Aircraft Anomaly Detection Method Based on Adaptive Parameter DBSCAN

Abstract

This invention discloses an aircraft anomaly detection method based on adaptive parameter DBSCAN. The implementation scheme involves: standardizing the latitude, longitude, altitude, and speed data of the aircraft using Z-scores; generating an eps-list using a distance matrix; optimizing the eps values ​​in the eps-list using a binary search optimization method, and using the corresponding minpts values ​​as adaptive parameters; constructing a candidate eps-list using the K-means algorithm; performing clustering using the DBSCAN algorithm; and detecting anomalies using the clustering results, identifying noise points, and analyzing their characteristics. This invention automatically determines the algorithm parameters without human intervention, directly improving the accuracy and robustness of clustering. It maintains a high response speed when processing large-scale aircraft data, and can more accurately identify anomalies in flight conditions, improving the efficiency and reliability of flight safety monitoring.

Description

Technical Field

[0001] This invention belongs to the field of pattern recognition technology, and further relates to an aircraft anomaly detection method based on the adaptive parameter density clustering algorithm (Density-Based Spatial Clustering of Applications with Noise, abbreviated as DBSCAN) in the field of aircraft anomaly detection technology. This invention can achieve automatic detection and alarm of abnormal aircraft behavior through the analysis of relevant data of individual abnormal aircraft, thereby ensuring aviation safety. Background Technology

[0002] With the continuous growth of global air traffic, the complexity of air traffic management is also increasing. To ensure aviation safety, real-time monitoring and anomaly detection of aircraft have become crucial. Currently, Automatic Dependent Surveillance-Broadcast (ADS-B) systems are used globally for real-time aircraft monitoring. The data provides critical information such as aircraft position, altitude, and speed, offering vital support for air traffic control and flight safety. However, with the surge in the number of aircraft, effectively identifying abnormal aircraft behavior from the massive amounts of ADS-B data has become a pressing challenge. Traditional rule-based methods often rely on manually set thresholds, which are ineffective in handling various complex flight situations and are prone to false alarms or missed detections.

[0003] In aircraft condition anomaly detection, commonly used algorithms include statistical methods, machine learning methods, and deep learning methods. Among them, density-based spatial clustering of applications with noise (DBSCAN) is widely used due to its ability to effectively handle noisy datasets. DBSCAN can discover clusters of arbitrary shapes and does not require pre-specifying the number of clusters, giving it an advantage in processing aircraft condition data. However, especially when applied to real-time aircraft flight condition anomaly detection, traditional DBSCAN algorithms suffer from problems such as parameter sensitivity and low efficiency in processing large-scale data. To address these issues, an adaptive density DBSCAN algorithm is proposed. This algorithm introduces an adaptive mechanism to dynamically adjust parameters, enabling it to automatically adjust its parameter settings according to the actual distribution characteristics of the data, thus better adapting to the data characteristics of the aircraft under different flight states. Furthermore, this algorithm optimizes the data processing flow, improving the efficiency of processing large-scale datasets and ensuring the real-time performance and accuracy of anomaly detection. The application of the adaptive density DBSCAN algorithm not only improves the performance of aircraft condition monitoring systems but also provides new ideas and technical support for large-scale data anomaly detection in other fields.

[0004] The Civil Aviation University of China disclosed a method for aircraft anomaly detection based on an improved K-means algorithm for airspace traffic flow clustering in its patent application, "Airspace Traffic Flow Clustering Method Based on Improved K-means Algorithm" (Application No.: CN 202410497259.5, Publication No.: CN 118098025 A, Application Date: April 24, 2024). The method's implementation steps include: acquiring flight data of all aircraft within a sector; standardizing the aircraft flight data; and performing cluster analysis on the airspace aircraft based on the standardized flight data, where the flight data includes the aircraft's x and y coordinates, altitude, and heading. This method reduces air traffic complexity and controller workload, proposes an improved k-means algorithm, optimizes heading and altitude division, improves clustering accuracy, and introduces the GapStatistic method to automatically determine the number of clusters. However, this method still has some shortcomings: the K-means algorithm is slow in processing speed for real-time flight status anomaly detection; it requires generating a large amount of reference dataset and performing multiple clustering operations, which takes a long time to compute, making it a limiting factor for flight status anomaly detection that requires real-time processing, especially in scenarios with large amounts of data or high real-time requirements; and users need to manually adjust other parameters, such as the initial value of the cluster centers, the division criteria for heading and altitude, etc., which increases the complexity of use.

[0005] In his paper "Abnormal Flight Behavior Mining Based on Density Clustering and Matching Algorithm" (Journal of Nanjing University of Aeronautics and Astronautics, Chinese Library Classification: V328, Document Code: A, Article Number: 1005-2615(2021)06-0863-09, Publication Date: December 2021), Wu Xinpeng disclosed an aircraft anomaly detection method based on density clustering (LOFDBSC-SDH) that considers speed, direction, and altitude, with improvements made to local anomaly factors. The implementation steps of this method include: improving the DBSCAN method by adopting an altitude layer partitioning strategy, local anomaly factors, and a fast cover tree; proposing the LOFDBSC-SDH density clustering algorithm to quickly and accurately extract normal flight path patterns; and then designing a flight path matching algorithm that considers time of passing points and the aforementioned anomaly features based on the normal flight path patterns to mine abnormal flight behavior. This method can assist air traffic controllers in making dispatch decisions and is of great significance for improving the efficiency of air traffic management. However, this method still has some shortcomings: under severe weather conditions, the flight status of the aircraft will be greatly affected, making the boundary between normal flight mode and abnormal flight mode blurred, thus affecting the accuracy of anomaly detection; the parameter density threshold still needs to be set based on experience, which means that users need to have a certain understanding of the algorithm and be able to adjust the parameters according to the specific dataset and application scenario, which increases the complexity of use and the time complexity of the algorithm.

[0006] Liu Jixin, in his paper "Terminal Area Track Clustering and Anomaly Identification Based on Density Peak" (Journal of Transportation Engineering, Chinese Library Classification: V355, Document Code: A, Article Number: 1671-1637(2021)05-0214-13, Publication Date: October 2021), disclosed a method for aircraft anomaly identification based on terminal area track clustering using density peak. The implementation steps of this method include: constructing a density-based similarity matrix using widely recorded Automatic Dependent Surveillance-Broadcast (ADS-B) data; clustering the data using a spectral clustering algorithm; selecting cluster centers for flight patterns with different densities using silhouette coefficients; and identifying abnormal trajectories by adjusting edge density parameters. This method can provide a data extraction platform for airspace-level traffic flow performance assessment and flight-level track prediction and optimization, which is of great significance for improving track clustering performance. However, the method still has shortcomings: the flight state of an aircraft is dynamically changing, and this method may not be flexible enough when dealing with rapidly changing flight states. For example, an aircraft may suddenly change its trajectory due to an unexpected event, and this method cannot identify such changes in time. Using contour coefficients to select cluster centers of different density flight patterns and adjusting edge density parameters to identify abnormal trajectories, however, in actual operation, the adjustment of these parameters requires professional knowledge and experience, which increases the complexity of use.

[0007] In summary, existing technologies for detecting anomalies in the real-time flight status of aircraft have the following four main shortcomings:

[0008] 1. Difficult parameter selection: Users need to manually adjust other parameters, such as the initial value of the cluster center, the division criteria of heading and altitude, etc. The adjustment of parameters depends on professional knowledge and experience, which increases the complexity of use;

[0009] 2. Insufficient real-time capability: The flight status of an aircraft is dynamically changing, and existing methods are not flexible enough in handling rapidly changing flight statuses. For example, an aircraft may suddenly change its trajectory due to an unexpected event, and existing methods cannot identify such changes in a timely manner;

[0010] 3. Many existing methods are based on assumptions about specific types of data distributions, such as the Gaussian distribution. However, in real-world aircraft flight data, the data distribution can be far more complex and does not follow simple statistical models. This means that existing methods are ineffective when dealing with datasets with varying density distributions, requiring additional preprocessing steps to adapt to the data distribution.

[0011] 4. High computational complexity: The algorithms used for anomaly detection have high computational complexity and low running efficiency. Summary of the Invention

[0012] The purpose of this invention is to address the shortcomings of the existing technologies mentioned above by proposing an aircraft anomaly detection method based on adaptive parameter DBSCAN. This method solves the problems of difficulty in manually inputting cluster center parameters, poor real-time performance, inability to adapt to anomaly detection of data with different density distributions, and low computational efficiency in the existing technologies.

[0013] The technical approach to achieving the objective of this invention is as follows: This invention uses the DBSCAN clustering algorithm for anomaly detection as its core, attempting to address the shortcomings and deficiencies of current technologies in real-time aircraft anomaly detection. The binary search algorithm employed in this invention determines a preliminary stable region and sets it as the initial search interval when the number of clusters remains unchanged after three consecutive clustering attempts. A binary search is then performed within this interval, selecting the middle eps value of the interval as a candidate value for testing each time. A DBSCAN implementation with a caching mechanism is used to evaluate the clustering effect corresponding to each candidate eps value. If the number of clusters is equal to or very close to the number of stable clusters, the binary search continues within the current interval; otherwise, the search interval is adjusted based on the clustering results, and the above iteration and search interval adjustment steps are repeated until an eps value that is closest to or equal to the number of stable clusters is found. This effectively reduces memory usage and consumption, improving the computational efficiency of DBSCAN. This solves the problem of low computational efficiency in anomaly detection in existing technologies, and also addresses the issue of deteriorating clustering quality due to given global parameters in the DBSCAN algorithm. This invention employs an adaptive algorithm to determine parameters. It performs Z-score standardization on the four dimensions of latitude, longitude, altitude, and speed in the aircraft dataset, calculates the Euclidean distance between any two aircraft, constructs a distance matrix, and uses this matrix to calculate the average h-nearest neighbor distance, storing it in eps-list. Next, a minpts-list is formed based on eps-list. By setting the balancing count to three, a preliminary stable region is determined when the number of clusters remains unchanged in three consecutive clustering results. A binary search method is then used to further optimize the eps value, repeatedly halving the search interval until an eps value closest to or equal to the number of stable clusters is found. The optimal eps value and corresponding minpts value are then determined, and the minpts value is used as the parameter k required for the next step, i.e., the h-value in the distance from each aircraft to its h-th nearest neighbor. This solves the problem of manually inputting initial values ​​for cluster centers, heading, and altitude division criteria in existing technologies. This invention utilizes K-means to determine a candidate eps-list, dynamically adjusting the selection range of eps values ​​in the eps-list based on the data distribution characteristics. Furthermore, it uses the eps values ​​obtained through binary search optimization to calculate the corresponding minpts value as the parameter k required for the next step. The parameter k is dynamically adjusted based on the characteristics of the aircraft dataset. Through the optimization process, the eps value closest to or equal to the number of stable clusters is found as the final optimized eps value, adapting to changes in the aircraft and better accommodating the dynamically changing flight states. This improves the real-time performance of anomaly detection, thus solving the problem of insufficient real-time performance and inability to flexibly handle rapidly changing flight states in existing technologies.

[0014] The technical solution to achieve the objective of this invention is,

[0015] Step 1: Generate eps-list;

[0016] Step 2: Use the binary search optimization method to optimize the eps value in eps-list, and use the minpts value corresponding to the optimal eps value found in minpts-list as the adaptive parameter;

[0017] Step 3: Use the K-means algorithm to build a candidate eps-list;

[0018] Step 4: Perform DBSCAN clustering based on the candidate eps-list;

[0019] Step 5: Detect anomalies based on clustering results.

[0020] Compared with the prior art, the present invention has the following advantages:

[0021] First, the adaptive algorithm used in this invention determines the parameters by adaptively calculating the corresponding minpts value as the parameter k required for the next step based on the statistical characteristics of the data. This overcomes the difficulty of manually inputting parameters such as the initial value of the cluster center, the heading and altitude division criteria in the prior art. This invention can automatically determine the algorithm parameters without human intervention, directly improving the accuracy and robustness of clustering, thereby improving the accuracy of aircraft anomaly detection.

[0022] Secondly, the binary search optimization method adopted in this invention uses the range of no change in the number of clusters in three consecutive clustering attempts as the initial search interval. After determining the initial stable region as the search range, the binary search method is used to further optimize the eps value in eps-list. Binary search is an efficient search algorithm that quickly locates the target value by repeatedly halving the search interval, effectively reducing memory usage and consumption, improving the computational efficiency of DBSCAN, overcoming the problem of low computational efficiency of anomaly detection in the prior art, and solving the problem of clustering quality deterioration caused by the given global parameters of the DBSCAN algorithm. This allows this invention to directly process large-scale aircraft datasets and is directly applicable to aircraft datasets with insignificant differences in cluster density.

[0023] Thirdly, this invention dynamically adjusts parameters based on real-time data changes. It uses the K-means algorithm to establish a candidate eps-list and dynamically adjusts the selection range of eps values ​​according to the data distribution characteristics. Furthermore, it utilizes a binary search optimization method to optimize the eps values ​​in the eps-list. Parameters are dynamically adjusted based on the characteristics of the dataset. Through the optimization process, the eps value closest to or equal to the stable cluster size is found as the final optimized eps value, thus more accurately reflecting the inherent structure of the data and better adapting to the dynamically changing flight states of the aircraft. These values ​​are then applied to the DBSCAN algorithm to cluster the flight state data and perform anomaly detection. Further analysis of these noise points identifies potential safety hazards or operational errors, overcoming the problems of existing technologies. This improves the real-time performance of anomaly detection, overcoming the shortcomings of existing technologies such as insufficient real-time performance, inability to flexibly handle rapidly changing flight states, low anomaly detection accuracy, and difficulty in adapting to datasets with different density distributions. This invention directly meets the needs of real-time flight state anomaly detection, more accurately identifies abnormal situations in flight states, and improves the efficiency and reliability of flight safety monitoring. Attached Figure Description

[0024] Figure 1 This is a flowchart illustrating the implementation of the method of the present invention. Detailed Implementation

[0025] The following is in conjunction with the appendix Figure 1 The embodiments and examples will be described in further detail to illustrate the specific implementation steps of the embodiments of the present invention.

[0026] Step 1: Generate eps-list.

[0027] Step 1.1: In this embodiment of the invention, the ADS-B dataset is selected. This dataset contains relevant data for 1000 aircraft, and the data for each aircraft includes four dimensions: latitude, longitude, altitude, and speed. The Z-score standardization method is used to process the latitude, longitude, altitude, and speed data respectively, so that the mean of each dimension is 0 and the standard deviation is 1.

[0028] Step 1.2: Based on the standardized latitude, longitude, altitude, and speed data, calculate the Euclidean distance between any two aircraft using the following formula:

[0029]

[0030] Where, d ij Let x represent the Euclidean distance between the i-th and j-th aircraft. ik x jkLet represent the coordinates of the i-th and j-th aircraft in the k-th dimension, respectively, where k = 1, 2, 3, 4 represent the four dimensions of latitude, longitude, altitude, and speed.

[0031] Step 1.3: Construct a distance matrix D composed of the Euclidean distances of all aircraft. In this embodiment of the invention, the distance matrix D is 1000×1000 dimensional.

[0032] Step 1.4: Sort each row of the distance matrix D in ascending order according to its Euclidean distance value to generate a sorted matrix D′. This step helps to determine the relationship between each aircraft and its nearest neighbor in the subsequent process.

[0033] Step 1.5: Each row of matrix D′ contains only one non-zero element, representing the distance between aircraft. The g-th non-zero element of each row is defined as the distance from the aircraft represented in that row to its h-th nearest neighbor. Specifically, for each row m, extract D′... m [1], that is, extracting the first non-zero element, i.e., the second element, because the first element is 0, representing the distance to itself) represents the distance of the m-plane to its nearest neighbor. Extract D′ m [2] That is, extracting the second non-zero element (i.e. the third element) represents the distance from the m-plane to its second nearest neighbor.

[0034] Step 1.6: For each row m, extract the g-th non-zero element, which is the distance from the m-th aircraft to its h-th nearest neighbor. Then, sum the h-th nearest neighbor distances for all rows and divide by the total number of aircraft n to obtain the average h-th nearest neighbor distance.

[0035] Step 1.7: Store the calculated average h-nearest neighbor distance in a new list eps_list, which contains the eps value for each aircraft. eps-list[g] represents the g-th non-zero element in eps-list, which is its h-th nearest neighbor distance. For a dataset of 1000 aircraft, the length of eps-list is also 1000.

[0036] Step 2: Optimize the eps value based on eps-list binary search.

[0037] Step 2.1: Based on the previously calculated sorted distance matrix D′ and eps-list, for each aircraft, check its distance to all other aircraft. If the distance is less than or equal to the aircraft's eps value, then the aircraft is considered a neighbor of the current aircraft. Count the number of neighbors that meet the condition and calculate the number of neighbors for each aircraft.

[0038] Step 2.2: Divide the number of neighbors for each aircraft by the total number of aircraft to obtain an average value. To meet practical application requirements, this average value is rounded to generate an integer as the minpts value. This generates a corresponding minpts value for each eps value, forming a minpts-list. For example, if the eps value is 0.5, the minpts value is 0.15, which is also rounded to 0.15.

[0039] Step 2.3: The number of balancing iterations is set based on the size of the aircraft dataset to ensure robust identification of aircraft groups and avoid oversegmentation or undersegmentation. The number of balancing iterations is determined according to the following rules: 3 iterations are set when the number of samples in the aircraft dataset is less than or equal to 1000; 4 iterations are set when the number of samples in the aircraft dataset is between 1000 and 3000; 5 iterations are set when the number of samples in the aircraft dataset is between 3000 and 5000; and 6 iterations are set when the number of samples in the aircraft dataset exceeds 5000. These steps ensure that the algorithm can more robustly identify the natural cluster structure in the aircraft dataset, avoiding oversegmentation or undersegmentation caused by inappropriate parameter selection.

[0040] In this embodiment of the invention, since the dataset contains 1000 aircraft, the number of balancing attempts N is set to 3.

[0041] The term "balance count" refers to the number of times that the number of clusters remains unchanged when the eps values ​​and corresponding minpts values ​​in eps-list are input into DBSCAN for clustering.

[0042] The reason for setting the number of balancing iterations is that, based on the experimental and analytical results of the aircraft dataset, the eps values ​​and corresponding minpts values ​​in eps-list are input into DBSCAN for clustering. It is found that when the number of clustering results does not change after k consecutive iterations, it indicates that the algorithm has converged to a relatively stable solution, and is considered to have reached a stable state.

[0043] Step 2.4: If the number of clusters remains unchanged after three consecutive clustering attempts, the system enters a preliminary stable region. Then, a binary search method is used to further narrow down the selection range of eps values, iteratively trying different eps values ​​in the eps-list, and using a DBSCAN implementation with a caching mechanism to evaluate the clustering effect corresponding to each eps value. Specifically, the clustering results of each attempt are recorded, including the number and structure of clusters. If the number of clusters generated by multiple consecutive eps values ​​remains unchanged, a stable number of clusters is considered to have been found, and the eps value at this point is recorded.

[0044] In this embodiment of the invention, the steps for optimizing the eps value using binary search are as follows:

[0045] The first step is to determine the initial stable area.

[0046] When the number of clusters remains unchanged in three consecutive clustering attempts, the algorithm is considered to have entered a preliminary stable region. It was found that the clustering results are relatively stable when the eps value is between 0.45 and 0.55. Therefore, this range is used as the initial search interval, i.e., [0.45, 0.55].

[0047] The second step is to set the initial search range.

[0048] If the initial stable region [0.45, 0.55] is determined as the search range, then the initial search interval is [0.45, 0.55].

[0049] The third step is to perform a binary search and record the results.

[0050] A binary search is performed within the initial search interval [0.45, 0.55], and the middle eps value of the interval is selected as a candidate value for testing each time. DBSCAN with a caching mechanism is used to evaluate the clustering effect corresponding to each candidate eps value, and the results are recorded. The specific steps are as follows:

[0051] First iteration: The median value of 0.50 in the initial search interval [0.45, 0.55] is selected as the candidate eps value for clustering. DBSCAN with a caching mechanism is used to record the number of clusters corresponding to each candidate eps value. If the number of clusters in the clustering result is equal to or very close to the number of stable clusters, a binary search is continued within the current interval. Otherwise, the search interval is adjusted based on the clustering results.

[0052] Adjusting the search interval: If the number of clusters in the clustering result is greater than the number of stable clusters: This indicates that the current EPS value is too large and needs to be reduced. Therefore, the search interval is adjusted to the left half of the current interval, i.e., [0.45, 0.50]. If the number of clusters in the clustering result is less than the number of stable clusters: This indicates that the current EPS value is too small and needs to be increased. Therefore, the search interval is adjusted to the right half of the current interval, i.e., [0.50, 0.55]. If the number of clusters in the clustering result is equal to or very close to the number of stable clusters: Continue performing a binary search within the current interval until the optimal EPS value is found, i.e., an EPS value that is closest to or equal to the number of stable clusters.

[0053] Repeat the above iteration and search interval adjustment steps: after each iteration, update the search interval until an eps value that is closest to or equal to the number of stable clusters is found.

[0054] Step 3: Determine the adaptive parameters.

[0055] The optimal eps value was found in the initial stable region [0.45, 0.55] using a binary search method. The optimal eps value was determined to be 0.52. The corresponding minpts value was found to be 152. This minpts value will be used as the adaptive parameter k = 152 required for the next step, which means that the h value in the distance from each spacecraft to its h nearest neighbor is 152.

[0056] Step 4: Use K-means to determine the candidate eps-list.

[0057] Step 4.1: Extract the distance from each aircraft to its 152nd nearest neighbor, collect these distance values ​​into a list, and draw a frequency histogram to show the frequency of different distance values.

[0058] Step 4.2 involves smoothing the histogram using a 5-point moving average. Peaks are automatically detected on the smoothed histogram; peaks in the distance-frequency histogram indicate high-density regions in the aircraft dataset. The number of cluster centers N required for the K-means algorithm is estimated by calculating the number of significant peaks in the histogram. A frequency histogram is then plotted based on this list, revealing three significant peaks.

[0059] Let P = {p1, p1, p3} be all the peak points in the histogram. Then the number of cluster centers in the K-means algorithm is 3, which is the number of significant peak points in the histogram.

[0060] Step 4.3 divides the aircraft dataset into 3 clusters. The cluster centers returned by the K-means algorithm are C = {c1, c2, c3}. For each cluster center c i Calculate the distance d from the center point to its farthest spacecraft. max (c i The values ​​were 0.38, 0.52, and 0.67 respectively.

[0061]

[0062] Among them, C i Let ||xc| represent all points in the i-th cluster. i || represents the relationship between point x and cluster center c. i The Euclidean distance between them.

[0063] Step 4.4: Use the distance from each cluster center to its farthest spacecraft as a candidate eps value. Sort the extracted eps values ​​in ascending order to form a candidate eps-list. eps-list = [0.38, 0.52, 0.67].

[0064] Step 5: Perform DBSCAN clustering based on the candidate eps-list.

[0065] Step 5.1: Input the aircraft data, the eps values ​​in the candidate eps-list, and the corresponding minpts values ​​into the DBSCAN algorithm for clustering. Use eps = 0.38, 0.52, 0.67 and the corresponding minpts as parameters to perform DBSCAN clustering on the aircraft data.

[0066] Step 5.2: After clustering is complete, save the clustered data and label these aircraft data points to prevent them from being clustered again in the next loop. This ensures that each aircraft data point is clustered only once, avoiding redundant calculations.

[0067] Step 5.3: Repeat steps 5.1 and 5.2 above. When all the eps values ​​in the candidate eps-list have been used, the clustering is complete.

[0068] Step 6: Detect anomalies based on clustering results.

[0069] Step 6.1: When the entire clustering process is complete, check the cluster label of each aircraft. Aircraft with a cluster label of -1 are considered noise points. Noise points are usually located in sparse regions of the aircraft dataset, where the number of aircraft is too small to form effective clusters.

[0070] Step 6.2: After identifying the noise points, further analysis is needed to understand their specific characteristics and potential problems. Analysis of the noise points' locations and attributes reveals that they are mainly concentrated in areas with significant deviations from the flight path. The noise points exhibit outliers in their speed, altitude, and other attributes, indicating abnormal flight conditions such as deviations from the planned route or abnormal speed changes.

[0071] The effectiveness of this invention can be further demonstrated through the following simulation experiments.

[0072] 1. Simulation experimental conditions.

[0073] The software platform for the simulation experiment of this invention is: Windows 10 operating system and Python 3.8.

[0074] The data used in the simulation experiments of this invention is a real flight dataset obtained from the aircraft monitoring system. This dataset includes data under normal flight conditions and data under known abnormal conditions. The dataset contains multiple features, such as flight altitude, speed, and acceleration, with a total sample size of 10,000. Z-score normalization is used to process the data in the four dimensions of latitude, longitude, altitude, and speed, ensuring that the mean of each dimension is 0 and the standard deviation is 1.

[0075] 2. Simulation content and result analysis.

[0076] This invention includes two simulation experiments to evaluate the algorithm's time performance and clustering quality, respectively.

[0077] 2.1 Simulation Experiment 1: Simulation of the algorithm's time performance.

[0078] Simulation Experiment 1 of this invention employs the method of this invention. It constructs a distance matrix by calculating the Euclidean distance between aircraft, and calculates the nearest neighbor distance for each row and each element to obtain the average nearest neighbor distance of that element, forming an eps-list to determine the initial stable region. An initial search interval is set, a binary search method is executed, and the clustering results of each attempt are recorded until the optimal eps value is found. Based on the optimized eps value, the corresponding minpts value is calculated to form adaptive parameters. The adaptive parameters are calculated through 100 rounds of experiments, and the calculation time for each round is recorded to obtain the average adaptive duration. The efficiency of the adaptive parameter algorithm is evaluated using the average adaptive duration. The average adaptive duration of Simulation Experiment 1 of this invention is 1.95 seconds, indicating that the algorithm has high efficiency in calculating adaptive parameters and can maintain a high response speed when processing large-scale aircraft data.

[0079] 2.2 Simulation Experiment 2 is a simulation of clustering quality.

[0080] Simulation Experiment 2 of this invention adopts the method of Simulation Experiment 1 of this invention to generate eps-list and perform binary search to optimize eps values. Then, the optimized eps values ​​and minpts values ​​are used for DBSCAN clustering. The silhouette coefficient is used as a clustering quality evaluation index to evaluate the clustering results. The silhouette coefficient is calculated for the clustering results of each round of experiments. The adjusted Rand Index (ARI), adjusted Mutual Information (AMI), and V-Measure scores of 100 experiments are recorded respectively. The following formula is used to calculate and all calculation results are plotted in Table 1.

[0081]

[0082] Where a represents the number of aircraft that belong to the same class in both real and experimental scenarios, b represents the number of aircraft that belong to the same class in real scenarios but not in experimental scenarios, c represents the number of aircraft that do not belong to the same class in real scenarios but belong to the same class in experimental scenarios, and d represents the number of aircraft that do not belong to the same class in either real or experimental scenarios.

[0083] The range of ARI values ​​is [-1, 1]. The larger the value, the better it matches the true results, that is, the better the clustering effect.

[0084]

[0085] Here, U and V represent two different clustering results, MI(U,V) represents the mutual information between U and V, E(MI(U,V)) represents the expected value of the mutual information, and H(U) and H(V) represent the entropy of U and V, respectively. The value of AMI ranges from 0 to 1, with a higher value indicating a higher similarity between the two clustering results.

[0086]

[0087]

[0088] Here, homogeneity indicates that a given cluster is considered homogeneous if it contains only one category of aircraft; completeness indicates that a given cluster is considered complete if all aircraft of a given category are assigned to the same cluster. dc n represents the number of aircraft that belong to both category d and category c. d and n c These represent the number of aircraft in category d and category c, respectively. The value of V-Measure also ranges from 0 to 1, with a larger value indicating better clustering results.

[0089] Table 1. Quantitative Analysis of the Invention in Simulation Experiments

[0090]

[0091] As can be seen from Table 1, all average coefficient scores of the present invention are higher than 0.8, indicating that the clustering results have good quality and separability, thus proving the effectiveness and reliability of the present invention in flight state anomaly detection.

[0092] The simulation experiments above demonstrate that the method of this invention adaptively calculates the corresponding minpts value as the parameter k required for the next step based on the statistical characteristics of the data, automatically determining the algorithm parameters without human intervention. The binary search method is used to further optimize the eps value, effectively reducing memory usage and computation time, and improving the computational efficiency of DBSCAN. Parameters are dynamically adjusted according to real-time data changes. A candidate eps-list is determined using K-means, and the selection range of eps values ​​is dynamically adjusted according to the data distribution characteristics. The optimization process finds the eps value closest to or equal to the stable cluster size as the final optimized eps value, more accurately reflecting the inherent structure of the data and better adapting to the dynamically changing flight states of aircraft. Therefore, this invention solves the problems of existing technologies, such as difficulty in manually inputting cluster center parameters, poor real-time performance, inability to adapt to anomaly detection of data with different density distributions, and low computational efficiency. This proves that the method of this invention can maintain a high response speed when processing large-scale aircraft data, and also demonstrates the effectiveness and reliability of this invention in flight state anomaly detection.

Claims

1. A method for detecting aircraft anomalies based on adaptive parameter DBSCAN, characterized in that, The method employs a binary search optimization method to determine adaptive parameters, uses the K-means algorithm to build a candidate eps-list, and performs anomaly detection on the aircraft by DBSCAN clustering of the candidate eps-list. The steps of this detection method are as follows: Step 1, generate eps-list: The first step is to generate a dataset containing at least 1,000 aircraft, with each aircraft's data including four dimensions: latitude, longitude, altitude, and speed. The Z-score standardization method is then used to process the latitude, longitude, altitude, and speed data respectively, so that the mean of each dimension is 0 and the standard deviation is 1. The second step is to calculate the Euclidean distance between any two aircraft using the following formula: Where, d ij Let x represent the Euclidean distance between the i-th and j-th aircraft. ik x jk Let represent the coordinates of the i-th and j-th aircraft in the k-th dimension, respectively, where k = 1, 2, 3, 4 represent the four dimensions of latitude, longitude, altitude, and speed, respectively. The third step is to construct a distance matrix D from all the Euclidean distances; The fourth step is to sort each row of the distance matrix D in ascending order according to its Euclidean distance value to generate a sorted matrix D′. Each row of matrix D′ contains only one zero element, which is used to represent the distance between the aircraft. The g-th non-zero element of each row is defined as the distance from the aircraft represented by that row to its h-th nearest neighbor. Fifth, sum all the nearest neighbor distances for each row and then divide by the total number of aircraft to obtain the average nearest neighbor distance for that row; compile all the nearest neighbor distances into a list eps-list, which contains the eps value for each aircraft; Step 2: Use the binary search optimization method to optimize the eps value in eps-list, and use the minpts value corresponding to the optimal eps value found in minpts-list as the adaptive parameter; The steps for optimizing the eps values ​​in eps-list using the binary search optimization method are as follows: The first step is to set an initial search range based on the preliminary stable region: when the number of clusters does not change in the clustering results of multiple consecutive attempts, the algorithm is considered to have entered a preliminary stable region, and the preliminary stable region is used as the search range. The second step is to execute the binary search optimization method and record the results: In the first search, the median value of the initial search interval is selected as the candidate eps value for clustering, and the number of clusters corresponding to each candidate eps value is recorded. If the number of clusters in the clustering result is equal to or very close to the number of stable clusters, then continue the binary search in the current interval; otherwise, adjust the search interval and execute the third step. The third step is to use the same method as the first search to find the eps value that is closest to or equal to the number of stable clusters within the updated search interval. Step 3: Extract the distance from each aircraft to its k-th nearest neighbor to form a distance list; use the K-means algorithm to build a candidate eps-list based on the distance list; The steps of the K-means algorithm are as follows: The first step is to estimate the number of cluster centers required by the K-means algorithm by using the number of significant peaks in the frequency histogram; The second step is to calculate the distance from each cluster center to its farthest spacecraft using the following formula: Where, d max (c i ) represents the i-th cluster center C i The distance to its farthest spacecraft, ||xc i || represents the x-th aircraft point and the i-th cluster center point C. i The Euclidean distance; The third step is to use the distance from each cluster center to its farthest spacecraft as a candidate eps value, and sort all the candidate eps values ​​in ascending order to form a candidate eps-list. Step 4: Perform DBSCAN clustering based on the candidate eps-list; Step 5: Detect anomalies based on clustering results.

2. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that, The phrase "the number of clusters did not change in the clustering results of multiple consecutive attempts" in step 2 refers to the number of times that the number of clusters remained unchanged when clustering the eps values ​​in eps-list with the corresponding minpts values.

3. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that, The adjustment of the search interval in step 2 means that if the number of clusters in the clustering result is greater than the number of stable clusters, it indicates that the current eps value is too large and needs to be reduced, so the search interval is adjusted to the left half of the current interval; if the number of clusters in the clustering result is less than the number of stable clusters, it indicates that the current eps value is too small and needs to be increased, so the search interval is adjusted to the right half of the current interval.

4. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that, The minpts-list mentioned in step 2 refers to the minpts value obtained by dividing the number of neighbors of each aircraft by the total number of aircraft, taking an average value, rounding the average value, and then assembling the minpts values ​​generated from all eps values ​​into a minpts-list.

5. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that, Step 4, which involves performing DBSCAN clustering based on candidate eps-list, means inputting the aircraft data, the eps values ​​in the candidate eps-list, and the corresponding minpts values ​​into the DBSCAN algorithm to perform DBSCAN clustering on the aircraft data.

6. The aircraft anomaly detection method based on adaptive parameter DBSCAN according to claim 1, characterized in that, The steps for detecting anomalies based on clustering results described in step 5 are as follows: The first step is to check the cluster label of each aircraft. If the cluster label is -1, the aircraft is considered a noise point. The second step involves analyzing the location and attributes of noise points. If the noise points are concentrated in areas where the flight path deviates significantly, it is determined that the speed and altitude attributes of the noise points have abnormal values. These abnormal values ​​indicate that the aircraft is in an abnormal flight state, deviating from the planned route or experiencing abnormal speed changes.

Images