A drone monitoring method based on WiFi features

Abstract

The present invention relates to a drone monitoring method based on Wi-Fi signatures. Based on drone signal data packets captured by wireless network cards, the present invention proposes a drone signal detection algorithm based on Wi-Fi signatures. This algorithm does not require the acquisition of raw drone signal data; instead, it captures data packets from drone communication links over a very short period of time. It then uses a random forest algorithm to perform feature recognition on the captured signals or compare them against a drone database to effectively detect drones. Because this method is integrated into an embedded processor, it is a convenient drone signal detection algorithm.

Description

Technical Field

[0001] The present invention belongs to the field of signal and information processing, and specifically provides a method for detecting drone signals based on WiFi features. Background Art

[0002] Drone monitoring methods have been a rapidly developing research area in recent years. Drones are primarily used for aerial photography, aerial mapping, and high-altitude operations. However, due to the recent reduction in the cost of drone manufacturing technology, they are increasingly being used by criminals for illegal activities. Therefore, drone monitoring methods have application value in the field of radio monitoring.

[0003] There are currently four main approaches to drone signal monitoring: radar-based drone detection, video-based drone detection, sound-based drone detection, and radio signal detection. However, these existing methods suffer from high costs, complex algorithms, and high false alarm rates. Therefore, research is needed on simpler, more cost-effective, and more accurate drone monitoring methods.

[0004] This paper proposes a drone monitoring method based on WiFi signatures, targeting low-cost drones that are in high demand on the market. This method utilizes the radio signals of WiFi-based drones to detect them by capturing and extracting their signatures. Compared to other methods, this method offers advantages such as rapid detection, high recognition accuracy, low cost, ease of deployment, and the ability to establish a drone database. Furthermore, it is effective in urban environments with complex electromagnetic environments. Summary of the Invention

[0005] In view of the above shortcomings of the prior art, the present invention proposes a drone monitoring method based on WiFi features, which includes the following steps:

[0006] A drone monitoring algorithm based on WiFi features is characterized by monitoring drone signals with WiFi image transmission protocol within a specified range. The method mainly includes:

[0007] Step 1: Signal capture step: Use aircrack to capture data packets on each WiFi channel through the wireless network card;

[0008] Step 2: Signal feature extraction step: protocol analysis and feature extraction of the captured data packets;

[0009] Step 2.1: Data packet parsing, performing protocol parsing on all retained data packets;

[0010] Step 2.2: Filter the data;

[0011] Step 2.3: Data packet grouping and preliminary identification. The filtered data packets are mixed with various traffic types. All data flows in each WiFi channel are grouped according to their source addresses (SA). The i-th data in the j-th group of data flows is defined as at this time The SA address will be compared with the drone model library. If the comparison result is an illegal drone, an alarm will be issued. If the model does not exist in the model library, step 2.4 will be performed.

[0012] Step 2.4: WiFi feature extraction, data packets classified by source address, data extraction features per second: the total number of data packets with the same source address per unit time TN i，j , average packet length AL i，j , the root mean square value RF of the control frame i，j , the root mean square value of the frame duration RD i，j ;

[0013] Combine the above features into a feature vector:

[0014] Ψ i，j ={TN i，j , AL i，j , RF i，j , RD i，j}

[0015] As input to machine learning algorithms;

[0016] Step 3: Signal detection: Based on the characteristics of each signal, a machine learning algorithm is used to detect drone signals. If a drone is found, the drone signal parameters are reported.

[0017] Step 3.1: Drone signal recognition: Use the feature vector extracted in the previous step as the input of the random forest model for recognition. If the recognition result is a drone, a drone intrusion alarm is issued and step 3.2 is performed;

[0018] Step 3.2: UAV information extraction, UAV model information extraction, extract the identified UAV model information, save and update it to the UAV model database.

[0019] Furthermore, step 1 targets all WiFi channels within the 2.4G and 5.8G frequency bands.

[0020] Furthermore, in step 1, the sniffing mode of aircrack is used to capture data packets on each channel in real time.

[0021] Furthermore, the sniffing mode of aircrack is used to capture data packets on each channel in real time, and the capture time is set to a fixed value of 1 second.

[0022] Furthermore, step 2.1 packet parsing performs protocol parsing on all retained data packets; including performing 802.11 protocol parsing on each data packet in a unit time, parsing out the public frame header information of each frame in a unit time, including: source media access control address (SA), destination MAC address (DA), transmitter MAC address (TA), receiver MAC address (RA), basic service set identifier (BSSID), packet length, epoch time and other MAC header information. The parsed data of the i-th frame packet in a unit time is

[0023] Furthermore, step 2.2 filters the data, including deleting all broadcast data packets, damaged data packets, and data packets with only receiving addresses in the data filtering stage, and retaining the remaining data packets. After filtering, the parsed data of the i-th frame packet in unit time is

[0024] Furthermore, the data packets filtered in step 2.3 are a mixture of various traffic types, including video streaming, social networking applications, online games, emails, web browsing applications, and drone signals.

[0025] Furthermore, step 2.4 defines the total length of data per second as M, and the packet length of the mth frame is defined as p i，j，m , the control frame value is f i，j，m , duration d i，j，m , the total number of data packets with the same source address per unit time TN i，j , average packet length AL i，j , the root mean square value RF of the control frame i，j , the root mean square value of the frame duration RD i，j The specific formula is as follows:

[0026] TN i，j =M

[0027]

[0028]

[0029]

[0030] Furthermore, the evaluation and verification were carried out using data collected in actual scenarios, and the probability of hit (POD), critical success index (CSI), false alarm rate (FAR) and F score were calculated.

[0031] Furthermore, a drone monitoring system based on WiFi features implements the above-mentioned drone monitoring algorithm based on WiFi features.

[0032] The present invention solves the following technical problems:

[0033] 1. The present invention extracts all data packet information within a unit time based on the public frame header information of the WiFi data packet, performs group statistics according to the SA address to calculate the short-term statistical feature vector, and performs classification and recognition through the random forest algorithm in the machine learning algorithm, effectively improving the recognition accuracy and recognition speed.

[0034] 2. The present invention has low computational complexity and fast recognition speed, and can therefore be applied to embedded mobile hardware devices and form a complete drone monitoring system with a distributed network structure for drone monitoring in a larger range of no-fly zones.

[0035] 3. This invention is applicable to all drones that use the WiFi protocol for image transmission and control signals. It can identify and classify drones of any manufacturer and model that use the WiFi protocol for image transmission and control signals, regardless of whether the transmission is encrypted. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flow chart of a drone monitoring method based on WiFi features; DETAILED DESCRIPTION

[0037] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Figure 1 As shown, the following steps are included:

[0038] The algorithm in this patent uses data packets captured by Aircrack to extract features and monitor drone signals based on the features. The specific steps are as follows:

[0039] (1) Signal capture step: Use aircrack to capture data packets on each WiFi channel through the wireless network card;

[0040] (2) Signal feature extraction step: protocol parsing and feature extraction of captured data packets;

[0041] (3) Signal detection step: Based on the characteristics of each signal, a machine learning algorithm is used to detect drone signals. If a drone is found, the drone signal parameters are reported. At the same time, a model database match can be performed, greatly reducing detection time.

[0042] Furthermore, step (1) includes the following sub-steps:

[0043] (1.1) For all WiFi channels in the 2.4G and 5.8G frequency bands, use Aircrack’s sniffing mode to capture data packets on each channel in real time.

[0044] Furthermore, step (2) includes the following sub-steps:

[0045] (2.1) Packet parsing. Protocol parsing is performed on all retained packets. Each packet within a unit time is subjected to 802.11 protocol parsing, and the public frame header information of each frame within the unit time is parsed, including: source media access control address (SA), destination MAC address (DA), transmitter MAC address (TA), receiver MAC address (RA), basic service set identifier (BSSID), packet length, epoch time, and other MAC header information, such as frame type, frame type (control, management, or data), sequence number, and duration / connection ID.

[0046] (2.2) Filter the data. In the data filtering stage, we remove all broadcast packets (such as 802.11 beacon frames), damaged packets, and packets with only receiving addresses (such as 802.11 ACK frames). The remaining packets are retained.

[0047] (2.3) Packet Grouping and Preliminary Identification. Filtered packets may often contain a mix of traffic types, such as video streams, social networking applications, online games, email, web browsing applications, and drone signals. We group all data flows within each WiFi channel by their source address (SA). The SA address in each data group is compared with our drone model database. If the comparison result indicates an illegal drone, an alarm is issued. If the model does not exist in the database, the next step is performed.

[0048] (2.4) WiFi feature extraction. After packets are classified by source address, we extract the following features for each second of data: the total number of packets from the same source address per unit time, the average packet length, the RMS value of control frames, and the RMS value of frame duration. These features are combined into a feature vector, which serves as the input for the machine learning algorithm.

[0049] Furthermore, step (3) includes the following sub-steps:

[0050] (3.1) Drone signal recognition. The feature vector extracted in the previous step is used as the input of the random forest model for recognition. If the recognition result is a drone, a drone intrusion alarm is issued and the next step is carried out.

[0051] (3.2) Extracting drone model information: Extract the identified drone model information, save it, and update it to the drone model database.

[0052] Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, other embodiments obtained by ordinary technicians in this field without making creative work are all within the scope of protection of the present invention.

Claims

1. A drone monitoring method based on WiFi features, characterized in that The method for monitoring the signal of a drone using WiFi as the image transmission protocol within a specified range mainly includes: Step 1: Signal capture step: Use aircrack to capture data packets on each WiFi channel through the wireless network card; Step 2: Signal feature extraction step: protocol analysis and feature extraction of the captured data packets; Step 2.1: Data packet parsing, performing protocol parsing on all retained data packets; Step 2.2: Filter the data; Step 2.3: Data packet grouping and preliminary identification. The filtered data packets are mixed with various traffic types, including video streaming, social networking applications, online games, emails, web browsing applications, and drone signals. All data flows in each WiFi channel are grouped according to their source address SA. The i-th data in the j-th group of data flows is defined as ,at this time The SA address will be compared with the drone model library. If the comparison result is an illegal drone, an alarm will be issued. If the model does not exist in the model library, step 2.4 will be performed. Step 2.4: WiFi feature extraction, data packets classified by source address, data extraction features within each second: the total number of data packets with the same source address per unit time , average packet length , the root mean square value of the control frame , the root mean square value of the frame duration ; Combine the above features into a feature vector: as input to machine learning methods; Step 3: Signal detection: Based on the characteristics of each signal, use machine learning methods to detect drone signals. If a drone is found, the drone signal parameters are reported. Step 3.1: Drone signal recognition: Use the feature vector extracted in the previous step as the input of the random forest model for recognition. If the recognition result is a drone, a drone intrusion alarm is issued and step 3.2 is performed; Step 3.2: UAV information extraction, UAV model information extraction, extract the identified UAV model information, save and update it to the UAV model database.

2. The method for monitoring drones based on WiFi features according to claim 1, wherein: Step 1 is for all WiFi channels in the 2.4G and 5.8G frequency bands.

3. The method for monitoring drones based on WiFi features according to claim 1, wherein: Step 1: Use Aircrack's sniffing mode to capture data packets on each channel in real time.

4. The method for monitoring drones based on WiFi features according to claim 3, wherein: Use aircrack's sniffing mode to capture data packets on each channel in real time, and set the capture time to a fixed value of 1 second.

5. The method for monitoring drones based on WiFi features according to claim 1, wherein: Step 2.1 Data packet parsing: performing protocol parsing on all retained data packets; Including each data packet in the unit time for 802.11 protocol parsing, parsing the public frame header information of each frame in the unit time, including: source media access control address SA, destination MAC address DA, transmitter MAC address TA, receiver MAC address RA, basic service set identifier BSSID, data packet length, epoch time and other MAC header information. The parsed data of the i-th frame packet in the unit time is .

6. The method for monitoring drones based on WiFi features according to claim 1, wherein: Step 2.2 filters the data, including deleting all broadcast data packets, damaged data packets and data packets with only receiving addresses in the data filtering stage, and retaining the remaining data packets. After filtering, the parsed data of the i-th frame packet in unit time is .

7. The method for monitoring drones based on WiFi features according to claim 1, wherein: Step 2.4 defines the total length of data per second as M, and the packet length of the mth frame is defined as , the control frame value is , duration ,The total number of data packets with the same source address per unit time , average packet length , the root mean square value of the control frame , the root mean square value of the frame duration The specific formula is as follows: 。 8. The method for monitoring drones based on WiFi features as claimed in claim 1, characterized in that The evaluation and verification were carried out using data collected in actual scenarios, and the hit rate (POD), critical success index (CSI), false alarm rate (FAR) and F-score were calculated.

9. A drone monitoring system based on WiFi features, implementing a drone monitoring method based on WiFi features as described in claims 1-8.

Images