ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism

Abstract

The invention discloses an ADS-B spoofing attack detection method based on a discrete cosine patch attention mechanism, and the method comprises the following steps: 1, carrying out the screening and cleaning of a collected ADS-B signal sequence, and reserving continuous flight data with time sequence features for network training; 2, segmenting the continuous flight data into a plurality of time windows according to channels, and extracting frequency domain features from the time windows by using cosine discrete transform; step 3, combining the time window with the frequency domain feature and the time window with the time feature, and inputting the obtained time window with the frequency domain feature and the time domain feature into a self-attention mechanism to obtain an instance level feature; 4, performing normalization on the instance level features by using anti-instance regularization; 5, measuring the deviation between the normalized features and the normal mode features learned in the training stage; and step 6, summarizing the measured deviations, calculating an overall abnormal score of each signal segment, and then classifying the signals by using the abnormal scores.

Description

Technical Field

[0001] The present invention relates to the fields of ADS-B system technology and deep learning technology, and in particular to an ADS-B spoofing attack detection method based on a discrete cosine patch attention mechanism. Background Art

[0002] Automatic Dependent Surveillance-Broadcast (ADS-B) is currently a very important air traffic monitoring technology in the new generation of navigation systems. Its monitoring system broadcasts the aircraft's precise location, speed, altitude and other data in the form of messages through data links. Other aircraft or ground receiving stations can receive the signal sent by the aircraft, allowing pilots and air traffic control personnel to track other aircraft in real time and dynamically. Since ADS-B broadcasts messages without any authentication and encryption, it is possible for other illegal elements to tamper with and fabricate message information and send it to other receivers. Therefore, with the widespread application of the ADS-B system, it is of great significance to quickly and effectively detect deceptive attack interference.

[0003] A lot of research has been conducted at home and abroad on the security issues of ADS-B data. The first is the cryptography-based method. This method usually requires changing the existing ADS-B protocol and is incompatible with the current ADS-B system. Therefore, it is difficult to implement and has high additional costs. The second type is the location verification-based method. This type of method usually uses the arrival time difference / arrival time to perform a secondary verification on the position claimed by the aircraft or other ADS-B message sender, but this type of method has certain requirements on the installation location of the receiving base station and is easily affected by the multipath effect. The third type is the method based on array antenna verification of wave direction estimation. Although this type of method does not require coordination between multiple ground base stations and only uses a single data source, it usually requires spatial search and direction finding, which has high computational complexity. Summary of the invention

[0004] The purpose of the present invention is to provide an ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism, in order to solve the above-mentioned problems.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A method for detecting ADS-B spoofing attacks based on discrete cosine patch attention mechanism includes the following steps:

[0007] Step 1: Filter and clean the collected ADS-B signal sequences, and retain the continuous flight data with time series characteristics for network training;

[0008] Step 2: Divide the continuous flight data into several time windows according to the channels, and use the cosine discrete transform to extract the frequency domain features from the time windows;

[0009] Step 3: Combine the time window with frequency domain features and the time window with time features, and input the obtained time window with frequency domain and time domain features into the self-attention mechanism to obtain instance-level features;

[0010] Step 4: Normalize instance-level features using anti-instance regularization;

[0011] Step 5: Measure the deviation of the normalized features from the normal pattern features learned during the training phase;

[0012] Step 6: Summarize the measured deviations, calculate the overall anomaly score for each signal segment, and then use the anomaly score to classify the signal.

[0013] In some embodiments, the continuous flight data with time series characteristics in step 1 is divided into: a training set; a validation set and a test set.

[0014] In some embodiments, key parameters for network training include latitude, longitude, altitude, speed, and corresponding x and y values ​​calculated from the center of the earth.

[0015] In some embodiments, the step 2: dividing the continuous flight data into time windows according to channels, and extracting frequency domain features from the time windows using cosine discrete transform; comprises:

[0016] Step 2.1: Sequence continuous flight data Where M represents the number of channels, L represents the sequence length, and the channels are divided into time windows; each channel sequence Where i = 0, 1, 2, ..., M; through the transformer model, the converted sequence Where i = 0, 1, 2, ..., M; then connected in series Output is a time window with time characteristics;

[0017] Step 2.2: From the signal perspective, the cosine discrete transform of a given sequence x[l] of length L is defined as follows:

[0018] Where k = 0, 1, 2, ..., L-1;

[0019] x[l] is the input time domain signal;

[0020] X[k] represents the discrete cosine transform coefficient in the frequency domain;

[0021] L is the length of the sequence;

[0022] After the continuous flight data is transformed by cosine discrete transformation, a time window with frequency domain characteristics is output.

[0023] In some embodiments, the calculation formula of the self-attention mechanism in step 3 is as follows:

[0024]

[0025] Among them, d K is the dimension of the K vector, Q, K, and V represent three matrices, all of which are a fully connected network or a convolutional layer with a kernel size of 1, and the instance-level features output by the self-attention mechanism are obtained.

[0026] In some embodiments, the mathematical definitions of the regularization and anti-instance regularization in step 4 are as follows:

[0027] For each instance-level feature T represents the length of the time series, and the calculation formulas for the mean and standard deviation are:

[0028]

[0029] So we get the regularized time series

[0030]

[0031] For regularized data After preprocessing, anti-instance regularization is used to restore the original distribution:

[0032]

[0033] In some embodiments, the signal classification in step 6:

[0034]

[0035] In some embodiments, in model testing and result analysis, four indicators are selected for the evaluation of model performance: accuracy, precision (reflecting the model's ability to recognize negative samples, the higher the accuracy, the stronger the model's ability to distinguish negative samples), recall (reflecting the model's ability to recognize positive samples, the higher the recall, the stronger the model's ability to recognize positive samples) and F1-Score (F1-Score, which is the weighted average of precision and recall. The higher the F1-Score, the more stable the model.

[0036] The beneficial effects that may be brought about by the ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism disclosed in this application include but are not limited to:

[0037] The present invention first divides the continuous flight data into time windows, and uses the cosine discrete transform to extract the frequency domain features of the time windows; after combining the frequency domain features with the time domain features, the features are input into the patch attention mechanism in deep learning to obtain instance-level features, and the instance-level features are normalized by anti-instance regularization, and the deviation is measured with the normal signal sequence to obtain the score summary output result. The accuracy of the aircraft take-off phase of the present invention is as high as 97.99%, the accuracy of the aircraft cruising phase is as high as 99.34%, and the F1 score is as high as 99.09%. This result proves the effectiveness of the discrete cosine patch attention model in the field of ADS-B spoofing attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 An overall flow chart of the method provided for an example of the present invention;

[0039] Figure 2 A flowchart of the attention mechanism provided for an example of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clear, the present application is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described here are only used to explain the present application and are not used to limit the present application.

[0041] On the contrary, the present application covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present application as defined by the claims. Further, in order to make the public have a better understanding of the present application, some specific details are described in detail in the detailed description of the present application below. Those skilled in the art can fully understand the present application without the description of these details.

[0042] The following is a detailed description of an ADS-B spoofing attack detection method based on a discrete cosine patch attention mechanism involved in an embodiment of the present application. It is worth noting that the following embodiments are only used to explain the present application and do not constitute a limitation of the present application.

[0043] like Figure 1-2 As shown, a method for detecting ADS-B spoofing attacks based on discrete cosine patch attention mechanism comprises the following steps:

[0044] Step 1: Filter and clean the collected ADS-B signal sequences, and only retain the continuous flight data with time series characteristics for network training. The key parameters used for network training include latitude, longitude, altitude, speed, and the corresponding x and y values ​​calculated from the center of the earth.

[0045] In this implementation, step 1 specifically includes:

[0046] Continuous flight data set collection and division: The training set includes 25 flight records, a total of 83,620 ADS-B signal sequences, and a flight time of 23 hours and 13 minutes; the validation set includes 10 flight records, a total of 40,613 ADS-B signal sequences, and a flight time of 11 hours and 16 minutes; the test set includes 7 flight records, a total of 15,392 ADS-B signal sequences, and a flight time of 4 hours and 16 minutes. Among them, each flight record includes at least 1,500 ADS-B signal sequences, and the information sampling time interval is fixed at 1 second. The specific flight parameters are as follows:

[0047]

[0048] Step 2: Split the continuous flight data into time windows (patches) according to the channels, and extract frequency domain features from the time windows using cosine discrete transform;

[0049] In this implementation, step 2 specifically includes:

[0050] Step 2.1: Convert continuous flight data to continuous flight data sequence (where M represents the number of channels and L represents the sequence length) is divided into time windows (patches) according to the channels. Each channel sequence (where i = 0, 1, 2, ..., M) through the transformer model, the converted sequence (where i = 0, 1, 2, ..., M), and then connected in series Output is a time window with time characteristics;

[0051] Step 2.2, from the signal point of view, from the signal point of view, the cosine discrete transform of a given sequence x[l] of length L is defined as follows:

[0052]

[0053] x[l] is the input time domain signal;

[0054] X[k] represents the discrete cosine transform coefficient in the frequency domain;

[0055] L is the length of the sequence;

[0056] After the continuous flight data is transformed by cosine discrete transformation, a time window with frequency domain characteristics is output.

[0057] Step 3: Combine the time window with frequency domain features and the time window with time features, input the obtained time window with frequency domain and time domain features into the self-attention mechanism to obtain instance-level features;

[0058] In this implementation, step 3 specifically includes:

[0059] The core idea of ​​the self-attention mechanism is to calculate the correlation between each element in the input sequence and other elements through three matrices: Q (Query, query matrix, indicating the information that the current element wants to know), K (Key, key matrix, indicating the information that the current element can provide), V (Value, value matrix, indicating the actual content carried by each element). The time window with frequency domain and time domain features is generated through three fully connected layers respectively. Q, K and V matrices:

[0060] Q=XW Q ,K=XW K ,V=XW V

[0061] Where W Q ,W K ,W V is a learnable parameter matrix. The attention weight matrix is ​​obtained by the following formula:

[0062]

[0063] Among them, d K is the dimension of the K vector. Multiply the attention weight matrix with the V matrix to get the weighted output of each time window. Finally, connect it with the feedforward neural network (containing two fully connected layers and an activation function) to perform nonlinear transformation, and output instance-level features;

[0064] Step 4, measure the deviation of the normalized features from the normal pattern features learned during the training phase;

[0065] In this implementation, step 4 specifically includes:

[0066] For each instance-level feature T represents the length of the time series, and the calculation formulas for the mean and standard deviation are:

[0067]

[0068] So we get the regularized time series

[0069]

[0070] For regularized data After preprocessing, anti-instance regularization is used to restore the original distribution:

[0071]

[0072] Step 5, measure the deviation of the normalized features from the normal pattern features learned during the training phase;

[0073] Step 6: Summarize the measured deviations, calculate the overall anomaly score for each signal segment, and then classify the signals using the anomaly score;

[0074] In this implementation, step 6 specifically includes:

[0075] Signal classification method:

[0076]

[0077] Here, τ is set to 0.1 based on experience.

[0078] To illustrate the technical advantages of the method of the present invention, the original data set is composed of ADS-B data from 42 different flights after screening to ensure full coverage of take-off, cruising and landing states. In the deception attack detection stage, accuracy, precision, recall and F1-score are used to measure the performance of the algorithm. The calculation formulas for each evaluation index are as follows:

[0079]

[0080] Among them, TP is the number of samples correctly predicted by the model as positive; FP is the case where the model incorrectly predicts the negative class as positive; FN is the case where the model incorrectly predicts the positive class as negative.

[0081] The above performance indicators can accurately represent the training efficiency of the model. During the experiment, the present invention will compare with three mature deception attack detection models, namely the transformer model, the informer model and the Dlinear model, in four situations: aircraft takeoff, landing, maneuvering and noise. The experiment of the present invention adopts Pytorch1.13.1, Python3.7.16 environment, graphics card 2060, running memory is 6G, running memory is small, time window length (patch) is 16, batch size (batch-size) is reduced to 128, and learning rate is 1×10 -5 , the training epoch parameter is set to 10. The performance of the four networks is shown in Table 1:

[0082] Table 1 Experimental results of four networks

[0083]

[0084] The experimental results fully demonstrate the comparative effects of each baseline model and the proposed model in different scenarios. The proposed method shows excellent performance, especially in complex scenarios such as maneuvering and noise, because in these scenarios, spoofing attack detection is more challenging. These structures not only demonstrate the numerical superiority of the proposed method, but also emphasize the practical significance of the proposed method in improving the robustness and reliability of the ADS-B system.

[0085] In order to better understand the contribution of each component in the present invention, we continue to conduct ablation studies, focusing on two key enhancements: anti-instance regularization and discrete cosine transform. The network performance of different configurations in four cases is shown in Table 2:

[0086] Table 2 Ablation experiment results

[0087]

[0088] It can be seen from the table that each enhancement method plays an important role in improving model performance. In deception attack detection, adding instance regularization and discrete cosine transform can help improve the accuracy and robustness of prediction. The combination of the two will achieve the best overall performance in different scenarios.

[0089] The above description is only a preferred embodiment of the present invention and is used to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting ADS-B spoofing attacks based on discrete cosine patch attention mechanism, characterized in that: The following steps are involved: Step 1: Filter and clean the collected ADS-B signal sequences, and retain the continuous flight data with time series characteristics for network training; Step 2: Divide the continuous flight data into several time windows according to the channels, and use the cosine discrete transform to extract the frequency domain features from the time windows; Step 3: Combine the time window with frequency domain features and the time window with time features, and input the obtained time window with frequency domain and time domain features into the self-attention mechanism to obtain instance-level features; Step 4: Normalize instance-level features using anti-instance regularization; Step 5: Measure the deviation of the normalized features from the normal pattern features learned during the training phase; Step 6: Summarize the measured deviations, calculate the overall anomaly score for each signal segment, and then use the anomaly score to classify the signal.

2. According to claim 1, the ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism is characterized in that: The continuous flight data with time series characteristics in step 1 are divided into: training set; validation set and test set.

3. According to claim 1, the ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism is characterized in that: The key parameters used for network training include latitude, longitude, altitude, speed, and the corresponding x- and y-values ​​calculated from the center of the Earth.

4. According to claim 1, the ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism is characterized in that: The step 2: dividing the continuous flight data into time windows according to the channels, and extracting frequency domain features from the time windows using cosine discrete transform; comprises: Step 2.1: Sequence continuous flight data Where M represents the number of channels, L represents the sequence length, and the channels are divided into time windows; each channel sequence Where i = 0, 1, 2, ..., M; through the transformer model, the converted sequence Where i = 0, 1, 2, ..., M; then connected in series Output is a time window with time characteristics; Step 2.2: From the signal perspective, the cosine discrete transform of a given sequence x[l] of length L is defined as follows: Where k = 0, 1, 2, ..., L-1; x[l] is the input time domain signal; X[k] represents the discrete cosine transform coefficient in the frequency domain; L is the length of the sequence; After the continuous flight data is transformed by cosine discrete transformation, a time window with frequency domain characteristics is output.

5. According to claim 1, the ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism is characterized in that: The calculation formula of the self-attention mechanism in step 3 is as follows: Among them, d K is the dimension of the K vector, Q, K, and V represent three matrices, all of which are a fully connected network or a convolutional layer with a kernel size of 1, and the instance-level features output by the self-attention mechanism are obtained.

6. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: The mathematical definitions of regularization and anti-instance regularization described in step 4 are as follows: For each instance-level feature T represents the length of the time series, and the calculation formulas for the mean and standard deviation are: So we get the regularized time series For regularized data After preprocessing, anti-instance regularization is used to restore the original distribution:

7. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: Signal classification in step 6:

8. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: In model testing and result analysis, four indicators are selected to evaluate model performance: accuracy, precision, recall and F1 score.

Images