Intelligent detection and classification method of abnormal electronic reconnaissance data

Abstract

The present invention relates to an intelligent detection and classification method for abnormal electronic reconnaissance data. The detection method comprises the following steps: Step 1: using a large number of normal samples X, X = {X1, X2, ..., X T}Train the network model, first normalize the maximum and minimum values ​​of the feature x of the selected data, the intelligent detection and classification method of abnormal electronic reconnaissance data of the present invention, detects abnormal electronic reconnaissance data by using BiGRU‑VAE, and classifies abnormal electronic data by using BiGRU, first use a sliding window to input the abnormal electronic reconnaissance data into the encoder of VAE to capture effective features, then establish a BiGRU network to predict the next window sequence, and input it into the decoder of VAE to reconstruct the abnormal electronic reconnaissance data, finally use the calculated reconstruction probability and the detection threshold to compare and judge the abnormal electronic reconnaissance data, compared with traditional methods, BiGRU is good at processing time series, and VAE can also fully extract the hidden features of abnormal electronic reconnaissance data, combining the two, the abnormality detection capability is improved.

Description

Technical field

[0001] The present invention relates to the technical field related to detection and classification methods, and in particular to an intelligent detection and classification method for abnormal electronic reconnaissance data. [Background Technology]

[0002] Electronic reconnaissance data is easily affected by eavesdropping, interference, injection, deletion, replacement and other problems when it is sent. Current technology makes it difficult to detect anomalies in a timely manner and classify various anomaly types. Therefore, it is necessary to solve this problem. The present invention proposes an intelligent detection and classification method for abnormal electronic reconnaissance data to solve the above problems. [Summary of the invention]

[0003] The purpose of the present invention is to address the deficiencies in the prior art and provide a method for intelligent detection and classification of abnormal electronic reconnaissance data.

[0004] To achieve the above objectives, the present invention provides an intelligent detection and classification method for abnormal electronic reconnaissance data. The detection method is:

[0005] Step 1: Use a large number of normal samples X, X={X1,X2,...,X T To train the network model, first normalize the maximum and minimum values ​​of the feature x of the selected data, and limit the value range of each dimension feature x' to [-1, 1], satisfying the formula:

[0006]

[0007] Step 2: After normalizing the normal sample X, the sliding window length is l = 10, and then the window X' = {X' t-l+1 ,X' t-l+2 ,...,X' t} as input to the VAE encoder;

[0008] Step 3: The VAE encoder expands the feature dimension of X' to obtain a high-dimensional embedding Z t , use Z as the input of the BiGRU network to predict Z', and use the prediction result Z' of the BiGRU network as the input of the VAE decoder;

[0009] Z'={z1',z2',...,z m '}=GRU(Z)

[0010] Step 4: The VAE decoder decodes the window data Z' to obtain the reconstructed sequence Each sequence segmented by the sliding window is shown in the formula; the reconstruction error is calculated by comparing the reconstructed sequence with the original sequence; the anomaly detection score f is calculated by setting a threshold d. When the anomaly detection score f is greater than d, the sequence point is judged as an anomaly;

[0011]

[0012]

[0013]

[0014] The classification method is:

[0015] Step 1: First, the two GRU layers of the bidirectional gated recurrent unit transmit the forward and reverse time sequences and concatenate the two layers of states.

[0016] Step 2: Get the hidden layer of BIGRU (hidden*2);

[0017] Step 3: Classify four common anomalies (A) random injection deviation, B fixed injection deviation, C DOS injection, and D route replacement, as well as normal data, and record the recognition accuracy.

[0018] Step 4: The four types of anomalies can be subdivided into eight categories, and normal data can also be divided into two categories according to cruising and take-off and landing, for a total of 10 categories, and the recognition accuracy is recorded.

[0019] Preferably, z' i The prediction window representing the high-dimensional embedding of the i-th window at time t is used as the input of the decoder to reconstruct the window sequence X'.

[0020] Preferably, after the deep autoencoder performs self-supervised learning on the features of conventional electronic reconnaissance data, only feature vectors with smaller dimensions can be used to represent the features.

[0021] Preferably, the input layer accepts input data x, maps it to the compressed space h expressed by the hidden layer through a certain "functional relationship" f(x), and then reconstructs it into x' through the reconstruction output layer function g(h). This "functional relationship" is implemented using a neural network in the autoencoder, and f(x) is called the encoder Encoder and g(h) is called the decoder Decoder.

[0022] Preferably, the purpose of the autoencoder is to extract the most essential hidden layer features of the input electronic reconnaissance data by training the parameters of each layer and then using the encoder Autocoder, and reconstructing the new features with the Decoder to obtain the re-formed data.

[0023] Preferably, the four types of anomalies are divided into eight categories: A1 cruise state random injection deviation, A2 take-off and landing state random injection deviation, B1 cruise state fixed injection deviation, B2 take-off and landing state fixed injection deviation, C1 cruise state DOS injection, C2 take-off and landing state DOS injection, D1 cruise state route replacement, D2 take-off and landing state route replacement.

[0024] The advantages of the present invention are:

[0025] The intelligent detection and classification method of abnormal electronic reconnaissance data of the present invention detects abnormal electronic reconnaissance data by using BiGRU-VAE, and classifies abnormal electronic data by using BiGRU. First, a sliding window is used to input the abnormal electronic reconnaissance data into the encoder of VAE to capture effective features. Then a BiGRU network is established to predict the next window sequence, and the data is input into the decoder of VAE to reconstruct the abnormal electronic reconnaissance data. Finally, the abnormal electronic reconnaissance data is detected by comparing the calculated reconstruction probability with the detection threshold. Compared with traditional methods, BiGRU is good at processing time series, and VAE can also fully extract the hidden features of abnormal electronic reconnaissance data. Combining the two, the abnormality detection capability is improved.

Brief Description of the Drawings

[0026] Figure 1 It is the autoencoder network structure;

[0027] Figure 2 This is a flowchart of the BiGRU-VAE method steps;

[0028] Figure 3 This is a flowchart of the anomaly classification method based on BiGRU;

[0029] Figure 4 It is the BiGRU parameter setting table. [Specific implementation method]

[0030] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0031] The reference numerals and components in the drawings are as follows:

[0032] As a whole, it is obvious that the embodiments described in this specification are only part of the feasible technical solutions of the present invention. Other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without any creative work should be deemed to fall within the scope of protection of the present invention.

[0033] The technical solutions of the various embodiments of the present invention described in this specification can be combined with each other, but they must be based on the fact that they can be implemented by ordinary technicians in this field. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that the combination of technical solutions does not exist.

[0034] refer to Figures 1-4 , the intelligent detection and classification method of abnormal electronic reconnaissance data of the present invention,

[0035] The detection method is:

[0036] Step 1: Use a large number of normal samples X, X={X1,X2,...,X T To train the network model, first normalize the maximum and minimum values ​​of the feature x of the selected data, and limit the value range of each dimension feature x' to [-1, 1], satisfying the formula:

[0037]

[0038] After normalizing the normal sample X, the sliding window length is l = 10, and then the window X' = {X' t-l+1 ,X' t-l+2 ,...,X' t} as input to the VAE encoder;

[0039] Step 2: The VAE encoder expands the feature dimension of X' to obtain a high-dimensional embedding Z t , use Z as the input of the BiGRU network to predict Z', and use the prediction result Z' of the BiGRU network as the input of the VAE decoder;

[0040] Z'={z1',z2',...,z m '}=GRU(Z)

[0041] z' i The prediction window representing the high-dimensional embedding of the i-th window at time t is used as the input of the decoder to reconstruct the window sequence X'.

[0042] Step 3: The VAE decoder decodes the window data Z' to obtain the reconstructed sequence For each sequence segmented by the sliding window, the reconstruction error is calculated by comparing the reconstructed sequence with the original sequence. The anomaly detection score f is calculated by setting a threshold d. When the anomaly detection score f is greater than d, the sequence point is judged as an anomaly.

[0043]

[0044]

[0045]

[0046] Note: An autoencoder is a data compression method whose primary function is to extract the essential features of data. This feature extraction is very similar to principal component analysis (PCA). After a deep autoencoder performs self-supervised learning on the features of conventional electronic reconnaissance data, it can only use feature vectors with smaller dimensions to represent the features. The following is the basic principle of a deep autoencoder.

[0047] Figure 2 It is the most basic autoencoder network structure. The input layer accepts input data x, which is mapped to the compressed space h expressed by the hidden layer through a certain "functional relationship" f(x), and then reconstructed into x' through the reconstruction output layer function g(h). This "functional relationship" is implemented using a neural network in the autoencoder. f(x) is called the encoder and g(h) is called the decoder.

[0048] The purpose of the autoencoder is to extract the most essential hidden layer features of the input electronic reconnaissance data by training the parameters of each layer and then using the encoder Autocoder, and reconstruct the new features with the Decoder to obtain the re-formed data.

[0049] For VAE variational autoencoders, the simplest and most direct loss function requirement is to measure the mean square error (MSE) between the input and the regenerated output, that is, the expression error. By minimizing the expression error, the regenerated output is ensured to be as close to the input as possible. In Euler space, the mean square error can be measured using the arithmetic square root of the Euler distance between two points in the space.

[0050] The anomaly handling method based on the variation autoencoder of bidirectional gated recurrent unit (BIGRU-VAE) is used to detect abnormal ADS-B trajectories. The unsupervised anomaly detection VAE model is combined with the deep learning model BiGRU to extract feature vectors such as longitude, latitude, altitude, flight speed and heading from the ADS-B data, perform numerical normalization, and learn the distribution of the feature vectors on the hidden layer through the autoencoder. At the same time, the appropriate time length is selected for learning respectively, the data within the sliding time interval is reconstructed, and data enhancement is performed on these data. By comparing with the threshold of normal data, four different types of anomalies in electronic reconnaissance data can be detected.

[0051] like Figure 3-4 , this paper studies the BiGRU-based method to classify different anomaly types:

[0052] The classification method is:

[0053] Step 1: First, the two GRU layers of the bidirectional gated recurrent unit transmit the forward and reverse time sequences, and concatenate the two layers of state to obtain the hidden layer of BIGRU (hidden*2). The prediction results can be compared with the context sequence of the time series trajectory dataset for learning. The parameter settings of each layer of BiGRU are as follows: Figure 4 shown.

[0054] Step 2: Classify four common anomalies (A) random injection deviation, B fixed injection deviation, C DOS injection, D route replacement, and normal data into five types, and record the recognition accuracy.

[0055] Step 3: According to the different flight states of the aircraft, cruise and take-off and landing can be further subdivided. The four types of anomalies can be subdivided into eight categories: A1 cruise state random injection deviation, A2 take-off and landing state random injection deviation, B1 cruise state fixed injection deviation, B2 take-off and landing state fixed injection deviation, C1 cruise state DOS injection, C2 take-off and landing state DOS injection, D1 cruise state route replacement, D2 take-off and landing state route replacement. Normal data can also be divided into two categories according to cruise and take-off and landing, a total of 10 categories, and the recognition accuracy is recorded.

[0056] The above is only a preferred embodiment of the present invention. It should be pointed out that ordinary technicians in this technical field can make several improvements and supplements without departing from the method of the present invention. These improvements and supplements should also be regarded as the scope of protection of the present invention.

Claims

1. A method for intelligent detection and classification of abnormal electronic reconnaissance data, characterized by: The detection method is: Step 1: Use a large number of normal samples X, X={X1,X2,...,X T To train the network model, first normalize the maximum and minimum values ​​of the feature x of the selected data, and limit the value range of each dimension feature x' to [-1, 1], satisfying the formula: Step 2: After normalizing the normal sample X, the sliding window length is l = 10, and then the window X' = {X' t-l+1 ,X' t-l+2 ,...,X' t } as input to the VAE encoder; Step 3: The VAE encoder expands the feature dimension of X' to obtain a high-dimensional embedding Z t , use Z as the input of the BiGRU network to predict Z', and use the prediction result Z' of the BiGRU network as the input of the VAE decoder; Z'={z1',z2',...,z m '}=DEC(Z) Step 4: The VAE decoder decodes the window data Z' to obtain the reconstructed sequence Each sequence segmented by the sliding window is shown in the formula; the reconstruction error is calculated by comparing the reconstructed sequence with the original sequence; the anomaly detection score f is calculated by setting a threshold d. When the anomaly detection score f is greater than d, the sequence point is judged as an anomaly; The classification method is: Step 1: First, the two GRU layers of the bidirectional gated recurrent unit transmit the forward and reverse time sequences and concatenate the two layers of states. Step 2: Get the hidden layer hidden*2 of BIGRU; Step 3: Classify four common anomalies (A) random injection deviation, B fixed injection deviation, C DOS injection, and D route replacement, as well as normal data, and record the recognition accuracy. Step 4: Divide the four types of anomalies into eight categories. The normal data is divided into two categories according to cruise and take-off and landing, for a total of 10 categories, and record the recognition accuracy. The four types of anomalies are divided into eight categories: A1 cruise state random injection deviation, A2 take-off and landing state random injection deviation, B1 cruise state fixed injection deviation, B2 take-off and landing state fixed injection deviation, C1 cruise state DOS injection, C2 take-off and landing state DOS injection, D1 cruise state route replacement, D2 take-off and landing state route replacement.

2. The method for intelligent detection and classification of abnormal electronic reconnaissance data according to claim 1, characterized in that: z' i The prediction window representing the high-dimensional embedding of the i-th window at time t is used as the input of the decoder to reconstruct the window sequence X'.

3. The method for intelligent detection and classification of abnormal electronic reconnaissance data according to claim 2, characterized in that: After the deep autoencoder performs self-supervised learning on the features of conventional electronic reconnaissance data, it can only use longitude, latitude, altitude, flight speed and heading feature vectors to represent the features.

4. The method for intelligent detection and classification of abnormal electronic reconnaissance data according to claim 3 is characterized by: The input layer accepts input data x, maps it to the compressed space h expressed by the hidden layer through a certain "functional relationship" f(x), and then reconstructs it into x' through the reconstruction output layer function g(h). This "functional relationship" is implemented using a neural network in the autoencoder, where f(x) is called the encoder and g(h) is called the decoder.

5. The method for intelligent detection and classification of abnormal electronic reconnaissance data according to claim 4 is characterized by: The purpose of the autoencoder is to extract the most essential hidden layer features of the input electronic reconnaissance data by training the parameters of each layer and then using the encoder Autocoder, and reconstruct the new features with the Decoder to obtain the re-formed data.

Images