An ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism

Abstract

The application discloses an ADS-B spoofing attack detection method based on a discrete cosine patch attention mechanism, and comprises the following steps: step 1, screening and cleaning the collected ADS-B signal sequence, retaining continuous flight data with time sequence characteristics for network training; step 2, dividing the continuous flight data into a plurality of time windows according to channels, and extracting frequency domain features from the time windows by using a cosine discrete transformation; step 3, combining the time windows with frequency domain features and the time windows with time features, inputting the obtained time windows with frequency domain and time domain features into a self-attention mechanism to obtain instance-level features; step 4, normalizing the instance-level features by using anti-instance regularization; step 5, measuring the deviation of the normalized features from normal mode features learned in the training phase; step 6, summarizing the measured deviation, calculating the overall anomaly score of each signal segment, and then classifying the signals by using the anomaly score.

Description

Technical Field

[0001] The present invention relates to the fields of ADS-B system technology and deep learning technology, and in particular to an ADS-B spoofing attack detection method based on a discrete cosine patch attention mechanism. Background Art

[0002] Automatic Dependent Surveillance-Broadcast (ADS-B) is a crucial air traffic monitoring technology in the next-generation navigation system. Its surveillance system broadcasts an aircraft's precise location, speed, altitude, and other data in the form of messages via a data link. Other aircraft or ground receiving stations can then receive the signals from the aircraft, allowing pilots and air traffic controllers to track other aircraft in real time and dynamically. Because ADS-B broadcasts messages without any authentication or encryption, it is possible for unauthorized actors to tamper with or fabricate message information and send it to other receivers. Therefore, with the widespread adoption of the ADS-B system, it is crucial to quickly and effectively detect spoofing attacks.

[0003] A lot of research has been conducted both domestically and internationally to address the security issues surrounding ADS-B data. The first is cryptography-based methods. These methods typically require changes to the existing ADS-B protocol and are incompatible with current ADS-B systems, making them difficult to implement and requiring high additional costs. The second category is location-based verification methods. These methods typically utilize the arrival time difference / arrival time to perform a secondary verification of the position claimed by the aircraft or other ADS-B message sender. However, these methods place certain requirements on the installation location of the receiving base station and are susceptible to multipath effects. The third category is methods based on array antennas to verify direction of arrival estimates. Although these methods do not require coordination between multiple ground base stations and only use a single data source, they typically require spatial search and direction finding, resulting in high computational complexity. Summary of the Invention

[0004] The purpose of this invention is to provide an ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism, in order to solve the above-mentioned problems.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] A method for detecting ADS-B spoofing attacks based on discrete cosine patch attention mechanism includes the following steps:

[0007] Step 1: Filter and clean the collected ADS-B signal sequences, retaining continuous flight data with time series characteristics for network training;

[0008] Step 2: Split the continuous flight data into several time windows according to the channel, and use the cosine discrete transform to extract the frequency domain features from the time windows;

[0009] Step 3: Combine the time window with frequency domain features and the time window with time features, and input the obtained time window with frequency domain and time domain features into the self-attention mechanism to obtain instance-level features;

[0010] Step 4: Normalize instance-level features using anti-instance regularization;

[0011] Step 5: Measure the deviation of the normalized features from the normal pattern features learned during the training phase;

[0012] Step 6: Summarize the measured deviations, calculate the overall anomaly score for each signal segment, and then use the anomaly score to classify the signal.

[0013] In some embodiments, the continuous flight data with time series characteristics in step 1 is divided into: a training set; a validation set and a test set.

[0014] In some embodiments, key parameters for network training include latitude, longitude, altitude, speed, and corresponding x and y values ​​calculated from the center of the Earth.

[0015] In some embodiments, step 2: dividing the continuous flight data into time windows according to channels, and extracting frequency domain features from the time windows using cosine discrete transform; includes:

[0016] Step 2.1: Sequence the continuous flight data Where M represents the number of channels, L represents the sequence length, and the time window is divided according to the channel; each channel sequence Where i = 0, 1, 2, ..., M; through the transformer model, the converted sequence Where i=0,1,2,…,M; then connect them in series Output is a time window with time characteristics;

[0017] Step 2.2: From the signal perspective, the cosine discrete transform of a given sequence x[l] of length L is defined as follows:

[0018] Where k = 0, 1, 2, ..., L-1;

[0019] x[l] is the input time domain signal;

[0020] X[k] represents the discrete cosine transform coefficient in the frequency domain;

[0021] L is the length of the sequence;

[0022] After the continuous flight data undergoes cosine discrete transformation, the output is a time window with frequency domain characteristics.

[0023] In some embodiments, the calculation formula of the self-attention mechanism in step 3 is as follows:

[0024]

[0025] Among them, d K is the dimension of the K vector, Q, K, and V represent three matrices, each of which is a fully connected network or a convolutional layer with a kernel size of 1, which obtains the instance-level features output by the self-attention mechanism.

[0026] In some embodiments, the mathematical definitions of the regularization and anti-instance regularization in step 4 are as follows:

[0027] For each instance-level feature T represents the length of the time series, and the calculation formulas for the mean and standard deviation are:

[0028]

[0029] Thus, the regularized time series is obtained

[0030]

[0031] Regularized data After preprocessing, anti-instance regularization is used to restore the original distribution:

[0032]

[0033] In some embodiments, the signal classification in step 6:

[0034]

[0035] In some embodiments, during model testing and result analysis, four indicators are selected for evaluating model performance: accuracy, precision (reflecting the model's ability to recognize negative samples; the higher the accuracy, the stronger the model's ability to distinguish negative samples), recall (reflecting the model's ability to recognize positive samples; the higher the recall, the stronger the model's ability to recognize positive samples), and F1-score (F1-Score, which is the weighted average of precision and recall; the higher the F1-score, the more stable the model).

[0036] The potential beneficial effects of the ADS-B spoofing attack detection method based on the discrete cosine patch attention mechanism disclosed in this application include but are not limited to:

[0037] The present invention first segments continuous flight data into time windows and uses the discrete cosine transform to extract frequency-domain features from these time windows. The frequency-domain and time-domain features are combined and then fed into the patch attention mechanism used in deep learning to generate instance-level features. These instance-level features are then normalized using inverse instance regularization and deviations from the normal signal sequence are measured to produce a score-aggregated output. The proposed method achieves an accuracy of 97.99% during takeoff and 99.34% during cruise, with an F1 score of 99.09%. These results demonstrate the effectiveness of the discrete cosine patch attention model in detecting ADS-B spoofing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 An overall flow chart of the method provided for an example of the present invention;

[0039] Figure 2 Flowchart of the attention mechanism provided for an example of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0041] On the contrary, this application covers any alternatives, modifications, equivalents, and solutions made within the spirit and scope of this application as defined by the claims. Furthermore, to facilitate a better understanding of this application, certain specific details are described in detail below in the detailed description of this application. Those skilled in the art will be able to fully understand this application without these details.

[0042] The following is a detailed description of an ADS-B spoofing attack detection method based on a discrete cosine patch attention mechanism according to an embodiment of the present application. It is worth noting that the following embodiments are only used to explain the present application and do not constitute a limitation of the present application.

[0043] like Figure 1-2 As shown, a method for detecting ADS-B spoofing attacks based on discrete cosine patch attention mechanism is provided, which includes the following steps:

[0044] Step 1: Filter and clean the collected ADS-B signal sequences, retaining only continuous flight data with time series characteristics for network training. The key parameters used for network training include latitude, longitude, altitude, speed, and the corresponding x and y values ​​calculated from the center of the earth.

[0045] In this embodiment, step 1 specifically includes:

[0046] Continuous flight data set collection and division: The training set includes 25 flight records, totaling 83,620 ADS-B signal sequences, with a flight time of 23 hours and 13 minutes; the validation set includes 10 flight records, totaling 40,613 ADS-B signal sequences, with a flight time of 11 hours and 16 minutes; the test set includes 7 flight records, totaling 15,392 ADS-B signal sequences, with a flight time of 4 hours and 16 minutes. Each flight record includes at least 1,500 ADS-B signal sequences, and the information sampling interval is fixed at 1 second. The specific flight parameters are as follows:

[0047]

[0048] Step 2: Split the continuous flight data into time windows (patches) according to the channel, and use the cosine discrete transform to extract frequency domain features from the time windows;

[0049] In this embodiment, step 2 specifically includes:

[0050] Step 2.1: Convert continuous flight data to continuous flight data sequence (where M represents the number of channels and L represents the sequence length) is divided into time windows (patches) according to the channels. Each channel sequence (where i = 0, 1, 2, ..., M) through the transformer model, the converted sequence (where i=0,1,2,…,M), and then connected in series Output is a time window with time characteristics;

[0051] Step 2.2, from the signal perspective, the cosine discrete transform of a given sequence x[l] of length L is defined as follows:

[0052]

[0053] x[l] is the input time domain signal;

[0054] X[k] represents the discrete cosine transform coefficient in the frequency domain;

[0055] L is the length of the sequence;

[0056] After the continuous flight data undergoes cosine discrete transformation, the output is a time window with frequency domain characteristics.

[0057] Step 3: Combine the time window with frequency domain features and the time window with time features, and input the obtained time window with frequency domain and time domain features into the self-attention mechanism to obtain instance-level features;

[0058] In this embodiment, step 3 specifically includes:

[0059] The core idea of self-attention mechanism is to calculate the relevance of each element in the input sequence with other elements through three matrices: Q (Query, query matrix, representing the information the current element wants to know), K (Key, key matrix, representing the information the current element can provide), and V (Value, value matrix, representing the actual content carried by each element). The time window with frequency domain and time domain features is generated through three fully connected layers to generate Q, K and V matrices:

[0060] Q = XW Q K = XW K V = XW V

[0061] Where W Q W K W V is a learnable parameter matrix. The attention weight matrix is obtained by the following formula:

[0062]

[0063] Where d K is the dimension of the K vector. Multiply the attention weight matrix with the V matrix to get the weighted output of each time window. Finally, connect with the feedforward neural network (including two fully connected layers and an activation function) to perform nonlinear transformation, and output the instance-level feature;

[0064] Step 4, measure the deviation of the normalized feature from the normal mode feature learned in the training phase;

[0065] In this embodiment, step 4 specifically includes:

[0066] For each instance-level feature T represents the length of the time series, and the calculation formula of the mean and standard deviation is:

[0067]

[0068] Thus, the regularized time series

[0069]

[0070] After preprocessing the regularized data , use anti-instance regularization to restore the original distribution:

[0071]

[0072] Step 5, measure the deviation of the normalized feature from the normal mode feature learned in the training phase;

[0073] Step 6: Summarize the measured deviations, calculate the overall anomaly score for each signal segment, and then use the anomaly score to classify the signal;

[0074] In this embodiment, step 6 specifically includes:

[0075] Signal classification method:

[0076]

[0077] Here, τ is set to 0.1 based on experience.

[0078] To illustrate the technical advantages of the proposed method, we used a raw dataset composed of filtered ADS-B data from 42 different flights to ensure comprehensive coverage of takeoff, cruising, and landing states. During the spoofing attack detection phase, accuracy, precision, recall, and F1-score were used to measure the algorithm's performance. The calculation formulas for each evaluation metric are as follows:

[0079]

[0080] Among them, TP is the number of samples correctly predicted by the model as positive; FP is the case where the model incorrectly predicts the negative class as positive; FN is the case where the model incorrectly predicts the positive class as negative.

[0081] The above performance indicators can accurately represent the training efficiency of the model. During the experiment, the present invention will be compared with three mature deception attack detection models: transformer model, informer model and Dlinear model in four situations: aircraft takeoff, landing, maneuvering and noise. The experiment of the present invention uses Pytorch1.13.1, Python3.7.16 environment, graphics card 2060, running memory is 6G, running memory is small, time window length (patch) is 16, batch size (batch-size) value is reduced to 128, learning rate is 1×10 -5 , the training epoch parameter is set to 10. The performance of the four networks is shown in Table 1:

[0082] Table 1 Experimental results of four networks

[0083]

[0084] Experimental results clearly demonstrate the comparative performance of each baseline model against the proposed model in various scenarios. The proposed model demonstrates superior performance, particularly in complex scenarios such as maneuvering and noise, where spoofing attack detection is more challenging. These results not only demonstrate the numerical superiority of the proposed model but also highlight its practical significance for improving the robustness and reliability of the ADS-B system.

[0085] To better understand the contribution of each component in this invention, we continue to conduct ablation studies, focusing on two key enhancements: anti-instance regularization and discrete cosine transform. The network performance of different configurations in four cases is shown in Table 2:

[0086] Table 2 Ablation experiment results

[0087]

[0088] As can be seen from the table, each enhancement method plays an important role in improving model performance. In deception attack detection, adding instance regularization and discrete cosine transform both help improve prediction accuracy and robustness. Combining the two will achieve the best overall performance in different scenarios.

[0089] The above description is only a preferred embodiment of the present invention and is used to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting ADS-B spoofing attacks based on discrete cosine patch attention mechanism, characterized in that: The following steps are involved: Step 1: Filter and clean the collected ADS-B signal sequences, retaining continuous flight data with time series characteristics for network training; Step 2: Split the continuous flight data into several time windows according to the channel, and use the cosine discrete transform to extract the frequency domain features from the time windows; Step 3: Combine the time window with frequency domain features and the time window with time features, and input the obtained time window with frequency domain and time domain features into the self-attention mechanism to obtain instance-level features; Step 4: Normalize instance-level features using anti-instance regularization; Step 5: Measure the deviation of the normalized features from the normal pattern features learned during the training phase; Step 6: Summarize the measured deviations, calculate the overall anomaly score for each signal segment, and then use the anomaly score to classify the signal; Step 2: dividing the continuous flight data into time windows according to the channels, and extracting frequency domain features from the time windows using cosine discrete transform; including: Step 2.1: Sequence the continuous flight data Where M represents the number of channels, L represents the sequence length, and the time window is divided according to the channel; each channel sequence Where i = 0, 1, 2, ..., M; Through the transformer model, the transformed sequence Where i=0,1,2,…,M; then connect them in series Output is a time window with time characteristics; Step 2.2: From the signal perspective, the cosine discrete transform of a given sequence x[l] of length L is defined as follows: Where k = 0, 1, 2, ..., L-1; x[l] is the input time domain signal; X[k] represents the discrete cosine transform coefficient in the frequency domain; L is the length of the sequence; After the continuous flight data undergoes cosine discrete transformation, the output is a time window with frequency domain characteristics.

2. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: The continuous flight data with time series characteristics in step 1 is divided into: training set; validation set and test set.

3. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: The key parameters used for network training include latitude, longitude, altitude, speed, and the corresponding x and y values ​​calculated from the center of the Earth.

4. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: The calculation formula of the self-attention mechanism in step 3 is as follows: Among them, d K is the dimension of the K vector, Q, K, and V represent three matrices, each of which is a fully connected network or a convolutional layer with a kernel size of 1, which obtains the instance-level features output by the self-attention mechanism.

5. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: The mathematical definitions of regularization and anti-instance regularization described in step 4 are as follows: For each instance-level feature T represents the length of the time series, and the calculation formulas for the mean and standard deviation are: Thus, the regularized time series is obtained Regularized data After preprocessing, anti-instance regularization is used to restore the original distribution:

6. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: Signal classification in step 6:

7. The ADS-B spoofing attack detection method based on discrete cosine patch attention mechanism according to claim 1 is characterized in that: In model testing and result analysis, four indicators are selected to evaluate model performance: accuracy, precision, recall and F1 score.

Images