Intelligent data security detection method for unmanned aerial vehicle

Abstract

The invention discloses an intelligent data security detection method for an unmanned aerial vehicle, and belongs to the technical field of data processing, and the detection method comprises the following specific steps: I, the unmanned aerial vehicle collects and processes multi-source data through a built-in sensor and a communication module; iI, constructing an anomaly detection model through distributed modeling, and optimizing model parameters; iII, analyzing historical task data and an operator behavior mode, and generating a user behavior baseline; according to the method, unknown threats can be efficiently identified, the security protection capability of the unmanned aerial vehicle is improved, the bandwidth and computing resource burden is reduced, the data privacy is protected, the system security is improved, the adaptability to a multi-unmanned aerial vehicle collaborative scene is enhanced, and the method has flexibility and expandability; according to the method, the passive response after the attack event occurs is reduced, the occurrence of the security event is quickly prevented through remote control, the active defense capability is improved, the loss is reduced, the user behavior can be deeply analyzed, the potential security risk can be found, and powerful support is provided for formulating a more accurate security policy.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to an intelligent data security detection method for unmanned aerial vehicles. Background Art

[0002] With the rapid development of cloud computing, big data and drone technology, the amount of data collected and transmitted by drones is growing exponentially. These data not only contain important industry information, but may also involve sensitive content such as citizen privacy. However, security incidents such as data leakage, theft, and unauthorized access have also occurred frequently, posing a serious threat to the brand reputation of the organization, network information security, and citizen privacy. Traditional data security products that respond to the threat of internal data leakage in enterprises, such as DLP (Data Leakage Prevention) products, mainly ensure enterprise information security by pre-setting enterprise sensitive data rules and controlling employee Internet behavior; therefore, it is particularly important to invent an intelligent data security detection method for drones.

[0003] The existing intelligent data security detection methods for drones cannot efficiently identify unknown threats, reduce the safety protection capabilities of drones, have a high bandwidth and computing resource burden, and have poor adaptability to multi-drone collaborative scenarios; in addition, the existing intelligent data security detection methods for drones have more passive responses after attack incidents, low active defense capabilities, high losses, and cannot deeply analyze user behavior, and cannot provide strong support for the formulation of more accurate security strategies; for this reason, we propose an intelligent data security detection method for drones. Summary of the invention

[0004] The purpose of the present invention is to solve the defects in the prior art and to propose an intelligent data security detection method for drones.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] An intelligent data security detection method for drones, the specific steps of the detection method are as follows:

[0007] Ⅰ. The drone collects and processes multi-source data through built-in sensors and communication modules;

[0008] II. Build an anomaly detection model through distributed modeling and optimize model parameters;

[0009] III. Analyze historical task data and operator behavior patterns to generate user behavior baselines;

[0010] IV. Analyze the probability of potential threats based on real-time collected data and generate response strategies;

[0011] V. When data security anomalies are detected, the preset emergency response mechanism is triggered;

[0012] VI. Dynamically adjust models and strategies based on drone types and new mission requirements;

[0013] Ⅶ. Regularly provide feedback on test results and strategy execution effects, and generate test reports.

[0014] As a further solution of the present invention, the specific steps of collecting and processing multi-source data in step II are as follows:

[0015] S1.1: Collect the flow data, flight path data, sensor data and mission log data of the drone, and use the quartile algorithm to divide the environmental data and structural data in the original sensor data set into 4 parts in ascending order, each accounting for 25% of the entire data set, where the lower quartile is recorded as Q1, the median is recorded as Q2, and the upper quartile is recorded as Q3;

[0016] S1.2: Calculate the difference between the upper quartile and the lower quartile and record it as the interquartile range I QR , according to Q1-1.5I QR and Q3+1.5I QR Get the inner limit of outliers [F L , F U ], and remove the data beyond this range. After the removal is completed, the missing values ​​in the data are filled by the cubic spline interpolation method, and each group of data is smoothed by a high-pass filter;

[0017] S1.3: Map the data to the range of [0, 1] through normalization processing, and then convert each group of normalized data into a standard normal distribution. Extract the key points of velocity and acceleration in the trajectory from the cleaned and standardized data, analyze the change amplitude of the sensor, and calculate the operation frequency of the mission log to obtain the flight trajectory characteristics, sensor characteristics, and mission log characteristics. Generate comprehensive drone data security detection related data based on the extracted groups of feature data and known vulnerability libraries and threat intelligence data.

[0018] As a further solution of the present invention, the specific steps of constructing the anomaly detection model in step II are as follows:

[0019] S2.1: Define the initial global model on the central server, collect the drones connected to the central server, and distribute it to each connected drone to update the architecture and parameters of each drone's local model. After that, each drone uses its own historical collected data as local data and uses the local data to train the local model;

[0020] S2.2: Local training performs forward propagation on each local data to obtain the abnormal prediction value of each group of data, calculates the loss value between the abnormal prediction value and the actual value through the cross entropy function, transfers the loss value from the local model output layer to the input layer according to the chain rule, and calculates the gradient of the loss value to each network layer, and then uses gradient descent to update the model parameters;

[0021] S2.3: Each drone repeatedly uses local data to feedback training and update the local model until its model loss value converges to the preset threshold. Each drone uploads the updated local model parameters to the central server. The central server receives the local model parameters of all clients, globally aggregates the collected local model parameters through weighted averaging, and updates the global model based on the aggregated parameter information.

[0022] S2.4: Use the global model as the teacher model to calculate the output soft label prediction. The student model in the central server fits the soft label prediction by minimizing the distillation loss to obtain the corresponding lightweight model. The lightweight model is then transmitted to each drone and the original local model on the drone is replaced. The input data is calculated using the updated local model for anomaly scores. If the anomaly score is higher than the preset threshold, it is judged as an anomaly. At the same time, the drone local model is regularly updated based on the real-time prediction results.

[0023] As a further solution of the present invention, the specific steps of generating the user behavior baseline in step III are as follows:

[0024] S3.1: Set the UAV’s mission state to S and the operator’s action to A. Then extract the state-action pairs from the historical data and define the initial strategy π0 to represent the probability distribution of historical behaviors. Then, treat each mission state as a node and the action from the current state to the next state as an edge between two sets of nodes.

[0025] S3.2: The current UAV mission state is taken as the root node. The root node generates multiple sets of different mission states according to the different behaviors of the operator, and the generated mission states are used as child nodes to construct the corresponding exploration tree. Starting from the root node, based on the upper confidence bound formula Calculate the UCB value of each child node, and select the child node with the highest UCB value layer by layer for exploration. i represents the upper confidence limit of node i, Q i represents the average reward of node i, C represents the exploration-exploitation trade-off coefficient, N represents the number of visits to the parent node, and n i represents the number of visits to node i;

[0026] S3.3: If the selected child node does not fully expand all its selectable actions, then randomly select an unexplored behavior action, add the new state converted by the action as a new child node to the exploration tree, randomly sample behavior actions from the expanded child node, simulate the operator's behavior in the current scenario, and evaluate the behavior results;

[0027] S3.4: The simulated reward is transmitted from the current node back to the root node, and the average reward and number of visits of each node in the same path are updated. After multiple rounds of exploration, the reward change value of the node converges to the preset range. After the exploration is completed, the path with the highest cumulative reward in the exploration tree is selected to generate the user behavior baseline.

[0028] As a further solution of the present invention, the specific steps of analyzing the probability of occurrence of potential threats based on real-time collected data in step IV are as follows:

[0029] S4.1: Collect and integrate the mission status of the drone and the operator's behavior, construct the corresponding state set and action set, calculate the probability of transferring from any state to other states by executing any action, and calculate the corresponding immediate reward;

[0030] S4.2: Extract key features from the data collected by the drone in real time, map them to the corresponding states, use historical data and real-time data to calculate the state transition probability, then model each threat event suffered by the drone as a specific target state set, and calculate the probability of reaching the threat state from the current state;

[0031] S4.2: Calculate the cumulative probability of potential threats, and use the reward function to evaluate the risk level of the current user behavior baseline. When the cumulative probability of a threat exceeding the set threshold, generate an alarm, trigger the drone safety mechanism, and readjust the user behavior baseline.

[0032] As a further solution of the present invention, the specific steps of dynamically adjusting the model and strategy in step VI are as follows:

[0033] S5.1: Collect real-time data from the UAV's flight control system, sensors, and mission logs, input the data features into the UAV's pre-trained local model, and detect whether the model's output is abnormal behavior. Use the generated user behavior baseline to compare whether the behavior features of the real-time data significantly deviate from the baseline. When the deviation range exceeds the preset threshold, it is determined to be abnormal;

[0034] S5.2: When abnormal behavior is detected, set the initial parameters of the model and strategy, initialize the temperature and decay rate, and define the optimization objective function of the parameters in combination with real-time data and baseline analysis results. Then randomly perturb the current parameters to generate new parameters and calculate their objective function values.

[0035] S5.3: Calculate the probability of receiving the new parameters. If the probability of receiving the new parameters is higher than the random threshold, update the current strategy parameters. Otherwise, keep them unchanged. According to the temperature attenuation formula, update the current temperature by the preset attenuation rate, and repeat the perturbation and parameter replacement process until the temperature reaches the preset temperature value. Update the original parameters of the model and strategy based on the optimal parameter information.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] 1. The drone uses an intelligent data security detection method to define an initial global model on the central server, collects drones connected to the central server, and distributes them to each connected drone to update the architecture and parameters of each drone's local model. After that, each drone uses its own historical collected data as local data, and uses local data to train the local model. The local training performs forward propagation on each local data to obtain the abnormal prediction value of each group of data, and calculates the loss value of the abnormal prediction value and the actual value through the cross entropy function. According to the chain rule, the loss value is transmitted from the local model output layer to the input layer, and the gradient of the loss value to each network layer is calculated, and then the model parameters are updated using gradient descent. Each drone repeatedly uses local data to feedback training and update the local model until its model loss value converges to the preset threshold. Each drone uploads the updated local model parameters to the central server. The central server Receive the local model parameters of all clients, globally aggregate the collected local model parameters through weighted averaging, and update the global model based on the aggregated parameter information. Use the global model as the teacher model to calculate the output soft label prediction. The built-in student model in the central server fits the soft label prediction by minimizing the distillation loss to obtain the corresponding lightweight model. The lightweight model is then transmitted to each drone and the original local model on the drone is replaced. The input data is calculated with the updated local model for anomaly scores. If the anomaly score is higher than the preset threshold, it is judged as an anomaly. At the same time, the drone local model is regularly updated based on the real-time prediction results. It can efficiently identify unknown threats, improve the safety protection capabilities of drones, reduce the burden on bandwidth and computing resources, protect data privacy, improve system security, enhance adaptability to multi-drone collaborative scenarios, and has flexibility and scalability.

[0038] 2. The drone uses an intelligent data security detection method to set the drone's mission state and the operator's behavior and actions, then extracts state-action pairs from historical data, and defines an initial strategy to represent the probability distribution of historical behaviors. After that, each mission state is regarded as a node, and the behavior from the current state to the next state is regarded as an edge between two sets of nodes. The current drone's mission state is used as the root node, which generates multiple sets of different mission states based on the operator's different behavior and actions, and uses the generated mission states as child nodes to construct a corresponding exploration tree for exploration. After multiple rounds of exploration, until the reward change value of the node converges to the preset range, after the exploration is completed, the path with the highest cumulative reward in the exploration tree is selected to generate a user behavior baseline, collect and integrate the drone's mission state and the operator's behavior and actions, construct the corresponding state set and action set, and calculate the reward from any state. The probability of transferring to other states by executing any action in a state and calculating its corresponding immediate reward, extract key features from the real-time data collected by the drone, map them to the corresponding states, use historical data and real-time data to count the state transition probability, and then model each threat event suffered by the drone as a specific target state set, calculate the probability of reaching the threat state from the current state, calculate the cumulative probability of potential threats, and evaluate the risk level of the current user behavior baseline in combination with the reward function. When the cumulative probability of the threat occurrence exceeds the set threshold, an alarm is generated, the drone safety mechanism is triggered, and the user behavior baseline is readjusted to reduce the passive response to the attack incident, and quickly prevent the occurrence of security incidents through remote control, improve the active defense capability, and reduce losses. It can deeply analyze user behavior, discover potential security risks, and provide strong support for the formulation of more accurate security strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0040] Figure 1 This is a flowchart of an intelligent data security detection method for drones proposed by the present invention. DETAILED DESCRIPTION

[0041] Example 1

[0042] Reference Figure 1 , an intelligent data security detection method for drones, the specific steps of the detection method are as follows:

[0043] Drones collect and process multi-source data through built-in sensors and communication modules.

[0044] Specifically, the flow data, flight path data, sensor data and mission log data of the drone are collected, and the environmental data and structural data in the original sensor data set are divided into 4 parts in ascending order using the quartile algorithm, each accounting for 25% of the entire data set, where the lower quartile is recorded as Q1, the median is recorded as Q2, and the upper quartile is recorded as Q3. The difference between the upper quartile and the lower quartile is recorded as the interquartile range I QR , according to Q1-1.5I QR and Q3+1.5I QR Get the inner limit of outliers [F L , F U ], and the data beyond this range is eliminated. After the elimination is completed, the missing values ​​in the data are filled by the cubic spline interpolation method, and each group of data is smoothed by a high-pass filter. The data is mapped to the range of [0, 1] through normalization processing, and then each group of normalized data is converted to a standard normal distribution. The speed and acceleration key points in the trajectory are extracted from the cleaned and standardized data, the change amplitude of the sensor is analyzed, and the operation frequency of the mission log is calculated to obtain the flight trajectory characteristics, sensor characteristics and mission log characteristics. The extracted feature data are used to generate comprehensive drone data security detection related data based on the known vulnerability library and threat intelligence data.

[0045] Build an anomaly detection model through distributed modeling and optimize model parameters.

[0046] Specifically, an initial global model is defined on a central server, and drones connected to the central server are collected and distributed to each connected drone to update the architecture and parameters of each drone's local model. After that, each drone uses its own historical collected data as local data, and uses the local data to train the local model. The local training performs forward propagation on each local data to obtain the abnormal prediction value of each group of data, and the loss value of the abnormal prediction value and the actual value is calculated through the cross entropy function. The loss value is transmitted from the local model output layer to the input layer according to the chain rule, and the gradient of the loss value to each network layer is calculated, and then the model parameters are updated using gradient descent. Each drone repeatedly uses the local data to feedback training and update the local model until its model loss value converges to the preset threshold. Each drone uploads the updated local model parameters to the central server. The central server receives the local model parameters of all clients, globally aggregates the collected local model parameters through weighted averaging, and updates the global model based on the aggregated parameter information. The global model is used as the teacher model to calculate the output soft label prediction. The student model in the central server fits the soft label prediction by minimizing the distillation loss to obtain the corresponding lightweight model. The lightweight model is then transmitted to each drone and replaces the original local model on the drone. The input data is calculated with the updated local model for anomaly scores. If the anomaly score is higher than the preset threshold, it is judged as an anomaly. At the same time, the drone local model is regularly updated based on the real-time prediction results.

[0047] Analyze historical mission data and operator behavior patterns to generate user behavior baselines.

[0048] Specifically, the UAV's mission state is set to S, the operator's behavior is set to A, and then the state-action pairs are extracted from the historical data. The initial strategy π0 is defined to represent the probability distribution of the historical behavior. After that, each mission state is regarded as a node, and the behavior from the current state to the next state is regarded as the edge between two groups of nodes. The current UAV's mission state is taken as the root node. The root node generates multiple groups of different mission states according to the different behavior actions of the operator, and the generated mission states are taken as child nodes to construct the corresponding exploration tree. Starting from the root node, the UCB value of each child node is calculated based on the upper confidence bound formula, and the child node with the highest UCB value is selected layer by layer. The node is explored. If the selected child node does not fully expand all its selectable actions, an unexplored behavior action is randomly selected, and the new state converted by the action is added to the exploration tree as a new child node. From the expanded child node, behavior actions are randomly sampled to simulate the operator's behavior in the current scenario, and the behavior results are evaluated. The simulated reward is transmitted back from the current node to the root node, and the average reward and number of visits of each node in the same path are updated. After multiple rounds of exploration, until the reward change value of the node converges to the preset range, after the exploration is completed, the path with the highest cumulative reward in the exploration tree is selected to generate the user behavior baseline.

[0049] It should be further explained that the specific calculation formula of the upper confidence bound formula is as follows:

[0050]

[0051] In the formula, UCB i represents the upper confidence limit of node i, Q i represents the average reward of node i, C represents the exploration-exploitation trade-off coefficient, N represents the number of visits to the parent node, and n i Represents the number of visits to node i.

[0052] Analyze the probability of potential threats based on real-time collected data and generate response strategies.

[0053] Specifically, the mission status of the drone and the operator's behavioral actions are collected and integrated, the corresponding state set and action set are constructed, the probability of transferring from any state to other states by executing any action is calculated, and the corresponding immediate reward is calculated. Key features are extracted from the data collected by the drone in real time and mapped to the corresponding states. The state transition probability is statistically analyzed using historical data and real-time data. After that, each threat event suffered by the drone is modeled as a specific target state set, the probability of reaching the threat state from the current state is calculated, the cumulative probability of potential threats is calculated, and the risk level of the current user behavior baseline is evaluated in combination with the reward function. When the cumulative probability of the threat occurrence exceeds the set threshold, an alarm is generated, the drone safety mechanism is triggered, and the user behavior baseline is readjusted.

[0054] Example 2

[0055] Reference Figure 1 , an intelligent data security detection method for drones, the specific steps of the detection method are as follows:

[0056] When data security anomalies are detected, the preset emergency response mechanism is triggered.

[0057] Dynamically adjust models and strategies based on drone type and new mission requirements.

[0058] Specifically, real-time data is collected from the flight control system, sensors and mission logs of the drone, and the data features are input into the local model pre-trained by the drone. The output of the model is detected to see if there is abnormal behavior. The generated user behavior baseline is used to compare whether the behavioral characteristics of the real-time data deviate significantly from the baseline. When the deviation range exceeds the preset threshold, it is determined to be abnormal. When abnormal behavior is detected, the initial parameters of the model and strategy are set, the temperature and decay rate are initialized, and the optimization objective function of the parameters is defined in combination with the real-time data and baseline analysis results. Then, the current parameters are randomly perturbed to generate new parameters, and their objective function values ​​are calculated. The acceptance probability of the new parameters is calculated. If the acceptance probability is higher than the random threshold, the current strategy parameters are updated, otherwise they remain unchanged. According to the temperature decay formula, the current temperature is updated by the preset decay rate, and the perturbation and parameter replacement process is repeated until the temperature reaches the preset temperature value, and the original parameters of the model and strategy are updated based on the optimal parameter information.

[0059] Provide regular feedback on test results and policy execution effects, and generate test reports.

Claims

1. An intelligent data security detection method for drones, characterized in that: The specific steps of this detection method are as follows: Ⅰ. The drone collects and processes multi-source data through built-in sensors and communication modules; II. Build an anomaly detection model through distributed modeling and optimize model parameters; III. Analyze historical task data and operator behavior patterns to generate user behavior baselines; IV. Analyze the probability of potential threats based on real-time collected data and generate response strategies; V. When data security anomalies are detected, the preset emergency response mechanism is triggered; VI. Dynamically adjust models and strategies based on drone types and new mission requirements; Ⅶ. Regularly provide feedback on test results and strategy execution effects, and generate test reports.

2. The intelligent data security detection method for drones according to claim 1 is characterized in that: The specific steps for collecting and processing multi-source data in step II are as follows: S1.1: Collect the flow data, flight path data, sensor data and mission log data of the drone, and use the quartile algorithm to divide the environmental data and structural data in the original sensor data set into 4 parts in ascending order, each accounting for 25% of the entire data set, where the lower quartile is recorded as Q1, the median is recorded as Q2, and the upper quartile is recorded as Q3; S1.2: Calculate the difference between the upper quartile and the lower quartile and record it as the interquartile range I QR , according to Q1-1.5I QR and Q3+1.5I QR Get the inner limit of outliers [F L , F U ], and remove the data beyond this range. After the removal is completed, the missing values ​​in the data are filled by the cubic spline interpolation method, and each group of data is smoothed by a high-pass filter; S1.3: Map the data to the range of [0, 1] through normalization processing, and then convert each group of normalized data into a standard normal distribution. Extract the key points of velocity and acceleration in the trajectory from the cleaned and standardized data, analyze the change amplitude of the sensor, and calculate the operation frequency of the mission log to obtain the flight trajectory characteristics, sensor characteristics, and mission log characteristics. Generate comprehensive drone data security detection related data based on the extracted groups of feature data and known vulnerability libraries and threat intelligence data.

3. The intelligent data security detection method for drones according to claim 2 is characterized in that: The specific steps for building anomaly detection model described in step II are as follows: S2.1: Define the initial global model on the central server, collect the drones connected to the central server, and distribute it to each connected drone to update the architecture and parameters of each drone's local model. After that, each drone uses its own historical collected data as local data and uses the local data to train the local model; S2.2: Local training performs forward propagation on each local data to obtain the abnormal prediction value of each group of data, calculates the loss value between the abnormal prediction value and the actual value through the cross entropy function, transfers the loss value from the local model output layer to the input layer according to the chain rule, and calculates the gradient of the loss value to each network layer, and then uses gradient descent to update the model parameters; S2.3: Each drone repeatedly uses local data to feedback training and update the local model until its model loss value converges to the preset threshold. Each drone uploads the updated local model parameters to the central server. The central server receives the local model parameters of all clients, globally aggregates the collected local model parameters through weighted averaging, and updates the global model based on the aggregated parameter information. S2.4: Use the global model as the teacher model to calculate the output soft label prediction. The student model in the central server fits the soft label prediction by minimizing the distillation loss to obtain the corresponding lightweight model. The lightweight model is then transmitted to each drone and the original local model on the drone is replaced. The input data is calculated using the updated local model for anomaly scores. If the anomaly score is higher than the preset threshold, it is judged as an anomaly. At the same time, the drone local model is regularly updated based on the real-time prediction results.

4. The intelligent data security detection method for drones according to claim 3 is characterized in that: The specific steps for generating the user behavior baseline described in step III are as follows: S3.1: Set the UAV’s mission state to S and the operator’s action to A. Then extract the state-action pairs from the historical data and define the initial strategy π0 to represent the probability distribution of historical behaviors. Then, treat each mission state as a node and the action from the current state to the next state as an edge between two sets of nodes. S3.2: The current UAV mission state is taken as the root node. The root node generates multiple sets of different mission states according to the different behaviors of the operator, and the generated mission states are used as child nodes to construct the corresponding exploration tree. Starting from the root node, based on the upper confidence bound formula Calculate the UCB value of each child node, and select the child node with the highest UCB value layer by layer for exploration. i represents the upper confidence limit of node i, Q i represents the average reward of node i, C represents the exploration-exploitation trade-off coefficient, N represents the number of visits to the parent node, and n i represents the number of visits to node i; S3.3: If the selected child node does not fully expand all its selectable actions, then randomly select an unexplored behavior action, add the new state converted by the action as a new child node to the exploration tree, randomly sample behavior actions from the expanded child node, simulate the operator's behavior in the current scenario, and evaluate the behavior results; S3.4: The simulated reward is transmitted from the current node back to the root node, and the average reward and number of visits of each node in the same path are updated. After multiple rounds of exploration, the reward change value of the node converges to the preset range. After the exploration is completed, the path with the highest cumulative reward in the exploration tree is selected to generate the user behavior baseline.

5. The intelligent data security detection method for drones according to claim 4 is characterized in that: The specific steps of analyzing the probability of occurrence of potential threats based on real-time collected data described in step IV are as follows: S4.1: Collect and integrate the mission status of the drone and the operator's behavior, construct the corresponding state set and action set, calculate the probability of transferring from any state to other states by executing any action, and calculate the corresponding immediate reward; S4.2: Extract key features from the data collected by the drone in real time, map them to the corresponding states, use historical data and real-time data to calculate the state transition probability, then model each threat event suffered by the drone as a specific target state set, and calculate the probability of reaching the threat state from the current state; S4.2: Calculate the cumulative probability of potential threats, and use the reward function to evaluate the risk level of the current user behavior baseline. When the cumulative probability of a threat exceeding the set threshold, generate an alarm, trigger the drone safety mechanism, and readjust the user behavior baseline.

6. The intelligent data security detection method for drones according to claim 5, characterized in that: The specific steps for dynamically adjusting the model and strategy described in step VI are as follows: S5.1: Collect real-time data from the UAV's flight control system, sensors, and mission logs, input the data features into the UAV's pre-trained local model, and detect whether the model's output is abnormal behavior. Use the generated user behavior baseline to compare whether the behavior features of the real-time data significantly deviate from the baseline. When the deviation range exceeds the preset threshold, it is determined to be abnormal; S5.2: When abnormal behavior is detected, set the initial parameters of the model and strategy, initialize the temperature and decay rate, and define the optimization objective function of the parameters in combination with real-time data and baseline analysis results. Then randomly perturb the current parameters to generate new parameters and calculate their objective function values. S5.3: Calculate the probability of receiving the new parameters. If the probability of receiving the new parameters is higher than the random threshold, update the current strategy parameters. Otherwise, keep them unchanged. According to the temperature attenuation formula, update the current temperature by the preset attenuation rate, and repeat the perturbation and parameter replacement process until the temperature reaches the preset temperature value. Update the original parameters of the model and strategy based on the optimal parameter information.

Images