower roles. Taking a four-aircraft formation as an example, the formation network configuration table might include the following: the high-speed aircraft with node identifier HV-001 assumes the role of leader, the high-speed aircraft with node identifier HV-002 assumes the role of follower, the high-speed aircraft with node identifier HV-003 assumes the role of follower, and the high-speed aircraft with node identifier HV-004 assumes the role of follower. This configuration table clearly defines HV-001 as the formation command core, responsible for sending coordination commands to the other three follower aircraft, while HV-002, HV-003, and HV-004, as follower aircraft, are responsible for receiving and executing the leader's commands.

[0062] The system queries the node role corresponding to the node identifier of the local high-speed aircraft according to the formation network configuration table; it determines the set of legal instruction source nodes when the local high-speed aircraft's current node role is the instruction receiver according to the instruction transmission and reception permission mapping relationship of the leader-slave formation structure; and it queries the node role corresponding to the node identifier of the local high-speed aircraft according to the formation network configuration table. The query operation enables the local aircraft to clearly understand its own position in the formation.

[0063] At the receiving time, the communication link connectivity status of each node in the set of legitimate instruction source nodes is obtained through communication link connectivity detection. Based on the communication link connectivity status, nodes whose current communication links are interrupted are filtered out from the set of legitimate instruction source nodes, resulting in the set of actually valid instruction source nodes at the current time. The instruction sending and receiving permission mapping relationship and the set of actually valid instruction source nodes at the current time are encapsulated to obtain the formation coordination state. The logic of the filtering operation is: if the communication link between a node and the local machine is interrupted, then from the physical communication level, the local machine should not be able to receive communication messages from that node. If the local machine still receives a coordination instruction message claiming to be from that node when the link is interrupted, there are two possibilities: one is that the message is a deceptive message forged by an attacker, who impersonates the node identifier of the interrupted node; the other is that there is an error in the communication link status detection, and the link is not actually completely interrupted. For security reasons, nodes with interrupted links are excluded from the set of valid instruction sources. Using the above four-machine formation example, assume that the local machine is HV-003 slave machine, and its legitimate instruction source node set is the leader node HV-001. At the receiving time, a communication link connectivity probe is performed. If the probe result shows that the communication link between HV-001 and HV-003 is connected, then the set of actually valid instruction source nodes at the current time is HV-001; if the probe result shows that the link is interrupted, then the set of actually valid instruction source nodes at the current time is empty. The formation coordination state fully records the instruction receiving permission constraints of the local machine in the formation and which nodes are actually qualified to send instructions to the local machine at the receiving time, providing a reference benchmark for subsequent comparison of node authorization legitimacy.

[0064] The method for determining the set of legitimate instruction source nodes when the current node role of the local high-speed aircraft is the instruction receiver, based on the instruction transmission and reception permission mapping relationship of the leader-slave formation structure, includes:

[0065] The command transmission and reception permission mapping relationship of the leader-slave formation structure is read from the pre-installed formation command permission configuration data. Based on the node role of the local high-speed aircraft, the source node role type authorized to receive commands when the local high-speed aircraft acts as the command receiver is queried from the command transmission and reception permission mapping relationship. Based on the source node role type, all nodes undertaking the source node role type are traversed and retrieved in the formation network configuration table, and the corresponding node identifiers are extracted for each node. All retrieved node identifiers are aggregated and integrated to obtain the set of legal command source nodes when the local high-speed aircraft acts as the command receiver. The formation command permission configuration data is the permission management data pre-configured and loaded into each formation node by the command and control system during the mission preparation phase, based on the formation organizational structure and command relationships. The command transmission and reception permission mapping relationship defines the command transmission authorization between different roles within the formation in the form of rules. Each rule describes which role nodes a node of a certain role is authorized to receive commands from when acting as the command receiver. In a typical single-leader formation, the command transmission and reception permission mapping relationship can be expressed as the following rule set: Rule 1, when the command receiver role is a slave role, the authorized source node role type for receiving commands is the leader role; Rule 2, when the command receiver role is the leader role, the authorized source node role type for receiving commands is empty, meaning the leader usually does not receive cooperative commands from slaves. Based on the node role of the local high-speed aircraft, the command transmission and reception permission mapping relationship is queried to find the authorized source node role type when the local aircraft is the command receiver. For example, using the local high-speed aircraft's node role as the query condition, a match is performed in the rule set of the command transmission and reception permission mapping relationship to find rules where the command receiver role matches the local aircraft's node role, and the authorized source node role type is extracted from this rule. Based on the extracted source node role type, the formation network configuration table is traversed to retrieve all nodes that assume that source node role type. The formation network configuration table records the node identifiers and node roles of all nodes in the formation; by traversing this table, all nodes whose role types match the source node role types can be found. The aggregation and integration operation organizes the search results into a set data structure, facilitating subsequent determination of node membership. If the formation structure is more complex, the set of legitimate instruction source nodes may contain multiple elements. For example, in a dual-leader redundant formation structure, the formation is configured with a primary leader HV-001 and a backup leader HV-002. The instruction sending and receiving permission mapping relationship stipulates that slave nodes are authorized to receive collaborative instructions from either the primary leader or the backup leader. Therefore, for slave node HV-003, its legitimate instruction source node set is a set containing both HV-001 and HV-002.

[0066] The method for obtaining the communication link connectivity status of each node in the set of legitimate instruction source nodes at the receiving time through communication link connectivity detection includes:

[0067] The system sends link probe request messages to the nodes corresponding to the node identifiers in the set of legitimate instruction source nodes, using the received time as the probe reference time. It records whether each node returns a link probe response message within a preset response time limit. If a node returns a link probe response message within the preset response time limit, its communication link connectivity is marked as connected; if a node does not return a link probe response message within the preset response time limit, its communication link connectivity is marked as interrupted. The link probe request message is a dedicated message type in the data link communication protocol used to detect the connectivity of communication links. It is typically a lightweight, short message containing basic fields such as the source node identifier, the target node identifier, the probe sequence number, and the sending timestamp. The purpose of sending the link probe request message is to verify whether the communication link between the local machine and the legitimate instruction source node is in a normal connected state at the same time as receiving the compliant protocol layer message to be detected. Since the connectivity of the communication link may change dynamically over time, using the received time as the probe reference time ensures the consistency of the probe results with the message to be detected in time. The link probe response message is a response message generated and returned by the probed node according to the protocol specification after receiving the link probe request message. Its existence and return latency are direct indicators of the communication link's connectivity. The preset response timeout is a timeout threshold pre-set based on the transmission delay characteristics of the data link communication system. It defines how long a link interruption can be determined without receiving a response message. Setting the preset response timeout requires comprehensive consideration of factors such as data link transmission bandwidth, signal processing latency, and the maximum communication distance between nodes in the formation. In typical application scenarios of high-speed aircraft formation data links, considering that the distance between formation nodes is usually in the range of several kilometers to tens of kilometers, the electromagnetic wave propagation delay is on the order of microseconds, and considering the time for message processing and response generation, the preset response timeout is usually set in the range of tens to hundreds of milliseconds. If the application scenario involves multi-hop transmission such as relaying, the preset response timeout needs to be extended accordingly. If a node returns a link probe response message within the preset response time limit, it indicates that the link probe request message sent by the local machine was successfully transmitted to the node and processed correctly, and the link probe response message generated by the node was also successfully transmitted back to the local machine, indicating that the bidirectional transmission function of the communication link is normal. If a node does not return a link probe response message within the preset response time limit, there may be several reasons: First, the link probe request message sent by the local machine was lost during transmission and failed to reach the target node; second, although the target node received the request message, it failed to generate a response message due to its own failure; third, the response message generated by the target node was lost during the return transmission. Regardless of the specific reason, the fact that no response message was received within the response time limit indicates that the current communication link function is in an abnormal state and reliable bidirectional communication cannot be guaranteed. The communication link connectivity status of this node is marked as interrupted.

[0068] The method for projecting the formation coordination command onto the snapshot of the mission execution site to compare and analyze the rationality of the command and obtain multi-dimensional semantic comparison results includes:

[0069] Extract instruction category identifiers from the formation coordination instructions, and perform attribute determination on the coordination actions pointed to by the instruction category identifiers and the set of permitted actions corresponding to the task process stage to obtain the task stage comparison results;

[0070] The instruction initiating node identifier is extracted from the formation coordination instruction. This identifier is then matched against the set of currently valid instruction source nodes in the formation coordination state to obtain a node authorization comparison result. The instruction initiating node identifier is a field in the formation coordination instruction used to identify the source of the instruction, recording the identity information of the node sending the instruction. The system checks whether the instruction initiating node identifier belongs to the set of currently valid instruction source nodes. If the identifier exists in the set, it indicates that the node initiating the instruction does indeed have valid authorization to send coordination instructions to the local machine, and the node authorization comparison result is deemed successful. If the identifier does not exist in the set, it indicates that the node initiating the instruction either does not have the authority to send instructions to the local machine, or although it has the authority, the current communication link is interrupted, and the node authorization comparison result is deemed unsuccessful.

[0071] Extract the trigger condition description claimed by the formation coordination command, and verify the causal correlation between the trigger condition description and the external hazard exposure level to obtain the trigger condition comparison result;

[0072] The coordinated response parameters required by the formation coordination command are extracted. These parameters are then compared with the physical reachability domain defined by the real-time platform state variables of the local high-speed aircraft to obtain a feasibility verification result. The task phase comparison result, node authorization comparison result, trigger condition comparison result, and response parameter comparison result are then summarized to generate a multi-dimensional semantic comparison result. The coordinated response parameters are fields in the formation coordination command used to specify the specific objectives that the slave aircraft needs to achieve when executing the command. These parameters may include target heading, target altitude, target speed, execution time limit, etc. The real-time platform state variables of the local high-speed aircraft include parameters reflecting the current flight state and capability boundaries, such as current heading, current altitude, current speed, current overload, and remaining fuel. The physical reachability domain refers to the range of state parameters that the local aircraft can maneuver to reach within a specified time limit under the constraints of its current platform state variables. The calculation of the physical reachability domain needs to comprehensively consider physical constraints such as the aerodynamic performance envelope, power system characteristics, and structural strength limitations of the machine. It is necessary to verify whether all the cooperative response parameters required by the command fall within the range of the machine's physical reachability domain. If all parameters are reachable, the response parameter comparison result is judged as passing; if any parameter is unreachable, it is judged as failing.

[0073] The method for extracting instruction category identifiers from the formation coordination instructions and classifying the coordination actions pointed to by the instruction category identifiers with the set of permitted actions corresponding to the task process stage to obtain the task stage comparison result includes:

[0074] The system queries the corresponding collaborative action identifier based on a pre-defined mapping table between instruction categories and collaborative actions. It then reads the mission process phase from a snapshot of the mission execution site and retrieves the set of permitted actions corresponding to that phase from the mission flow planning data pre-installed on the high-speed aircraft. This set of permitted actions contains all collaborative action identifiers allowed to be executed within the current mission process phase. If the collaborative action identifier exists in the set of permitted actions, the mission phase comparison result is determined to be phase permitted and marked as passed; if the collaborative action identifier does not exist in the set of permitted actions, the mission phase comparison result is determined to be phase prohibited and marked as failed. The mapping table between instruction categories and collaborative actions is a pre-defined lookup table used during the data link communication protocol design phase to establish the correspondence between instruction type encoding and collaborative action semantics. This mapping table is loaded into each formation node during the mission preparation phase to ensure that each node in the formation maintains a consistent semantic understanding of the instruction type. Taking a typical high-speed aircraft formation data link communication protocol as an example, the mapping table between command categories and coordinated actions may contain the following corresponding entries: Command category identifier 0x01 corresponds to coordinated action identifier "formation adjustment"; command category identifier 0x02 corresponds to coordinated action identifier "altitude coordination"; command category identifier 0x03 corresponds to coordinated action identifier "speed synchronization"; command category identifier 0x04 corresponds to coordinated action identifier "course change"; command category identifier 0x05 corresponds to coordinated action identifier "cooperative avoidance"; command category identifier 0x06 corresponds to coordinated action identifier "electronic interference"; and command category identifier 0x07 corresponds to coordinated action identifier "target allocation". Once the command category identifier is extracted from the formation coordination command, the corresponding coordinated action identifier can be obtained by querying this mapping table.

[0075] If the cooperative action identifier exists in the set of permitted actions, it indicates that the cooperative action required by the formation coordination command does indeed belong to the type of action planned and permitted within the current task phase. The command is consistent with the current task context in terms of task phase attribution, and the task phase comparison result is determined to be phase permitted and marked as passed. If the cooperative action identifier does not exist in the set of permitted actions, it indicates that the cooperative action required by the formation coordination command does not belong to the type of action planned and permitted within the current task phase. The command contradicts the current task context in terms of task phase attribution, and the task phase comparison result is determined to be phase prohibited and marked as failed. For example, suppose the current task process phase is the formation assembly phase, and the set of permitted actions for this phase is formation adjustment, height coordination, and speed synchronization. If the command category identifier of the received formation coordination command is 0x01, the mapped cooperative action identifier is formation adjustment. Formation adjustment exists in the set of permitted actions, and the task phase comparison result is passed. If the received formation coordination command has a command category identifier of 0x06, the mapped coordination action identifier is electronic interference. Since electronic interference does not exist in the set of permitted actions, the task phase comparison result is "failed".

[0076] The method for extracting the trigger condition description claimed in the formation coordination command and verifying the causal correlation between the trigger condition description and the external hazard exposure level to obtain the trigger condition comparison result includes:

[0077] The semantic parsing process extracts the claimed hazard type and hazard level from the trigger condition description claimed in the instruction. It reads the external hazard exposure level and the currently perceived hazard type from the snapshot of the mission execution site, compares the claimed hazard type with the currently perceived hazard type for type consistency, and compares the claimed hazard level with the external hazard exposure level for hazard level matching. If the hazard type matching result is consistent and the hazard level matching result is achieved, the trigger condition comparison result is determined to have causal support and marked as passed; otherwise, the trigger condition comparison result is determined to lack causal support and marked as failed. The trigger condition description is a field in the formation coordination instruction used to explain the background of the instruction issuance, recording the situational judgment upon which the leader issued the instruction in a structured or semi-structured form. The semantic parsing operation, according to the predefined trigger condition description format specification, separates and extracts two key information types from the trigger condition description field: hazard type identifier and hazard level identifier. The hazard type identifier indicates the category of the hazard source that triggered the instruction, and the hazard level identifier indicates the severity of the threat posed by the hazard source to the formation. The currently perceived hazard types record the types of hazards actually detected by the aircraft's sensor systems at the moment of reception. A type consistency comparison is performed between the hazard types claimed in the trigger condition description and the currently perceived hazard types in the mission execution snapshot. This type consistency comparison verifies whether the hazard types claimed in the command actually appear in the aircraft's current situational awareness results. If the aircraft's high-speed aircraft sensor system does detect a hazard of the same type as claimed in the command, the hazard type matching result is consistent; if the aircraft's sensor system does not detect this type of hazard, or if the detected hazard type does not match the type claimed in the command, the hazard type matching result is inconsistent. The hierarchy comparison verifies whether the hazard level claimed in the command matches the actual hazard level currently faced by the aircraft. Because the sensor systems of the lead and follower aircraft may have differences in detection coverage and accuracy, and the different spatial positions of nodes within the formation may lead to differences in distance perception of the same hazard, the hierarchy comparison typically uses a tolerance matching strategy rather than a strict equality judgment. If the command claims a high-risk level, the external hazard exposure level of the aircraft must be at least at the medium-risk level or higher for the hazard level matching result to be considered achieved. If the external hazard exposure level of the aircraft is only low-risk or no-risk, there is a significant gap compared to the high-risk level claimed in the command, and the hazard level matching result is not achieved. The tolerance range can be adjusted according to the spatial distribution characteristics of the formation and the performance differences of the sensor systems.If the hazard type matching result is consistent and the hazard level matching result is met, it indicates that the triggering conditions claimed by the command are indeed supported by facts in the current situational awareness of the aircraft, and there is a reasonable causal relationship between the triggering background claimed by the command and the actual dangerous situation perceived by the aircraft. The triggering condition comparison result is determined to have causal support and is marked as passed. If the hazard type matching result is inconsistent, or the hazard level matching result is not met, or neither is met, it indicates that there is no causal support between the triggering conditions claimed by the command and the actual situation perceived by the aircraft. The triggering condition comparison result is determined to have no causal support and is marked as failed.

[0078] Example 2: Based on the same inventive concept, such as Figure 2 As shown, this embodiment also provides a high-speed aircraft data link communication abnormal traffic detection system. The system includes: a protocol layer compliance judgment and filtering module, an instruction semantic parsing module, a mission execution site snapshot generation module, and a traffic abnormality detection and result output module. Each module is connected to the other in sequence.

[0079] The protocol layer compliance determination and filtering module is used to acquire communication packets received by the high-speed aircraft data link, determine communication packets that conform to the preset data link communication protocol specifications as protocol layer compliant packets, and determine communication packets that do not conform to the preset data link communication protocol specifications as protocol layer abnormal traffic and filter them.

[0080] The instruction semantic parsing module is used to perform instruction semantic parsing on the protocol layer compliant message to obtain the formation coordination instruction. The formation coordination instruction includes an instruction category identifier, an instruction initiating node identifier, a description of the triggering conditions claimed by the instruction, and the coordination response parameters required by the instruction.

[0081] The task execution scene snapshot generation module is used to synchronously collect multi-source task context information of the local high-speed aircraft based on the reception time of the protocol layer compliant message; and generate a task execution scene snapshot corresponding to the reception time based on the multi-source task context information.

[0082] The traffic anomaly detection and result output module is used to project the formation coordination command onto the task execution site snapshot to compare and analyze the rationality of the command to obtain a multi-dimensional semantic comparison result; if the judgment result of each comparison dimension in the multi-dimensional semantic comparison result is passed, the corresponding communication traffic is judged as task-driven normal coordination traffic; if the judgment result of any comparison dimension in the multi-dimensional semantic comparison result is failed, the corresponding communication traffic is judged as intentional spoofing deception anomaly traffic, and the detection result is output.

[0083] It should be noted that the specific methods by which each module performs operations in the system described in the above embodiments have been described in detail in the embodiments related to the method, and will not be elaborated here.

[0084] Finally, it should be noted that although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting abnormal traffic of high-speed aircraft data link communication, characterized in that, The method comprises: Obtaining a communication message of a high-speed aircraft data link receiver, determining a communication message meeting a preset data link communication protocol specification as a protocol layer compliance message, and determining a communication message not meeting the preset data link communication protocol specification as a protocol layer abnormal traffic and filtering the same; Performing instruction semantic analysis on the protocol layer compliance message to obtain a formation coordination instruction, the formation coordination instruction comprising an instruction category identifier, an instruction initiation node identifier, an instruction claimed trigger condition description, and an instruction required coordination response parameter; Synchronously collecting multi-source task context information of a local high-speed aircraft based on a receiving time of the protocol layer compliance message; and generating a task execution field snapshot corresponding to the receiving time according to the multi-source task context information. Projecting the formation coordination instruction into the task execution field snapshot to perform instruction rationality comparison analysis to obtain a multi-dimensional semantic comparison result; if the determination results of each comparison dimension in the multi-dimensional semantic comparison result are all passed, corresponding communication traffic is determined as task-driven normal coordination traffic; if the determination result of any comparison dimension in the multi-dimensional semantic comparison result is failed, corresponding communication traffic is determined as intent-disguised fraud abnormal traffic, and a detection result is output.

2. The method of claim 1, wherein, The method for generating a task execution field snapshot corresponding to the receiving time according to the multi-source task context information comprises: Extracting task flow planning data pre-installed in the local high-speed aircraft from the multi-source task context information, the task flow planning data containing a plurality of task nodes arranged in time sequence and a set of permitted actions corresponding to each task node; matching the receiving time with a preset execution time window of each task node in the task flow planning data to determine a current task node of the local high-speed aircraft at the receiving time, and marking the current task node as a task process stage; Extracting a dangerous situation awareness result of the local high-speed aircraft from the multi-source task context information, and comprehensively quantifying the dangerous situation awareness result and a relative distance between a danger source and the local high-speed aircraft to obtain an external danger exposure level of the local high-speed aircraft; Extracting a node role of the local high-speed aircraft in a leader-follower formation structure and a corresponding instruction transmission and reception authority mapping relationship from the multi-source task context information, and generating a formation coordination state in combination with a communication link connectivity state of each node; and generating a task execution field snapshot corresponding to the receiving time after timestamp alignment and encapsulation of the task process stage, the external danger exposure level, and the formation coordination state.

3. The method of claim 2, wherein, The method for obtaining an external danger exposure level of the local high-speed aircraft according to the dangerous situation awareness result and a relative distance between a danger source and the local high-speed aircraft comprises: The dangerous situation awareness result is analyzed to extract a dangerous source type identifier of each dangerous source in a current detection coverage range and a relative distance between each dangerous source and the host high-speed aircraft; a preset dangerous source type and dangerous weight corresponding relationship table is used to assign a type dangerous weight corresponding to the dangerous source type identifier to each dangerous source; a distance attenuation function is used to calculate a distance dangerous factor corresponding to each dangerous source according to the relative distance between each dangerous source and the host high-speed aircraft; a single-source dangerous contribution value of each dangerous source is calculated according to the type dangerous weight and the corresponding distance dangerous factor of each dangerous source, and a comprehensive dangerous quantitative value is obtained by accumulating the single-source dangerous contribution values of all dangerous sources; and an external dangerous exposure level of a current danger degree suffered by the host high-speed aircraft is determined according to the comprehensive dangerous quantitative value.

4. The method of claim 2, wherein, The method for extracting the node role of the host high-speed aircraft in the leader-follower formation structure and the corresponding instruction sending and receiving permission mapping relationship from the multi-source task context information, and generating the formation coordination state in combination with the communication link connectivity state of each node comprises: A pre-installed formation networking configuration table is extracted from the multi-source task context information, the formation networking configuration table records the node identifier of each node in the formation and the node role assumed by each node in the leader-follower formation structure, and the node role includes a leader role and a follower role; The node identifier corresponding to the node role of the host high-speed aircraft is queried according to the formation networking configuration table; and a legal instruction source node set when the current node role of the host high-speed aircraft is an instruction receiver is determined according to the instruction sending and receiving permission mapping relationship of the leader-follower formation structure; The communication link connectivity state of each node in the legal instruction source node set is obtained by communication link connectivity detection at a receiving time; a node whose communication link is in an interrupted state is filtered out from the legal instruction source node set according to the communication link connectivity state, to obtain an actually effective instruction source node set at the current time; and the instruction sending and receiving permission mapping relationship and the actually effective instruction source node set at the current time are encapsulated to obtain the formation coordination state.

5. The method of claim 4, wherein, The method for determining the legal instruction source node set when the current node role of the host high-speed aircraft is an instruction receiver according to the instruction sending and receiving permission mapping relationship of the leader-follower formation structure comprises: The instruction sending and receiving permission mapping relationship of the leader-follower formation structure is read from the pre-installed formation instruction permission configuration data; the source node role type authorized to receive instructions when the host high-speed aircraft is an instruction receiver is queried in the instruction sending and receiving permission mapping relationship according to the node role of the host high-speed aircraft; all nodes assuming the source node role type are searched and retrieved in the formation networking configuration table according to the source node role type, and the node identifier corresponding to each node is extracted; and all node identifiers searched and retrieved are converged and integrated to obtain the legal instruction source node set when the host high-speed aircraft is an instruction receiver.

6. The method of claim 4, wherein, The method for obtaining the communication link connectivity state of each node in the legal instruction source node set by communication link connectivity detection at a receiving time comprises: Take the receiving time as the detection reference time, send a link detection request message to each node in the legal instruction source node set, and record whether each node returns a link detection response message within a preset response time limit; if a node returns a link detection response message within the preset response time limit, mark the communication link state of the node as a connected state; if a node does not return a link detection response message within the preset response time limit, mark the communication link state of the node as a disconnected state.

7. The method of claim 4, wherein, The method for projecting the formation coordination instruction into the task execution field snapshot for comparison and analysis of instruction rationality to obtain a multi-dimensional semantic comparison result comprises: Extracting an instruction category identifier from the formation coordination instruction, attributing the coordination action pointed to by the instruction category identifier to the permitted action set corresponding to the task process stage to obtain a task stage comparison result; Extracting an instruction initiation node identifier from the formation coordination instruction, matching the instruction initiation node identifier with the instruction source node set that is actually effective at the current time in the formation coordination state to obtain a node authorization comparison result; Extracting a trigger condition description claimed by the instruction from the formation coordination instruction, verifying the cause-effect association of the trigger condition description with the external danger exposure level to obtain a trigger condition comparison result; Extracting a coordination response parameter required by the instruction from the formation coordination instruction, performing feasibility checking on the coordination response parameter with the physical reachable domain defined by the real-time platform state quantity of the host high-speed aircraft to obtain a response parameter comparison result; and aggregating the task stage comparison result, the node authorization comparison result, the trigger condition comparison result, and the response parameter comparison result to generate a multi-dimensional semantic comparison result.

8. The method of claim 7, wherein, The method for extracting an instruction category identifier from the formation coordination instruction, attributing the coordination action pointed to by the instruction category identifier to the permitted action set corresponding to the task process stage to obtain a task stage comparison result comprises: According to a preset mapping relationship table of instruction categories and coordination actions, querying a coordination action identifier corresponding to an instruction category identifier; reading a task process stage from a task execution field snapshot, and retrieving a permitted action set corresponding to the task process stage from task flow planning data preinstalled in the host high-speed aircraft, wherein the permitted action set contains all coordination action identifiers allowed to be executed in the current task process stage; if the coordination action identifier exists in the permitted action set, determining that the task stage comparison result is stage-permitted and marking it as passed; if the coordination action identifier does not exist in the permitted action set, determining that the task stage comparison result is stage-prohibited and marking it as failed.

9. The method of claim 7, wherein, The method for extracting a trigger condition description claimed by the instruction from the formation coordination instruction, verifying the cause-effect association of the trigger condition description with the external danger exposure level to obtain a trigger condition comparison result comprises: The semantic parsing of the trigger condition description claimed by the instruction extracts the claimed hazard type and the claimed hazard level in the trigger condition description description; reads the external hazard exposure level and the current actually perceived hazard type from the task execution scene snapshot, compares the claimed hazard type with the current actually perceived hazard type to obtain a hazard type matching result; compares the claimed hazard level with the external hazard exposure level to obtain a hazard level matching result, if the hazard type matching result is consistent and the hazard level matching result is reached, it is determined that the trigger condition comparison result exists causal support and is marked as passed; otherwise, it is determined that the trigger condition comparison result does not exist causal support and is marked as failed.

10. A high-speed aircraft data link communication anomaly traffic detection system characterized by, The system comprises: a protocol layer compliance determination and filtering module, an instruction semantic parsing module, a task execution scene snapshot generation module, a traffic anomaly detection and result output module, and each module is sequentially connected in communication; The protocol layer compliance determination and filtering module is used for acquiring communication messages received by the high-speed aircraft data link, determining communication messages meeting the preset data link communication protocol specification as protocol layer compliant messages, and determining communication messages not meeting the preset data link communication protocol specification as protocol layer abnormal traffic and filtering; The instruction semantic parsing module is used for performing instruction semantic parsing on the protocol layer compliant message to obtain a formation coordination instruction, and the formation coordination instruction comprises an instruction category identifier, an instruction initiation node identifier, an instruction claimed trigger condition description, and an instruction required coordination response parameter; The task execution scene snapshot generation module is used for synchronously collecting multi-source task context information of the local high-speed aircraft based on the receiving time of the protocol layer compliant message; and generating a task execution scene snapshot corresponding to the receiving time according to the multi-source task context information; The traffic anomaly detection and result output module is used for projecting the formation coordination instruction into the task execution scene snapshot to perform instruction rationality comparison analysis to obtain a multi-dimensional semantic comparison result; if the determination results of each comparison dimension in the multi-dimensional semantic comparison result are all passed, the corresponding communication traffic is determined as task-driven normal coordination traffic; if the determination result of any comparison dimension in the multi-dimensional semantic comparison result is failed, the corresponding communication traffic is determined as intent-disguised fraud abnormal traffic, and the detection result is output.

Images