Online Parallel Anomaly Detection Method and System for Unmanned Aerial Vehicles under Resource Constraints
By combining isolated forest and support vector machine algorithms in drone anomaly detection, parallel training models and adaptive update of anomaly boundaries are solved, and efficient and robust detection effects are achieved.
Patent Information
- Application Number
- CN202111501744.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-12-09
- Publication Date
- 2025-06-10
- Estimated Expiration
- 2041-12-09
AI Technical Summary
Existing drone anomaly detection algorithms are difficult to realize online parallel detection on airborne computing nodes with limited resources, and face the challenges of high-dimensional data, streaming data, few abnormal labels and mode conversion characteristics, resulting in low detection efficiency and high false detection rate.
Unsupervised isolated forest algorithm with linear time complexity combined with a type of support vector machine algorithm is used to train anomaly detection models in parallel to shorten the online training delay, and adaptively learn the anomaly boundary of the updated training data set to improve robustness.
It realizes online parallel abnormality detection of drone data under resource constraints, reduces algorithm complexity, shortens training delay, improves detection efficiency and robustness, and effectively combats the false detection problems caused by drone mode switching.
Smart Images
Figure CN114398944B_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of unmanned aerial vehicle (UAV) management, and particularly relates to an online parallel anomaly detection method and system for UAVs under resource-constrained conditions. Background Art
[0002] Currently, with the rapid development of UAV technology, it has been widely used in various fields. At the same time, the internal system structure of UAVs has become increasingly complex. Moreover, due to the lack of on-site operation by pilots, disaster accidents caused by equipment failures occur frequently, resulting in huge potential safety hazards and property losses. Therefore, anomaly detection of UAV systems to enable them to accurately perceive their own abnormal states is an important means to improve the operational safety and reliability of UAVs.
[0003] Currently, anomaly detection technologies can be divided into qualitative anomaly detection methods based on prior knowledge, quantitative anomaly detection methods based on models, and data-driven anomaly detection methods. Due to the lack of expert experience knowledge of UAVs, it is difficult to fully grasp the types of faults, and the anomaly detection system should have scalability. In recent years, most of the UAV anomaly detection research has focused on data-driven methods, and good detection effects have also been achieved in experimental simulations. It is divided into: statistical-based methods, classification-based methods, similarity-based methods, and prediction-based methods. However, in actual application scenarios, UAV data has the characteristics of high-dimensionality, streaming data, few anomaly labels, and pattern conversion. Therefore, many algorithms cannot be directly used for online detection. The reasons are as follows: (1) Statistical-based methods rely too much on the regularity of data distribution, and it is difficult to determine the prior distribution assumptions of most UAV data; (2) Classification-based anomaly detection algorithms are difficult to train a classifier with good robustness when facing few anomaly labels and incomplete grasp of the types; (3) Similarity-based methods measure similarity based on information such as distance, density, and angle between data, which leads to an exponential growth in the computational complexity of some algorithms when the UAV data dimension is too high or the training set is too large, and the on-board computing node resources are limited and often insufficient to meet the computational requirements of these high-complexity algorithms; (4) In prediction-based methods, high-dimensional data increases the difficulty of prediction model and parameter optimization, and is sensitive to irregularly distributed noise data. (5) The pattern conversion characteristic of UAV data makes the telemetry flight data show different behaviors from other normal behaviors, resulting in an increase in the false detection rate of algorithms. Therefore, there is an urgent need to design a new online parallel anomaly detection method and system for UAVs under resource-constrained conditions.
[0004] Through the above analysis, the problems and defects existing in the prior art are as follows:
[0005] (1) Existing statistical-based methods rely too much on the regularity of data distribution, and it is difficult to determine the prior distribution assumptions of most UAV data. Therefore, many algorithms cannot be directly used for online detection.
[0006] (2) Existing anomaly detection algorithms based on classification are difficult to train a classifier with good robustness when faced with few anomaly labels and incomplete grasp of the types.
[0007] (3) Existing similarity-based methods measure similarity based on information such as distance, density, and angle between data, resulting in an exponential increase in the computational complexity of some algorithms when the UAV data dimension is too high or the training set is too large. However, the resources of on-board computing nodes are limited and insufficient to meet the computational requirements of these high-complexity algorithms.
[0008] (4) In existing prediction-based methods, high-dimensional data increases the difficulty of prediction model and parameter optimization, and is sensitive to noise data with irregular distribution.
[0009] (5) The mode conversion characteristics of existing UAV data cause the telemetry flight data to show performances different from other normal behaviors, resulting in an increase in the false detection rate of algorithms.
[0010] The difficulties in solving the above problems and defects are as follows:
[0011] (1) Currently, most anomaly detection algorithms have too high complexity and are not suitable for online anomaly detection of resource-constrained on-board computing nodes. There is an urgent need to reduce the algorithm complexity and shorten the training delay.
[0012] (2) The mode switching characteristics of UAVs may cause changes in the normal performance of data. At this time, the anomaly measurement of the anomaly detection algorithm for data will also deviate, and the anomaly threshold of the old model will greatly increase the false detection rate of the anomaly detection algorithm.
[0013] The significance of solving the above problems and defects is as follows:
[0014] (1) By parallelizing the training of the anomaly detection model and splitting the isolation forest model into smaller forest models with lower complexity, the online update of the model is realized, and the processing and detection process of UAV telemetry flight data is accelerated.
[0015] (2) Through the data update mechanism and combined with the one-class support vector machine algorithm to adaptively learn the anomaly boundary of the data after mode switching, the mode switching problem of UAVs is effectively countered, and the robustness of the online anomaly detection model is improved. Summary of the Invention
[0016] Aiming at the problems existing in the prior art, the present invention provides a UAV online parallel anomaly detection method and system under resource-constrained conditions.
[0017] The present invention is implemented as follows. An online parallel anomaly detection method for unmanned aerial vehicles (UAVs) under resource-constrained conditions, the online parallel anomaly detection method for UAVs under resource-constrained conditions includes:
[0018] Aiming at the problems of high-dimensional and large-volume UAV data, resource constraints of on-board computing nodes, few anomaly labels, and uneven distribution of positive and negative class samples, an unsupervised isolation forest algorithm with linear time complexity is selected to measure the anomaly degree of telemetry flight data. Considering that the mode switching of UAVs may cause changes in the normal performance of UAV data, certain rules are adopted to update the training data set. The isolation forest model is trained in parallel to shorten the online training delay. The one-class support vector machine algorithm is used to adaptively learn the anomaly boundary after the training data set is updated, so as to improve the robustness of the online anomaly detection model.
[0019] Further, the online parallel anomaly detection method for UAVs under resource-constrained conditions includes the following steps:
[0020] Step 1, construct an anomaly detection training module;
[0021] By training the anomaly detection model in parallel, the online training delay of the model is shortened.
[0022] Step 2, perform offline parallel training of the isolation forest based on the historical complete telemetry flight data set, establish an anomaly metric model file and read the model;
[0023] By constructing a historical complete telemetry flight data set for model training, the initial anomaly metric model has sufficient robustness to the flight data of known patterns.
[0024] Step 3, perform offline training of the one-class support vector machine based on the initial historical anomaly score set, establish an anomaly determination model file and read the model;
[0025] Using the one-class support vector machine algorithm to train the anomaly boundary eliminates the process of establishing the anomaly score threshold of the isolation forest model.
[0026] Step 4, read the real-time telemetry flight data and perform normalization processing;
[0027] Data normalization processing eliminates the dimensional difference between different-dimensional data and reduces the impact of data space sparsification on the algorithm accuracy.
[0028] Step 5, calculate the anomaly score of the normalized telemetry flight data using the anomaly metric model; and use the anomaly determination model to determine the anomaly score and output the determination result; if the determination result is normal, return to Step 4 and execute Step 6; if the determination result is abnormal, execute Step 7 and return to Step 4;
[0029] Step 6: Update the training data set of the anomaly detection module and update the anomaly detection model file online;
[0030] By using the data update mechanism, the normal telemetry flight data is added to the training set to ensure that when the flight mode is switched, the training data set already contains the data after the mode switch. A class of support vector machine algorithms is used to adaptively learn the abnormal boundaries of the training data set after the update, thus improving the robustness of the anomaly detection model.
[0031] Step 7: read the anomaly measurement model file and update the anomaly measurement model; read the anomaly determination model file and update the anomaly determination model.
[0032] When data is detected as abnormal, subsequent data can be detected more accurately based on the updated anomaly measurement model and anomaly determination model, effectively combating the problem of drone mode switching.
[0033] Furthermore, the construction of the anomaly detection training module in step 1 includes:
[0034] (1) Constructing an isolation forest training module; the isolation forest training module generates an anomaly measurement model based on a telemetry flight data training set. Since there is no strong dependency between individual learners of the isolation forest, the isolation forest model is split into multiple small forest models for parallel training.
[0035] Among them, the "telemetry flight data" refers to the system operation status monitoring data of the UAV during the mission execution, including the status monitoring data of the UAV structure, functional components, sensors, hardware and software; the "anomaly measurement model" is used to calculate the anomaly score for the normalized telemetry data.
[0036] (2) Constructing a type of support vector machine training module; the type of support vector machine training module generates an anomaly determination model based on an anomaly score training set.
[0037] The "abnormality determination model" is used to determine whether the abnormality score is abnormal or not.
[0038] Furthermore, the "historical complete telemetry flight data set" in step 2 is a normal flight data set that contains all known modes as much as possible.
[0039] Furthermore, the "historical anomaly score set" in step three is a set of anomaly scores calculated by the anomaly measurement model trained in step two for the historical complete telemetry flight data set.
[0040] Further, the "normalization" in step four is used to eliminate the dimensional differences between data of different dimensions and avoid the sparsity of data in the spatial dimension. The normalization methods include, but are not limited to, the linear function normalization (min-max) method and the zero-mean normalization (Z-score) method.
[0041] Further, for the training data set of the anomaly detection module updated in step six, the online update of the anomaly detection model file includes:
[0042] (1) Add the normal normalized telemetry flight data to the telemetry flight data training set of the anomaly metric model, drive the isolation forest training module to perform online model training, and update each small forest model to the anomaly metric model file after the training ends;
[0043] (2) Add the anomaly metric scores corresponding to the normal normalized telemetry flight data to the anomaly score training set of the anomaly determination model, drive the one-class support vector machine training module to perform online model training, and update the one-class support vector machine model to the anomaly determination model file after the training ends.
[0044] Considering the limited resources of the airborne computing node in step six, set scale thresholds for the telemetry flight data training set and the anomaly score training set. When the scales of the telemetry flight data training set and the anomaly score training set reach the thresholds, eliminate the earliest updated telemetry flight data and anomaly scores in a first-in, first-out (FIFO) manner.
[0045] Another object of the present invention is to provide an unmanned aerial vehicle (UAV) online parallel anomaly detection system under resource-constrained conditions for implementing the UAV online parallel anomaly detection method under resource-constrained conditions. The UAV online parallel anomaly detection system under resource-constrained conditions includes:
[0046] Anomaly detection training module construction module, used to construct an anomaly detection training module;
[0047] Anomaly metric model file establishment module, used to perform offline parallel training of isolation forest based on the historical complete telemetry flight data set, establish an anomaly metric model file and read the model;
[0048] Anomaly determination model file establishment module, used to perform offline training of one-class support vector machine based on the initial historical anomaly score set, establish an anomaly determination model file and read the model;
[0049] Telemetry flight data reading module, used to read real-time telemetry flight data and perform normalization processing;
[0050] Anomaly score calculation module, used to calculate the anomaly scores of the normalized telemetry flight data using the anomaly metric model, and determine and output the determination result for the anomaly scores using the anomaly determination model.
[0051] Anomaly detection training set update module, which is used to update the training data set of the anomaly detection module and update the anomaly detection model file online;
[0052] Anomaly detection model update module, which is used to read the anomaly metric model file and update the anomaly metric model; read the anomaly determination model file and update the anomaly determination model.
[0053] Another object of the present invention is to provide a computer device, which includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor performs the following steps:
[0054] Aiming at the problems of high-dimensional, large amount of data, limited resources of airborne computing nodes, few anomaly labels, and uneven distribution of positive and negative class samples in UAV data, an unsupervised isolation forest algorithm with linear time complexity is selected to measure the anomaly degree of telemetry flight data; considering that the mode switching of the UAV may cause changes in the normal performance of UAV data, certain rules are adopted to update the training data set; the isolation forest model is trained in parallel to shorten the online training delay; the one-class support vector machine algorithm is used to adaptively learn the anomaly boundary after the training data set is updated, so as to improve the robustness of the online anomaly detection model.
[0055] Another object of the present invention is to provide an information data processing terminal, which is used to implement the UAV online parallel anomaly detection system under the above-mentioned resource-limited conditions.
[0056] Combining all the above technical solutions, the advantages and positive effects of the present invention are as follows: The UAV online parallel anomaly detection method provided by the present invention establishes a UAV online anomaly detection model by combining the isolation forest algorithm and the one-class support vector machine algorithm, and meets the delay requirements of anomaly detection by training the anomaly detection model in parallel, and finally realizes the online anomaly detection of UAV data.
[0057] The present invention trains the anomaly detection model in parallel on resource-limited airborne computing nodes, accelerates the processing and detection process of UAV data, adaptively updates the anomaly boundary, effectively combats the UAV mode switching problem, and realizes the online anomaly detection of UAV data.
[0058] The present invention selects an anomaly detection algorithm with low complexity, which can perform anomaly detection on UAV telemetry flight data on resource-limited airborne computing nodes; the present invention designs a UAV telemetry flight data update mechanism, which can effectively combat the problem of data misdetection that may be caused by UAV mode switching.
[0059] The present invention parallelizes the training of the anomaly detection model, shortens the online training time delay, and can realize the online anomaly detection of UAV telemetry flight data; the present invention uses the one-class support vector machine algorithm to adaptively learn the updated anomaly boundary of the training data set, improving the robustness of the online anomaly detection model. BRIEF DESCRIPTION OF THE DRAWINGS
[0060] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required to be used in the embodiments of the present invention. Obviously, the following described drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.
[0061] Figure 1 is a flowchart of the UAV online parallel anomaly detection method under resource-constrained conditions provided by an embodiment of the present invention.
[0062] Figure 2 is a schematic diagram of the UAV online parallel anomaly detection method under resource-constrained conditions provided by an embodiment of the present invention.
[0063] Figure 3 is a block diagram of the UAV online parallel anomaly detection system structure under resource-constrained conditions provided by an embodiment of the present invention;
[0064] In the figure: 1. Anomaly detection training module construction module; 2. Anomaly metric model file establishment module; 3. Anomaly determination model file establishment module; 4. Telemetry flight data reading module; 5. Anomaly score calculation module; 6. Anomaly detection model training set update module; 7. Anomaly detection model update module.
[0065] Figures 4(a) and 4(b) are diagrams of the time delay results of the UAV online parallel anomaly detection system under resource-constrained conditions provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0066] In order to make the purpose, technical solutions and advantages of the present invention clearer, the following further details the present invention in conjunction with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.
[0067] In view of the problems existing in the prior art, the present invention provides a UAV online parallel anomaly detection method and system under resource-constrained conditions, and the following makes a detailed description of the present invention in conjunction with the drawings.
[0068] As Figure 1 shown, the UAV online parallel anomaly detection method under resource-constrained conditions provided by an embodiment of the present invention includes the following steps:
[0069] S101, construct an anomaly detection training module;
[0070] S102, perform isolation forest offline parallel training based on a historical complete telemetry flight dataset, establish an anomaly metric model file and read the model;
[0071] S103, perform one-class support vector machine offline training based on an initial historical anomaly score set, establish an anomaly determination model file and read the model;
[0072] S104, read real-time telemetry flight data and perform normalization processing;
[0073] S105, use the anomaly metric model to calculate the anomaly score of the normalized telemetry flight data; and use the anomaly determination model to determine the anomaly score and output the determination result; if the determination result is normal, return to S104 and execute S106; if the determination result is abnormal, execute S107 and return to S104;
[0074] S106, update the training dataset of the anomaly detection module and online update the anomaly detection model file;
[0075] S107, read the anomaly metric model file and update the anomaly metric model; read the anomaly determination model file and update the anomaly determination model.
[0076] The schematic diagram of the online parallel anomaly detection method for drones under resource-constrained conditions provided by the embodiments of the present invention is as Figure 2 shown.
[0077] As Figure 3 shown, the online parallel anomaly detection system for drones under resource-constrained conditions provided by the embodiments of the present invention includes:
[0078] Anomaly detection training module construction module 1, used to construct an anomaly detection training module;
[0079] Anomaly metric model file establishment module 2, used to perform isolation forest offline parallel training based on a historical complete telemetry flight dataset, establish an anomaly metric model file and read the model;
[0080] Anomaly determination model file establishment module 3, used to perform one-class support vector machine offline training based on an initial historical anomaly score set, establish an anomaly determination model file and read the model;
[0081] Telemetry flight data reading module 4, used to read real-time telemetry flight data and perform normalization processing;
[0082] Anomaly score calculation module 5, used to calculate the anomaly score of the normalized telemetry flight data using the anomaly metric model, and use the anomaly determination model to determine the anomaly score and output the determination result;
[0083] The abnormal detection model training set update module 6 is used to update the training data set of the abnormal detection module and update the abnormal detection model file online;
[0084] The abnormal detection model update module 7 is used to read the abnormal metric model file and update the abnormal metric model; read the abnormal determination model file and update the abnormal determination model.
[0085] The technical solution of the present invention will be further described below in conjunction with specific embodiments.
[0086] Embodiment 1
[0087] The purpose of the present invention is to propose an online parallel abnormal detection method for drones under resource - limited conditions in view of the deficiencies of the above - mentioned existing technologies. An online abnormal detection model for drones is established by combining the isolation forest algorithm and the one - class support vector machine algorithm. The time - delay requirement of abnormal detection is met by parallelizing the training of the abnormal detection model, and finally, online abnormal detection of drone data is realized.
[0088] It should be noted that the technical idea for achieving the purpose of the present invention is as follows: First, in view of the problems of high - dimensional, large - data - volume, resource - limited airborne computing nodes, few abnormal labels, and uneven distribution of positive and negative class samples in drone data, an unsupervised isolation forest algorithm with linear time complexity is selected to measure the abnormal degree of telemetry flight data. Secondly, considering that the mode switch of the drone may cause changes in the normal performance of drone data, the present invention adopts certain rules to update the training data set, and in order to further shorten the online training time - delay, the isolation forest model is trained in parallel. Finally, the one - class support vector machine algorithm is used to adaptively learn the abnormal boundary after the update of the training data set, so as to improve the robustness of the online abnormal detection model.
[0089] In order to achieve the above purpose, the technical solution adopted by the present invention is as follows:
[0090] The online parallel abnormal detection method for drones under resource - limited conditions provided by the present invention specifically includes constructing an abnormal detection training module, establishing an abnormal metric and an abnormal determination model, normalizing the drone telemetry flight data, and adding a data update mechanism to realize online parallel abnormal detection of drone data. The method includes the following steps:
[0091] (1) Construct an abnormal detection training module;
[0092] (1a) Construct an isolation forest training module. This module generates an abnormal metric model based on the telemetry flight data training set. Since there is no strong dependence relationship between the individual learners of the isolation forest, the isolation forest model is split into multiple small forest models for parallel training;
[0093] (1b) Construct a support vector machine training module. This module generates an anomaly determination model based on the anomaly score training set.
[0094] (2) Based on the historical complete telemetry flight data set, isolation forest offline parallel training is performed to establish the anomaly measurement model file and read the model.
[0095] (3) Based on the initial historical anomaly score set, a class of support vector machine offline training is performed, an anomaly judgment model file is established and the model is read.
[0096] (4) Read real-time telemetry flight data and perform normalization processing.
[0097] (5) Calculate the anomaly score of the normalized telemetry flight data using the anomaly measurement model; and use the anomaly determination model to determine the anomaly score and output the determination result. If the determination result is normal, return to step (4) and execute step (6); if the determination result is abnormal, execute step (7) and then return to step (4).
[0098] (6) Update the training data set of the anomaly detection module and update the anomaly detection model file online;
[0099] (6a) adding normal normalized telemetry flight data to the telemetry flight data training set of the anomaly measurement model, driving the isolation forest training module to perform online model training, and updating each small forest model to the anomaly measurement model file after the training is completed;
[0100] (6b) The anomaly metric scores corresponding to the normalized telemetry flight data are added to the anomaly score training set of the anomaly determination model, driving the one-class support vector machine training module to perform online model training, and after the training is completed, the one-class support vector machine model is updated to the anomaly determination model file.
[0101] (7) Read the anomaly measurement model file and update the anomaly measurement model; read the anomaly determination model file and update the anomaly determination model.
[0102] It should be noted that the "telemetry flight data" in step (1a) refers to the system operation status monitoring data of the UAV during the mission, including the status monitoring data of the UAV structure, functional components, sensors, hardware and software. The purpose of the "abnormal measurement model" is to calculate the abnormal score for the normalized telemetry data.
[0103] It should be noted that the purpose of the "abnormality determination model" in step (1b) is to determine whether the abnormality score is abnormal or not.
[0104] It should be noted that the "historical complete telemetry flight data set" in step (2) is a normal flight data set that contains all known modes as much as possible.
[0105] It should be noted that in step (3), the "historical anomaly score set" is the set of anomaly scores calculated by the anomaly metric model trained in step (2) for the historical complete telemetry flight data set.
[0106] It should be noted that the purpose of "normalization" in step (4) is to eliminate the possible dimensional differences between data of different dimensions and avoid the sparsity of data in the spatial dimension. The normalization method can be but is not limited to methods such as min-max and Z-score.
[0107] It should be noted that considering the limited resources of the airborne computing node in step (6), a scale threshold is set for the telemetry flight data training set and the anomaly score training set. When the scales of the telemetry flight data training set and the anomaly score training set reach the threshold, the earliest updated telemetry flight data and anomaly scores are removed in a FIFO (First In First Out) manner.
[0108] The present invention selects an anomaly detection algorithm with low complexity, which can perform anomaly detection on UAV telemetry flight data on an airborne computing node with limited resources; the present invention designs an update mechanism for UAV telemetry flight data, which can effectively combat the problem of data misdetection that may be caused by UAV mode switching.
[0109] The present invention trains the anomaly detection model in parallel, shortening the online training delay, and can realize the online anomaly detection of UAV telemetry flight data; the present invention uses the one-class support vector machine algorithm to adaptively learn the anomaly boundary after the training data set is updated, improving the robustness of the online anomaly detection model.
[0110] Embodiment 2
[0111] As Figure 2 shown is the specific process of the method for realizing online parallel anomaly detection of UAV data by using container technology in the present invention. It should be noted that the embodiments of the present invention should not be construed as limitations on the present invention.
[0112] The method for online parallel anomaly detection of UAVs under resource-constrained conditions provided by the present invention specifically includes constructing an anomaly detection training module, establishing an anomaly metric and an anomaly determination model, normalizing UAV telemetry flight data, and adding a data update mechanism to realize online parallel anomaly detection of UAV data. The method includes the following steps:
[0113] (1) Construct an anomaly detection training module.
[0114] (1a) Construct an isolation forest training module. This module generates an anomaly metric model based on the telemetry flight data training set. Since there is no strong dependence relationship between the individual learners of the isolation forest, the isolation forest model is split into multiple small forest models for parallel training;
[0115] In the embodiment of the present invention, the isolation forest training module is placed in the isolation forest training container, and the telemetry flight data training set is divided into two parts, namely the historical complete data set Complete data_set and the telemetry flight data update set data_update.
[0116] (1b) Construct a one-class support vector machine training module. This module generates an anomaly determination model based on the anomaly score training set;
[0117] In the embodiment of the present invention, the one-class support vector machine training module is placed in the one-class support vector machine training container, and the anomaly score training set is divided into two parts, namely the historical anomaly score set Score data_set and the anomaly score update set score_update.
[0118] (2) Perform offline parallel training of the isolation forest based on the historical complete telemetry flight data set, establish an anomaly metric model file and read the model.
[0119] (3) Perform offline training of the one-class support vector machine based on the initial historical anomaly score set, establish an anomaly determination model file and read the model.
[0120] In the embodiment of the present invention, the offline-trained anomaly metric model and anomaly determination model are respectively placed in the anomaly metric container and the anomaly determination container.
[0121] (4) Read the real-time telemetry flight data and perform normalization processing;
[0122] In the embodiment of the present invention, the communication terminal container is used to read the real-time telemetry flight data, and the normalized telemetry data is stored in the normalized data storage file. The min-max normalization method is adopted in the embodiment of the present invention. This method scales down the telemetry flight data proportionally and retains the general distribution characteristics of the data in space.
[0123] (5) Use the anomaly metric container to calculate the anomaly score of the normalized telemetry flight data, and write the anomaly score into the anomaly score storage file; use the anomaly determination container to read the anomaly score from the anomaly score storage file for determination, and write the determination result into the anomaly marking file. Finally, the training set update and model reloading container reads the anomaly marking from the anomaly marking file. If the marking is normal, it returns to the communication terminal container in step (4) and executes step (6) to trigger the training set update, as Figure 2 the solid arrow; if the determination result is abnormal, step (7) is executed to trigger the anomaly metric container and the anomaly determination container to respectively reload the isolation forest model and the one-class support vector machine model for online training, and then return to the communication terminal container in step (4), as Figure 2 the dashed arrow in the figure.
[0124] (6) Update the training data set of the anomaly detection module and update the anomaly detection model file online;
[0125] (6a) Add normal normalized telemetry flight data to the telemetry flight data update set data_update, drive the isolation forest training container to perform online model training, and update each small forest model to the abnormal measurement model file Forest after the training is completed;
[0126] (6b) The anomaly measurement scores corresponding to the normalized telemetry flight data are added to the anomaly score update set score_update, and the one-class support vector machine (OCSVM) training container is driven to perform online model training. After the training is completed, the one-class support vector machine model is updated to the anomaly judgment model file OCSVM.
[0127] (7) Read each Forest file and use the integrated isolation forest model to update the anomaly measurement model; read the OCSVM file and update the anomaly determination model.
[0128] It should be noted that the "telemetry flight data" in step (1a) refers to the system operation status monitoring data of the UAV during the mission, including the status monitoring data of the UAV structure, functional components, sensors, hardware and software. The "abnormal measurement model" aims to calculate the abnormal score for the normalized telemetry data.
[0129] It should be noted that the purpose of the "abnormality determination model" in step (1b) is to determine whether the abnormality score is abnormal or not.
[0130] It should be noted that the "historical complete telemetry flight data set" in step (2) is a normal flight data set that contains all known modes as much as possible.
[0131] It should be noted that the "historical anomaly score set" in step (3) is the anomaly score set calculated by the anomaly measurement model trained in step (2) for the historical complete telemetry flight data set.
[0132] It should be noted that the purpose of "normalization" in step (4) is to eliminate the dimensional differences that may exist between data of different dimensions and avoid the sparsification of data in the spatial dimension. The normalization method may include but is not limited to min-max, Z-score and other methods.
[0133] It should be noted that in step (6), considering the limited resources of the airborne computing node, scale thresholds are set for data_update and score_update. When the scales of data_update and score_update reach the thresholds, the earliest updated telemetry flight data and anomaly scores are removed in a FIFO (First In First Out) manner.
[0134] It should be noted that data sharing is carried out among containers by means of data volume mounting, that is, the data and model files in the containers are mounted to the host.
[0135] Under the condition of limited resources of the airborne computing node, the present invention parallelizes the training of the anomaly detection algorithm, accelerates the processing and detection process of UAV data, adaptively updates the anomaly boundary, effectively combats the UAV mode switching problem, and realizes the online anomaly detection of UAV data.
[0136] The technical effects of the present invention will be described in detail below in combination with simulations.
[0137] The simulation parameters are set as shown in the following table:
[0138] Table 1 Experimental Parameter Settings
[0139] Setting item Value Total number of isolated trees 200 Number of small forest models 10 Average number of isolated trees in small forest models 20 Kernel function Gaussian kernel Training error 0.05 Kernel coefficient 0.1
[0140] The size of the UAV telemetry flight data test set is 5502, and it contains pattern data that does not appear in the training data set. The following table shows the anomaly detection results of this embodiment. The results show that the true positive rate is approximately 99.24%.
[0141] Table 2 Anomaly Detection Results
[0142] Result Actually normal Actually abnormal Detected as normal 5460 0 Detected as abnormal 42 0
[0143] As shown in Figure 4(a), it is the detection delay result diagram of each data point of this test set. Due to the excessive density of data points, for the convenience of analysis, the detection delay results of the first 100 data points are intercepted, as shown in Figure 4(b). As shown in Figure 4(b), the depth of some telemetry flight data in the isolation tree is relatively large, reaching the tree height limit, and the delay is distributed around 0.016s; the depth of other parts of the data in the isolation tree is relatively small, not reaching the tree height limit, and the delay is distributed near 0s. The detection delay results show that this example can fully meet the sampling frequency requirements of UAV telemetry flight data.
[0144] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented in whole or in part in the form of a computer program product, the computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the processes or functions described in the embodiments of the present invention are generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wire (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that includes one or more integrated available media. The available medium may be a magnetic medium (such as a floppy disk, hard disk, magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (SSD)), etc.
[0145] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention, any modifications, equivalent replacements, and improvements made within the spirit and principle of the present invention shall be covered by the protection scope of the present invention.
Claims
1. A method for online parallel anomaly detection of drones under resource-constrained conditions, It is characterized in that The method for online parallel anomaly detection of unmanned aerial vehicles under resource-constrained conditions selects an unsupervised isolation forest algorithm with linear time complexity to measure the degree of anomaly of telemetry flight data; adopts certain rules to update the training data set; parallelizes the training of the isolation forest model to shorten the online training delay; adopts a class of support vector machine algorithm to adaptively learn the anomaly boundary of the updated training data set; The method for online parallel anomaly detection of unmanned aerial vehicles under resource-constrained conditions comprises the following steps: Step 1: Build an anomaly detection training module; Step 2: Perform offline parallel training of the isolation forest based on the historical complete telemetry flight data set, establish the anomaly measurement model file and read the model; Step 3: Perform offline training of a class of support vector machines based on the initial historical anomaly score set, establish an anomaly determination model file and read the model; Step 4: read the real-time telemetry flight data and perform normalization processing; Step 5: Calculate the anomaly score of the normalized telemetry flight data using the anomaly measurement model; and use the anomaly determination model to determine the anomaly score and output the determination result; if the determination result is normal, return to step 4 and execute step 6; if the determination result is abnormal, execute step 7 and return to step 4; Step 6: Update the training data set of the anomaly detection module and update the anomaly detection model file online; Step 7: read the anomaly measurement model file and update the anomaly measurement model; read the anomaly determination model file and update the anomaly determination model; The construction of the anomaly detection training module in step 1 includes: (1) constructing an isolation forest training module; the isolation forest training module generates an anomaly measurement model based on a telemetry flight data training set, and splits the isolation forest model into multiple small forest models for parallel training; The telemetry flight data refers to the system operation status monitoring data of the UAV during the mission, including the status monitoring data of the UAV structure, functional components, sensors, hardware and software; the anomaly measurement model is used to calculate the anomaly score for the normalized telemetry data; (2) constructing a type of support vector machine training module; the type of support vector machine training module generates an anomaly determination model based on an anomaly score training set; The anomaly determination model is used to determine whether the anomaly score is abnormal or not.
2. The method for online parallel anomaly detection of unmanned aerial vehicles under resource-constrained conditions as claimed in claim 1, It is characterized in that The historical complete telemetry flight data set in step 2 is a normal flight data set that contains all known modes as much as possible.
3. The method for online parallel anomaly detection of unmanned aerial vehicles under resource-constrained conditions as claimed in claim 1, It is characterized in that The historical anomaly score set in step three is a set of anomaly scores calculated by the anomaly measurement model trained in step two for the historical complete telemetry flight data set.
4. The method for online parallel anomaly detection of unmanned aerial vehicles under resource-constrained conditions as claimed in claim 1, It is characterized in that The normalization in step 4 is used to eliminate the dimensional differences between data of different dimensions and avoid the sparsity of data in the spatial dimension. The normalization methods include linear function normalization (min-max method) and zero-mean normalization (Z-score method).
5. The online parallel anomaly detection method for unmanned aerial vehicles under resource-constrained conditions as claimed in claim 1, characterized in that the training data set of the anomaly detection module in step 6, and the online update of the anomaly detection model file include: (1) Adding the normal normalized telemetry flight data to the telemetry flight data training set of the anomaly metric model, driving the isolation forest training module to perform online model training, and updating each small forest model to the anomaly metric model file after the training is completed; (2) Adding the anomaly metric scores corresponding to the normal normalized telemetry flight data to the anomaly score training set of the anomaly determination model, driving the one-class support vector machine training module to perform online model training, and updating the one-class support vector machine model to the anomaly determination model file after the training is completed; In step 6, considering the resource constraints of the airborne computing node, scale thresholds are set for the telemetry flight data training set and the anomaly score training set. When the scales of the telemetry flight data training set and the anomaly score training set reach the thresholds, the earliest updated telemetry flight data and anomaly scores are removed in a first-in-first-out (FIFO) manner.
6. An online parallel anomaly detection system for unmanned aerial vehicles under resource-constrained conditions for implementing the online parallel anomaly detection method for unmanned aerial vehicles under resource-constrained conditions according to any one of claims 1 to 5, characterized in that the online parallel anomaly detection system for unmanned aerial vehicles under resource-constrained conditions includes: An anomaly detection training module construction module, used to construct an anomaly detection training module; An anomaly metric model file establishment module, used to perform isolation forest offline parallel training based on the historical complete telemetry flight data set, establish an anomaly metric model file and read the model; An anomaly determination model file establishment module, used to perform one-class support vector machine offline training based on the initial historical anomaly score set, establish an anomaly determination model file and read the model; A telemetry flight data reading module, used to read real-time telemetry flight data and perform normalization processing; An anomaly score calculation module, used to calculate the anomaly scores of the normalized telemetry flight data using the anomaly metric model, and use the anomaly determination model to determine the anomaly scores and output the determination results; An anomaly detection model training set update module, used to update the training data set of the anomaly detection training module and online update the anomaly detection model file; An anomaly detection model update module, used to read the anomaly metric model file and update the anomaly metric model; read the anomaly determination model file and update the anomaly determination model.
7. A computer device, characterized in that the computer device includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, the processor executes the steps of the online parallel anomaly detection method for unmanned aerial vehicles under resource-constrained conditions according to any one of claims 1 to 5.
8. An information data processing terminal, characterized in that The information data processing terminal is used to implement the steps of the online parallel anomaly detection method for drones under the resource-constrained conditions described in any one of claims 1 to 5.