Four-rotor unmanned aerial vehicle GNSS sensor attack detection and identification method

Abstract

The invention provides a quadrotor unmanned aerial vehicle GNSS sensor attack detection and identification method, which comprises the following steps: comparing unmanned aerial vehicle state estimation obtained according to an inertial navigation system / GNSS direct loosely integrated navigation system with a GNSS measurement value, and obtaining feature information related to whether a GNSS is attacked or not; then, by analyzing the influence of attacks on the feature information of different signal channels, training a support vector machine binary classifier; and finally, based on the trained support vector machine SVM binary classifier, designing an error correction output code-support vector machine in combination with a feature combination coding scheme, and constructing an attack detection subsystem and an attack identification subsystem. According to the invention, whether the GNSS is attacked and the attacked signal channel can be judged, the detection efficiency is improved, and the detection function is enriched.

Description

Technical Field

[0001] The present invention belongs to the field of unmanned aerial vehicle attack detection, and in particular relates to a method for detecting and identifying a GNSS sensor attack on a quad-rotor unmanned aerial vehicle. Background Art

[0002] Quad-rotor drones have been widely used in civil and military fields due to their simple structure, strong maneuverability and low cost. In modern drone technology, the Global Navigation Satellite System (GNSS) is one of the key technologies for realizing drone positioning and navigation. The accuracy and reliability of the GNSS system are crucial to the normal operation of drones. However, due to the openness and fragility of GNSS signals, GNSS attacks have become a serious security issue. Such attacks may cause errors in drone positioning information, thereby triggering a series of security incidents. However, how to achieve effective GNSS attack detection in a resource-constrained environment has become a challenging problem. Therefore, developing an efficient GNSS attack detection and identification method is of great significance to improving the safety of quad-rotor drones. Summary of the invention

[0003] Purpose of the invention: In order to improve the safety and reliability of a quadrotor drone when it is attacked by the Global Navigation Satellite System (GNSS), the present invention provides a quadrotor drone GNSS sensor attack detection and identification method, which can efficiently and accurately detect and identify various types of GNSS attacks, thereby reducing safety accidents caused by GNSS attacks.

[0004] Technical solution: The present invention provides a method for detecting and identifying attacks on GNSS sensors of quad-rotor drones, which obtains characteristic information related to whether the global navigation satellite system GNSS is under attack and constructs a detection model, so as to detect in real time whether the GNSS sensor of the drone global navigation satellite system is under attack; and after detecting the attack, identifies the signal channel of the drone under attack. Specifically, the following steps are included:

[0005] Step 1, select the appropriate state vector and establish the system equation and measurement equation, and construct the direct loose integrated navigation system subsystem based on the extended Kalman filter (Extended Kalman Filter, EKF);

[0006] Step 2, comparing the estimated value of the integrated navigation system with the measured value of the global navigation satellite system GNSS, and extracting characteristic information related to whether the global navigation satellite system GNSS is under attack;

[0007] Step 3: Decompose the attack detection and attack identification tasks into support vector machine (SVM) binary classification tasks, and train the support vector machine (SVM) binary classifiers one by one in combination with the duck swarm algorithm;

[0008] Step 4: According to the goals and requirements of attack detection, a feature combination coding scheme is used to encode whether the global navigation satellite system GNSS is attacked, and an appropriate support vector machine (SVM) binary classifier is selected to design an Error Correcting Output Codes-Support Vector Machine (ECOC-SVM) model, and an attack detection subsystem is constructed;

[0009] Step 5: According to the goals and requirements of attack identification, a feature combination coding scheme is used to encode the attack types suffered by the global navigation satellite system GNSS, and an appropriate support vector machine (SVM) binary classifier is selected to design an error correction output coding-support vector machine (ECOC)-SVM model, and an attack identification subsystem is constructed;

[0010] Step 6: Use the attack detection subsystem to perform attack detection on the test data set to obtain decision codes, and decode them to determine whether the global navigation satellite system GNSS is under attack; if the global navigation satellite system GNSS is under attack, use the attack identification subsystem to perform attack identification on the test data set to obtain decision codes, and decode them to identify the type of attack on the global navigation satellite system GNSS.

[0011] In step 1, the direct loose integrated navigation system subsystem based on the extended Kalman filter EKF includes a state vector x k and the observed value z k , defined as:

[0012]

[0013] in, is a quaternion, which represents the attitude of the aircraft; represents the real number space; They represent the speed and position of the UAV in the North-East-Down Coordinate System (NED coordinate system). represent the constant deviations in the measurements of the gyroscope, accelerometer, and magnetometer in the body coordinate system, respectively; represents the Earth's magnetic field vector in the Northeast Earth (NED) coordinate system; It represents the velocity component of wind in the horizontal direction; Represents the three-axis magnetic field value measured by the magnetometer in the body coordinate system; Represents the three-dimensional velocity value measured by the Global Navigation Satellite System GNSS; Represents the horizontal position value measured by the Global Navigation Satellite System (GNSS); Indicates the measured value of the barometer.

[0014] The following state equation and measurement equation are established:

[0015] x k+1 =f(x k ,u k )+w k

[0016] z k =h(x k )+v k

[0017] Among them, x k represents the state vector of the system at the kth moment; z k represents the observation vector of the system at the kth moment; represents the input vector of the direct loose integrated navigation system subsystem at the kth moment, T represents the matrix transpose; ω b 、a b represents the angular velocity measurement value and acceleration measurement value provided by the gyroscope and accelerometer respectively; w k ,v k denote the process noise and measurement noise of the integrated navigation system at the kth moment respectively; f(·) and h(·) denote the state transfer equation and the observation equation respectively.

[0018] Step 2 includes: using a direct loose integrated navigation system to estimate the system state, and comparing the estimated value of the integrated navigation system with the GNSS measurement value to extract feature information related to whether the GNSS is under attack, considering a time interval Δ k The difference between the change in the measured value of the Global Navigation Satellite System GNSS and the change in the estimated value of the Extended Kalman Filter EKF is:

[0019]

[0020] in, They represent the estimated values ​​of the UAV speed and position output by the integrated navigation system in the Northeast Earth (NED) coordinate system; represents the error value between the change value of the measurement value of the global navigation satellite system GNSS and the change value of the estimated value of the extended Kalman filter EKF at the kth moment; It represents the error value of the N-axis component of the velocity in the Northeast Earth (NED) coordinate system at the kth moment; It represents the error value of the E-axis component of the velocity in the Northeast Earth (NED) coordinate system at the kth moment; It represents the error value of the D-axis component of the velocity in the Northeast Earth (NED) coordinate system at the kth moment; It represents the error value of the N-axis component of the position in the Northeast Earth (NED) coordinate system at the kth moment; Indicates the error value of the E-axis component of the position in the Northeast Earth (NED) coordinate system at the kth moment; time interval Δ k The size of is determined by the sampling frequency of the global navigation satellite system GNSS. The time interval Δ of the hardware platform used in the present invention is k 0.4 seconds.

[0021] Both the GNSS measurement values ​​and the estimated values ​​output by the integrated navigation system are information related to time series. Therefore, in order to obtain the time series characteristics contained therein, a sliding time series window is introduced to construct feature information:

[0022]

[0023] in, It represents the characteristic information constructed by the error value of the N-axis component of the velocity in the Northeast Earth (NED) coordinate system in a given sliding time series window; It represents the characteristic information constructed by the error value of the E-axis component of the velocity in the Northeast Earth (NED) coordinate system in a given sliding time series window; It represents the feature information constructed by the error value of the N-axis component of the position in the Northeast Earth (NED) coordinate system in a given sliding time series window; It represents the feature information constructed by the error value of the E-axis component of the position in the Northeast Earth (NED) coordinate system in a given sliding time series window; It represents the feature information constructed by the error value of the D-axis component of the position in the Northeast Earth (NED) coordinate system in a given sliding time series window.

[0024] In step 3, the kernel function κ(x i ,x j ) is chosen as the radial basis function:

[0025] κ(x i ,x j )=exp(-γ||x i -x j || 2 )

[0026] Among them, x i, x j Represents two samples in the training sample set (the training sample set is generally composed of feature information The label is the specific signal channel under attack); γ is the kernel function parameter, which controls the width of the kernel of the radial basis function and is usually expressed as σ is the kernel width; exp is the natural exponential function.

[0027] In step 3, the support vector machine SVM binary classifiers are trained one by one in combination with the duck swarm algorithm, specifically including the following steps:

[0028] Step 3.1: Initialize the duck flock algorithm, randomly initialize the duck flock, and the position of each duck represents a set of support vector machine SVM parameters; in the present invention, the position of the duck flock individuals includes the optimization penalty parameter C and the kernel function parameter γ.

[0029] Step 3.2: After calculating the fitness value corresponding to the individual position in the duck flock, find the duck that is currently in the optimal position; the fitness value of the individual position in the duck flock represents the classification effect of the support vector machine SVM parameters corresponding to the current duck's position. Therefore, the duck with the highest fitness value is the individual in the optimal position.

[0030] Step 3.3: Exploration phase: After the ducks’ queuing behavior occurs, that is, the ducks arrive at a place with more food, each individual gradually disperses and begins to look for food, which can be expressed as:

[0031]

[0032] Where sign(·) represents the sign function, sign(rand-0.5) affects the process of searching for food; rand represents a random number between (0, 1); μ is the control parameter of global search; P is the search transition probability in the exploration phase; CF 1 and CF 2 They represent the cooperation coefficient and competition coefficient of ducks in the search phase respectively; represents duck X in the tth iteration i location; represents the duck X obtained during the exploration phase i location; represents the duck in the best position in the first t iterations; Indicates that in the tth iteration, around the duck Ducks looking for food; global search control parameter μ, duck cooperation coefficient CF during the search phase 1 and the competition coefficient CF 2 The calculation formula is:

[0033]

[0034] K=sin(2·rand)+1

[0035]

[0036] Among them, FP represents a constant, which is generally 0.618;

[0037] Step 3.4: Development phase: The positional fitness of each duck is expressed as:

[0038]

[0039] Among them, KF 1 and KF 2 represent the cooperation coefficient and competition coefficient of ducks in the development stage respectively; Indicates that after the exploration phase, around the duck The kth duck foraging for food, Indicates that after the exploration phase, around the duck The jth duck foraging, where k≠j; and Respectively The fitness and Adaptability; represents the duck X after the tth iteration i location, Indicates that duck X is in the exploration stage i The position of KF 1 and KF 2 The calculation formula is:

[0040]

[0041] Step 3.5: Determine whether the maximum number of iterations has been reached (generally set to 1000 times). If so, proceed to step 3.6; otherwise, return to step 3.2;

[0042] Step 3.6: Obtained from the historical iteration round Set as the optimal individual and The position is decomposed to obtain the hyperparameters of the support vector machine SVM, including the optimized penalty parameter C and the kernel function parameter γ.

[0043] In step 4 and step 5, the feature combination coding scheme is to combine and encode the classification results of more than two support vector machine SVM binary classifiers for the global navigation satellite system GNSS under different attack types, and identify the behavioral differences of specific signal channels under attacks; then combine and encode the features of different signal channels to realize the attack detection and identification functions of the global navigation satellite system GNSS.

[0044] In step 4, the attack detection subsystem refers to a suitable support vector machine SVM binary classifier (in the present invention, the output results of the support vector machine SVM binary classifier under different attacks are specifically compared, and the minimum number of support vector machines SVM is selected to complete the attack detection function. The present invention does not propose a specific method for selecting those support vector machines SVM binary classifiers, but the present invention in the following embodiments mainly uses the finally trained support vector machine SVM to analyze the output results of the corresponding attack, and selects the combination of the minimum number of support vector machines SVM that can determine the attack), and uses a feature combination coding scheme to be integrated into the error correction output coding-support vector machine ECOC-SVM model to distinguish between the attacked state and the normal state, thereby detecting whether the global navigation satellite system GNSS is under attack.

[0045] In step 5, the attack identification subsystem uses the trained support vector machine SVM binary classifier and a feature combination coding scheme to design and construct an error correction output coding-support vector machine ECOC-SVM model for identifying attacks on different signal channels.

[0046] In step 6, the decision code is decoded using the Hamming distance.

[0047] The present invention also provides an electronic device, comprising a processor and a memory, wherein the memory stores program code, and when the program code is executed by the processor, the processor executes the steps of the described method.

[0048] Beneficial effect: By applying the technical solution of the present invention, a method for detecting and identifying attacks on GNSS sensors of a quadrotor unmanned aerial vehicle global navigation satellite system based on a duck flock algorithm and ECOC-SVM is provided, which respectively differentiates attack detection and attack identification into multiple support vector machine SVM binary classification problems. This paper adopts a feature combination coding scheme to encode attack detection and attack identification problems, and constructs an error correction output coding-support vector machine ECOC-SVM model. Compared with the prior art, the technical solution of the present invention can solve the problem of insufficient accuracy of the prior art method for detecting and identifying attacks on GNSS sensors of a quadrotor unmanned aerial vehicle global navigation satellite system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, and the above and / or other advantages of the present invention will become more clear.

[0050] Figure 1 The present invention is a flow chart of a method for detecting and identifying attacks on a GNSS sensor of a quadrotor unmanned aerial vehicle (UAV).

[0051] Figure 2 The present invention is a schematic diagram of an implementation scheme of a method for detecting and identifying attacks on a GNSS sensor of a quadrotor unmanned aerial vehicle (UAV).

[0052] Figure 3 It is a flowchart of the duck flock algorithm.

[0053] Figure 4 It is a diagram of attack detection results in a specific embodiment of the present invention.

[0054] Figure 5 It is a diagram of attack identification results in a specific embodiment of the present invention. DETAILED DESCRIPTION

[0055] As a specific embodiment of the present invention, a PX4-based system is used to acquire a training data set using an FDI attack.

[0056] As a specific embodiment of the present invention, the present invention considers that the position signal channel of the global navigation satellite system GNSS in the horizontal direction is attacked, so the global navigation satellite system GNSS will be in the following situations: A (normal situation), B (longitude signal channel is attacked), C (latitude signal channel is attacked), D (both longitude and latitude signal channels are attacked).

[0057] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. Figure 1 and Figure 2 , this embodiment provides a method for detecting and identifying attacks on GNSS sensors of a quad-rotor drone, and provides a system for implementing the method, the system comprising a sensor subsystem, a direct loose combined navigation subsystem, a feature extraction subsystem, a global navigation satellite system GNSS attack detection subsystem, and a global navigation satellite system GNSS attack identification subsystem. The sensor subsystem comprises an inertial navigation unit (IMU) and a global navigation satellite system GNSS sensor; wherein the inertial navigation unit IMU does not interact with an external system, so the possibility of being attacked by an attacker is not considered; while the global navigation satellite system GNSS sensor needs to interact with an external system to perform measurements, and is vulnerable to external attacks. The sensor subsystem can collect multiple sensor data in real time, and then send the data to the direct loose combined navigation subsystem and the feature extraction subsystem.

[0058] The direct loose combined navigation subsystem mainly processes the collected sensor data based on the extended Kalman filter EKF to estimate the position and velocity information of the drone at the kth moment. The position and velocity information as well as the position and velocity information measured by the GNSS sensor of the global navigation satellite system are sent to the feature extraction subsystem. The feature extraction subsystem transmits the feature information to the attack detection subsystem to determine whether the GNSS sensor of the global navigation satellite system is attacked. If attacked, the attack identification subsystem will use the feature information for attack identification.

[0059] As a specific embodiment of the present invention, the direct loose integrated navigation system model based on the extended Kalman filter EKF described in step 1 has a state vector x k and the observed value z k They are defined as:

[0060]

[0061] in, The quaternion represents the attitude of the aircraft; They represent the speed and position of the UAV in the Northeast Earth (NED) coordinate system respectively; They represent the constant deviations in the measurements of the gyroscope, accelerometer, and magnetometer in the body coordinate system, respectively; represents the Earth's magnetic field vector in the Northeast Earth (NED) coordinate system; Represents the velocity component of wind in the horizontal direction. Represents the three-axis magnetic field value measured by the magnetometer in the body coordinate system; Represents the three-dimensional velocity value measured by the Global Navigation Satellite System GNSS; Represents the horizontal position value measured by the Global Navigation Satellite System (GNSS); Indicates the value measured by the barometer.

[0062] As a specific embodiment of the present invention, the state equation and measurement equation of the direct loose integrated navigation system model based on the extended Kalman filter EKF described in step 1 can be expressed as follows:

[0063]

[0064] in, represents the angular velocity measurement value and acceleration measurement value provided by the gyroscope and accelerometer; f(·) and h(·) represent the state transfer equation and observation equation respectively; w k ,v k represent the process noise and measurement noise of the integrated navigation system respectively.

[0065] As a specific embodiment of the present invention, the feature extraction process uses an inertial navigation system (INS) / global navigation satellite system GNSS direct loose combined navigation system based on an extended Kalman filter EKF to estimate the system state, and compares it with the global navigation satellite system GNSS measurement value to extract feature information related to whether the global navigation satellite system GNSS is attacked, considering the difference between the change value of the measurement value of the global navigation satellite system GNSS and the change value of the estimated value of the extended Kalman filter EKF within a time interval:

[0066]

[0067] in, They respectively represent the estimated values ​​of the UAV speed and position output by the integrated navigation system in the Northeast Earth (NED) coordinate system. represents the error value between the change value of the measurement value of the global navigation satellite system GNSS and the change value of the estimated value of the extended Kalman filter EKF; It represents the error value of the N-axis component of the velocity in the Northeast Earth (NED) coordinate system at the kth moment; It represents the error value of the E-axis component of the velocity in the Northeast Earth (NED) coordinate system at the kth moment; It represents the error value of the D-axis component of the velocity in the Northeast Earth (NED) coordinate system at the kth moment; It represents the error value of the N-axis component of the position in the Northeast Earth (NED) coordinate system at the kth moment; It represents the error value of the E-axis component of the position in the northeast earth (NED) coordinate system at the kth moment; both the GNSS measurement value and the estimated value output by the integrated navigation system are information related to the time series. Therefore, in order to obtain the time series characteristics contained therein, the present invention introduces a sliding time series window to construct feature information:

[0068]

[0069] in, It represents the characteristic information constructed by the error value of the N-axis component of the velocity in the Northeast Earth (NED) coordinate system in a given sliding time series window; It represents the characteristic information constructed by the error value of the E-axis component of the velocity in the Northeast Earth (NED) coordinate system in a given sliding time series window; It represents the feature information constructed by the error value of the N-axis component of the position in the Northeast Earth (NED) coordinate system in a given sliding time series window; It represents the feature information constructed by the error value of the E-axis component of the position in the Northeast Earth (NED) coordinate system in a given sliding time series window; It represents the feature information constructed by the error value of the D-axis component of the position in the Northeast Earth (NED) coordinate system in a given sliding time series window.

[0070] As a specific embodiment of the present invention, the present invention will adopt a feature combination coding scheme to design an error correction output coding-support vector ECOC-SVM attack detection and identification algorithm. The present invention considers that the position signal channel of the global navigation satellite system GNSS in the horizontal direction is attacked, so the global navigation satellite system GNSS will be in the following situations: A (normal situation), B (longitude signal channel is attacked), C (latitude signal channel is attacked), D (longitude and latitude signal channels are attacked). The feature information used is mainly adopted and The characteristic information of the global navigation satellite system GNSS in different states is respectively used and A support vector machine SVM binary classifier as shown in Table 1 below can be constructed.

[0071] Table 1 SVM binary classifier

[0072]

[0073] Among them, SVM-1~SVM-6 represent the characteristic information collected by the global navigation satellite system GNSS in different states The constructed data set is used to perform pairwise training of support vector machine (SVM) binary classifiers; SVM-7 to SVM-12 use feature information collected by the global navigation satellite system (GNSS) in different states. The constructed data set is used for pairwise training of support vector machine (SVM) binary classifier.

[0074] As a specific embodiment of the present invention, the kernel function κ(x i ,x j ) is selected as the radial basis kernel function:

[0075] κ(x i ,x j )=exp(-γ||x i -x j || 2 ) (5)

[0076] Among them, x i , x jrepresents two samples in the training sample set; γ is the kernel function parameter, which controls the width of the kernel of the radial basis function, usually expressed as σ is the kernel width.

[0077] As a specific embodiment of the present invention, Figure 3 As shown, the duck swarm algorithm is used to optimize the hyperparameters of the support vector machine SVM binary classifier, including optimizing the penalty parameter C and the kernel function parameter γ, which specifically includes the following steps:

[0078] Step 3.1: Initialize the duck swarm algorithm, randomly initialize the duck swarm, and the position of each duck represents a set of support vector machine SVM parameters;

[0079] Step 3.2: After calculating the fitness values ​​corresponding to the individual positions in the duck flock, find the duck that is currently in the best position;

[0080] Step 3.3: Exploration phase;

[0081] Step 3.4: Development phase;

[0082] Step 3.5: Determine whether the maximum number of iterations has been reached or a certain stopping criterion has been met. If so, proceed to step 3.6; otherwise, return to step 3.2.

[0083] Step 3.6: Convert the historical iterations obtained Set it as the optimal individual and decompose its position. Decompose the position dimension of the optimal individual obtained in step 3.4 to obtain the hyperparameters of the support vector machine SVM.

[0084] Furthermore, in step 3.3, after the ducks’ queuing behavior occurs, that is, the ducks arrive at a place with more food. Each individual gradually disperses and begins to look for food. This process is defined as follows:

[0085]

[0086] Where sign(·) represents the sign function; sign(rand-0.5) affects the process of searching for food; rand represents a random number between (0, 1); μ is the control parameter of global search; P is the search transition probability in the exploration phase; CF 1 and CF 2 They represent the cooperation coefficient and competition coefficient of ducks in the search phase respectively; In the tth iteration, duck X i location; represents the duck X obtained during the exploration phase i location; represents the duck in the best position in the first t iteration; Indicates that in the tth iteration, around the duck Duck looking for food.

[0087] Furthermore, in step 3.4, the position fitness of each duck is closely related to this process.

[0088]

[0089] Among them, KF 1 and KF 2 represent the cooperation coefficient and competition coefficient of ducks in the development stage respectively; and Indicates that after the exploration phase, around the duck Foraging ducks, where k≠j; and express and The fitness of .

[0090] Furthermore, in steps 3.3 and 3.4, the calculation formulas of various parameters are as follows:

[0091]

[0092] Here, FP represents a constant, which is generally 0.618.

[0093] As a specific embodiment of the present invention, in order to further obtain the relationship between the classification results of SVM-1 to SVM-12 and the state of the global navigation satellite system GNSS, the output results of SVM-1 to SVM-12 are obtained respectively using the collected data. The following Table 2 shows the probability that the output of SVM-1 to SVM-12 is 1 in the four cases of A, B, C, and D respectively.

[0094] Table 2 Output of SVM binary classifier

[0095]

[0096] As a specific embodiment of the present invention, the present invention uses a feature combination coding scheme to encode whether the GNSS global navigation satellite system GNSS is under attack, selects a suitable support vector machine SVM binary classifier and designs an error correction output coding-support vector machine ECOC-SVM model. Comprehensive analysis shows that SVM-1, SVM-4, SVM-8, SVM-9 are used in combination with the feature combination coding scheme, and the feature coding of the global navigation satellite system GNSS in a normal state is [1 0 1 1].

[0097] As a specific embodiment of the present invention, the present invention uses a feature combination coding scheme to encode which signal channel of the global navigation satellite system GNSS, selects a suitable support vector machine SVM binary classifier and designs an error correction output coding-support vector machine ECOC-SVM model. After comprehensive analysis, the feature combination coding scheme is used to design coding schemes for the four attack signals of the global navigation satellite system GNSS, as shown in Table 3 below.

[0098] Table 3 Feature combination coding scheme

[0099] SVM-1 SVM-2 SVM-3 SVM-4 SVM-5 SVM-6 SVM-7 SVM-8 SVM-9 SVM-10 SVM-11 SVM-12 A 1 1 1 0 1 1 1 1 1 1 1 1 B 0 1 1 1 1 0 1 1 1 1 1 1 C 1 1 1 0 1 1 1 0 1 0 1 1 D 0 1 1 1 1 0 1 0 0 0 0 0

[0100] As a specific embodiment of the present invention, the multi-classification error correction output coding-support vector machine ECOC-SVM model is used to perform attack detection and attack identification on the encoded test data set to obtain decision coding, and the decision coding is decoded using the Hamming distance, and finally the results of attack detection and attack identification are obtained, respectively. Figure 4 and Figure 5 As shown. Among them, Figure 4 is the attack detection result, which is used to measure the detection effect of the attack detection subsystem proposed in the present invention. Figure 4 As shown, the attack detection system proposed by the present invention has significant effect, and the overall attack detection accuracy rate exceeds 90%, especially the detection accuracy rate for normal state even reaches 100%. Figure 5 is the result of attack identification, which is used to measure the identification effect of the attack identification subsystem proposed in the present invention. Figure 5 As shown, the attack identification subsystem proposed by the present invention has an identification accuracy rate of more than 80% for different attacks.

[0101] The present invention provides a method for detecting and identifying attacks on GNSS sensors of quad-rotor drones. There are many methods and ways to implement the technical solution. The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention. All components not specified in this embodiment can be implemented by existing technologies.

Claims

1. A method for detecting and identifying GNSS sensor attacks on a quadrotor drone, characterized in that: The steps include: Step 1, select the appropriate state vector and establish the system equation and measurement equation to construct the direct loose integrated navigation system subsystem based on the extended Kalman filter; Step 2, comparing the estimated value of the integrated navigation system with the measured value of the global navigation satellite system GNSS, and extracting characteristic information related to whether the global navigation satellite system GNSS is under attack; Step 3, decompose the attack detection and attack identification tasks into support vector machine (SVM) binary classification tasks, and train the support vector machine (SVM) binary classifiers one by one in combination with the duck swarm algorithm; Step 4: According to the goals and requirements of attack detection, a feature combination coding scheme is used to encode whether the global navigation satellite system GNSS is attacked, and a suitable support vector machine (SVM) binary classifier is selected to design an error correction output coding-support vector machine (ECOC)-SVM model, and an attack detection subsystem is constructed; Step 5: According to the goals and requirements of attack identification, a feature combination coding scheme is used to encode the types of attacks suffered by the global navigation satellite system GNSS, and a support vector machine (SVM) binary classifier is selected to design an error correction output coding-support vector machine (ECOC)-SVM model, and an attack identification subsystem is constructed; Step 6: Use the attack detection subsystem to perform attack detection on the test data set to obtain decision codes, and decode them to determine whether the global navigation satellite system GNSS is under attack; if the global navigation satellite system GNSS is under attack, use the attack identification subsystem to perform attack identification on the test data set to obtain decision codes, and decode them to identify the type of attack on the global navigation satellite system GNSS.

2. The method according to claim 1, characterized in that In step 1, the direct loose integrated navigation system subsystem based on the extended Kalman filter EKF includes a state vector x k and the observed value z k , defined as: in, is a quaternion, which represents the attitude of the aircraft; represents the real number space; They represent the speed and position of the UAV in the northeastern coordinate system respectively; represent the constant deviations in the measurements of the gyroscope, accelerometer, and magnetometer in the body coordinate system, respectively; Represents the earth's magnetic field vector in the northeast coordinate system; It represents the velocity component of wind in the horizontal direction; Represents the three-axis magnetic field value measured by the magnetometer in the body coordinate system; Represents the three-dimensional velocity value measured by the Global Navigation Satellite System GNSS; Represents the horizontal position value measured by the Global Navigation Satellite System (GNSS); Indicates the measured value of the barometer; The following state equation and measurement equation are established: x k+1 =f(x k ,u k )+w k z k =h(x k )+v k Among them, x k represents the state vector of the system at the kth moment; z k represents the observation vector of the system at the kth moment; represents the input vector of the direct loose integrated navigation system subsystem at the kth moment, T represents the matrix transpose; ω b 、a b represents the angular velocity measurement value and acceleration measurement value provided by the gyroscope and accelerometer respectively; w k ,v k denote the process noise and measurement noise of the integrated navigation system at the kth moment respectively; f(·) and h(·) denote the state transfer equation and the observation equation respectively.

3. The method according to claim 2, characterized in that Step 2 includes: using a direct loose integrated navigation system to estimate the system state, and comparing the estimated value of the integrated navigation system with the GNSS measurement value to extract feature information related to whether the GNSS is under attack, considering a time interval Δ k The difference between the change in the measured value of the Global Navigation Satellite System GNSS and the change in the estimated value of the Extended Kalman Filter EKF is: in, They represent the estimated values ​​of the UAV speed and position output by the integrated navigation system in the northeastern coordinate system respectively; represents the error value between the change value of the measurement value of the global navigation satellite system GNSS and the change value of the estimated value of the extended Kalman filter EKF at the kth moment; It represents the error value of the N-axis component of the velocity in the northeast coordinate system at the kth moment; It represents the error value of the E-axis component of the velocity in the northeast coordinate system at the kth moment; It represents the error value of the D-axis component of the velocity in the northeast coordinate system at the kth moment; It represents the error value of the N-axis component of the position in the northeast coordinate system at the kth moment; Indicates the error value of the E-axis component of the position in the northeast coordinate system at the kth moment; the time interval Δ k The size of is determined by the sampling frequency of the global navigation satellite system GNSS; Introduce sliding time series window to construct feature information: in, It represents the characteristic information constructed by the error value of the N-axis component of the velocity in the northeast coordinate system in a given sliding time series window; It represents the characteristic information constructed by the error value of the E-axis component of the velocity in the northeast coordinate system in a given sliding time series window; It represents the feature information constructed by the error value of the N-axis component of the position in the northeast coordinate system in a given sliding time series window; It represents the characteristic information constructed by the error value of the E-axis component of the position in the northeast coordinate system in a given sliding time series window; It represents the characteristic information constructed by the error value of the D-axis component of the position in the northeast coordinate system in a given sliding time series window.

4. The method according to claim 3, characterized in that In step 3, the kernel function κ(x i ,x j ) is chosen as the radial basis function: κ(x i ,x j )=exp(-γ||x i -x j || 2 ) Among them, x i , x j represents two samples in the training sample set; γ is the kernel function parameter, which controls the width of the kernel of the radial basis function, usually expressed as σ is the kernel width; exp is the natural exponential function.

5. The method according to claim 4, characterized in that In step 3, the support vector machine SVM binary classifiers are trained one by one in combination with the duck swarm algorithm, specifically including the following steps: Step 3.1: Initialize the duck swarm algorithm, randomly initialize the duck swarm, and the position of each duck represents a set of support vector machine SVM parameters; the position of the duck swarm individuals includes the optimization penalty parameter C and the kernel function parameter γ; Step 3.2: After calculating the fitness value corresponding to the individual position in the duck flock, find the duck currently in the optimal position; the fitness value of the individual position in the duck flock represents the classification effect of the support vector machine SVM parameters corresponding to the current duck position, so the duck with the highest fitness value is the individual in the optimal position; Step 3.3: Exploration phase: After the ducks’ queuing behavior occurs, that is, the ducks arrive at a place with more food, each individual gradually disperses and begins to look for food, which can be expressed as: Where sign(·) represents the sign function; rand represents a random number between (0, 1); μ is the control parameter of the global search; P is the search transition probability in the exploration phase; CF1 and CF2 represent the cooperation coefficient and competition coefficient of the duck in the search phase, respectively; represents duck X in the tth iteration i location; represents the duck X obtained during the exploration phase i location; represents the duck in the best position in the first t iterations; Indicates that in the tth iteration, around the duck Ducks looking for food; the calculation formulas for the global search control parameter μ, the ducks' cooperation coefficient CF1 and competition coefficient CF2 during the search phase are: K=sin(2·rand)+1 Among them, FP represents a constant; Step 3.4: Development phase: The positional fitness of each duck is expressed as: Among them, KF1 and KF2 represent the cooperation coefficient and competition coefficient of ducks in the development stage, respectively; Indicates that after the exploration phase, around the duck The kth duck foraging for food, Indicates that after the exploration phase, around the duck The jth duck foraging, where k≠j; and Respectively The fitness and Adaptability; represents the duck X after the tth iteration i location, Indicates that duck X is in the exploration stage i The calculation formulas of KF1 and KF2 are: Step 3.5: Determine whether the maximum number of iterations has been reached. If so, proceed to step 3.6; otherwise, return to step 3.2; Step 3.6: Obtained from the historical iteration round Set as the optimal individual and The position is decomposed to obtain the hyperparameters of the support vector machine SVM, including the optimized penalty parameter C and the kernel function parameter γ.

6. The method according to claim 5, characterized in that In step 4 and step 5, the feature combination coding scheme is to combine and encode the classification results of more than two support vector machine SVM binary classifiers for the global navigation satellite system GNSS under different attack types, and identify the behavioral differences of specific signal channels under attacks; then combine and encode the features of different signal channels to realize the attack detection and identification functions of the global navigation satellite system GNSS.

7. The method according to claim 6, characterized in that In step 4, the attack detection subsystem refers to a suitable support vector machine SVM binary classifier, which adopts a feature combination coding scheme integrated into the error correction output coding-support vector machine ECOC-SVM model to distinguish between the attacked state and the normal state, thereby detecting whether the global navigation satellite system GNSS is attacked.

8. The method according to claim 7, characterized in that In step 5, the attack identification subsystem uses the trained support vector machine SVM binary classifier and a feature combination coding scheme to design and construct an error correction output coding-support vector machine ECOC-SVM model for identifying attacks on different signal channels.

9. The method according to claim 8, characterized in that In step 6, the decision code is decoded using the Hamming distance.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores program codes, and when the program codes are executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 9.

Images