Aircraft anomaly detection method based on adaptive parameter DBSCAN

Abstract

The invention discloses an aircraft anomaly detection method based on adaptive parameter DBSCAN, and the method comprises the steps: processing the latitude, longitude, height and speed data of an aircraft through Z-score standardization, and generating an eps-list through a distance matrix; optimizing an eps value in the eps-list by using a binary search optimization method, and taking a minpt value corresponding to the eps value as an adaptive parameter; a K-means algorithm is used to establish a candidate eps-list; clustering is carried out through a DBSCAN algorithm; and detecting abnormity by using a clustering result, identifying noise points and analyzing the characteristics of the noise points. According to the method, algorithm parameters can be automatically determined without human intervention, the accuracy and robustness of clustering are directly improved, high response speed can be kept when large-scale aircraft data are processed, abnormal conditions in the flight state can be recognized more accurately, and the efficiency and reliability of flight safety monitoring are improved.

Description

Technical Field

[0001] The present invention belongs to the field of pattern recognition technology, and further relates to an aircraft anomaly detection method based on an adaptive parameter density clustering algorithm (Density-Based Spatial Clustering of Applications with Noise, referred to as DBSCAN) in the field of aircraft anomaly detection technology. The present invention can automatically detect and warn of abnormal aircraft behaviors through relevant data analysis of abnormal aircraft individuals, thereby ensuring aviation safety. Background Art

[0002] As global air traffic continues to grow, the complexity of air traffic management is also increasing. In order to ensure aviation safety, real-time monitoring and anomaly detection of aircraft have become crucial. At present, the Automatic Dependent Surveillance–Broadcast (ADS-B) system is used worldwide to achieve real-time monitoring of aircraft. The data can provide key information such as the location, altitude, and speed of the aircraft, providing important support for air traffic control and flight safety. However, with the surge in the number of aircraft, how to effectively identify abnormal behavior of aircraft from the huge ADS-B data has become a difficult problem that needs to be solved urgently. Traditional rule-based methods often rely on manually set thresholds, cannot effectively deal with various complex flight situations, and are prone to false alarms or missed alarms.

[0003] In the detection of aircraft state anomaly, commonly used algorithms include statistical methods, machine learning methods, and deep learning methods. Among them, the density-based spatial clustering algorithm (DBSCAN) is widely used because it can effectively process noisy data sets. The DBSCAN algorithm can find clusters of any shape and does not need to pre-specify the number of clusters, which gives it certain advantages in processing aircraft state data. However, especially when applied to the real-time flight state anomaly detection of aircraft, the traditional DBSCAN algorithm has the following problems: parameter sensitivity and low efficiency in processing large-scale data. To address the above problems, an adaptive density DBSCAN algorithm is proposed. The algorithm dynamically adjusts parameters by introducing an adaptive mechanism, so that the algorithm can automatically adjust its parameter settings according to the actual distribution characteristics of the data, so as to better adapt to the data characteristics of the aircraft under different flight states. In addition, the algorithm also optimizes the data processing process, improves the processing efficiency of large-scale data sets, and ensures the real-time and accuracy of anomaly detection. The application of the adaptive density DBSCAN algorithm not only improves the performance of the aircraft state monitoring system, but also provides new ideas and technical support for large-scale data anomaly detection in other fields.

[0004] The Civil Aviation University of China disclosed an aircraft anomaly detection method for airspace traffic flow clustering based on an improved K-means algorithm in its patent application document "Airspace Traffic Flow Clustering Method Based on Improved K-means Algorithm" (application number: CN 202410497259.5, application publication number: CN 118098025 A, application date: April 24, 2024). The implementation steps of this method include: obtaining flight data of all aircraft in the sector; standardizing the aircraft flight data; clustering analysis of airspace aircraft based on the standardized flight data, wherein the flight data includes the horizontal and vertical coordinates, altitude and heading of the aircraft. This method reduces the complexity of air traffic and the load of controllers, proposes an improved k-means algorithm, optimizes the heading and altitude division, improves the clustering accuracy, and introduces the GapStatistic method to automatically determine the number of clusters. However, this method still has some shortcomings: for real-time flight status anomaly detection, the K-means algorithm is slow in processing speed; a large number of reference data sets need to be generated and multiple clustering is performed, which takes a long time to calculate, which is a limiting factor for flight status anomaly detection that requires real-time processing, especially in scenarios with large data volumes or high real-time requirements; users are required to manually adjust other parameters, such as the initial value of the cluster center, the heading and altitude division criteria, etc., which increases the complexity of use.

[0005] Wu Xinpeng published a paper titled "Mining Abnormal Flight Behavior Based on Density Clustering and Matching Algorithm" (Journal of Nanjing University of Aeronautics and Astronautics, Chinese Library Classification Number: V328, Document Code: A, Article Number: 1005-2615 (2021) 06-0863-09, Published in December 2021) that discloses an aircraft anomaly detection method based on a density clustering method (LOFDBSC-SDH) that considers speed, direction and altitude with improved local anomaly factors. The implementation steps of this method include: improving the DBSCAN method using altitude layer division strategy, local anomaly factors and fast cover tree, and proposing a LOFDBSC-SDH density clustering algorithm to quickly and accurately extract normal track patterns. Then, based on the normal track pattern, a track matching algorithm that considers the passing time and the above-mentioned abnormal features is designed to mine abnormal flight behavior. This method can assist controllers in making deployment decisions, which is of great significance to improving the efficiency of air traffic management. However, this method still has some shortcomings: under severe weather conditions, the flight status of the aircraft will be greatly affected, causing the boundary between normal flight mode and abnormal flight mode to become blurred, thus affecting the accuracy of anomaly detection; the parameter density threshold still needs to be set based on experience, which means that users need to have a certain understanding of the algorithm and be able to adjust parameters according to specific data sets and application scenarios, which increases the complexity of use and the time complexity of the algorithm.

[0006] Liu Jixin published a method for identifying aircraft anomalies in the terminal area based on density peak track clustering in his paper "Track Clustering and Anomaly Identification in Terminal Area Based on Density Peak" (Journal of Transportation Engineering, Chinese Library Classification Number: V355. Document Code: A, Article Number: 1671-1637 (2021) 05-0214-13, Publication Time: October 2021). The implementation steps of the method include: using widely recorded automatic dependent surveillance-broadcast (ADS-B) data, constructing a density-based similarity matrix, clustering the data using a spectral clustering algorithm, selecting cluster centers of flight modes with different densities by silhouette coefficients, and identifying abnormal tracks by adjusting edge density parameters. The method can provide a data extraction platform for airspace-level traffic flow performance evaluation and flight-level track prediction and optimization, which is of great significance to improving track clustering performance. However, the method still has the disadvantage that the flight state of the aircraft is dynamically changing, and the method may not be flexible enough when dealing with rapidly changing flight states. For example, an aircraft may suddenly change its track due to an unexpected event, and this method cannot identify such changes in a timely manner; the silhouette coefficient is used to select the cluster center of flight modes with different densities, and the edge density parameters are adjusted to identify abnormal trajectories. However, in actual operation, the adjustment of these parameters needs to rely on professional knowledge and experience, which increases the complexity of use.

[0007] In summary, the existing technology for detecting abnormal flight status of aircraft in real time has the following four shortcomings:

[0008] 1. Difficulty in parameter selection: Users are required to manually adjust other parameters, such as the initial value of the cluster center, the heading and altitude division criteria, etc. The adjustment of parameters requires professional knowledge and experience, which increases the complexity of use;

[0009] 2. Insufficient real-time performance: The flight state of an aircraft changes dynamically, and existing methods are not flexible enough to handle rapidly changing flight states. For example, an aircraft may suddenly change its trajectory due to an emergency, and existing methods cannot identify such changes in a timely manner;

[0010] 3. Many existing methods are based on the assumption of a specific type of data distribution, such as Gaussian distribution. However, in actual aircraft flight data, the distribution of data may be more complex and does not follow a simple statistical model. This results in the inability of existing methods to work effectively when faced with data sets with different density distributions, and additional preprocessing steps are required to adapt the data distribution.

[0011] 4. High computational complexity: The algorithm used for anomaly detection has high computational complexity and low operating efficiency. Summary of the invention

[0012] The purpose of the present invention is to address the deficiencies in the above-mentioned prior art and propose an aircraft anomaly detection method based on adaptive parameter DBSCAN to solve the problems of the prior art such as difficulty in manually inputting cluster center parameters, poor real-time performance, inability to adapt to anomaly detection of data with different density distributions, and low computational efficiency.

[0013] The technical idea for achieving the purpose of the present invention is: the present invention uses the anomaly detection of the DBSCAN clustering algorithm as the algorithm core, and attempts to solve the defects and deficiencies of the current technology in real-time aircraft anomaly detection. The binary search algorithm adopted by the present invention determines the initial stable area when the number of clusters does not change in the clustering results of three consecutive attempts, and sets it as the initial search interval. The binary search is performed in the interval, and the middle eps value of the interval is selected as the candidate value for testing each time. The clustering effect corresponding to each candidate eps value is evaluated by using the DBSCAN implementation with a cache mechanism. If the number of clusters is equal to or very close to the number of stable clusters, the binary search is continued in the current interval; otherwise, the search interval is adjusted according to the clustering results, and the above-mentioned iteration and adjustment steps of the search interval are repeated until the eps value that can produce the closest or equal number of stable clusters is found, which effectively reduces the memory usage and consumption, and improves the computational efficiency of DBSCAN, thereby solving the problem of low computational efficiency of anomaly detection in the prior art, and also solving the problem of deterioration of clustering quality due to the given global parameters of the DBSCAN algorithm. The adaptive algorithm used in the present invention determines parameters, performs Z-score standardization on the four-dimensional data of latitude, longitude, altitude and speed in the aircraft data set, calculates the Euclidean distance between any two aircraft, constructs a distance matrix, and uses the matrix to calculate the average h nearest neighbor distance and stores it in eps-list. Then, minpts-list is formed based on eps-list. By setting the number of balancing times to 3 times, when the number of clusters does not change in three consecutive clustering results, a preliminary stable area is determined, and the eps value is further optimized by a binary search method, and the search interval is repeatedly halved until the eps value closest to or equal to the number of stable clusters is found, the optimal eps value and the corresponding minpts value are determined, and the minpts value is used as the parameter k required for the next step, that is, the h value in the distance from each aircraft to the hth nearest neighbor to be extracted, thereby solving the problem of the difficulty of manually inputting the initial value of the cluster center, the division standard of the heading and the altitude in the prior art. The present invention uses K-means to determine candidate eps-lists, dynamically adjusts the selection range of eps values ​​in eps_list according to the distribution characteristics of data, and in addition, uses the eps values ​​obtained by binary search optimization to calculate the corresponding minpts value as the parameter k required for the next step, dynamically adjusts the parameter force according to the characteristics of the aircraft data set, and finds the eps value closest to or equal to the number of stable clusters through the optimization process as the final optimized eps value to adapt to the changes of the aircraft, better adapt to the dynamically changing flight state of the aircraft, and improve the real-time performance of anomaly detection, thereby solving the problem that the existing technology has insufficient requirements for real-time performance and cannot flexibly handle the rapidly changing flight state.

[0014] The technical solution for achieving the purpose of the present invention is:

[0015] Step 1, generate eps-list;

[0016] Step 2, use the binary search optimization method to optimize the eps value in eps-list, and use the minpts value corresponding to the optimal eps value found in minpts-list as the adaptive parameter;

[0017] Step 3, use K-means algorithm to create candidate eps-list;

[0018] Step 4, perform DBSCAN clustering based on the candidate eps-list;

[0019] Step 5: Detect anomalies based on clustering results.

[0020] Compared with the prior art, the present invention has the following advantages:

[0021] First, the adaptive algorithm adopted in the present invention determines the parameters and adaptively calculates the corresponding minpts value as the parameter k required for the next step according to the statistical characteristics of the data, thereby overcoming the difficulty of manually inputting parameters such as the initial value of the cluster center, the heading and altitude division criteria in the prior art. The present invention can automatically determine the algorithm parameters without human intervention, directly improve the accuracy and robustness of clustering, and thus improve the accuracy of aircraft anomaly detection.

[0022] 2. The binary search optimization method adopted by the present invention, when the number of clusters does not change in the clustering results of three consecutive attempts, takes this range as the initial search interval, and after determining the preliminary stable area as the search range, uses the binary search method to further optimize the eps value in eps-list. Binary search is an efficient search algorithm, which quickly locates the target value by repeatedly halving the search interval, effectively reduces memory usage and consumption, improves the computational efficiency of DBSCAN, overcomes the problem of low computational efficiency of anomaly detection in the prior art, and solves the problem of deterioration of clustering quality due to given global parameters of the DBSCAN algorithm, so that the present invention can directly process large-scale aircraft data sets, and is directly applicable to aircraft data sets with no obvious differences in cluster density.

[0023] 3. The present invention dynamically adjusts parameters according to real-time changes in data, uses the K-means algorithm to establish a candidate eps-list, and dynamically adjusts the selection range of the eps value according to the distribution characteristics of the data. In addition, the binary search optimization method is used to optimize the eps value in the eps-list, and the parameters are dynamically adjusted according to the characteristics of the data set. Through the optimization process, the eps value closest to or equal to the number of stable clusters is found as the final optimized eps value, thereby more accurately reflecting the internal structure of the data and better adapting to the dynamically changing flight state of the aircraft. In addition, these values ​​are applied to the DBSCAN algorithm to cluster the flight state data and perform anomaly detection. Through further analysis of these noise points, potential safety hazards or operational errors are identified, thereby overcoming the problems in the prior art and improving the real-time performance of anomaly detection. The problems in the prior art that the real-time requirements are insufficient, the rapidly changing flight state cannot be flexibly processed, the anomaly detection accuracy is low, and it is difficult to adapt to data sets with different density distributions are overcome, so that the present invention can directly meet the needs of real-time flight state anomaly detection, more accurately identify abnormal situations in the flight state, and improve the efficiency and reliability of flight safety monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 The present invention is a flowchart of the method. DETAILED DESCRIPTION

[0025] The following is combined with Figure 1 The specific implementation steps of the embodiments of the present invention are further described in detail.

[0026] Step 1, generate eps-list.

[0027] Step 1.1, in the embodiment of the present invention, an ADS-B data set is selected, which contains relevant data of 1,000 aircraft, and the data of each aircraft contains four dimensions: latitude, longitude, altitude, and speed. The Z-score standardization method is used to process the four dimensional data of latitude, longitude, altitude, and speed respectively, so that the mean value of each dimension is 0 and the standard deviation is 1.

[0028] Step 1.2, based on the standardized latitude, longitude, altitude, and speed data, calculate the Euclidean distance between any two aircraft according to the following formula:

[0029]

[0030] Among them, d ij represents the Euclidean distance between the i-th aircraft and the j-th aircraft, x ik 、x jkThey represent the coordinates of the ith aircraft and the jth aircraft in the kth dimension respectively, and k=1, 2, 3, 4 represent the four dimensions of latitude, longitude, altitude, and speed respectively.

[0031] Step 1.3, construct a distance matrix D composed of the Euclidean distances of all aircraft. The distance matrix D in the embodiment of the present invention has a dimension of 1000×1000.

[0032] Step 1.4, sort each row of the distance matrix D in ascending order according to its Euclidean distance value to generate a sorted matrix D′. This step helps to determine the relationship between each aircraft and its nearest neighbor later.

[0033] Step 1.5, each row in the matrix D′ contains only one non-zero element, which represents the distance between aircraft. The gth non-zero element in each row is defined as the distance from the aircraft represented by the row to its hth nearest neighbor. Specifically, for each row m, extract D′ m [1], that is, extract the first non-zero element, which is the second element, because the first element is 0, indicating the distance to itself) represents the distance from the m aircraft to its nearest neighbor. Extract D′ m [2], that is, extract the second non-zero element (i.e., the third element) to represent the distance from the m aircraft to its second nearest neighbor.

[0034] Step 1.6, for each row m, extract the gth non-zero element, which is the distance from the mth aircraft to its hth nearest neighbor. Then, sum the hth nearest neighbor distances of all rows and divide by the total number of aircraft n to get the average hth nearest neighbor distance.

[0035] Step 1.7, store the calculated average h nearest neighbor distance in a new list eps_list, which contains the eps value of each aircraft. eps-list[g] represents the g-th non-zero element in eps-list, which is its h-th nearest neighbor distance. For the dataset of 1000 aircraft, the length of eps-list is also 1000.

[0036] Step 2: Optimize the eps value based on eps-list binary search.

[0037] Step 2.1, based on the sorted distance matrix D′ and eps-list calculated previously, for each aircraft, check its distance to all other aircraft. If the distance is less than or equal to the eps value of the aircraft, the aircraft is considered to be a neighbor of the current aircraft, and the number of neighbors that meet the conditions is counted, and the number of neighbors of each aircraft is calculated.

[0038] Step 2.2, divide the number of neighbors of each aircraft by the total number of aircraft to get an average value. In order to meet the actual application requirements, this average value is rounded to generate an integer as the minpts value. In this way, a corresponding minpts value is generated for each eps value, forming a minpts-list. For the case where the eps value is 0.5, the minpts value is 0.15, and the minpts value after rounding is 0.15.

[0039] Step 2.3, the number of balancing is set based on the size of the aircraft data set to enable the algorithm to robustly identify aircraft groups and avoid over-segmentation or under-segmentation. The determination of the number of balancing follows the rule: when the number of samples contained in the aircraft data set is less than or equal to 1000, the number of balancing is set to 3 times; when the number of samples contained in the aircraft data set is between 1000 and 3000, the number of balancing is set to 4 times; when the number of samples contained in the aircraft data set is between 3000 and 5000, the number of balancing is set to 5 times; when the number of samples contained in the aircraft data set exceeds 5000, the number of balancing is set to 6 times. Through the above steps, it is ensured that the algorithm can more robustly identify the natural cluster structure in the aircraft data set and avoid over-segmentation or under-segmentation caused by improper parameter selection.

[0040] In the embodiment of the present invention, since the data set contains 1000 aircrafts, the number of balancing times N is set to 3 times.

[0041] The number of balancing times refers to the number of times the eps value in eps-list and the corresponding minpts value are input into DBSCAN for clustering, and the number of clusters remains unchanged.

[0042] The reason for setting the number of balancing times is that based on the balancing times obtained from experiments and analysis of the aircraft data set, the eps value in eps-list and the corresponding minpts value are input into DBSCAN for clustering. It is found that when the number of consecutive k clustering results does not change, it means that the algorithm has converged to a relatively stable solution and it is considered to have reached a stable state.

[0043] Step 2.4, when the number of clustering results does not change for three consecutive times, it enters the preliminary stable region. After that, the binary search method is used to further narrow the selection range of eps values, iteratively try different eps values ​​in eps-list, and use DBSCAN with a cache mechanism to evaluate the clustering effect corresponding to each eps value. Specifically, the clustering results of each attempt are recorded, including the number and structure of clusters. If the number of clusters generated by multiple consecutive eps values ​​remains unchanged, it is considered that a stable number of clusters has been found, and the eps value at this time is recorded.

[0044] The steps of optimizing the EPS value by binary search in the embodiment of the present invention are as follows:

[0045] The first step is to determine the initial stable area.

[0046] When the number of clusters does not change in the clustering results of three consecutive attempts, the algorithm is considered to have entered a preliminary stable region. It is found that when the eps value is between 0.45 and 0.55, the clustering results are relatively stable. Therefore, this range is used as the initial search interval, that is, [0.45, 0.55].

[0047] The second step is to set the initial search range.

[0048] Determine the preliminary stable region [0.45, 0.55] as the search range, and the initial search interval is [0.45, 0.55].

[0049] The third step is to perform a binary search and record the results.

[0050] Perform a binary search in the set initial search interval [0.45, 0.55], and select the middle eps value of the interval as the candidate value for testing each time. Use DBSCAN with a cache mechanism to evaluate the clustering effect corresponding to each candidate eps value and record the results. The specific steps are as follows:

[0051] First iteration: Select the middle value 0.50 of the initial search interval [0.45, 0.55] as the candidate eps value for clustering. Use DBSCAN with a cache mechanism to record the number of clusters corresponding to each candidate eps value. If the number of clusters in the clustering result is equal to or very close to the number of stable clusters, continue to perform binary search in the current interval. Otherwise, adjust the search interval according to the clustering result.

[0052] Adjust the search interval: If the number of clusters in the clustering result is greater than the number of stable clusters: it means that the current eps value is too large and needs to be reduced. Therefore, adjust the search interval to the left half of the current interval, that is, [0.45, 0.50]; If the number of clusters in the clustering result is less than the number of stable clusters: it means that the current eps value is too small and needs to be increased. Therefore, adjust the search interval to the right half of the current interval, that is, [0.50, 0.55]; If the number of clusters in the clustering result is equal to or very close to the number of stable clusters: continue to perform binary search in the current interval until the optimal eps value is found, that is, the eps value closest to or equal to the number of stable clusters is generated.

[0053] Repeat the above steps of iterating and adjusting the search interval: after each iteration, update the search interval until you find the eps value that is closest to or equal to the number of stable clusters.

[0054] Step 3: Determine the adaptive parameters.

[0055] The optimal EPS value is found in the preliminary stable region [0.45, 0.55] through the binary search method. The optimal EPS value is determined to be 0.52, and the corresponding minpts value is 152. This minpts value will be used as the adaptive parameter k=152 required for the next step, that is, the h value in the distance from each aircraft to the hth neighbor is 152.

[0056] Step 4: Use K-means to determine the candidate eps-list.

[0057] Step 4.1, extract the distance from each aircraft to its 152nd nearest neighbor, collect these distance values ​​into a list, and draw a frequency histogram to show the frequency of occurrence of different distance values.

[0058] Step 4.2, the histogram is smoothed by a 5-point moving average. Peaks are automatically detected on the smoothed histogram. The peaks of the distance frequency histogram indicate high-density areas in the aircraft data set. The number of cluster centers N required by the K-means algorithm is estimated by counting the number of significant peaks in the histogram. Based on this list, a frequency histogram is plotted and three significant peaks are observed.

[0059] Assume that P = {p1, p1, p3} is all the peak points in the histogram, then the number of cluster centers of the K-means algorithm is 3, which is the number of significant peak points in the histogram.

[0060] Step 4.3, divide the aircraft data set into three clusters. The cluster centers returned by the K-means algorithm are C = {c1, c2, c3}. For each cluster center c i , calculate the distance d from the center point to its farthest aircraft max (c i ), which are 0.38, 0.52, and 0.67 respectively:

[0061]

[0062] Among them, C i represents all points in the i-th cluster, ||xc i || represents point x and cluster center c i The Euclidean distance between .

[0063] Step 4.4, take the distance from each cluster center to its farthest aircraft as the candidate eps value. Arrange the extracted eps values ​​in ascending order to form a candidate eps-list. eps-list = [0.38, 0.52, 0.67].

[0064] Step 5: Perform DBSCAN clustering based on the candidate eps-list.

[0065] Step 5.1, input the aircraft data, the eps values ​​in the candidate eps-list and the corresponding minpts values ​​into the DBSCAN algorithm for clustering. Use eps=0.38, 0.52, 0.67 and the corresponding minpts as parameters to perform DBSCAN clustering on the aircraft data.

[0066] Step 5.2, after clustering is completed, save the clustered data and mark these aircraft data points to prevent them from being clustered again in the next cycle. This ensures that each aircraft data point is clustered only once to avoid repeated calculations.

[0067] Step 5.3, repeat the above steps 5.1 and 5.2. When all the eps values ​​in the candidate eps-list are used up, the clustering is completed.

[0068] Step 6: Detect anomalies based on the clustering results.

[0069] Step 6.1, when the entire clustering process is completed, check the cluster label of each aircraft. Aircraft with a cluster label of -1 are considered noise points. Noise points are usually located in sparse areas of the aircraft dataset, where the number of aircraft is small and insufficient to form effective clusters.

[0070] Step 6.2: After identifying the noise points, further analysis is needed to understand their specific characteristics and potential problems. By analyzing the location and attributes of the noise points, it is found that the noise points are mainly concentrated in areas with large deviations from the flight path. There are abnormal values ​​in the speed, height and other attributes of the noise points. These abnormal values ​​indicate abnormal flight status of the aircraft, such as deviation from the scheduled route, abnormal speed changes, etc.

[0071] The effect of the present invention can be further demonstrated through the following simulation experiments.

[0072] 1. Simulation experimental conditions.

[0073] The software platform for the simulation experiment of the present invention is: Windows 10 operating system and Python 3.8.

[0074] The data used in the simulation experiment of the present invention is a real flight data set obtained from the aircraft monitoring system, which includes data under normal flight conditions and data under known abnormal conditions. The data set contains multiple features, such as flight altitude, speed, acceleration, etc., with a total sample size of 10,000. The Z-score standardization method is used to process the four dimensional data of latitude, longitude, altitude, and speed respectively, so that the mean of each dimension is 0 and the standard deviation is 1.

[0075] 2. Analysis of simulation content and results.

[0076] The present invention has two simulation experiments, which respectively evaluate the time performance and clustering quality of the algorithm.

[0077] 2.1,Simulation Experiment 1,Simulation of the time performance of the algorithm.

[0078] The simulation experiment 1 of the present invention adopts the method of the present invention, calculates the Euclidean distance between aircraft, constructs a distance matrix, and calculates the nearest neighbor distance of each row and each element to obtain the average nearest neighbor distance of the element, forms an eps-list, and determines the preliminary stable area. Set the initial search interval, perform the binary search method, and record the clustering results of each attempt until the optimal eps value is found. According to the optimized eps value, calculate the corresponding minpts value to form an adaptive parameter. Calculate the adaptive parameters through 100 rounds of experiments, and record the time of each calculation to obtain the average adaptive duration. The average adaptive duration is used to evaluate the efficiency of the adaptive parameter algorithm, and the average adaptive duration of the simulation experiment 1 of the present invention is 1.95 seconds, indicating that the algorithm has a high efficiency in calculating the adaptive parameters, and it can maintain a high response speed when processing large-scale aircraft data.

[0079] 2.2,Simulation Experiment 2 is a simulation of clustering quality.

[0080] Simulation experiment 2 of the present invention adopts the method of simulation experiment 1 of the present invention to generate eps-list and perform binary search to optimize eps value, and then use the optimized eps value and minpts value to perform DBSCAN clustering. The clustering results are evaluated by using the silhouette coefficient (Silhouette Coefficient) clustering quality evaluation index, and the silhouette coefficient is calculated for the clustering results of each round of experiments. After recording the adjusted Rand Index (ARI), adjusted mutual information (AMI) and V-measure (V-Measure) scores of 100 experiments, the following formula is used for calculation, and all calculation results are plotted into Table 1.

[0081]

[0082] Among them, a represents the number of aircraft that belong to the same class in both real and experimental situations, b represents the number of aircraft that belong to the same class in real situations but do not belong to the same class in the experimental situation, c represents the number of aircraft that do not belong to the same class in real situations but belong to the same class in the experimental situation, and d represents the number of aircraft that do not belong to the same class in both real and experimental situations.

[0083] The value range of ARI is [-1, 1]. The larger the value, the more consistent it is with the actual result, that is, the better the clustering effect;

[0084]

[0085] Among them, U and V represent two different clustering results, MI(U,V) represents the mutual information between U and V, E(MI(U,V)) represents the expected value of the mutual information, and H(U) and H(V) represent the entropy of U and V. The value range of AMI is from 0 to 1, and the higher the value, the higher the similarity between the two clustering results.

[0086]

[0087]

[0088] Among them, homogeneity means that if a given cluster contains only aircraft of one category, it is considered homogeneous; completeness means that if all aircraft of a given category are assigned to the same cluster, it is considered complete. dc represents the number of aircraft belonging to both category d and category c, n d and n c They represent the number of aircraft in category d and category c respectively. The value range of V-Measure is also from 0 to 1. The larger the value, the better the clustering effect.

[0089] Table 1. Quantitative analysis table of the present invention in simulation experiment

[0090]

[0091] It can be seen from Table 1 that all average coefficient scores of the present invention are higher than 0.8, indicating that the clustering results have good quality and separability, thus proving the effectiveness and reliability of the present invention in flight status anomaly detection.

[0092] The above simulation experiments show that the method of the present invention adaptively calculates the corresponding minpts value as the parameter k required for the next step according to the statistical characteristics of the data, and automatically determines the algorithm parameters without human intervention. The binary search method is used to further optimize the eps value, effectively reduce the memory usage and calculation time, and improve the calculation efficiency of DBSCAN. The parameters are dynamically adjusted according to the real-time changes of the data, and the candidate eps-list is determined by K-means. The selection range of the eps value is dynamically adjusted according to the distribution characteristics of the data, and the eps value closest to or equal to the number of stable clusters is found through the optimization process as the final optimized eps value, which more accurately reflects the inherent structure of the data and better adapts to the dynamically changing flight state of the aircraft. It can be seen that the present invention solves the problems of the prior art of manual input of cluster center parameters, poor real-time performance, inability to adapt to abnormal detection of data with different density distributions, and low calculation efficiency. It is proved that the method of the present invention can maintain a high response speed when processing large-scale aircraft data, and also proves the effectiveness and reliability of the present invention in abnormal detection of flight status.

Claims

1. An aircraft anomaly detection method based on adaptive parameter DBSCAN, characterized in that: The adaptive parameters are determined by using the binary search optimization method, and the candidate eps-list is established using the K-means algorithm. The abnormality detection of the aircraft is performed by DBSCAN clustering of the candidate eps-list. The steps of the detection method include the following: Step 1, generate eps-list; Step 2, use the binary search optimization method to optimize the eps value in eps-list, and use the minpts value corresponding to the optimal eps value found in minpts-list as the adaptive parameter; Step 3, use K-means algorithm to build candidate eps-list; Step 4, perform DBSCAN clustering based on the candidate eps-list; Step 5: Detect anomalies based on clustering results.

2. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that: The steps to generate eps-list described in step 1 are as follows: The first step is to generate a data set containing at least 1,000 aircraft. The data of each aircraft contains four dimensions: latitude, longitude, altitude, and speed. The Z-score standardization method is used to process the four dimensions of latitude, longitude, altitude, and speed respectively, so that the mean value of each dimension is 0 and the standard deviation is 1. The second step is to calculate the Euclidean distance between two aircraft according to the following formula: Among them, d ij represents the Euclidean distance between the i-th aircraft and the j-th aircraft, x ik 、x jk Respectively represent the coordinates of the i-th aircraft and the j-th aircraft in the k-th dimension, k = 1, 2, 3, 4 represent the four dimensions of latitude, longitude, altitude, and speed respectively; The third step is to form a distance matrix D composed of all Euclidean distances; Step 4: Sort each row of the distance matrix D in ascending order according to its Euclidean distance value to generate a sorted matrix D′. Each row in the matrix D′ contains only one non-zero element, which is used to represent the distance between aircraft. The gth non-zero element of each row is defined as the distance from the aircraft represented by the row to its hth nearest neighbor. The fifth step is to sum up all the nearest neighbor distances of each row and divide it by the total number of aircraft to get the average nearest neighbor distance of the row; all the nearest neighbor distances are combined into a list eps-list, which contains the eps value of each aircraft.

3. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that: The steps to optimize the eps value in eps-list using the binary search optimization method described in step 2 are as follows: The first step is to set the initial search interval according to the preliminary stable region: when the number of clusters does not change in the clustering results of multiple consecutive attempts, it is considered that the algorithm has entered a preliminary stable region and the preliminary stable region is used as the search range; The second step is to perform the binary search optimization method and record the results: In the first search, the middle value of the initial search interval is selected as the candidate EPS value for clustering, and the number of clusters corresponding to each candidate EPS value is recorded; if the number of clusters in the clustering result is equal to or very close to the number of stable clusters, continue to perform binary search in the current interval, otherwise, adjust the search interval and execute the third step; In the third step, the same method as the first search is used to find the EPS value that can produce the closest or equal number of stable clusters within the update search interval.

4. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 3 is characterized in that: The number of clusters in the clustering results of the consecutive multiple attempts not changing refers to the number of times that the eps value in eps-list is clustered with the corresponding minpts value and the number of clusters remains unchanged.

5. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 3, characterized in that: The adjustment of the search interval means that if the number of clusters in the clustering result is greater than the number of stable clusters, it means that the current EPS value is too large, and the EPS value needs to be reduced, and the search interval is adjusted to the left half of the current interval; if the number of clusters in the clustering result is less than the number of stable clusters, it means that the current EPS value is too small, and the EPS value needs to be increased, and the search interval is adjusted to the right half of the current interval.

6. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that: The minpts-list described in step 2 means that the number of neighbors of each aircraft is divided by the total number of aircraft to obtain an average value, the minpts value is obtained by rounding the average value, and the minpts values ​​generated by all eps values ​​form a minpts-list.

7. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that: The steps to create a candidate eps-list using the K-means algorithm described in step 3 are as follows: The first step is to estimate the number of cluster centers required by the K-means algorithm through the number of significant peaks in the frequency histogram; The second step is to calculate the distance from each cluster center to its farthest aircraft according to the following formula: Among them, d max (c i ) represents the i-th cluster center point C i The distance to its farthest aircraft, ||xc i || represents the xth aircraft point and the i-th cluster center point C i The Euclidean distance of In the third step, the distance from each cluster center to its farthest aircraft is used as a candidate EPS value, and all candidate EPS values ​​are arranged in ascending order to form a candidate EPS-list.

8. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 7, characterized in that: The DBSCAN clustering based on the candidate eps-list described in step 4 refers to inputting the aircraft data, the eps value in the candidate eps-list and the corresponding minpts value into the DBSCAN algorithm to perform DBSCAN clustering on the aircraft data.

9. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that: The steps for detecting anomalies based on clustering results described in step 5 are as follows: The first step is to check the cluster label of each aircraft. If the cluster label is -1, the aircraft is considered as a noise point. In the second step, by analyzing the location and attributes of the noise points, if the noise points are concentrated in the area where the flight path deviates greatly, it is determined that there are abnormal values ​​in the speed and altitude attributes of the noise points. These abnormal values ​​indicate that the aircraft has deviated from the planned route and has an abnormal flight state with abnormal speed changes.

Images