A method and system for active protection of unmanned aerial vehicles against security threats

Abstract

The present invention provides a method for active protection of unmanned aerial vehicles against security threats, which belongs to the field of unmanned aerial vehicle defense, and includes: real-time collection of network flow data of the network security domain of unmanned aerial vehicles; converting the data in the descriptive field and the proportional field in the network flow data into structured data, and extracting data features of the statistical field and the descriptive field and the proportional field after the data structure is converted, obtaining the feature vector of each field, combining and fusing the features of each feature vector, and generating a security threat log containing the threat type according to the combined feature vector and the feature fusion result; formulating a security strategy according to the threat type, and the unmanned aerial vehicle system actively protecting against security threats according to the security strategy. The method does not rely on thresholds and rules, does not need to frequently update and improve the defense strategy, can reduce the resource consumption of the system under the premise of ensuring safety, improve the endurance and performance of the unmanned aerial vehicle, and improve the security of the entire unmanned aerial vehicle network.

Description

Technical Field

[0001] The present invention belongs to the technical field of drone defense, and in particular relates to a method and system for active drone protection against security threats. Background Art

[0002] With the rapid development of the low-altitude economy, drones are increasingly used in various fields, including logistics distribution, environmental monitoring, film and television shooting, etc. However, at the same time, the security threats faced by drones are becoming increasingly severe. In the current network environment, GPS spoofing attacks have become a major hidden danger to drone security. Attackers forge false GPS signals to mislead the drone's positioning system and cause it to deviate from the predetermined route or position, which may cause the drone to perform the wrong mission or even cause serious consequences such as a crash.

[0003] At the same time, channel attacks should not be ignored. The communication channel between the drone and the control end may be invaded by attackers, stealing key communication data, thereby obtaining control of the drone or important information. Signal interference is another common threat method. External interference sources may interfere with the normal signal reception of the drone, causing it to lose contact with the control end and unable to execute instructions normally. DOS attacks can paralyze the drone's network system, making it unable to process and respond to instructions normally, seriously affecting the normal operation of the drone. Man-in-the-middle attacks are even more harmful. Attackers can intercept and tamper with the communication content between the drone and the control end, resulting in command errors or information leakage.

[0004] In order to solve the above-mentioned attacks on drones, people use complex technologies such as encryption algorithms, authentication mechanisms, encrypted communications, and multi-sensor fusion to defend drones, resist external interference, and ensure the security of drone networks. When identifying security threats, the above methods rely on preset thresholds and rules. When dealing with complex network environments, defense strategies need to be frequently updated and improved, making the entire drone threat identification and defense process complicated, consuming a lot of computing resources and energy, and thus affecting the drone's endurance and performance. Summary of the invention

[0005] In order to solve the above problems, the present invention provides a method for actively protecting a drone against security threats.

[0006] In order to achieve the above object, the present invention provides the following technical solutions:

[0007] An active protection method for drones against security threats, comprising:

[0008] Real-time collection of network flow data in the drone network security domain; the network flow data includes unstructured descriptive fields, structured statistical fields, and semi-structured proportional fields;

[0009] The data in the descriptive fields and proportional fields in the network flow data are converted into structured data, and the data features of the statistical fields and the descriptive fields and proportional fields after the data structure conversion are extracted to obtain the feature vector of the descriptive fields. , characteristic vector of statistical fields and the characteristic vector of the proportional field , combining and fusion of each feature vector, and generating a security threat log containing threat types according to the combined feature vector and feature fusion results;

[0010] Security strategies are formulated based on threat types, and the UAV system takes the initiative to protect against security threats based on the security strategies.

[0011] Preferably, the data in the descriptive field and the proportional field in the network flow data are converted into structured data, specifically:

[0012] Use One-Hot encoding to perform feature processing on each attribute in the descriptive field, quantize all discrete data, and obtain the quantization result of the field attribute;

[0013] The Sigmoid function is used to map the data with attribute values ​​greater than 1 in the proportional field to between (0, 1), and then jointly analyzed with the original data with attribute values ​​between [0, 1] to obtain the mapping value of the proportional field.

[0014] Preferably, before extracting data features from the statistical fields and the descriptive fields and proportional fields after data structure conversion, the statistical fields are normalized to obtain normalized results of field attribute values.

[0015] Preferably, the quantization result of the field attribute, the normalization result of the field attribute value and the mapping value of the proportional field are respectively extracted with a deep learning algorithm to obtain a feature vector of the descriptive field. , characteristic vector of statistical fields and the characteristic vector of the proportional field .

[0016] Preferably, the deep learning algorithm is a convolutional neural network (CNN), which uses the convolutional neural network (CNN) to extract data features from the descriptive field to obtain a feature vector of the descriptive field. ;

[0017] ;

[0018] In the formula, is the convolution kernel, It is the value of the descriptive field after One-Hot encoding. b is the bias term, f is an activation function used to map the feature values ​​after the convolution operation;

[0019] The convolutional neural network (CNN) is used to extract data features from the normalized results of field attribute values ​​to obtain the feature vector of the statistical field. ;

[0020] ;

[0021] In the formula, It is the normalized value of the statistical field;

[0022] The convolutional neural network (CNN) is used to extract the features of the mapping value of the proportional field and obtain the feature vector of the proportional field. ;

[0023] ;

[0024] In the formula, The mapping value for the proportional field.

[0025] Preferably, the combining and fusion of the feature vectors and generating a security threat log containing the threat type according to the combined feature vectors and the feature fusion result specifically include:

[0026] Characteristic vector for descriptive fields , characteristic vector of statistical fields and the characteristic vector of the proportional field Combine, each group contains There are four combinations: 、{ , }、{ , }as well as{ , , };

[0027] For only In the case of Perform feature learning and classification; for combinations of two or more features, connect each feature set in a cascade manner, and then use CNN to extract the feature vectors of each combination;

[0028] ;

[0029] ;

[0030] ;

[0031] In the formula, It is a cascade symbol, which is used to connect two or more features in series; To be the first i Data and The feature set after cascading; To be the first i Data and The feature set after cascading; To be the first i Data , as well as The feature set after all cascades, is the convolution kernel, b is the bias term, f is an activation function used to map the feature values ​​after the convolution operation;

[0032] according to And the characteristic vector of each combination , and Generates a security threat log containing threat types.

[0033] The present invention also provides an active protection system for unmanned aerial vehicles against security threats, comprising:

[0034] A data collection module, which is deployed on the drone side and is used to collect network flow data of the drone network security domain in real time; the network flow data includes unstructured descriptive fields, structured statistical fields, and semi-structured proportional fields;

[0035] A single honeypot is deployed on the ground side through a communication serial port, and is used to receive network flow data sent by the data acquisition module through a network interface, convert the data in the descriptive field and the proportional field in the network flow data into structured data, and extract data features from the statistical field and the descriptive field and proportional field after the data structure is converted, and obtain the feature vector of the descriptive field. , characteristic vector of statistical fields and the characteristic vector of the proportional field , combining and fusion of each feature vector, and generating a security threat log containing threat types according to the combined feature vector and feature fusion results;

[0036] Honeypot management platform, used to receive security threat logs sent by a single honeypot, formulate security policies according to threat types, and send security policies to single honeypots;

[0037] The single honeypot transmits the security policy to the drone system, and the drone system actively protects against security threats based on the security policy.

[0038] The present invention also provides a computer device, comprising a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement any one of the steps in the method for active protection of a drone against security threats.

[0039] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is loaded by a processor, it can execute any step of the method for active protection of a drone against security threats.

[0040] The present invention provides a method for actively protecting drones from security threats, which has the following beneficial effects:

[0041] The present invention converts the data in the descriptive field and the proportional field in the network flow data into structured data, unifies the data structure, extracts data features from the statistical field and the descriptive field and the proportional field after the data structure is converted, obtains the feature vector of the descriptive field, the feature vector of the statistical field and the feature vector of the proportional field, and combines and fuses the features of each feature vector. The above data processing method is not affected by the complexity of the network environment, can monitor and analyze various signals and data in different network environments of the unmanned aerial vehicle in real time, generates a security threat log containing threat types according to the combined feature vector and the feature fusion result, and formulates a security strategy according to the threat type, rather than relying solely on preset thresholds and rules. The security log contains security threats generated by the final processing of multiple network flow data, so that the entire method can automatically adapt to new attacks and complex attack scenarios, without the need to frequently update and improve defense strategies, and can reduce the resource consumption of the system under the premise of ensuring safety, improve the endurance and performance of the unmanned aerial vehicle, and improve the security of the entire unmanned aerial vehicle network. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiment of the present invention and its design scheme, the following briefly introduces the drawings required for this embodiment. The drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0043] Figure 1A flowchart of a method for actively protecting a drone from security threats provided by the present invention;

[0044] Figure 2 A logic diagram of an active protection system for unmanned aerial vehicles against security threats provided by the present invention;

[0045] Figure 3 This is a schematic diagram of the process of processing network flow data by a single honeypot. DETAILED DESCRIPTION

[0046] In order to enable those skilled in the art to better understand the technical solution of the present invention and implement it, the present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the scope of protection of the present invention.

[0047] Example 1

[0048] The present invention provides a method for actively protecting a drone from security threats, specifically: Figure 1 As shown, including:

[0049] Step 1: Collect network flow data of the drone network security domain in real time; the network flow data includes unstructured descriptive fields, structured statistical fields, and semi-structured proportional fields.

[0050] Step 2: Convert the data in the descriptive field and the proportional field in the network flow data into structured data, and extract the data features of the statistical field and the descriptive field and the proportional field after the data structure conversion to obtain the feature vector of the descriptive field. , characteristic vector of statistical fields and the characteristic vector of the proportional field , combine and fuse the feature vectors, and generate a security threat log containing threat types based on the combined feature vectors and feature fusion results.

[0051] Specifically, the combined feature vector and feature fusion result constitute the fingerprint feature of the UAV system. After the fingerprint data is parsed, the data packet becomes a series of protocol feature data and user data. By collecting the protocol feature data and performing behavioral analysis on the user data, protocol feature data and behavioral feature data are formed respectively. After analyzing the protocol feature data and behavioral feature data, the feature matrix :

[0052] ;

[0053] in, represents the number of features used, Represents the number of packets, and then the matrix Convert to a Vector .

[0054] ;

[0055] Based on the above feature extraction process, the final normal feature traffic fingerprint library vector that characterizes the security threat log containing the threat type can be obtained. :

[0056] ;

[0057] in, Represents the type label of the drone terminal sensor.

[0058] According to the normal characteristic traffic fingerprint library vector Generates a security threat log containing threat types.

[0059] Step 3: Develop security strategies based on threat types, and the UAV system will proactively protect against security threats based on the security strategies.

[0060] Specifically, formulating a security strategy includes learning the fluctuation range of fingerprint feature errors through long-term learning, setting an error matrix, and then comparing the error matrix with the final normal feature traffic fingerprint library vector. If it is within the allowable range of the error matrix, the data flows normally; if it exceeds the allowable range of the error matrix, the actual sensor task corresponding to the data is recorded and added to the abnormal behavior library for reporting.

[0061] If the data flows normally, the control command will be transmitted to the flight control computer; if it exceeds the allowable range of the error matrix, the network flow data will be truncated so that it cannot be transmitted to the flight control computer, and a corresponding specific alarm message will be issued.

[0062] Example 2

[0063] Based on the same inventive concept, the present invention also provides an active protection system for drones against security threats, such as Figure 2 As shown, it includes a data collection module 101, a single honeypot 102 and a honeypot management platform 103.

[0064] Specifically, the data collection module 101 is deployed on the drone side and is used to collect network flow data of the drone network security domain in real time; wherein the network flow data includes unstructured descriptive fields, structured statistical fields and semi-structured proportional fields.

[0065] The drone network mainly deploys a single honeypot 102 on the ground through a communication serial port. The single honeypot 102 receives the network flow data sent by the data acquisition module through a network interface, and converts the data in the descriptive fields and proportional fields in the network flow data into structured data in an offline manner, and extracts data features from the statistical fields and the descriptive fields and proportional fields after the data structure is converted to obtain the feature vector of the descriptive field. , characteristic vector of statistical fields and the characteristic vector of the proportional field , combine and fuse the feature vectors, and generate a security threat log containing threat types based on the combined feature vectors and feature fusion results. At the same time, the security threat log is output to the honeypot management platform in an offline manner.

[0066] The honeypot management platform 103 is used to receive security threat logs sent by a single honeypot, formulate security policies according to threat types, and send the security policies to the single honeypot, thereby improving the honeypot's ability to actively identify threats.

[0067] A single honeypot transmits security policies to the UAV system, and the UAV system actively protects against security threats based on the security policies.

[0068] The processing of network flow data by a single honeypot 102 is described in detail below.

[0069] The present invention divides all attributes of network traffic into three sub-attribute sets according to the industrial Internet data type: descriptive fields, statistical fields, and proportional fields. The specific division is shown in Table 1.

[0070] Table 1 Schematic diagram of data feature grouping

[0071]

[0072] First, preprocess the descriptive fields, statistical fields, and proportional fields respectively, such as Figure 3 As shown, the details are as follows:

[0073] Descriptive fields are mostly unstructured data, corresponding to the first column of fields in Table 1. These data are relatively discrete, and there is no direct connection between the data, so it is difficult to directly characterize and measure them. In the field of data mining, there is a common method for quantifying text data, which is One-Hot encoding. One-Hot encoding uses N-bit binary numbers to encode multiple states. Generally, the number of states is the same as the number of bits of the binary number. When a state needs to be represented, it is only necessary to set the position representing the state to 1 and the other positions to 0. For example, for drone communication, the protocol types include TCP, UDP, and MavLink, etc. The One-Hot encoding corresponding to TCP is [1 0 0], and the other two can be represented as [0 1 0] and [0 0 1] respectively. Similarly, other Symbolic attributes can be encoded. The present invention uses One-Hot encoding to perform feature processing on each attribute in the descriptive field, quantizes all discrete data, and obtains the quantization result of the field attribute, so as to facilitate feature measurement and analysis.

[0074] Statistical fields are mostly structured data, corresponding to the second column of fields in Table 1. The data range of each attribute is different and cannot be directly analyzed. The present invention uses two methods to normalize statistical fields. One is to divide the value of each data on a certain attribute by the average value of all data on the attribute; the other is to divide the value of each data on a certain attribute by the maximum value of all data on the attribute. Both methods can process statistical fields on the basis of maintaining the original data distribution as much as possible, so that the data range of each attribute is as close as possible to facilitate horizontal comparison and analysis. Assume that there are a total of n For the data i The first j The sub-attribute value is .

[0075] ;

[0076] ;

[0077] In the formula, is the mean normalization result, is the maximum normalized result, m is the total number of attributes in the statistical field, for The maximum value of .

[0078] Through this normalization process, the normalized result of the field attribute value is obtained, so that the data distribution of each feature is as close as possible, so as to facilitate unified measurement and analysis.

[0079] Proportional fields are mostly semi-structured data, corresponding to the third column field in Table 1. According to information such as the IP address and MAC address of the network connection, the proportion of network connections with certain characteristics in the network flow within a period of time can be obtained, such as network connections with the same source address or destination address as a certain network connection, so that a variety of proportional data can be obtained. Among these data, some data are between [0, 1], and these data are retained because of their similar values. The other part is data greater than 1, which is widely distributed and difficult to grasp its rules. Therefore, this part of data cannot be directly synchronized with the data between [0, 1] for analysis. The present invention processes data with attribute values ​​greater than 1 in the proportional field, maps it to (0, 1) using the Sigmoid function, and then performs a joint analysis with the data with the original attribute value between [0, 1] to obtain the mapping value of the proportional field. The definition of the Sigmoid function is shown in the formula.

[0080] ;

[0081] In the formula, For the proportional field j The property corresponds to i The value of the data. for The value after being mapped by the Sigmoid function; is an exponential function.

[0082] Next, the quantization results of the field attributes, the normalization results of the field attribute values, and the mapping values ​​of the proportional fields are respectively extracted through the deep learning algorithm to obtain the feature vector of the descriptive field. , characteristic vector of statistical fields and the characteristic vector of the proportional field , as follows:

[0083] In this embodiment, the deep learning algorithm is a convolutional neural network (CNN). The CNN model is designed to have three convolutional layers and one fully connected layer. The ReLu function is selected as the activation function, and maximum pooling is used to downsample the extracted features.

[0084] Use convolutional neural network (CNN) to extract data features from descriptive fields and obtain feature vectors of descriptive fields. :

[0085] ;

[0086] In the formula, in the formula, is the convolution kernel, It is the value of the descriptive field after One-Hot encoding. bis the bias term, f It is an activation function that can map the feature values ​​after the convolution operation.

[0087] Use CNN to extract data features from the normalized results of field attribute values ​​to obtain the feature vector of the statistical field. :

[0088] ;

[0089] In the formula, It is the normalized value of the statistical field.

[0090] The convolutional neural network (CNN) is used to extract the features of the mapping value of the proportional field and obtain the feature vector of the proportional field. ;

[0091] ;

[0092] In the formula, It is the value of the proportional field after being mapped by the Sigmoid function, that is, the mapping value of the proportional field.

[0093] Finally, the feature vectors are combined and fused, and a security threat log containing threat types is generated based on the combined feature vectors and feature fusion results, as follows:

[0094] In the honeypot, the network flow data of the drone communication serial port is parsed through a deep learning algorithm. In the structured data obtained, there are certain multidimensional feature sets that jointly represent a specific meaning. These feature sets need to be processed in order to reduce redundancy while retaining basic information.

[0095] This embodiment selects different feature subsets for combination and feature fusion to study the impact of various features on network behavior recognition and classification. The descriptive fields mainly include attributes such as network protocol type, network service type, and connection status. Considering that these attributes are of great significance to network connection, when combining features, each group contains , there are four specific combinations: 、{ , }、{ , }as well as{ , , }.

[0096] For only In the case of , the classification model can be used directly for feature learning and classification. For two or more feature combinations, each feature set is connected in a cascade manner, and then CNN is used to extract the feature vectors of each combination.

[0097] ;

[0098] ;

[0099] ;

[0100] In the formula, It is a cascade symbol, which is used to connect two or more features in series; To be the first i Data and The feature set after cascading; To be the first i Data and The feature set after cascading; To be the first i Data , as well as The feature set after all cascades, is the convolution kernel, b is the bias term, f It is an activation function used to map the feature values ​​after the convolution operation.

[0101] according to And the characteristic vector of each combination , and Generates a security threat log containing threat types.

[0102] Each module in the above-mentioned unmanned aerial vehicle active protection system against security threats can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0103] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps in an embodiment of a method for actively protecting a drone from security threats. The specific implementation method can be found in the method embodiment, which will not be described in detail here.

[0104] Furthermore, the present invention also provides a non-temporary computer-readable storage medium containing instructions, and a computer program is stored on the storage medium. For example, a memory containing instructions, the above instructions can be executed by a processor of a computer device to complete the above method. For example, the non-temporary computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a tape, a floppy disk, and an optical data storage device. When the computer program is executed by the processor, it can implement the steps in an embodiment of a method for active protection of a drone against security threats. The specific implementation method can be found in the method embodiment, which will not be repeated here.

[0105] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0107] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0108] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0109] It should be pointed out that the specific implementation methods described above can enable those skilled in the art to understand the invention more comprehensively, but do not limit the invention in any way. Therefore, although the invention has been described in detail in this specification and embodiments, those skilled in the art should understand that the invention can still be modified or replaced by equivalents; and all technical solutions and improvements that do not deviate from the spirit and scope of the invention are included in the protection scope of the patent for the invention. Any figure mark in the claims should not be regarded as limiting the claims involved. Any simple change or equivalent replacement of the technical solution that can be obviously obtained by any technician familiar with the field within the technical scope disclosed in the present invention belongs to the protection scope of the present invention.

Claims

1. A method for active protection of drones against security threats, characterized in that: include: Real-time collection of network flow data in the drone network security domain; the network flow data includes unstructured descriptive fields, structured statistical fields, and semi-structured proportional fields; The data in the descriptive field and the proportional field in the network flow data are converted into structured data, and the data features of the statistical field and the descriptive field and the proportional field after the data structure conversion are extracted to obtain the feature vector of the descriptive field, the feature vector of the statistical field and the feature vector of the proportional field, and the feature vectors are combined and feature fused, and a security threat log containing threat types is generated according to the combined feature vector and the feature fusion result; Formulate security strategies based on threat types, and the UAV system will proactively protect against security threats based on the security strategies; The data in the descriptive field and the proportional field in the network flow data are converted into structured data, specifically: Use One-Hot encoding to perform feature processing on each attribute in the descriptive field, quantize all discrete data, and obtain the quantization result of the field attribute; The Sigmoid function is used to map the data with attribute values ​​greater than 1 in the proportional field to between (0, 1), and then the data with the original attribute values ​​between [0, 1] are analyzed together to obtain the mapping value of the proportional field. Before extracting data features from the statistical fields and the descriptive fields and proportional fields after the data structures are converted, the statistical fields are normalized to obtain normalized results of field attribute values; The quantification results of the field attributes, the normalization results of the field attribute values, and the mapping values ​​of the proportional fields are respectively extracted through the deep learning algorithm to obtain the feature vector F of the descriptive field. D , the characteristic vector F of the statistical field S and the characteristic vector F of the proportional field P ; The combining and fusing the feature vectors and generating a security threat log containing the threat type according to the combined feature vectors and the feature fusion results specifically include: The feature vector F for the descriptive field D , the characteristic vector F of the statistical field S and the characteristic vector F of the proportional field P Combine them, each group contains F D There are four combinations: F D 、{F D , F S }、{F D , F P } and {F D , F S , F P }; For only F D In the case of F, the classification model is directly used D Perform feature learning and classification; for combinations of two or more features, connect each feature set in a cascade manner, and then use CNN to extract the feature vectors of each combination; In the formula, It is a cascade symbol, which is used to connect two or more features together; is the F of the i-th data D and F S The feature set after cascading; is the F of the i-th data D With F P The feature set after cascading; is the F of the i-th data D 、F S and F P The feature set after all cascades, W is the convolution kernel, b is the bias term, and f is the activation function, which is used to map the feature values ​​after the convolution operation; According to F D And the characteristic vectors of each combination and Generates a security threat log containing threat types.

2. The method for active protection of drones against security threats according to claim 1, characterized in that: The deep learning algorithm is a convolutional neural network (CNN), which uses the convolutional neural network (CNN) to extract data features from the descriptive field and obtain a feature vector F of the descriptive field. D ; F D =f(W·V D +b); Where W is the convolution kernel, V D is the value of the descriptive field after One-Hot encoding, b is the bias term, and f is the activation function, which is used to map the feature value after the convolution operation; The convolutional neural network (CNN) is used to extract data features from the normalized results of field attribute values ​​to obtain the feature vector F of the statistical field. S ; F S =f(W·V S +b); Where V S It is the normalized value of the statistical field; The convolutional neural network (CNN) is used to extract the features of the mapping value of the proportional field and obtain the feature vector F of the proportional field. P ; F P =f(W·V P +b); Where V P The mapping value for the proportional field.

3. An active protection system for drones against security threats, characterized in that: include: A data collection module, which is deployed on the drone side and is used to collect network flow data of the drone network security domain in real time; the network flow data includes unstructured descriptive fields, structured statistical fields, and semi-structured proportional fields; A single honeypot is deployed on the ground side through a communication serial port, and is used to receive the network flow data sent by the data acquisition module through a network interface, convert the data in the descriptive field and the proportional field in the network flow data into structured data, and extract data features from the statistical field and the descriptive field and the proportional field after the data structure is converted, and obtain the feature vector F of the descriptive field. D , the characteristic vector F of the statistical field S and the characteristic vector F of the proportional field P , combining and fusion of each feature vector, and generating a security threat log containing threat types according to the combined feature vector and feature fusion results; Honeypot management platform, used to receive security threat logs sent by a single honeypot, formulate security policies according to threat types, and send security policies to single honeypots; The single honeypot transmits the security policy to the UAV system, and the UAV system actively protects against security threats according to the security policy; The data in the descriptive field and the proportional field in the network flow data are converted into structured data, specifically: Use One-Hot encoding to perform feature processing on each attribute in the descriptive field, quantize all discrete data, and obtain the quantization result of the field attribute; The Sigmoid function is used to map the data with attribute values ​​greater than 1 in the proportional field to between (0, 1), and then the data with the original attribute values ​​between [0, 1] are analyzed together to obtain the mapping value of the proportional field. Before extracting data features from the statistical fields and the descriptive fields and proportional fields after the data structures are converted, the statistical fields are normalized to obtain normalized results of field attribute values; The quantization results of the field attributes, the normalization results of the field attribute values, and the mapping values ​​of the proportional fields are respectively extracted through the deep learning algorithm to obtain the feature vector F of the descriptive field. D , the characteristic vector F of the statistical field S and the characteristic vector F of the proportional field P ; The combining and fusing the feature vectors and generating a security threat log containing the threat type according to the combined feature vectors and the feature fusion results specifically include: The feature vector F for the descriptive field D , the characteristic vector F of the statistical field S and the characteristic vector F of the proportional field P Combine them, each group contains F D There are four combinations: F D 、{F D , F S }、{F D , F P } and {F D , F S , F P }; For only F D In the case of F, we can directly use the classification model to D Perform feature learning and classification; for combinations of two or more features, connect each feature set in a cascade manner, and then use CNN to extract the feature vectors of each combination; In the formula, It is a cascade symbol, which is used to connect two or more features together; is the F of the i-th data D and F S The feature set after cascading; is the F of the i-th data D With F P The feature set after cascading; is the F of the i-th data D 、F S and F P The feature set after all cascades, W is the convolution kernel, b is the bias term, and f is the activation function, which is used to map the feature values ​​after the convolution operation; According to F D And the characteristic vectors of each combination and Generates a security threat log containing threat types.

4. A computer device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 and 2.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is loaded into a processor, the computer program can execute the steps of the method according to any one of claims 1 and 2.

Images