A quadrotor drone GNSS sensor attack detection and identification method

Abstract

This invention provides a method for detecting and identifying GNSS sensor attacks on quadrotor UAVs, comprising: comparing the UAV state estimate obtained from an inertial navigation system / GNSS direct loose combination navigation system with GNSS measurements to obtain feature information related to whether the GNSS is under attack; then, training a support vector machine (SVM) binary classifier by analyzing the impact of attacks on different signal channels on the feature information; finally, designing an error correction output code-SVM based on the trained SVM binary classifier and a feature combination coding scheme, and constructing an attack detection subsystem and an attack identification subsystem. This invention can determine whether the GNSS is under attack and the attacked signal channel, which not only improves detection efficiency but also enriches detection functions.

Description

Technical Field

[0001] This invention belongs to the field of UAV attack detection, and in particular relates to a method for detecting and identifying attacks on GNSS sensors of quadcopter UAVs. Background Technology

[0002] Quadrotor drones have been widely used in both civilian and military fields due to their simple structure, high maneuverability, and low cost. In modern drone technology, the Global Navigation Satellite System (GNSS) is one of the key technologies for drone positioning and navigation. The accuracy and reliability of the GNSS system are crucial for the normal operation of drones. However, due to the openness and vulnerability of GNSS signals, GNSS attacks have become a serious security problem. Such attacks can lead to incorrect drone positioning information, resulting in a series of safety incidents. However, how to effectively detect GNSS attacks in resource-constrained environments remains a challenging issue. Therefore, developing an efficient GNSS attack detection and identification method is of great significance for improving the security of quadrotor drones. Summary of the Invention

[0003] Purpose of the invention: In order to improve the security and reliability of quadcopter drones when attacked by Global Navigation Satellite System (GNSS), this invention provides a method for detecting and identifying GNSS sensor attacks on quadcopter drones. This method can efficiently and accurately detect and identify various types of GNSS attacks, thereby reducing security incidents caused by GNSS attacks.

[0004] Technical Solution: This invention provides a method for detecting and identifying attacks on the GNSS sensors of a quadcopter drone. It acquires feature information related to whether the Global Navigation Satellite System (GNSS) is under attack and constructs a detection model to detect in real time whether the drone's GNSS sensors are under attack; and after detecting an attack, identifies the signal channel through which the drone is being attacked. Specifically, it includes the following steps:

[0005] Step 1: Select a suitable state vector and establish system equations and measurement equations to construct a direct loosely coupled navigation system subsystem based on the Extended Kalman Filter (EKF).

[0006] Step 2: Compare the estimated values ​​of the integrated navigation system with the GNSS measurements of the Global Navigation Satellite System to extract feature information related to whether the GNSS of the Global Navigation Satellite System has been attacked;

[0007] Step 3: Decompose the attack detection and attack identification tasks into Support Vector Machine (SVM) binary classification tasks, and train the SVM binary classifiers one by one using the duck flocking algorithm.

[0008] Step 4: Based on the target and requirements of attack detection, a feature combination coding scheme is used to encode whether the Global Navigation Satellite System (GNSS) is under attack. A suitable Support Vector Machine (SVM) binary classifier is selected to design the Error Correcting Output Codes-Support Vector Machine (ECOC-SVM) model, and an attack detection subsystem is constructed.

[0009] Step 5: Based on the target and requirements of attack identification, the attack types of the Global Navigation Satellite System (GNSS) are encoded using a feature combination coding scheme. An appropriate Support Vector Machine (SVM) binary classifier is selected to design an error correction output coding-support vector machine ECOC-SVM model, and an attack identification subsystem is constructed.

[0010] Step 6: Use the attack detection subsystem to perform attack detection on the test dataset to obtain decision codes, and then decode them to determine whether the Global Navigation Satellite System (GNSS) has been attacked. If the GNSS has been attacked, use the attack identification subsystem to perform attack identification on the test dataset to obtain decision codes, and then decode them to identify the type of attack on the GNSS.

[0011] In step 1, the direct loosely coupled navigation system subsystem based on the extended Kalman filter (EKF) includes a state vector x. k and observed value z k Defined as:

[0012]

[0013] in, It is a quaternion representing the attitude of the aircraft; Represents the space of real numbers; These represent the velocity and position of the UAV in the North-East-Down Coordinate System (NED). These represent the constant deviations in the measurements of the gyroscope, accelerometer, and magnetometer in the body coordinate system, respectively. This represents the Earth's magnetic field vector in the Northeastern Earth (NED) coordinate system. This represents the horizontal velocity component of the wind. This represents the triaxial magnetic field values ​​measured by the magnetometer in the body coordinate system. This represents the three-dimensional velocity values ​​obtained from GNSS measurements by the Global Navigation Satellite System; This represents the horizontal position value obtained from GNSS measurements. This indicates the measured value of the barometer.

[0014] The following state equations and measurement equations are established:

[0015] x k+1 =f(x) k ,u k )+w k

[0016] z k =h(x k )+v k

[0017] Where, x k z represents the state vector of the system at time k; k This represents the system's observation vector at time k; Let ω represent the input vector of the direct loosely coupled navigation system subsystem at time k, and T represent the matrix transpose; b a b These represent the angular velocity and acceleration measurements provided by the gyroscope and accelerometer, respectively; w k ,v k Let f(·) and h(·) represent the process noise and measurement noise of the integrated navigation system at time k, respectively; f(·) and h(·) represent the state transition equation and the observation equation, respectively.

[0018] Step 2 includes: estimating the system state using a direct loosely coupled navigation system, comparing the estimated values ​​with GNSS measurements, extracting feature information related to whether the GNSS has been attacked, and considering a time interval Δ k Within this range, the difference between the variation in GNSS measurements and the variation in EKF (Extended Kalman Filter) estimates:

[0019]

[0020] in, These represent the estimated values ​​of the UAV's velocity and position output by the integrated navigation system in the Northeastern Dignity (NED) coordinate system, respectively. This represents the error between the change in the measured value of the Global Navigation Satellite System (GNSS) and the change in the estimated value of the Extended Kalman Filter (EKF) at time k. This represents the error value of the N-axis component of the velocity in the Northeastern (NED) coordinate system at time k. This represents the error value of the E-axis component of the velocity in the Northeastern (NED) coordinate system at time k. This represents the error value of the D-axis component of the velocity in the Northeastern (NED) coordinate system at time k. This represents the error value of the N-axis component of the position in the Northeast (NED) coordinate system at time k. This represents the error value of the E-axis component of the position in the Northeastern (NED) coordinate system at time k; the time interval Δ k The size is determined by the sampling frequency of the Global Navigation Satellite System (GNSS), and the time interval Δ in the hardware platform used in this invention is... k It takes 0.4 seconds.

[0021] Both GNSS measurements from Global Navigation Satellite Systems and estimated values ​​output by integrated navigation systems are time-related information. Therefore, to extract the inherent time-series characteristics, a sliding time-series window is introduced to construct feature information.

[0022]

[0023] in, This represents the feature information constructed from the error values ​​of the N-axis component of the velocity in the Northeastern (NED) coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the E-axis component of the velocity in the Northeastern (NED) coordinate system within a given sliding time window. This represents the feature information constructed from the error values ​​of the N-axis component of the location in the Northeastern (NED) coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the E-axis component of the location in the Northeastern (NED) coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the D-axis component of the location in the Northeastern (NED) coordinate system within a given sliding time window.

[0024] In step 3, the kernel function κ(x) of the Support Vector Machine (SVM) binary classifier i ,x j Radial basis functions are chosen as follows:

[0025] κ(x i ,x j )=exp(-γ||x i -x j || 2 )

[0026] Where, x ix j This represents two samples in the training sample set (the training sample set is generally composed of feature information). The structure consists of a label representing the specific signal channel under attack; γ is a kernel function parameter that controls the width of the radial basis function kernel, typically expressed as... σ is the kernel width; exp is the natural exponential function.

[0027] Step 3, which involves training a Support Vector Machine (SVM) binary classifier using the duck flocking algorithm, specifically includes the following steps:

[0028] Step 3.1: Initialize the duck flock algorithm. Randomly initialize the duck flock. The position of each duck represents a set of support vector machine (SVM) parameters. In this invention, the position of an individual duck includes the optimization penalty parameter C and the kernel function parameter γ.

[0029] Step 3.2: After calculating the fitness value corresponding to the position of an individual in the flock, find the duck that is currently in the optimal position. The fitness value of an individual in the flock represents the classification effect of the SVM parameters corresponding to the current position of the duck. Therefore, the duck with the highest fitness value is the individual in the optimal position.

[0030] Step 3.3: Exploration Phase: After the ducks exhibit queuing behavior, i.e., when they reach areas with more food, each individual gradually disperses and begins searching for food, as represented by:

[0031]

[0032] Where, sign(·) represents the sign function, sign(rand-0.5) affects the food-finding process; rand represents a random number between (0, 1); μ is the control parameter for the global search; P is the search transition probability during the exploration phase; CF1 and CF2 represent the cooperation coefficient and competition coefficient of the ducks during the search phase, respectively; In the t-th iteration, duck X represents... i Location; Duck X obtained during the exploration phase i Location; This represents the duck in the optimal position during the first t iterations; This indicates that in the t-th iteration, the number of ducks is... Ducks searching for food; the formulas for calculating the global search control parameter μ, the cooperation coefficient CF1, and the competition coefficient CF2 of the ducks during the search phase are as follows:

[0033]

[0034] K = sin(2·rand) + 1

[0035]

[0036] Where FP represents a constant, typically 0.618;

[0037] Step 3.4: Development Phase: The positional adaptability of each duck is represented as follows:

[0038]

[0039] Wherein, KF1 and KF2 represent the cooperation coefficient and competition coefficient of the ducks during the development stage, respectively; This indicates that after the exploration phase, the focus will be on the ducks. The kth duck searching for food This indicates that after the exploration phase, the focus will be on the ducks. The j-th duck foraging for food, where k≠j; and They represent Adaptability and The fitness of; This indicates that after the t-th iteration, duck X i Location, This indicates that duck X is in the exploration phase. i The position; where the calculation formulas for KF1 and KF2 are:

[0040]

[0041] Step 3.5: Determine if the maximum number of iterations has been reached (usually set to 1000). If yes, continue to step 3.6; otherwise, return to step 3.2.

[0042] Step 3.6: Obtain the results from the historical iteration rounds Set as the optimal individual, and for The position is decomposed to obtain the hyperparameters of the support vector machine (SVM), including the optimization penalty parameter C and the kernel function parameter γ.

[0043] In steps 4 and 5, the feature combination encoding scheme combines and encodes the classification results of two or more Support Vector Machine (SVM) binary classifiers for different attack types of Global Navigation Satellite System (GNSS) to identify the behavioral differences of specific signal channels under attack; then, the features of different signal channels are combined and encoded to realize the attack detection and identification function of Global Navigation Satellite System (GNSS).

[0044] In step 4, the attack detection subsystem refers to a suitable Support Vector Machine (SVM) binary classifier (specifically, in this invention, the output results of the SVM binary classifier under different attacks are compared, and the combination of the minimum number of SVMs is selected to complete the attack detection function. This invention does not propose a specific method for selecting which SVM binary classifiers to use, but in later embodiments, it mainly uses the finally trained SVMs to analyze the output results of the corresponding attacks and selects the combination of the minimum number of SVMs that can identify the attack). This subsystem is integrated into the Error Correction Output Code-Support Vector Machine (ECOC-SVM) model using a feature combination encoding scheme to distinguish between attacked and normal states, thereby detecting whether the Global Navigation Satellite System (GNSS) has been attacked.

[0045] In step 5, the attack identification subsystem is a model designed and constructed by using a feature combination encoding scheme to construct an error correction output encoding-support vector machine ECOC-SVM model from a trained support vector machine (SVM) binary classifier, which is used to identify attacks targeting different signal channels.

[0046] In step 6, Hamming distance is used to decode the decision code.

[0047] The present invention also provides an electronic device, including a processor and a memory, the memory storing program code that, when executed by the processor, causes the processor to perform the steps of the method.

[0048] Beneficial Effects: This invention provides a method for GNSS sensor attack detection and identification for quadrotor UAVs based on the duck flocking algorithm and ECOC-SVM, decomposing attack detection and identification into multiple Support Vector Machine (SVM) binary classification problems. This paper employs a feature combination encoding scheme to encode the attack detection and identification problems and constructs an error-correcting output code-ECOC-SVM model. Compared with existing technologies, this invention solves the problem of insufficient accuracy in existing quadrotor UAV GNSS attack detection and identification methods. Attached Figure Description

[0049] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0050] Figure 1 This is a flowchart of a method for detecting and identifying attacks on GNSS sensors of a quadcopter UAV's global navigation satellite system.

[0051] Figure 2This is a schematic diagram of an implementation scheme for a method of detecting and identifying attacks on GNSS sensors of a quadcopter UAV's global navigation satellite system.

[0052] Figure 3 This is a flowchart of the duck flocking algorithm.

[0053] Figure 4 This is an attack detection result diagram in a specific embodiment of the present invention.

[0054] Figure 5 This is an attack identification result diagram in a specific embodiment of the present invention. Detailed Implementation

[0055] As a specific embodiment of the present invention, the training dataset is obtained by using an FDI attack based on a PX4 system.

[0056] As a specific embodiment of the present invention, the present invention considers that the position signal channel of the Global Navigation Satellite System (GNSS) in the horizontal direction is attacked. Therefore, the GNSS may be in the following situations: A (normal situation), B (longitude signal channel attacked), C (latitude signal channel attacked), D (both longitude and latitude signal channels attacked).

[0057] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. Please refer to... Figure 1 and Figure 2 This embodiment provides a method for detecting and identifying GNSS sensor attacks on quadcopter UAVs, and provides a system for implementing the method. The system includes a sensor subsystem, a direct loosely coupled navigation subsystem, a feature extraction subsystem, a GNSS attack detection subsystem, and a GNSS attack identification subsystem. The sensor subsystem includes an inertial navigation unit (IMU) and GNSS sensors. The IMU does not interact with external systems, therefore its vulnerability to attack is not considered. However, the GNSS sensors require interaction with external systems for measurement and are therefore susceptible to external attacks. The sensor subsystem can collect data from multiple sensors in real time and then send the data to the direct loosely coupled navigation subsystem and the feature extraction subsystem.

[0058] The direct loosely coupled navigation subsystem primarily processes the collected sensor data using an extended Kalman filter (EKF) to estimate the UAV's position and velocity at time k. This position and velocity information, along with the position and velocity information measured by the GNSS sensors, is then sent to the feature extraction subsystem. The feature extraction subsystem transmits the feature information to the attack detection subsystem to determine if the GNSS sensors have been attacked. If attacked, the attack identification subsystem uses the feature information to identify the attack.

[0059] As a specific embodiment of the present invention, the direct loosely coupled navigation system model based on the Extended Kalman Filter (EKF) described in step 1 has a state vector x k and the observed value z k They are defined as follows:

[0060]

[0061] in, The attitude of the aircraft is represented by a quaternion; These represent the velocity and position of the UAV in the Northeastern Diffuse (NED) coordinate system, respectively. These represent the constant deviations in the measurements of the gyroscope, accelerometer, and magnetometer in the body coordinate system, respectively. This represents the Earth's magnetic field vector in the Northeastern Earth (NED) coordinate system. This represents the horizontal velocity component of the wind. This represents the triaxial magnetic field values ​​measured by the magnetometer in the body coordinate system. This represents the three-dimensional velocity values ​​obtained from GNSS measurements by the Global Navigation Satellite System; This represents the horizontal position value obtained from GNSS measurements. This indicates the value measured by the barometer.

[0062] As a specific embodiment of the present invention, the state equation and measurement equation of the direct loosely combined navigation system model based on the extended Kalman filter (EKF) described in step 1 can be expressed in the following form:

[0063]

[0064] in, The values ​​represent the angular velocity and acceleration measurements provided by the gyroscope and accelerometer, respectively; f(·) and h(·) represent the state transition equation and the observation equation, respectively; w k ,v k These represent the process noise and measurement noise of the integrated navigation system, respectively.

[0065] As a specific embodiment of the present invention, the feature extraction process employs a direct loosely coupled navigation system based on an Extended Kalman Filter (EKF) Inertial Navigation System (INS) / Global Navigation Satellite System (GNSS) to estimate the system state, and compares it with GNSS measurements to extract feature information related to whether the GNSS has been attacked. This considers the difference between the changes in GNSS measurements and the changes in the EKF estimates over a given time interval.

[0066]

[0067] in, These represent the estimated values ​​of the UAV's velocity and position output by the integrated navigation system in the Northeastern Dignity (NED) coordinate system. This represents the error between the change in the measured value of the Global Navigation Satellite System (GNSS) and the change in the estimated value of the Extended Kalman Filter (EKF). This represents the error value of the N-axis component of the velocity in the Northeastern (NED) coordinate system at time k. This represents the error value of the E-axis component of the velocity in the Northeastern (NED) coordinate system at time k. This represents the error value of the D-axis component of the velocity in the Northeastern (NED) coordinate system at time k. This represents the error value of the N-axis component of the position in the Northeast (NED) coordinate system at time k. This represents the error value of the E-axis component of the position in the Northeast Earth (NED) coordinate system at time k. Both GNSS measurements and estimated values ​​output by the integrated navigation system are time-related information. Therefore, to obtain the inherent time-series characteristics, this invention introduces a sliding time-series window to construct feature information:

[0068]

[0069] in, This represents the feature information constructed from the error values ​​of the N-axis component of the velocity in the Northeastern (NED) coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the E-axis component of the velocity in the Northeastern (NED) coordinate system within a given sliding time window. This represents the feature information constructed from the error values ​​of the N-axis component of the location in the Northeastern (NED) coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the E-axis component of the location in the Northeastern (NED) coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the D-axis component of the location in the Northeastern (NED) coordinate system within a given sliding time window.

[0070] As a specific embodiment of the present invention, this invention will employ a feature combination coding scheme to design an attack detection and identification algorithm for Error Correction Output Coding-Support Vector ECC-SVM. This invention considers that the horizontal position signal channel of a Global Navigation Satellite System (GNSS) may be attacked, therefore the GNSS may be in the following situations: A (normal situation), B (longitude signal channel attacked), C (latitude signal channel attacked), and D (both longitude and latitude signal channels attacked). The feature information used mainly employs… and They respectively used characteristic information of the Global Navigation Satellite System (GNSS) in different states. and The Support Vector Machine (SVM) binary classifier shown in Table 1 can be constructed.

[0071] Table 1 SVM Binary Classifier

[0072]

[0073] SVM-1 to SVM-6 represent feature information collected using Global Navigation Satellite System (GNSS) under different conditions. The constructed dataset was used to train a Support Vector Machine (SVM) binary classifier in pairs; SVM-7 to SVM-12 used feature information collected from Global Navigation Satellite System (GNSS) under different conditions. The constructed dataset is used to train a Support Vector Machine (SVM) binary classifier by pairwise combinations.

[0074] As a specific embodiment of the present invention, the kernel function κ(x) of the Support Vector Machine (SVM) binary classifier is described. i ,x j Choose the radial basis kernel function:

[0075] κ(x i ,x j )=exp(-γ||x i -x j || 2 (5)

[0076] Where, x i x jLet represent two samples in the training sample set; γ is the kernel function parameter, which controls the width of the radial basis function kernel, usually expressed as . σ is the kernel width.

[0077] As a specific embodiment of the present invention, such as Figure 3 As shown, the duck flocking algorithm is used to optimize the hyperparameters of the Support Vector Machine (SVM) binary classifier, including optimizing the penalty parameter C and the kernel function parameter γ. Specifically, the steps are as follows:

[0078] Step 3.1: Initialize the duck flock algorithm. Randomly initialize the duck flock, with the position of each duck representing a set of Support Vector Machine (SVM) parameters.

[0079] Step 3.2: After calculating the fitness value corresponding to the position of an individual in the duck flock, find the duck that is currently in the optimal position;

[0080] Step 3.3: Exploration Phase;

[0081] Step 3.4: Development Phase;

[0082] Step 3.5: Determine whether the maximum number of iterations has been reached or a certain stopping criterion has been met. If yes, continue to step 3.6; otherwise, return to step 3.2.

[0083] Step 3.6: Obtain the results from the historical iteration rounds Set the optimal individual and decompose its position. Decompose the position dimension of the optimal individual obtained in step 3.4 to obtain the hyperparameters of the support vector machine (SVM).

[0084] Furthermore, in step 3.3, after the ducks have engaged in queuing behavior—that is, when they reach an area with more food—each individual gradually disperses and begins searching for food. This process is defined as follows:

[0085]

[0086] Where, sign(·) represents the sign function; sign(rand-0.5) affects the food-finding process; rand represents a random number between (0, 1); μ is the control parameter for the global search; P is the search transition probability during the exploration phase; CF1 and CF2 represent the cooperation coefficient and competition coefficient of the ducks during the search phase, respectively; In the t-th iteration, duck X represents i Location; Duck X obtained during the exploration phase i Location; This represents the duck in the optimal position during the first t-th iteration; This indicates that in the t-th iteration, the number of ducks is... Ducks searching for food.

[0087] Furthermore, in step 3.4, the positional fitness of each duck is closely related to this process.

[0088]

[0089] Wherein, KF1 and KF2 represent the cooperation coefficient and competition coefficient of the ducks during the development stage, respectively; and This indicates that after the exploration phase, the focus will be on the ducks. Ducks foraging for food, where k≠j; and express and The degree of adaptability.

[0090] Furthermore, in steps 3.3 and 3.4, the calculation formulas for each parameter are as follows:

[0091]

[0092] Where FP represents a constant, typically 0.618.

[0093] As a specific embodiment of the present invention, in order to further obtain the relationship between the classification results of SVM-1 to SVM-12 and the status of the Global Navigation Satellite System (GNSS), the collected data were used to obtain the output results of SVM-1 to SVM-12 respectively. Table 2 below shows the probability of SVM-1 to SVM-12 outputting 1 in four cases: A, B, C, and D.

[0094] Table 2 Output of SVM Binary Classifier

[0095]

[0096] As a specific embodiment of the present invention, the present invention employs a feature combination coding scheme to encode whether a GNSS global navigation satellite system is under attack. A suitable support vector machine (SVM) binary classifier is selected, and an error correction output coding-support vector machine ECOC-SVM model is designed. Comprehensive analysis shows that by using SVM-1, SVM-4, SVM-8, and SVM-9 combined with the feature combination coding scheme, the feature encoding of a GNSS global navigation satellite system under normal conditions is [1 0 1 1].

[0097] As a specific embodiment of the present invention, the present invention employs a feature combination coding scheme to encode specific signal channels of the Global Navigation Satellite System (GNSS), selects a suitable Support Vector Machine (SVM) binary classifier, and designs an error correction output coding-support vector machine ECOC-SVM model. Based on comprehensive analysis, the feature combination coding scheme designs coding schemes for the four types of attack signals received by the Global Navigation Satellite System (GNSS), as shown in Table 3 below.

[0098] Table 3 Feature Combination Coding Scheme

[0099] SVM-1 SVM-2 SVM-3 SVM-4 SVM-5 SVM-6 SVM-7 SVM-8 SVM-9 SVM-10 SVM-11 SVM-12 A 1 1 1 0 1 1 1 1 1 1 1 1 B 0 1 1 1 1 0 1 1 1 1 1 1 C 1 1 1 0 1 1 1 0 1 0 1 1 D 0 1 1 1 1 0 1 0 0 0 0 0

[0100] As a specific embodiment of the present invention, the multi-class error correction output encoder-support vector machine (ECOC-SVM) model is used to perform attack detection and attack identification on the encoded test dataset to obtain a decision code. The Hamming distance is then used to decode the decision code, ultimately yielding the results of attack detection and attack identification, as shown below. Figure 4 and Figure 5 As shown. Among them, Figure 4 The attack detection results serve as a measure of the detection effectiveness of the attack detection subsystem proposed in this invention. Figure 4 As shown, the attack detection system proposed in this invention is remarkably effective, with an overall attack detection accuracy exceeding 90%, and particularly achieving 100% accuracy in detecting attacks under normal conditions. Meanwhile... Figure 5 The results of attack identification are used to measure the effectiveness of the attack identification subsystem proposed in this invention. For example... Figure 5 As shown, the attack identification subsystem proposed in this invention has an accuracy rate of over 80% for identifying different attacks.

[0101] This invention provides a method for detecting and identifying GNSS sensor attacks on quadcopter UAVs. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A method for detecting and identifying GNSS sensor attacks on quadcopter unmanned aerial vehicles (UAVs), characterized in that, Includes the following steps: Step 1: Select the state vector and establish the system equations and measurement equations to construct a direct loose combination navigation system subsystem based on the extended Kalman filter; Step 2: Compare the estimated values ​​of the integrated navigation system with the GNSS measurements of the Global Navigation Satellite System to extract feature information related to whether the GNSS of the Global Navigation Satellite System has been attacked; Step 3: Decompose the attack detection and attack identification tasks into support vector machine (SVM) binary classification tasks, and train the SVM binary classifiers one by one using the duck flocking algorithm. Step 4: Based on the target and requirements of attack detection, a feature combination coding scheme is used to encode whether the Global Navigation Satellite System (GNSS) is under attack. A suitable Support Vector Machine (SVM) binary classifier is selected to design an error correction output coding-support vector machine ECOC-SVM model, and an attack detection subsystem is constructed. Step 5: Based on the target and requirements of attack identification, the attack types of the Global Navigation Satellite System (GNSS) are encoded using a feature combination coding scheme. An error correction output coding-support vector machine (ECOC-SVM) model is designed using a support vector machine (SVM) binary classifier, and an attack identification subsystem is constructed. Step 6: Use the attack detection subsystem to perform attack detection on the test dataset to obtain decision codes, and then decode them to determine whether the Global Navigation Satellite System (GNSS) has been attacked; if the GNSS has been attacked, use the attack identification subsystem to perform attack identification on the test dataset to obtain decision codes, and then decode them to identify the type of attack on the GNSS. In step 1, the direct loosely coupled navigation system subsystem based on the extended Kalman filter (EKF) includes a state vector x. k and observed value z k Defined as: in, It is a quaternion representing the attitude of the aircraft; Represents the space of real numbers; These represent the velocity and position of the UAV in the northeast coordinate system, respectively. These represent the constant deviations in the measurements of the gyroscope, accelerometer, and magnetometer in the body coordinate system, respectively. This represents the Earth's magnetic field vector in the Northeastern coordinate system; This represents the horizontal velocity component of the wind. This represents the triaxial magnetic field values ​​measured by the magnetometer in the body coordinate system. This represents the three-dimensional velocity values ​​obtained from GNSS measurements by the Global Navigation Satellite System; This represents the horizontal position value obtained from GNSS measurements. This indicates the measured value of the barometer; The following state equations and measurement equations are established: x k+1 =f(x k ,u k )+w k z k =h(x k )+v k Where, x k z represents the state vector of the system at time k; k This represents the system's observation vector at time k; Let ω represent the input vector of the direct loosely coupled navigation system subsystem at time k, and T represent the matrix transpose; b a b These represent the angular velocity and acceleration measurements provided by the gyroscope and accelerometer, respectively; w k ,v k Let f(·) and h(·) represent the process noise and measurement noise of the integrated navigation system at time k, respectively; f(·) and h(·) represent the state transition equation and the observation equation, respectively.

2. The method according to claim 1, characterized in that, Step 2 includes: estimating the system state using a direct loosely coupled navigation system, comparing the estimated values ​​with GNSS measurements, extracting feature information related to whether the GNSS has been attacked, and considering a time interval Δ k Within this range, the difference between the variation in GNSS measurements and the variation in EKF (Extended Kalman Filter) estimates: in, These represent the estimated values ​​of the UAV's velocity and position output by the integrated navigation system in the Northeast coordinate system, respectively. This represents the error between the change in the measured value of the Global Navigation Satellite System (GNSS) and the change in the estimated value of the Extended Kalman Filter (EKF) at time k. This represents the error value of the N-axis component of the velocity in the northeast coordinate system at time k. This represents the error value of the E-axis component of the velocity in the northeast coordinate system at time k. This represents the error value of the D-axis component of the velocity in the northeast coordinate system at time k. This represents the error value of the N-axis component of the position in the northeast coordinate system at time k. This represents the error value of the E-axis component of the position in the northeast coordinate system at time k; the time interval Δ k The size is determined by the sampling frequency of the Global Navigation Satellite System (GNSS); Introducing a sliding time window to construct feature information: in, This represents the feature information constructed from the error values ​​of the N-axis component of velocity in the northeast coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the E-axis component of the velocity in the northeast coordinate system within a given sliding time window. This represents the feature information constructed from the error values ​​of the N-axis component of the position in the northeast coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the E-axis component of the position in the northeast coordinate system within a given sliding time window; This represents the feature information constructed from the error values ​​of the D-axis component in the northeast coordinate system within a given sliding time window.

3. The method according to claim 2, characterized in that, In step 3, the kernel function κ(x) of the Support Vector Machine (SVM) binary classifier i ,x j Radial basis functions are chosen as follows: κ(x i ,x j )=exp(-γ||x i -x j || 2 ) Where, x i x j Let represent two samples in the training sample set; γ is the kernel function parameter, which controls the width of the radial basis function kernel, usually expressed as . σ is the kernel width; exp is the natural exponential function.

4. The method according to claim 3, characterized in that Step 3, which involves training a Support Vector Machine (SVM) binary classifier using the duck flocking algorithm, specifically includes the following steps: Step 3.1: Initialize the duck flock algorithm. Randomly initialize the duck flock. The position of each duck represents a set of Support Vector Machine (SVM) parameters. The position of each duck includes the optimization penalty parameter C and the kernel function parameter γ. Step 3.2: After calculating the fitness value corresponding to the position of an individual in the duck flock, find the duck that is currently in the optimal position; the fitness value of an individual in the duck flock represents the classification effect of the SVM parameters corresponding to the current position of the duck. Therefore, the duck with the highest fitness value is the individual in the optimal position. Step 3.3: Exploration Phase: After the ducks exhibit queuing behavior, i.e., when they reach areas with more food, each individual gradually disperses and begins searching for food, represented as: Where sign(·) represents the sign function; rand represents a random number between (0, 1); μ is the control parameter for the global search; P is the search transition probability in the exploration phase; CF1 and CF2 represent the cooperation coefficient and competition coefficient of the ducks in the search phase, respectively; In the t-th iteration, duck X represents... i Location; Duck X obtained during the exploration phase i Location; This represents the duck in the optimal position during the first t iterations; This indicates that in the t-th iteration, the number of ducks is... Ducks searching for food; the formulas for calculating the global search control parameter μ, the cooperation coefficient CF1, and the competition coefficient CF2 of the ducks during the search phase are as follows: K = sin(2·rand) + 1 Where FP represents a constant; Step 3.4: Development Phase: The positional adaptability of each duck is represented as follows: Wherein, KF1 and KF2 represent the cooperation coefficient and competition coefficient of the ducks during the development stage, respectively; This indicates that after the exploration phase, the focus will be on the ducks. The kth duck searching for food This indicates that after the exploration phase, the focus will be on the ducks. The j-th duck foraging for food, where k≠j; and They represent Adaptability and The fitness of; This indicates that after the t-th iteration, duck X i Location, This indicates that duck X is in the exploration phase. i The position; where the calculation formulas for KF1 and KF2 are: Step 3.5: Determine if the maximum number of iterations has been reached. If yes, continue to step 3.6; otherwise, return to step 3.

2. Step 3.6: Obtain the results from the historical iteration rounds Set as the optimal individual, and for The position is decomposed to obtain the hyperparameters of the support vector machine (SVM), including the optimization penalty parameter C and the kernel function parameter γ.

5. The method according to claim 4, characterized in that, In steps 4 and 5, the feature combination encoding scheme combines and encodes the classification results of two or more Support Vector Machine (SVM) binary classifiers for different attack types of Global Navigation Satellite System (GNSS) to identify the behavioral differences of specific signal channels under attack; then, the features of different signal channels are combined and encoded to realize the attack detection and identification function of Global Navigation Satellite System (GNSS).

6. The method according to claim 5, characterized in that, In step 4, the attack detection subsystem refers to a suitable support vector machine (SVM) binary classifier, which is integrated into the error correction output code-support vector machine ECOC-SVM model using a feature combination encoding scheme to distinguish between the attacked state and the normal state, thereby detecting whether the Global Navigation Satellite System (GNSS) has been attacked.

7. The method according to claim 6, characterized in that, In step 5, the attack identification subsystem is a model designed and constructed by using a feature combination encoding scheme to construct an error correction output encoding-support vector machine ECOC-SVM model from a trained support vector machine (SVM) binary classifier, which is used to identify attacks targeting different signal channels.

8. The method according to claim 7, characterized in that, In step 6, Hamming distance is used to decode the decision code.

9. An electronic device, characterized in that, It includes a processor and a memory, the memory storing program code that, when executed by the processor, causes the processor to perform the steps of the method as described in any one of claims 1 to 8.

Images