A networking radar anomaly detection method and system based on a graph neural network

Abstract

The application provides a networking radar anomaly detection method and system based on a graph neural network, and belongs to the technical field of Internet of Things security. The method comprises the following steps: recording the track of a target detected by a radar, perfecting the target track route detected by the radar, and determining the track results observed by each radar in the networking radar; calculating the attention value of the track observed by each radar node, adaptively determining the adjacency matrix between the nodes, and taking the adjacency matrix as one of the features of the networking radar; predicting the node situation at the next moment through the graph neural network by using the observation results of each node in the networking radar and the adjacency matrix between the radar nodes; and comparing the node track information predicted by each radar node at the next moment and the track results observed by the radar at the next moment, so as to determine the radar node in an abnormal state in the networking radar. The application can rapidly and real-timely detect the sensors in an abnormal state in the Internet of Things, has strong robustness, and has high accuracy.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of networked radar security, and particularly relates to a networked radar anomaly detection method and system based on a graph neural network. BACKGROUND

[0002] In recent decades, a networked radar system (NRS) has received extensive attention and has been applied to more and more fields. The networked radar can greatly improve the detection and tracking capability of a target by acquiring a multi-scattering coefficient of the target through cooperative detection of multiple radars in the network. At present, the networked radar system mostly adopts a method of detecting before tracking (DBT), that is, a local radar node performs single-cycle threshold detection on a received echo signal at each time to obtain some false alarm points that may be targets, and then transmits the points or target tracks obtained by tracking filtering of the points to a fusion center for fusion. This method is defined as multi-sensor fusion based on DBT (MSF-DBT) in this paper. The MSF-DBT has good performance under a high signal-to-noise ratio, but when the signal-to-noise ratio is low, the target is often difficult to pass the single-cycle threshold detection, resulting in loss of information of the local node and serious decline of the algorithm performance. On the basis of the traditional networked radar detection method, the traditional method still has many deficiencies. First, due to the heterogeneity of the networked radar, it is difficult to uniformly represent different system radars. Second, in the networked radar, the influence of the nodes affected by interference is not considered, resulting in a decrease in detection accuracy when there are too many nodes in the networked radar. Finally, the traditional adjacency matrix is determined in advance according to the Euclidean metric between nodes, and this metric method greatly reduces the robustness of the algorithm. SUMMARY

[0003] The present application overcomes the above-mentioned deficiencies of the prior art and provides a networked radar anomaly detection method and system based on a graph neural network, which can quickly and in real time detect the positions of radar nodes in an abnormal state in the networked radar and has strong robustness.

[0004] The second object of the present application is to provide a method of graph association for the networked radar based on an adaptive adjacency matrix to cope with the poor robustness of the traditional metric method.

[0005] In order to achieve the above-mentioned objects, the present application adopts the following technical solutions:

[0006] A networked radar anomaly detection method based on a graph neural network, which comprises the following steps:

[0007] Step 1, record the track of target detection according to radar, perfect the track route of radar detection target, and determine the track result observed by each radar in the networked radar.

[0008] Step 2, calculate the attention value of the track observed by each radar node, and adaptively determine the adjacency matrix between nodes, so as to take the adjacency matrix as one of the features of the networked radar.

[0009] Step 3, predict the node situation at the next time through the graph neural network by combining the observation results of each node in the networked radar and the adjacency matrix between radar nodes.

[0010] Step 4, compare the node track information predicted by each radar node at the next time and the track result observed by the radar at the next time, so as to judge the radar node in abnormal state in the networked radar.

[0011] Wherein, the specific process of step 1 to obtain the track of each radar node in the networked radar when observing the target includes:

[0012] 1.1, simulate the trajectory of target motion in the networked radar, and construct target motion data set, wherein the model of target motion includes three target motion conditions of uniform linear motion, uniform accelerated linear motion and variable accelerated linear motion.

[0013] 1.2, construct networked radar observation data set, set different interference conditions of networked radar, for example, 64 interference conditions of six node radar, and make the networked radar in each interference condition observe different target motion to generate radar observation data set.

[0014] Wherein, the specific implementation process of step 2 includes:

[0015] 2.1, encode the track features into vector representation suitable for input to attention mechanism. Use convolutional neural network to process time series data and extract key features. Standardize track features to ensure uniform range of feature values, so as to avoid calculation instability caused by some feature values being too large or too small in attention calculation.

[0016] 2.2, use attention mechanism to calculate the attention value between nodes, that is, the similarity weight between each radar node. Use fully connected layer to convert the features of each node into Query, Key and Value vectors.

[0017] And calculate the attention value between nodes.

[0018]

[0019] 2.3, determine the adjacency relationship between radar nodes according to the attention value, directly generate the adjacency matrix according to the attention weight matrix, and update the weight for generating the attention value through back propagation in the training process, so that the adjacency matrix can dynamically reflect the relationship change between nodes.

[0020] The specific implementation process of step 3 comprises:

[0021] 3.1, input the observed features of the radar nodes and the corresponding adjacency matrix into the graph neural network at each time step.

[0022] 3.2, pass and fuse information between nodes by using the adjacency matrix through the graph convolution layer and the graph attention layer, and update the feature representation of each node.

[0023] 3.3, let the network output the predicted trajectory of each node at the next moment, and these prediction results are based on the relationship between nodes and the current observation information.

[0024] The specific implementation process of step 4 comprises:

[0025] 4.1, obtain the actual track information of each radar node observed at the next moment.

[0026] 4.2, compare the predicted track information of each radar node with the actual observed track information, calculate the error between them, and calculate the error by using RMSE.

[0027]

[0028] 4.3, according to the tolerance of the system, set an error threshold. If the prediction error of a certain radar node exceeds the threshold, the node may be in an abnormal state.

[0029] 4.4, feed back the anomaly detection result to the GNN model for further optimization of the model. The ability to identify abnormal situations can be strengthened in subsequent training.

[0030] The second aspect of the application relates to a dynamic graph-based networking radar anomaly detection system, comprising:

[0031] The acquisition module records the track detected by the radar on the target, perfects the target track route detected by the radar, and determines the track results observed by each radar in the networking radar;

[0032] The adjacency matrix generation module calculates the attention value of the track observed by each radar node, and adaptively determines the adjacency matrix between nodes, so as to take the adjacency matrix as one of the features of the networking radar;

[0033] A prediction module predicts the node state at the next time point by a graph neural network based on the observation results of each node in the networked radar and the adjacency matrix between radar nodes.

[0034] An anomaly detection module compares the node track information predicted at the next time point for each radar node with the track results observed by the radar at the next time point to determine the radar node in the networked radar that is in an abnormal state.

[0035] In summary, the scheme proposed in the application has the following advantages:

[0036] The application realizes joint processing between radars of different systems and different modes, has good scalability, and generates a corresponding adjacency matrix for the networked radar according to the similarity between nodes to predict the track measurement value of the target observed by each radar node in the networked radar at the next time point. By comparing the track measurement value predicted at the next time point for each radar node with the track measurement value observed by the corresponding radar node at the next time point, the radar node in the networked radar that is in an abnormal state is detected in real time, abnormal data is detected more quickly, and processing and response can be performed more timely. The application uses a graph attention mechanism to enhance the spatial connection between radar nodes and the sensitivity to anomalies. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the specific embodiments of the application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description.

[0038] Figure 1 The figure is a flowchart of the networked radar anomaly detection method based on a dynamic graph. DETAILED DESCRIPTION

[0039] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0040] Embodiment 1

[0041] This embodiment gives a dynamic graph-based networking radar radar anomaly detection method, referring to Figure 1 , the networking radar radar anomaly detection method comprises the following steps:

[0042] Step 1, record the track of target detection according to the radar, perfect the target track route of radar detection, and determine the track result observed by each radar in the networking radar.

[0043] By simulating the track observed by the radar nodes of the networking radar to the target, the track is simulated according to the traditional motion mode, and three target motion conditions of uniform linear motion, uniform acceleration linear motion and variable acceleration linear motion are simulated, so that each node of the networking radar randomly observes the same target each time. The specific process of obtaining the track of each radar node in the networking radar observed to the target in this step includes:

[0044] 1.1, simulate the trajectory of target motion in the networking radar, and construct a target motion dataset, wherein the model of target motion includes three target motion conditions of uniform linear motion, uniform acceleration linear motion and variable acceleration linear motion.

[0045] 1.2, construct a networking radar observation dataset, set different interference conditions in the networking radar, for example, there are 64 interference conditions for a six-node radar, and let the networking radar in each interference condition randomly observe different target motion to generate a radar observation dataset.

[0046] Step 2, calculate the attention value of the track observed by each radar node, and adaptively determine the adjacency matrix between nodes to take the adjacency matrix as one of the features of the networking radar.

[0047] Through the characteristics of the radar itself, when observing the target, the observation result is the track feature of the target in a period of time. By inputting the track feature into the attention mechanism, the attention coefficient between nodes is calculated, and then the adjacency matrix of the networking radar is determined. The specific implementation process of this step includes:

[0048] 2.1, encode the track features into vector representation suitable for input to attention mechanism. Use convolutional neural network (CNN) to process time series data and extract key features, normalize track features to ensure uniform range of feature values, thereby avoiding computational instability caused by excessively large or small feature values in attention calculation.

[0049] 2.2, use attention mechanism to calculate attention values between nodes, i.e. similarity weights between radar nodes. Use fully connected layer to convert features of each node into Query, Key and Value vectors.

[0050] and calculate the attention values between nodes.

[0051]

[0052] 2.3, determine the adjacency relationship between radar nodes according to the attention values, directly generate the adjacency matrix according to the attention weight matrix, and update the weights for generating attention values through back propagation in the training process, so that the adjacency matrix can dynamically reflect the changes of the relationship between nodes.

[0053] Step 3, input the observation results of each node in the networked radar and the adjacency matrix between radar nodes into the graph neural network to predict the node situation at the next time.

[0054] Through the feature of sensitivity to adjacency matrix of graph neural network, the graph neural network is used to predict the target trajectory of networked radar at the next time. The specific implementation process of this step includes:

[0055] 3.1, input the observation features of radar nodes and the corresponding adjacency matrix into the graph neural network at each time step.

[0056] 3.2, pass and fuse information between nodes using adjacency matrix through graph convolution layer and graph attention layer, and update the feature representation of each node.

[0057] 3.3, let the network output the predicted trajectory of each node at the next time. These prediction results are based on the relationship between nodes and the current observation information.

[0058] Step 4, compare the node track information predicted by each radar node at the next time and the track results observed by the radar at the next time to determine the radar node in abnormal state in the networked radar.

[0059] 4.1, obtain the actual track information of the target observed by each radar node at the next time.

[0060] 4.2 Compare the predicted trajectory information of each radar node with the actual observed trajectory information, calculate the error between the two, and use RMSE to calculate the error.

[0061]

[0062] 4.3. Set an error threshold based on the system's tolerance. If the prediction error of a radar node exceeds this threshold, the node may be in an abnormal state.

[0063] 4.4 Feed the anomaly detection results back to the GNN model for further optimization. This can enhance the model's ability to identify anomalies during subsequent training.

[0064] Example 2

[0065] This embodiment provides a dynamic graph-based networked radar anomaly detection system for implementing the dynamic graph-based networked radar anomaly detection method described in Embodiment 1. The dynamic graph-based networked radar anomaly detection system includes:

[0066] The acquisition module records the target detection trajectory based on the radar, improves the target trajectory route detected by the radar, and determines the trajectory results observed by each radar in the network radar.

[0067] The adjacency matrix generation module calculates the attention value of the track observed by each radar node and adaptively determines the adjacency matrix between nodes so as to use the adjacency matrix as one of the features of the networked radar.

[0068] The prediction module uses a graph neural network to predict the node status at the next time step by combining the observation results of each node in the networked radar with the adjacency matrix between the radar nodes.

[0069] The anomaly detection module compares the predicted node trajectory information of each radar node at the next moment with the trajectory results observed by the radar at the next moment to determine the radar nodes in the network radar that are in an abnormal state.

[0070] Furthermore, the acquisition module includes:

[0071] The simulation submodule simulates the trajectory of the target motion in the networked radar and constructs a target motion dataset. The target motion model includes three target motion scenarios: uniform linear motion, uniformly accelerated linear motion, and variable acceleration linear motion.

[0072] Furthermore, the adjacency matrix generation module includes:

[0073] The feature extraction submodule encodes the track features into vector representations suitable for input into the attention mechanism. It uses a convolutional neural network (CNN) to process time-series data and extract key features. The track features are standardized to ensure a uniform range of feature values, thus avoiding computational instability caused by some feature values ​​being too large or too small during attention calculations.

[0074] The attention value calculation submodule uses an attention mechanism to calculate the attention value between nodes, i.e., the similarity weight between each radar node. A fully connected layer is used to convert the features of each node into a Query, Key, and Value vector. Then, the attention value between nodes is calculated.

[0075] Furthermore, the prediction module includes:

[0076] The network update submodule updates the feature representation of each node by using graph convolutional layers and graph attention layers to pass and fuse information between nodes through the adjacency matrix.

[0077] Furthermore, the anomaly detection module includes:

[0078] The loss update submodule compares the predicted trajectory information of each radar node with the actual observed trajectory information, calculates the error between the two, and uses RMSE to calculate the error.

[0079] The threshold determination submodule sets an error threshold based on the system's tolerance. If the prediction error of a radar node exceeds this threshold, the node may be in an abnormal state.

[0080] The principles, formulas, and parameter definitions involved in the above embodiments are all applicable, and will not be traced back one by one here.

[0081] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A network radar anomaly detection method based on graph neural networks, characterized in that, Includes the following steps: Step 1: Record the target detection trajectory based on the radar, refine the target trajectory route detected by the radar, and determine the trajectory results observed by each radar in the network radar. By simulating the trajectory of a target observed by the radar nodes of a network radar, we simulated the trajectory and, based on traditional motion methods, simulated the motion of three types of targets: uniform linear motion, uniformly accelerated linear motion, and variable acceleration linear motion, allowing each node of the network radar to randomly observe the same target each time. Step 2: Calculate the attention value for the track observed by each radar node, and adaptively determine the adjacency matrix between nodes, so as to use the adjacency matrix as one of the features of the networked radar. Based on the inherent characteristics of radar, when observing a target, the observation result is the target's trajectory characteristics over a period of time. By inputting the trajectory characteristics into the attention mechanism, the attention coefficients between nodes are calculated, thereby determining the adjacency matrix of the networked radar. Step 3: Use a graph neural network to predict the node status at the next time step by combining the observation results of each node in the networked radar with the adjacency matrix between radar nodes. Leveraging the sensitivity of graph neural networks to adjacency matrices, graph neural networks are used to predict the target trajectory of the networked radar at the next moment. Step 4: Compare the predicted node trajectory information of each radar node at the next moment with the radar observation trajectory results at the next moment to determine the radar nodes in the network radar that are in an abnormal state.

2. The network radar anomaly detection method based on graph neural networks as described in claim 1, characterized in that, Step 1, obtaining the specific process by which each radar node in the network observes the target and obtains the flight path, includes: 1.1 Simulate the trajectory of the target motion in the networked radar and construct a target motion dataset, wherein the target motion model includes three target motion cases: uniform linear motion, uniformly accelerated linear motion, and variable acceleration linear motion. 1.2 Construct a network radar observation dataset. Set different interference scenarios within the network radar and have the network radar under each interference scenario randomly observe different target movements to generate a radar observation dataset.

3. The network radar anomaly detection method based on graph neural networks as described in claim 1, characterized in that, The specific implementation process of step 2 includes: 2.1 Encode the track features into a vector representation suitable for input into the attention mechanism; use a convolutional neural network to process time series data and extract key features, standardize the track features to ensure that the range of feature values ​​is uniform, thereby avoiding computational instability caused by some feature values ​​being too large or too small in the attention calculation; 2.2 Calculate the attention value between nodes using an attention mechanism, i.e., the similarity weight between each radar node; use a fully connected layer to convert the features of each node into Query, Key, and Value vectors; and calculate the attention value between nodes. 2.3 Determine the adjacency relationship between radar nodes based on the attention value. Generate the adjacency matrix directly based on the attention weight matrix. Update the weights of the generated attention value through backpropagation during the training process so that the adjacency matrix can dynamically reflect the changes in the relationship between nodes.

4. The network radar anomaly detection method based on graph neural networks as described in claim 1, characterized in that, The specific implementation process of step 3 includes: 3.1 At each time step, the observation features of the radar node and the corresponding adjacency matrix are input into the graph neural network; 3.

2. By using graph convolutional layers and graph attention layers, information is transmitted and fused between nodes using the adjacency matrix to update the feature representation of each node; 3.

3. The network outputs the predicted trajectory of each node at the next time step. These predictions are based on the relationships between nodes and the current observation information.

5. The network radar anomaly detection method based on graph neural networks as described in claim 1, characterized in that, Step 4 specifically includes: 4.1 Obtain the actual trajectory information of the target that each radar node will observe at the next moment; 4.2 Compare the predicted trajectory information of each radar node with the actual observed trajectory information, calculate the error between the two, and use RMSE to calculate the error; 4.

3. Based on the system's tolerance, set an error threshold; if the prediction error of a radar node exceeds this threshold, the node is in an abnormal state. 4.4 Feed the anomaly detection results back to the GNN model for further optimization; enhance the ability to identify anomalies in subsequent training.

6. A networked radar anomaly detection system based on dynamic graphs, comprising: The acquisition module records the target detection trajectory based on the radar, improves the target trajectory route detected by the radar, and determines the trajectory results observed by each radar in the network radar. The adjacency matrix generation module calculates the attention value of the track observed by each radar node and adaptively determines the adjacency matrix between nodes, using the adjacency matrix as one of the features of the networked radar; including: The feature extraction submodule encodes track features into vector representations suitable for input into the attention mechanism; it uses a convolutional neural network (CNN) to process time-series data and extract key features, standardizing the track features to ensure a uniform range of feature values, thus avoiding computational instability caused by some feature values ​​being too large or too small during attention calculation; the attention value calculation submodule uses the attention mechanism to calculate the attention value between nodes, i.e., the similarity weight between each radar node; it uses a fully connected layer to convert the features of each node into a Query, Key, and Value vector, where the Query is the current attention focus position, the Key is the identifier of other positions, and the Value stores complete information about each position; and it calculates the attention value between nodes. The prediction module uses a graph neural network to predict the node status at the next time step by combining the observation results of each node in the networked radar with the adjacency matrix between the radar nodes. The anomaly detection module compares the predicted node trajectory information of each radar node at the next moment with the trajectory results observed by the radar at the next moment to determine the radar nodes in the network radar that are in an abnormal state.

7. The network radar anomaly detection system based on dynamic graphs as described in claim 6, characterized in that, The acquisition module includes: The simulation submodule simulates the trajectory of the target motion in the networked radar and constructs a target motion dataset. The target motion model includes three target motion scenarios: uniform linear motion, uniformly accelerated linear motion, and variable acceleration linear motion.

8. The networked radar anomaly detection system based on dynamic graphs as described in claim 6, characterized in that, The prediction module includes: The network update submodule updates the feature representation of each node by using graph convolutional layers and graph attention layers to pass and fuse information between nodes using the adjacency matrix.

9. The network radar anomaly detection system based on dynamic graphs as described in claim 6, characterized in that, The anomaly detection module includes: The loss update submodule compares the predicted trajectory information of each radar node with the actual observed trajectory information, calculates the error between the two, and uses RMSE to calculate the error. The threshold determination submodule sets an error threshold based on the system's tolerance; if the prediction error of a radar node exceeds this threshold, the node is in an abnormal state.

Images