Low-altitude networked unmanned aerial vehicle identification method based on 4G5G mobile communication network

Abstract

The invention discloses a low-altitude network-connected unmanned aerial vehicle identification method based on a 4G5G mobile communication network, and relates to the field of low-altitude network-connected unmanned aerial vehicles, and the method comprises the steps: obtaining low-altitude radar data in a preset time period and a user signaling in the 4G5G mobile communication network, determining an unmanned aerial vehicle feature value in the user signaling, determining an unmanned aerial vehicle suspected result according to a preset network connection unmanned aerial vehicle event sequence and the event generation time of each signaling event in the user signaling; determining an unmanned aerial vehicle detection value in the low-altitude radar data, and when the sum of the unmanned aerial vehicle characteristic value and the unmanned aerial vehicle detection value is greater than a preset unmanned aerial vehicle suspected threshold value and the unmanned aerial vehicle suspected result comprises a suspected unmanned aerial vehicle, determining the unmanned aerial vehicle detection value; and determining the terminal device bound with the user number corresponding to the user signaling as the network-connected unmanned aerial vehicle so as to intercept the network-connected unmanned aerial vehicle through the user number. According to the invention, the problem of low identification accuracy of the networked unmanned aerial vehicle is solved, so that the accuracy of intercepting the networked unmanned aerial vehicle is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of low-altitude networked drones, and in particular to a method for identifying low-altitude networked drones based on 4G5G mobile communication networks. Background Art

[0002] Drone technology has been widely used in agriculture, construction, logistics, etc. The question that follows is how to effectively manage and monitor the flight of drones to ensure their safety and legal use. At present, drone interception solutions are mainly aimed at drones that use radio frequency transmission. They can be intercepted by interfering with the frequency band corresponding to the radio frequency drone.

[0003] As for networked drones transmitted through the operator's public network (for example, 4G (Fourth Generation) 5G (Fifth Generation) mobile communication network), the frequency bands used are the same as those used by ordinary telecommunication public network users (for example, mobile phone users). If the frequency bands corresponding to networked drones transmitted through the operator's public network are interfered with, ordinary telecommunication public network users using the operator's public network will be affected. Since networked drones and ordinary telecommunication public network users share the same frequency band, it is difficult to accurately identify networked drones in the operator's public network, so there is currently a technical problem of low accuracy in identifying networked drones.

[0004] The above contents are only used to assist in understanding the technical solutions of the embodiments of the present application, and do not constitute an admission that the above contents are prior art. Summary of the invention

[0005] The main purpose of the embodiments of the present application is to provide a method for identifying low-altitude networked drones based on a 4G5G mobile communication network, aiming to solve the problem of low accuracy in identifying networked drones.

[0006] To achieve the above objectives, the present application provides a method for identifying low-altitude networked drones based on a 4G5G mobile communication network, the method comprising: Acquire low-altitude radar data within a preset time period and user signaling in a 4G5G mobile communication network, wherein the user signaling includes one or more different signaling events, wherein the signaling event is a terminal type event, a power-on event, an Internet access event, a domain name event, a switching event, or a power-off event; Determine the drone feature value in the user signaling, and determine the drone suspected result according to the preset networked drone event sequence and the event generation time of each of the signaling events in the user signaling; Determine the UAV detection value in the low-altitude radar data. When the sum of the UAV eigenvalue and the UAV detection value is greater than the preset UAV suspicion threshold and the UAV suspicion result includes a suspected UAV, determine the terminal device bound to the user number corresponding to the user signaling as a networked UAV, so as to intercept the networked UAV through the user number.

[0007] In one embodiment, the step of determining the UAV eigenvalue in the user signaling includes: Determine the sub-eigenvalues of each signaling event, and perform weighted summation on the sub-eigenvalues to obtain the UAV eigenvalue.

[0008] In one embodiment, the step of determining the sub-eigenvalue of each signaling event includes: When the signaling event is a terminal type event, obtain the terminal type from the terminal type event; Search for the terminal eigenvalue corresponding to the terminal type in the preset terminal feature mapping relationship; Use the terminal eigenvalue as the sub-eigenvalue of the terminal type event; Wherein, the preset terminal feature mapping relationship includes preset terminal eigenvalues corresponding to multiple preset terminal types.

[0009] In one embodiment, the step of determining the sub-eigenvalue of each signaling event includes: When the signaling event is a domain name event, obtain the domain name from the domain name event; If the domain name exists in the preset UAV domain name whitelist, determine the sub-eigenvalue of the domain name event as the preset UAV domain name value; If the domain name does not exist in the preset UAV domain name whitelist, determine the sub-eigenvalue of the domain name event as the preset null value; If the sub-eigenvalue of the domain name event is the preset UAV domain name value, determine the sub-eigenvalue of the signaling event as the Internet access event as the preset UAV Internet access value; If the sub-eigenvalue of the domain name event is the preset null value, determine the sub-eigenvalue of the signaling event as the Internet access event as the preset null value.

[0010] In one embodiment, the step of determining the sub-eigenvalue of each signaling event includes: When the signaling event is a handover event, obtain the first handover base station location, the second handover base station location, the first moment of entering the base station service area where the first handover base station location is located, and the second moment of entering the base station service area where the second handover base station location is located from the handover event; Calculate a handover movement speed based on the first moment, the second moment, the first handover base station position, and the second handover base station position; If the handover movement speed is greater than a preset speed threshold, determine that the sub-feature value of the handover event is a preset UAV handover value; If the handover movement speed is less than or equal to the preset speed threshold, determine that the sub-feature value of the handover event is a preset null value.

[0011] In one embodiment, the step of determining the sub-feature value of each of the signaling events includes: In the case where there is a shutdown event and a startup event in the user signaling, the time difference between the shutdown moment of the shutdown event and the startup moment of the startup event is less than a preset duration threshold, the sub-feature value of the domain name event in the user signaling is a preset UAV domain name value, and the sub-feature value of the handover event is a preset UAV handover value, determine that the sub-feature value of the startup event is a preset UAV startup value, and determine that the sub-feature value of the shutdown event is a preset UAV shutdown value.

[0012] In one embodiment, the preset networked UAV event sequence includes a plurality of preset events sorted in sequence; The step of determining a UAV suspicion result based on the preset networked UAV event sequence and the event generation moment of each of the signaling events in the user signaling includes: For each of the signaling events existing in the user signaling, obtain the event generation moment from the signaling event, and sort the signaling events according to the event generation moment corresponding to each of the signaling events to obtain an event sorting, where the event generation moment of the signaling event sorted earlier in the event sorting is earlier than the signaling event sorted later; When the number of signaling events existing in the user signaling is the same as the number of preset events in the preset networked UAV event sequence, if the event sorting is consistent with the preset networked UAV event sequence, determine that the UAV suspicion result includes a suspected UAV; Among them, the preset networked UAV event sequence represents the event generation sequence during the operation of the networked UAV, and the preset events sorted in sequence in the event generation sequence are a preset terminal type event, a preset startup event, a preset Internet access event, a preset domain name event, a preset handover event, and a preset shutdown event.

[0013] In one embodiment, after the step of sorting the signaling events according to the event generation moment corresponding to each of the signaling events to obtain an event sorting, it further includes: When the number of signaling events existing in the user signaling is less than the number of preset events in the preset networked drone event sequence, if the relative order between any two existing signaling events in the event sorting is the same as the relative order between the corresponding two preset events in the preset networked drone event sequence, it is determined that the drone suspected result includes a suspected drone.

[0014] In one embodiment, the step of determining the drone detection value in the low-altitude radar data includes: Obtain the detected drone, the detection position and detection time of the drone from the low-altitude radar data; Determine the first handover base station position, the second handover base station position, the first time to enter the base station service area where the first handover base station position is located, and the second time to enter the base station service area where the second handover base station position is located from the handover events of the user signaling; If the detection time belongs to the period between the first time and the second time, and the detection position belongs to the base station service area where the first handover base station position is located and / or the base station service area where the second handover base station position is located, it is determined that the drone detection value is the product of the preset drone presence value and the preset detection weight.

[0015] In one embodiment, the method further includes: When it is determined that the terminal device bound to the user number is a networked drone, if it is detected that the networked drone enters a preset area and the networked drone belongs to the preset no-fly list of the preset area, the networked drone is disconnected from the network through the user number corresponding to the networked drone to intercept the networked drone corresponding to the user number.

[0016] In addition, to achieve the above object, an embodiment of the present application provides a low-altitude networked drone identification device based on a 4G / 5G mobile communication network. The device includes: An acquisition module, configured to acquire low-altitude radar data within a preset period and user signaling in the 4G / 5G mobile communication network. The user signaling includes one or more different signaling events, and the signaling events are terminal type events, power-on events, Internet access events, domain name events, handover events or power-off events; A determination module, configured to determine the drone characteristic value in the user signaling, and determine the drone suspected result according to the preset networked drone event sequence and the event generation time of each of the signaling events in the user signaling; An identification module, configured to determine a drone detection value in the low-altitude radar data, and when the sum of the drone eigenvalue and the drone detection value is greater than a preset drone suspicion threshold and the drone suspicion result includes a suspected drone, determine that the terminal device bound to the user number corresponding to the user signaling is a network-connected drone, so as to intercept the network-connected drone through the user number.

[0017] In addition, to achieve the above object, an embodiment of the present application further provides an electronic device, where the electronic device includes: a memory, a processor, and a program of the low-altitude network-connected drone identification method based on the 4G / 5G mobile communication network stored on the memory and executable on the processor. When the program of the low-altitude network-connected drone identification method based on the 4G / 5G mobile communication network is executed by the processor, the steps of the low-altitude network-connected drone identification method based on the 4G / 5G mobile communication network as described above can be implemented.

[0018] In addition, to achieve the above object, an embodiment of the present application further provides a computer-readable storage medium, on which a program for implementing the low-altitude network-connected drone identification method based on the 4G / 5G mobile communication network is stored. When the program of the low-altitude network-connected drone identification method based on the 4G / 5G mobile communication network is executed by the processor, the steps of the low-altitude network-connected drone identification method based on the 4G / 5G mobile communication network as described above are implemented.

[0019] In addition, to achieve the above object, an embodiment of the present application further provides a computer program product, including a computer program, and when the computer program is executed by a processor, the steps of the low-altitude network-connected drone identification method based on the 4G / 5G mobile communication network as described above are implemented.

[0020] One or more technical solutions proposed in the embodiments of the present application have at least the following technical effects: In the present application, user signaling in the 4G / 5G mobile communication network can be obtained. Since networked drones communicate in the 4G / 5G mobile communication network, and there are certain differences between the signaling generated by networked drones and the signaling generated by ordinary public network users, user signaling generated in the 4G / 5G mobile communication network can be obtained, so as to subsequently identify networked drones in combination with the user signaling. Also, since there is a predetermined order of generation for each signaling event corresponding to networked drones, the event order of networked drones and the generation time of each signaling event in the user signaling can be preset to determine the suspected drone result, and then the drone detection value can be determined through low-altitude radar data, so as to determine whether there is a drone in the low altitude through the low-altitude radar data. Furthermore, in the present application, when the sum of the drone feature value and the drone detection value is greater than the preset drone suspicion threshold and the drone suspicion result includes a suspected drone, it is determined that the terminal device bound to the user number corresponding to the user signaling is a networked drone. Thus, the identification of networked drones through user signaling and low-altitude radar data is realized, and the identification accuracy of networked drones in the 4G / 5G mobile communication network is improved, which is convenient for subsequently intercepting the networked drone corresponding to the user number through the user number. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings herein are incorporated into the specification and form a part of the specification, showing embodiments consistent with the embodiments of the present application, and are used together with the specification to explain the principles of the embodiments of the present application.

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the accompanying drawings required for use in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0023] Figure 1 It is a schematic flowchart of an embodiment of a method for identifying low-altitude networked drones based on the 4G / 5G mobile communication network according to an embodiment of the present application; Figure 2 It is a schematic diagram of the scenario corresponding to a networked drone in a method for identifying low-altitude networked drones based on the 4G / 5G mobile communication network according to an embodiment of the present application; Figure 3 It is a schematic flowchart of a method for identifying networked drones in a method for identifying low-altitude networked drones based on the 4G / 5G mobile communication network according to an embodiment of the present application; Figure 4 It is a schematic diagram of a module for intercepting networked drones in a method for identifying low-altitude networked drones based on the 4G / 5G mobile communication network according to an embodiment of the present application; Figure 5 This is a schematic diagram of the module structure of a low-altitude networked drone identification device based on a 4G5G mobile communication network according to an embodiment of the present application; Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the low-altitude networked drone identification method based on the 4G5G mobile communication network in the embodiment of the present application.

[0024] The purpose, features and advantages of the embodiments of the present application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0025] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the embodiments of the present application and are not used to limit the embodiments of the present application.

[0026] In order to better understand the technical solutions of the embodiments of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0027] With the continuous development of science and technology, drone technology has been widely used in various fields such as agriculture, construction, logistics, security, scientific research, etc. The problem that follows is how to effectively manage and monitor the flight of drones to ensure their safety and legal use. At present, the country has formulated relevant laws and regulations to regulate the use of drones, and has also conducted corresponding research on drone control technology.

[0028] The communication methods of drones can be divided into several main types according to the technology and transmission media they use, including radio frequency transmission, satellite communication transmission, optical communication transmission, and operator public network transmission.

[0029] Radio frequency transmission: This is the most commonly used communication method for drones. It uses radio waves to propagate in space to achieve communication between drones and ground control stations. It has the advantages of long transmission distance, high transmission rate, and strong anti-interference ability. The key technologies of radio frequency transmission include coding, modulation, signal processing and antenna technology. The frequency bands planned for use by drone systems include 1430-1444MHz (Megahertz), 2400-2476MHz, 5725-5829MHz, etc.

[0030] Satellite communication transmission: The communication between the UAV and the ground control station is realized by using satellite as a relay station. This method has a wide coverage and is suitable for long-distance and large-scale UAV communication.

[0031] Optical communication transmission: using optical means such as laser or optical fiber for communication, suitable for short-distance, high-bandwidth drone communication. The characteristics of optical communication transmission are high transmission rate, strong anti-interference ability and good confidentiality. Carrier public network transmission: The data and videos of the drone are transmitted over an unlimited distance through 4G or even 5G networks. This method improves the data transmission speed, enhances real-time performance and reliability, and is suitable for application scenarios that require high bandwidth and low latency. Drones using carrier public network transmission can be simply referred to as network-connected drones. Among the communication methods of drones, radio frequency transmission and carrier public network transmission are the most commonly used. Satellite communication transmission and optical communication transmission have relatively high technical thresholds for drones, and are usually less used in civilian drones. Currently, the existing drone interception solutions mainly target drones using radio frequency transmission and have no interception effect on those using carrier public network transmission.

[0032] The following is an explanation of drones using radio frequency transmission: Applications in drones using radio frequency transmission include, but are not limited to, remote control command sending, telemetry data reception, real-time video transmission, etc. These application scenarios require the radio transmission solution of the drone to have high reliability and anti-interference ability. Radio frequency transmission is based on the principle of electromagnetic wave propagation in the air, and information is transmitted from the drone to the ground control station through radio waves.

[0033] Therefore, currently, the main approach is to interfere with the communication link of drones using radio frequency transmission, so that they cannot receive control signals or navigation signals normally. For example, the following are some of the main interception solutions: 1. Omnidirectional radio jamming equipment: Such equipment emits strong jamming signals that match the communication frequency band of the drone, flooding or confusing the legitimate signals received by the drone, causing the drone to be unable to correctly parse control commands or positioning information, thereby achieving the forced landing, hovering, or return of the drone.

[0034] 2. Drone radio jamming equipment: This equipment emits radio waves of specific frequencies to interfere with the communication link, navigation signal, or control signal of the drone.

[0035] 3. Fixed radio monitoring stations: These monitoring stations can monitor and direction-find radio signals, measure the parameters of radio signals, and can automatically complete signal attribute identification, measurement, statistics, and analysis, etc.

[0036] 4. Portable radio monitoring and direction-finding systems: Such systems are suitable for on-site instant application requirements such as major event guarantee and emergency guarantee. They have the characteristics of small size, light weight, low power consumption, and fast deployment.

[0037] Therefore, the current interception scheme mainly interferes by interfering with specified communication frequency bands. The communication frequency bands occupied by radio frequency drones mainly concentrate on 1430 - 1444 MHz, 2400 - 2476 MHz, 5725 - 5829 MHz, etc. The communication frequency bands used by drones using the operator's public network for transmission are inconsistent with those used for radio frequency transmission.

[0038] Therefore, when the current interception scheme is used to intercept drones using the operator's public network for transmission, it cannot achieve the interception effect due to the inconsistent frequency bands. If the interception device uses the operator's public network for transmission and occupancy interception, it will cause serious interference to ordinary telecom public network users (such as mobile phone users), affecting the normal operations of the operator.

[0039] In summary, due to frequency band reasons, the current radio frequency transmission drone interception scheme has defects when intercepting drones using the operator's public network for transmission.

[0040] Therefore, this application proposes a method for identifying low - altitude network - connected drones based on the 4G / 5G mobile communication network. In the embodiments of this application, user signaling in the 4G / 5G mobile communication network can be obtained. Since network - connected drones communicate in the 4G / 5G mobile communication network, and there are certain differences between the signaling generated by network - connected drones and that generated by ordinary public network users, user signaling generated in the 4G / 5G mobile communication network can be obtained to facilitate subsequent identification of network - connected drones in combination with the user signaling. Also, since there is a predefined order of generation for each signaling event corresponding to network - connected drones, the event order of network - connected drones and the generation time of each signaling event in the user signaling can be preset to determine the drone suspicion result. Then, the drone detection value can be determined through low - altitude radar data to determine whether there is a drone in the low altitude through the low - altitude radar data. Furthermore, in the embodiments of this application, when the sum of the drone characteristic value and the drone detection value is greater than the preset drone suspicion threshold and the drone suspicion result includes a suspected drone, it is determined that the terminal device bound to the user number corresponding to the user signaling is a network - connected drone, thus realizing the identification of network - connected drones through user signaling and low - altitude radar data, improving the identification accuracy of network - connected drones in the 4G / 5G mobile communication network, and facilitating subsequent interception of the network - connected drone corresponding to the user number through the user number.

[0041] Based on this, the embodiments of this application provide a method for identifying low - altitude network - connected drones based on the 4G / 5G mobile communication network. Refer to Figure 1 , Figure 1This is a schematic flowchart of the first embodiment of the method for identifying low-altitude networked drones based on 4G / 5G mobile communication networks in the embodiments of this application. The method for identifying low-altitude networked drones based on 4G / 5G mobile communication networks includes steps S10 to S30: Step S10: Obtain low-altitude radar data and user signaling in the 4G / 5G mobile communication network during a preset time period. The user signaling includes one or more different signaling events, and the signaling events are terminal type events, power-on events, Internet access events, domain name events, handover events, or power-off events; It should be noted that networked drones communicate through 4G / 5G mobile communication networks. The 4G and 5G networks have the characteristics of low latency and high bandwidth, providing sufficient development space for the development of networked drones. The 4G / 5G network endows networked drones with important capabilities such as real-time ultra-high-definition backhaul, a large number of connection numbers, and remote low-latency control. The preset time period can be set customarily. The duration of the preset time period can be data such as 30 minutes or 5 minutes. For example, the preset time period can also be the time period between 9 o'clock and 9:30. This embodiment does not make specific limitations on this.

[0042] The low-altitude radar data is the data in the low altitude scanned by the radar. The low altitude is the height from 120 meters to 300 meters above the ground. The radar data can scan the objects appearing in the low altitude, which is convenient for subsequently verifying and determining whether there are networked drones in combination with the low-altitude radar data.

[0043] The user signaling can be the signaling corresponding to the user number. Different user numbers may not have the same corresponding user signaling. The user signaling can include at least one signaling event, and the user signaling can also include multiple signaling events. For example, the user signaling can include terminal type events, power-on events, Internet access events, domain name events, handover events, and / or power-off events, and the various signaling events included in the same user signaling are different. The user signaling is the signaling event generated by the terminal device corresponding to the user number through the 4G / 5G mobile communication network, and can be obtained from the core network (Core Network, CN) corresponding to the 4G / 5G mobile communication network. For example, reference can be made to Figure 2 , Figure 2 which shows the communication schematic diagram of the networked drone, Figure 2 which includes a core network. The core network is connected to base station J. Base station J is a 4G / 5G base station. The networked drone can communicate with the base station, and the base station can communicate with the core network. The core network has a corresponding service terminal, and the user signaling can be obtained from the service terminal corresponding to the core network.

[0044] For example, it can be obtained from interfaces such as MRO (Measurement Report for Optimization), MME (Mobility Management Entity), HTTP (Hyper - Text Transfer Protocol), NRMRO (New Radio Measurement Report for Optimization), N1 / N2 (key interfaces between the core network and the terminal device (UE) and the base station), and N3 (user plane interface) in the service terminal of the core network. This embodiment does not make specific limitations in this regard. N3 is the interface between the base station and the user plane function (UPF, User Plane Function) in 5G and is responsible for data transmission. For example, the terminal type event can be used to determine the type of the terminal device bound to the user number. The terminal type event and the power - on event can be obtained from the N1 / N2 interface. The power - on event is an event generated when the terminal device bound to the user number is powered on. The Internet access event can be obtained from the HTTP interface. The Internet access event is an event generated when the terminal device bound to the user number applies for Internet access. The domain name event of the user number within a preset time period can be obtained from the HTTP interface. The domain name event may include the domain name accessed by the terminal device through the 4G / 5G mobile communication network. The domain name can be a website name, such as a DNS domain name. The handover event can be obtained from the MME interface. The handover event is an event generated when the terminal device bound to the user number moves. The power - off event can also be obtained from N1 / N2. The power - off event is an event generated when the terminal device bound to the user number is powered off.

[0045] Since the behaviors of network - connected drones are different from those of ordinary telecom users. For example, the length of time that network - connected drones stay online and the duration between power - on and power - off are different from those of ordinary telecom users. Therefore, it is possible to identify whether it is a network - connected drone by combining user signaling.

[0046] Exemplarily, low - altitude radar data, as well as terminal type events, power - on events, Internet access events, domain name events, handover events, and / or power - off events corresponding to the same user number in the 4G / 5G mobile communication network, can be obtained within a preset time period.

[0047] Step S20: Determine the drone feature value in the user signaling, and determine the suspected drone result according to the preset network - connected drone event sequence and the event generation time of each signaling event in the user signaling. It should be noted that the drone eigenvalue can be used to evaluate the possibility that the user signaling is generated by a networked drone in the 4G / 5G mobile communication network. The higher the drone eigenvalue, the higher the possibility that the user signaling is generated by a networked drone; the lower the drone eigenvalue, the lower the possibility that the user signaling is generated by a networked drone. The event generation times of different signaling events are not necessarily the same, and the event generation time table records the time when the signaling event occurs.

[0048] The preset networked drone event sequence represents the event generation sequence when the networked drone is running. The drone suspicion result can reflect whether the sequence of occurrence of each signaling event in the user signaling conforms to the preset networked drone event sequence. Therefore, in this embodiment, the drone suspicion result can be determined through the preset networked drone event sequence and the generation time of each event, so as to subsequently determine whether the terminal device corresponding to the user signaling is a networked drone.

[0049] Exemplarily, the drone eigenvalue can be determined based on each signaling event in the user signaling, and then the drone suspicion result can be determined according to the preset networked drone event sequence and the generation time of each signaling event in the user signaling.

[0050] In a feasible embodiment, step S20 further includes step S21: determining the sub-eigenvalue of each signaling event, and performing weighted summation on the sub-eigenvalues to obtain the drone eigenvalue.

[0051] It should be noted that the sub-eigenvalue can be used to evaluate the possibility that the signaling event is generated by a networked drone in the 4G / 5G mobile communication network. The sub-eigenvalue of the signaling event can be determined based on the signaling event itself, or based on the signaling event itself and other signaling events in the user signaling.

[0052] The weights corresponding to different signaling events can be the same or different, and this embodiment does not make specific limitations on this. For a signaling event that has a greater impact on determining whether it is a networked drone, its weight is also higher.

[0053] For example, according to each signaling event, the sub-eigenvalue of each signaling event is determined, and weighted summation can be performed on the sub-eigenvalues to obtain the drone eigenvalue. In this embodiment, by comprehensively evaluating each signaling event existing in the user signaling, the accuracy of the drone eigenvalue can be improved.

[0054] In a feasible embodiment, step S21 further includes steps S211 to S213: Step S211, when the signaling event is a terminal type event, obtain the terminal type from the terminal type event; Step S212, look up the terminal feature value corresponding to the terminal type in the preset terminal feature mapping relationship; Step S213, taking the terminal feature value as a sub-feature value of the terminal type event; Among them, the preset terminal feature mapping relationship includes preset terminal feature values corresponding to multiple preset terminal types respectively.

[0055] It should be noted that the terminal type event includes the terminal type corresponding to the user number. There will be communication cards for communication in 4G / 5G mobile communication networks in networked drones. Each communication card has its own corresponding communication number, and this communication number can be the user number. Corresponding communication cards are also set on the terminals of non-networked drones such as ordinary mobile phone terminals or Internet of Things terminals. The communication cards set on the terminals of non-networked drones are generally SIM cards, and the SIM cards also have corresponding numbers. The terminal types adapted by different communication cards are not necessarily the same. Therefore, the terminal type corresponding to the user number in the terminal type event can be obtained to determine whether the user number can be adapted to the networked drone.

[0056] For example, when a networked drone communicates in a 4G / 5G mobile communication network, the reported terminal type is generally Dongle (Dongle Adapter, wireless data adapter) adapter or Module (Module Adapter, module adapter) adapter, while the reported terminal type for ordinary mobile phone users during communication is generally Mobile Phone (mobile phone). The terminal types of Dongle adapter and Module adapter can support other Internet of Things devices in addition to networked drones. Therefore, just obtaining the terminal type event may not accurately determine that when the terminal type is Dongle adapter or Module adapter, the terminal device corresponding to this terminal type must be a networked drone. Therefore, other signaling events need to be combined for judgment.

[0057] The preset terminal feature mapping relationship can be set based on 3GPP (3rd Generation Partnership Project) specifications. For example, the preset terminal feature mapping relationship includes that multiple preset terminal types can be preset Dongle adapter, preset Module adapter, preset Mobile Phone, and preset unknown terminal type respectively. The preset terminal feature values of the preset Dongle adapter and the preset Module adapter are both 1, the preset terminal feature value of the preset Mobile Phone is 0, and the preset terminal feature value of the preset unknown terminal type is -1. The preset unknown terminal type indicates that the terminal type corresponding to the user number is unknown, and it can be considered that the terminal types other than Dongle adapter, Module adapter, and Mobile Phone are unknown terminal types.

[0058] A preset terminal characteristic value of 1 indicates that the terminal type is adapted to the networked drone, a preset terminal characteristic value of 0 indicates that the terminal type is not adapted to the networked drone, and a preset terminal characteristic value of -1 indicates the terminal type corresponding to an unknown user number.

[0059] Exemplarily, when the signaling event is a terminal type event, obtain the terminal type from the terminal type event; when the terminal type is a Dongle adapter or a Module adapter, the terminal characteristic value corresponding to the terminal type is found to be 1 in the preset terminal characteristic mapping relationship. When the terminal type is a Mobile Phone, the terminal characteristic value corresponding to the terminal type is found to be 0 in the preset terminal characteristic mapping relationship. When the terminal type is a preset unknown terminal type, the terminal characteristic value corresponding to the terminal type is found to be -1 in the preset terminal characteristic mapping relationship, and use the terminal characteristic value as the sub-characteristic value of the terminal type event.

[0060] This embodiment facilitates improving the accuracy of identifying networked drones by identifying the terminal type.

[0061] In a feasible embodiment, step S21 further includes steps A10 to A50: Step A10: When the signaling event is a domain name event, obtain the domain name from the domain name event; Step A20: If the domain name exists in the preset drone domain name whitelist, determine that the sub-characteristic value of the domain name event is the preset drone domain name value; Step A30: If the domain name does not exist in the preset drone domain name whitelist, determine that the sub-characteristic value of the domain name event is the preset null value; Step A40: If the sub-characteristic value of the domain name event is the preset drone domain name value, determine that the sub-characteristic value of the signaling event for the Internet access event is the preset drone Internet access value; Step A50: If the sub-characteristic value of the domain name event is the preset null value, determine that the sub-characteristic value of the signaling event for the Internet access event is the preset null value.

[0062] It should be noted that the domain name is the name of the website accessed by the terminal device. The website name accessed by the networked drone is generally the name of the server website corresponding to the manufacturer of the drone. For non-networked drone terminal devices, such as ordinary mobile phone users, they generally do not access the server website corresponding to the drone. The preset drone domain name whitelist contains the drone website names pre-determined to be related to drones, and the corresponding drone website names can be manually added to the preset drone domain name whitelist.

[0063] The preset UAV domain name whitelist can be pre-configured, and this embodiment does not make specific limitations on this. For example, when configuring the UAV domain name whitelist, the website name set can be obtained first, and the website names corresponding to mobile phones, tablets, vehicle terminals, and shared bicycles are automatically excluded from the website name set, so that a list containing UAV domain names can be initially obtained. Then, the list of UAV domain names can be manually deleted to obtain the preset UAV domain name whitelist. Since the website names corresponding to mobile phones, tablets, vehicle terminals, and shared bicycles are all limited, the preset UAV domain name whitelist can be determined by screening.

[0064] The preset UAV domain name value can be 1. When the sub-feature value of the domain name event is the preset UAV domain name value, it indicates that the probability that the domain name event is generated by a network-connected UAV is relatively high. The preset null value can be 0. When the sub-feature value of the domain name event is the preset null value, it indicates that the probability that the domain name event is generated by a network-connected UAV is low.

[0065] The sub-feature value of the Internet access event needs to be determined based on the domain name event. Since ordinary mobile phone users also perform Internet access operations, there will also be Internet access events. Therefore, if it is necessary to distinguish whether the Internet access event is generated by a network-connected UAV, it can be determined by combining the domain name event.

[0066] The preset UAV Internet access value can be 1. When the sub-feature value of the Internet access event is the preset UAV Internet access value, it indicates that the probability that the Internet access event is generated by a network-connected UAV is relatively high. When the sub-feature value of the Internet access event is the preset null value, it indicates that the probability that the Internet access event is generated by a network-connected UAV is relatively low, and it may not be generated by a network-connected UAV.

[0067] Exemplarily, when the signaling event is a domain name event, the domain name is obtained from the domain name event. If the domain name exists in the preset UAV domain name whitelist, the sub-feature value of the domain name event is determined to be the preset UAV domain name value; if the domain name does not exist in the preset UAV domain name whitelist, the sub-feature value of the domain name event is determined to be the preset null value; if the sub-feature value of the domain name event is the preset UAV domain name value, it can be indicated that the domain name event corresponding to the user number is very likely to be generated by a network-connected UAV, so the sub-feature value of the Internet access event can be the preset UAV Internet access value; if the sub-feature value of the domain name event is the preset null value, it indicates that the domain name event corresponding to the user number is probably not generated by a network-connected UAV, so it can be determined that the sub-feature value of the signaling event for the Internet access event is the preset null value.

[0068] This embodiment evaluates whether it is a network-connected UAV through the domain name, which can improve the accuracy of UAV recognition. Moreover, the sub-feature value of the Internet access event is also determined in combination with the domain name event, which can also improve the recognition accuracy of network-connected UAVs.

[0069] In a feasible embodiment, step S21 further includes steps B10 to B40: Step B10, when the signaling event is a handover event, obtain the first handover base station location, the second handover base station location, the first moment of entering the base station service area where the first handover base station location is located, and the second moment of entering the base station service area where the second handover base station location is located from the handover event; Step B20, calculate the handover movement speed according to the first moment, the second moment, the first handover base station location, and the second handover base station location; Step B30, if the handover movement speed is greater than the preset speed threshold, determine that the sub - characteristic value of the handover event is the preset UAV handover value; Step B40, if the handover movement speed is less than or equal to the preset speed threshold, determine that the sub - characteristic value of the handover event is the preset null value.

[0070] It should be noted that the handover event may include two handover sub - events. Each time the terminal device switches to a new base station, a handover sub - event is generated. Therefore, at least two handover sub - events can be determined from the handover event. For example, it can be the first handover sub - event and the second handover sub - event. The first handover base station location and the first moment of entering the base station service area where the first handover base station location is located can be determined from the first handover sub - event, and the second handover base station location and the second moment of entering the base station service area where the second handover base station location is located can be determined from the second handover sub - event.

[0071] Each base station has its corresponding base station service range, and there may be some overlap between the base station service ranges of different base stations. The first handover base station location can be the location of the base station itself. For example, it can be the central location of the base station service range, and the second handover base station is also the corresponding location of the base station itself.

[0072] During the flight of a connected drone, as the altitude increases and the position moves, the base stations communicating with the connected drone will change accordingly, and handover events will occur during the process of base station change. For ordinary mobile phone users, there will also be situations where the base station changes when moving on the ground. Therefore, in this embodiment, the handover movement speed of the terminal device corresponding to the user number can be calculated based on the handover event to evaluate whether the handover event is generated by a connected drone. For example, referring to the XDR (eXtensible Data Record) information of the MME interface in the DPI (Deep Packet Inspection) specification, the handover event can be obtained from the data decoded from S1AP (S1 Application Protocol)-NAS (Non-Access-Stratum) in the XDR information. For example, the handover event can be obtained from the decoded fields. For example, each field can be: X2 handover, S1 handoverinS1 (handover in based on the S1 interface, where S1 refers to the interface between the MME and the base station), and S1 handover outS1 (handover out based on the S1 interface). The base station that the terminal device has recently switched to can be obtained from S1 handover inS1, and the base station before the terminal device switches to the new base station can be obtained from S1handover outS1.

[0073] The preset drone handover value can be 1. When the sub-feature value of the handover event is the preset drone handover value, it indicates that the probability that the handover event is generated by a connected drone is relatively high. When the sub-feature value of the handover event is the preset null value, it indicates that the probability that the handover event is generated by a connected drone is relatively low and may not be generated by a connected drone. The preset speed threshold can be set based on the actual situation, and this embodiment does not make specific limitations on this. When the handover movement speed is greater than the preset speed threshold, it indicates that the handover movement speed is relatively fast, and this handover event is very likely to be generated by a connected drone. When the handover movement speed is less than or equal to the preset speed threshold, it indicates that the handover movement speed is relatively slow, and this handover event may not be generated by a connected drone. Since a connected drone may be stationary, and ordinary mobile phone users may also take transportation, resulting in a relatively fast speed of base station handover corresponding to the mobile phone user, it is difficult to determine whether the terminal device is a connected drone only based on the handover movement speed. Therefore, it is also necessary to comprehensively evaluate by combining other signaling events in the user signaling except the handover event to accurately identify the connected drone.

[0074] Exemplarily, when the signaling event is a handover event, obtain the first handover base station location, the second handover base station location, the first moment of entering the service area of the base station where the first handover base station location is located, and the second moment of entering the service area of the base station where the second handover base station location is located from the handover event, calculate the difference between the first moment and the second moment to obtain the handover duration, calculate the relative distance between the first handover base station location and the second handover base station location, and calculate the handover movement speed through the handover duration and the relative distance; if the handover movement speed is greater than the preset speed threshold, determine that the sub-feature value of the handover event is the preset UAV handover value; if the handover movement speed is less than or equal to the preset speed threshold, determine that the sub-feature value of the handover event is the preset null value. In other embodiments, the motion state can also be identified in combination with the handover event. For example, when the handover movement speed is 0, it can be considered a stationary state, and when the handover movement speed is greater than 0, it can be considered a motion state. This embodiment combines the handover event for identification, thereby facilitating the improvement of the identification accuracy of the networked UAV.

[0075] In a feasible embodiment, step S21 further includes step C10: when there are a shutdown event and a startup event in the user signaling, the difference between the shutdown moment of the shutdown event and the startup moment of the startup event is less than the preset duration threshold, the sub-feature value of the domain name event in the user signaling is the preset UAV domain name value, and the sub-feature value of the handover event is the preset UAV handover value, determine that the sub-feature value of the startup event is the preset UAV startup value, and determine that the sub-feature value of the shutdown event is the preset UAV shutdown value.

[0076] It should be noted that during the startup period of the networked UAV, the communication card of the adapter of the networked UAV will interact with the 4G / 5G mobile communication network to generate a connection request signaling. If the connection request signaling corresponding to the user number can be obtained, it can be determined that there is a startup event. For example, the connection request signaling may be included in the user signaling, and the connection request signaling represents the generation of a startup event.

[0077] Due to battery power reasons, the networked UAV needs to replace the battery or shut down after completing the flight mission, so it will also generate a shutdown signaling in the 4G / 5G mobile communication network. For example, the shutdown signaling may be included in the user signaling, and the shutdown event is included in the shutdown signaling.

[0078] Ordinary mobile phone users may also have corresponding power-on events and power-off events. However, the power-off events and power-on events generated by ordinary mobile phone users may not be so frequent, and the power-on duration is generally longer than that of networked drones. Therefore, when evaluating whether the power-on event and / or power-off event is generated by a networked drone, the power-on moment can be determined from the power-on event, and the power-off moment can be determined from the power-off event. Then, the difference between the power-off moment and the power-on moment can be calculated to obtain the power-on duration, and the power-on duration can be combined to evaluate whether the power-on event and / or power-off event is likely to be generated by a networked drone.

[0079] In addition, if the sub-feature value of the domain name event is the preset drone domain name value and the sub-feature value of the switching event is the preset drone switching value, it indicates that the terminal device corresponding to the user number is very likely to be a networked drone. Therefore, the domain name event and the switching event can also be combined to jointly evaluate whether the terminal device is likely to be a networked drone, because ordinary mobile phone users may not have the switching movement speed corresponding to a networked drone, nor will they necessarily visit the website corresponding to the drone.

[0080] Moreover, if both a power-off event and a power-on event exist in the user signaling, it also indicates that it is very likely to be a networked drone, because the user signaling is collected within a preset time period, and ordinary mobile phone users may not all generate power-on events and power-off events within the preset time period. Therefore, in this embodiment, by using the power-on duration, whether there are both a power-on event and a power-off event, and combining the domain name event and the switching event, the accuracy of identifying networked drones can be improved.

[0081] The preset drone power-on value can be 1, and the preset drone power-off value can be 1. When the sub-feature value of the power-on event is the preset drone power-on value, it indicates that the probability that the power-on event is generated by a networked drone is relatively high. When the sub-feature value of the power-on event is the preset null value, it indicates that the probability that the power-on event is generated by a networked drone is relatively low and may not be generated by a networked drone. When the sub-feature value of the power-off event is the preset drone power-off value, it indicates that the probability that the power-off event is generated by a networked drone is relatively high. When the sub-feature value of the power-off event is the preset null value, it indicates that the probability that the power-off event is generated by a networked drone is relatively low and may not be generated by a networked drone.

[0082] Exemplarily, in the case where there are a power-off event and a power-on event in the user signaling, the difference between the power-off moment of the power-off event and the power-on moment of the power-on event is less than the preset duration threshold, the sub-feature value of the domain name event in the user signaling is the preset drone domain name value, and the sub-feature value of the switching event is the preset drone switching value, the sub-feature value of the power-on event is determined to be the preset drone power-on value, and the sub-feature value of the power-off event is determined to be the preset drone power-off value.

[0083] In the case where there is a shutdown event in the user signaling, the sub - eigenvalue of the domain name event in the user signaling is the preset UAV domain name value, and the sub - eigenvalue of the handover event is the preset UAV handover value, determine that the sub - eigenvalue of the startup event is the preset null value, and determine that the sub - eigenvalue of the shutdown event is the preset UAV shutdown value. In this case, it indicates that the startup event may be lost, but the shutdown event may also be generated by the connected UAV, so the sub - eigenvalue of the shutdown event is the preset UAV shutdown value.

[0084] In the case where there is a startup event in the user signaling, the sub - eigenvalue of the domain name event in the user signaling is the preset UAV domain name value, and the sub - eigenvalue of the handover event is the preset UAV handover value, determine that the sub - eigenvalue of the startup event is the preset UAV startup value, and determine that the sub - eigenvalue of the shutdown event is the preset null value. In this case, it indicates that the shutdown event may be lost, but the startup event may also be generated by the connected UAV, so the sub - eigenvalue of the startup event is the preset UAV startup value.

[0085] In the case where the sub - eigenvalue of the domain name event in the user signaling is the preset null value and / or the sub - eigenvalue of the handover event is the preset null value, determine that the sub - eigenvalue of the startup event is the preset null value, and determine that the sub - eigenvalue of the shutdown event is the preset null value. In this case, the probability that the domain name event and / or the handover event is generated by the connected UAV is low, so the startup event and the shutdown event may not be generated by the connected UAV either. The sub - eigenvalue of the startup event is the preset null value, and the sub - eigenvalue of the shutdown event is determined to be the preset null value.

[0086] In the case where there are a shutdown event and a startup event in the user signaling, and the difference between the shutdown time of the shutdown event and the startup time of the startup event is greater than the preset duration threshold, determine that the sub - eigenvalue of the startup event is the preset null value, and determine that the sub - eigenvalue of the shutdown event is the preset null value. In this case, it indicates that the startup duration is too long, and the startup event and the shutdown event may not be generated by the connected UAV.

[0087] For a better understanding of the UAV eigenvalue and the UAV detection value in this embodiment, refer to Table 1: Table 1:

[0088] Table 1 shows the user signaling and low-altitude radar data corresponding to three user numbers, namely user number 1 to user number 3. In Table 1, a data value of 0 indicates that there is no signaling event corresponding to the user number with a data value of 0. For example, user number 1 has no Internet access event and handover event, and user number 3 has no power-on event, Internet access event, and handover event. Among them, the weight a in the table is the weight corresponding to the terminal type event. When there is a terminal type event, the corresponding sub-feature value can be 1. Therefore, when there is a terminal type event, it can be the sub-feature value 1 of the terminal type event multiplied by the weight a. So, the weight a will be displayed in the table. The corresponding weights b, c, d, e, and f are the weights corresponding to the power-on event, Internet access event, domain name event, handover event, and power-off event respectively. The weight g is the preset detection weight corresponding to the low-altitude radar data. Correspondingly, when there is a power-on event, the sub-feature value corresponding to the power-on event is 1. When there is an Internet access event, the sub-feature value corresponding to the Internet access event is 1. When there is a domain name event, the sub-feature value corresponding to the domain name event is 1. When there is a handover event, the sub-feature value corresponding to the handover event is 1. When there is a power-off event, the sub-feature value corresponding to the power-off event is 1. When there is a drone matching the user signaling in the low-altitude radar data, the corresponding drone detection value is 1. Therefore, the corresponding weights will be displayed in the table.

[0089] The sum of the drone feature value and the drone detection value of user number 1 is: weight a + weight b + weight c + weight d + weight e + weight f + weight g; The sum of the drone feature value and the drone detection value of user number 2 is: weight a + weight b + 0 + weight d + 0 + weight f + weight g; The sum of the drone feature value and the drone detection value of user number 3 is: weight a + 0 + 0 + weight d + 0 + weight f + weight g; Furthermore, it is possible to identify whether the terminal device corresponding to each user number is likely to be a networked drone based on the sum of the drone feature value and the drone detection value.

[0090] In a feasible embodiment, the preset networked drone event sequence includes multiple preset events sorted in sequence. Step S21 further includes steps D21 to D22: Step D21, for each signaling event existing in the user signaling, obtain the event generation time from the signaling event, and sort the signaling events according to the event generation times corresponding to the respective signaling events to obtain an event sequence. Among them, the event generation time of the signaling event sorted earlier in the event sequence is earlier than that of the signaling event sorted later; Step D22: When the number of signaling events in the user signaling is the same as the number of preset events in the preset networked drone event sequence, if the event order is consistent with the preset networked drone event sequence, it is determined that the drone suspected result includes a suspected drone. Among them, the preset networked drone event sequence represents the event generation sequence when the networked drone is running. The preset events sorted in sequence in the event generation sequence are respectively the preset terminal type event, the preset power-on event, the preset Internet access event, the preset domain name event, the preset handover event, and the preset power-off event.

[0091] It should be noted that the event generation time is the generation time corresponding to the signaling event. For example, the event generation time of the power-on event can be the power-on time, the event generation time of the power-off event can be the power-off time, and the event generation time of the handover event can be the first time or the second time. Because for a networked drone, the power-on event is performed first, and then the Internet access event and the domain name event are performed before the handover event can occur. Therefore, both the first time and the second time in the handover event are after the power-on event, the Internet access event, and the domain name event, and also before the power-off event. So the event generation time of the handover event can be the first time or the second time. And the event generation time of the terminal type event may be the same as the power-on event.

[0092] The event order is the order of each signaling event existing in the user signaling. The event generation time of the signaling event sorted earlier in the event order is earlier than that of the signaling event sorted later.

[0093] The preset networked drone event sequence represents the event generation sequence when the networked drone is running. The order of generation of each preset event in the event generation sequence is, in sequence, the preset terminal type event, the preset power-on event, the preset Internet access event, the preset domain name event, the preset handover event, and the preset power-off event. Among them, the times of the preset terminal type event and the preset power-on event can also be the same, and the preset terminal type event and the preset power-on event can both be sorted in the same order.

[0094] The number in the preset networked drone event sequence is 6. If the number of signaling events in the user signaling is also 6, it means that the user signaling includes all signaling events and there is no situation of missing signaling. Therefore, the event order and the preset networked drone order can be directly compared. If the event order is the same as the preset networked drone order, it is determined that the drone suspected result includes a suspected drone. A suspected drone indicates that the event order is the same as the preset networked drone event sequence. The drone suspected result can also include that it is not a networked drone.

[0095] Exemplarily, for each signaling event existing in the user signaling, obtain the event generation time from the signaling event, and sort the signaling events according to the event generation time corresponding to each signaling event to obtain an event sorting; when the number of signaling events existing in the user signaling is the same as the number of preset events in the preset networked UAV event sequence, if the event sorting is consistent with the preset networked UAV event sequence, determine that the UAV suspected result includes a suspected UAV; if the event sorting is different from the preset networked UAV event sequence, determine that the UAV suspected result includes not a networked UAV. If it is determined that the UAV suspected result includes not a networked UAV, it can be directly determined that the terminal device corresponding to the user number is not a networked UAV, and subsequent verification using low-altitude radar data may not be required either.

[0096] In a feasible embodiment, after step D21, step D211 is further included: when the number of signaling events existing in the user signaling is less than the number of preset events in the preset networked UAV event sequence, if the relative order between any two signaling events existing in the event sorting is the same as the relative order between the corresponding two preset events in the preset networked UAV event sequence, determine that the UAV suspected result includes a suspected UAV.

[0097] It should be noted that when the number of signaling events existing in the user signaling is less than the number of preset events in the preset networked UAV event sequence, it indicates that there may be missing signaling events in the user signaling, or there may be signaling events that are not generated by the terminal device corresponding to the user signaling. For example, the terminal device may not generate a shutdown event or a handover event, etc. If the user signaling is generated by a networked UAV, there may be a situation of signaling loss, resulting in not all signaling events in the user signaling. Therefore, when the number of signaling events existing in the user signaling is less than the number of preset events in the preset networked UAV event sequence, it cannot be directly determined that the terminal device corresponding to the user signaling is not a networked UAV.

[0098] Therefore, in this embodiment, it can be determined whether the UAV suspected result includes a suspected UAV by comparing whether the relative order between any two signals in the event sorting is the same as the relative order between the corresponding two preset events in the preset networked UAV event sequence. If they are the same, it can be determined that the UAV suspected result includes a suspected UAV. If there is an inverse order in the event sequence that contradicts the preset networked UAV event sequence, it is determined that the UAV suspected result includes not a networked UAV.

[0099] The relative order of two signaling events in reverse order is not the preset relative order, and the preset relative order can be determined from the preset networked drone event order. For example, in event sorting, any first target signaling event and any second target signaling event are determined. The first target signaling event is different from the second target signaling event. The first target signaling event is any signaling event existing in the user signaling, and the second target signaling event is any signaling event existing in the user signaling.

[0100] The first target signaling event corresponds to a first target preset signaling event in the preset networked drone event order, and the second target signaling event corresponds to a second target preset signaling event in the preset networked drone event order. The preset relative order is determined based on the first target preset signaling event and the second target preset signaling event. If the preset relative order is different from the relative order between the first target signaling event and the second target signaling event, it is determined that the drone suspected result includes that it is not a networked drone. In other embodiments, if there is no reverse order in the event order that contradicts the preset networked drone event order, it can be determined that the drone suspected result includes a suspected drone.

[0101] For example, when the event sorting is: handover event, Internet access event, and power-on event, the relative sorting between the power-on event and the Internet access event in the event sorting is that the power-on event is sorted after the Internet access event. Then the power-on event corresponds to a preset power-on event in the preset networked drone event order, and the Internet access event corresponds to a preset Internet access event in the preset networked drone event. The preset relative order of the preset power-on event and the preset Internet access event is: the preset power-on event is sorted before the preset Internet access event. The preset relative order is different from the relative order in the event sorting, so it can be determined that the drone suspected result does not include a networked drone.

[0102] This embodiment can also evaluate whether the terminal device corresponding to the user signaling is a networked drone in the case where a signaling event is missing in the user signaling, thereby improving the accuracy of identifying networked drones. It can also avoid missing networked drones.

[0103] Step S30: Determine the drone detection value in the low-altitude radar data. When the sum of the drone feature value and the drone detection value is greater than the preset drone suspicion threshold and the drone suspected result includes a suspected drone, determine that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone through the user number.

[0104] It should be noted that the drone detection value indicates that a drone matching the user signaling is detected through the low-altitude radar data, indicating that the detection time of the drone detected by the low-altitude radar data is within the first time to the second time of the handover event, and the detection position of the drone is within the base station service area corresponding to the handover event.

[0105] The sum of the UAV eigenvalue and the UAV detection value is greater than the preset UAV suspicion threshold, and the UAV suspicion result includes a suspected UAV, indicating that the user signaling is very likely to be generated by a networked UAV. However, if the UAV eigenvalue is less than or equal to the preset UAV suspicion threshold, it is determined that the user signaling is not generated by a networked UAV. If the UAV suspicion result includes not a networked UAV, it indicates that the user signaling is not generated by a networked UAV.

[0106] Based on the UAV detected in the low-altitude radar data, the detection time of the UAV, and the detection location, it can be determined whether there is actually a UAV at the position and time corresponding to the handover event. The low-altitude radar data can scan the UAVs appearing in the low altitude, but it cannot identify which type of UAV it is, that is, it cannot identify whether it is a networked UAV. Therefore, the low-altitude radar data can be combined to evaluate whether the terminal device corresponding to the user signaling is a networked UAV.

[0107] Exemplarily, when the sum of the UAV eigenvalue and the UAV detection value is greater than the preset UAV suspicion threshold and the UAV suspicion result includes a suspected UAV, it is determined that the terminal device bound to the user number corresponding to the user signaling is a networked UAV; when the sum of the UAV eigenvalue and the UAV detection value is less than or equal to the preset UAV suspicion threshold, and / or the UAV suspicion result includes a suspected UAV, it is determined that the terminal device bound to the user number corresponding to the user signaling is not a networked UAV.

[0108] In the embodiments of the present application, user signaling in the 4G / 5G mobile communication network can be obtained. Since networked UAVs communicate in the 4G / 5G mobile communication network, and there are certain differences between the signaling generated by networked UAVs and the signaling generated by ordinary public network users, user signaling generated in the 4G / 5G mobile communication network can be obtained to facilitate subsequent identification of networked UAVs in combination with the user signaling. Also, since there is a fixed order of generation for each signaling event corresponding to networked UAVs, the order of networked UAV events and the generation time of each signaling event in the user signaling can be preset to determine the UAV suspicion result, and then the UAV detection value can be determined through the low-altitude radar data to determine whether there is a UAV in the low altitude through the low-altitude radar data. Furthermore, in the embodiments of the present application, when the sum of the UAV eigenvalue and the UAV detection value is greater than the preset UAV suspicion threshold and the UAV suspicion result includes a suspected UAV, it is determined that the terminal device bound to the user number corresponding to the user signaling is a networked UAV, thereby realizing the identification of networked UAVs through user signaling and low-altitude radar data, improving the identification accuracy of networked UAVs in the 4G / 5G mobile communication network, and facilitating subsequent interception of the networked UAV corresponding to the user number through the user number.

[0109] In a feasible embodiment, step S30 further includes steps S31 to S33: Step S31, obtaining the detected unmanned aerial vehicle (UAV), the detection position of the UAV, and the detection time from the low-altitude radar data; Step S32, determining the first handover base station position, the second handover base station position, the first time to enter the base station service area where the first handover base station position is located, and the second time to enter the base station service area where the second handover base station position is located from the handover events of the user signaling; Step S33, if the detection time belongs to the period between the first time and the second time, and the detection position belongs to the base station service area where the first handover base station position is located and / or the base station service area where the second handover base station position is located, determining that the UAV detection value is the product of the preset UAV presence value and the preset detection weight.

[0110] It should be noted that the low-altitude radar data includes the UAV detected by the radar at low altitude, the detection position of the UAV, and the detection time. The detection position is the position of the UAV detected at the detection time. There may be multiple detected UAVs in the low-altitude radar data, and each UAV has its corresponding detection position and detection time. The preset UAV presence value is 1. When the UAV detection value is the preset UAV presence value, it indicates that the UAV detected in the low-altitude radar data matches the user signaling. The preset detection weight can be set based on the actual situation, and this embodiment does not make specific limitations on it.

[0111] Exemplarily, if there is a UAV in the low-altitude radar data whose detection time belongs to the period between the first time and the second time, and the detection position is in the base station service area where the first handover base station position is located and / or the base station service area where the second handover base station position is located, it can be determined that the user signaling is indeed generated by the connected UAV. If there is no UAV in the low-altitude radar data whose detection time belongs to the period between the first time and the second time, and the detection position is in the base station service area where the first handover base station position is located and the base station service area where the second handover base station position is located, the UAV detection value is the preset null value. It shows that the suspected connected UAV determined by the user signaling is actually not a connected UAV.

[0112] This embodiment determines the UAV detection value through the low-altitude radar data, thereby improving the accuracy of connected UAV identification.

[0113] In a feasible embodiment, after step S30, it further includes step Y10: When it is determined that the terminal device bound to the user number is a connected UAV, if it is detected that the connected UAV enters a preset area and the connected UAV belongs to the preset no-fly list of the preset area, the connected UAV is disconnected from the network through the user number corresponding to the connected UAV to intercept the connected UAV corresponding to the user number.

[0114] It should be noted that when the terminal device bound to the user number is an internet-connected drone, the internet-connected drone can be intercepted through the user number, which can improve the interception accuracy and will not interfere with other ordinary public telecom network users. The preset area may be, for example, a certain urban area or the area where a certain industrial park is located. This embodiment does not make specific limitations in this regard. To ensure the low-altitude safety of the preset area, it is necessary to intercept drones that are not allowed to enter the preset area. Therefore, when it is detected that an internet-connected drone enters the preset area and the internet-connected drone belongs to the preset no-fly list of the preset area, the network can be disconnected for the user number corresponding to the internet-connected drone to intercept the internet-connected drone. The preset no-fly list can be determined in advance. This embodiment does not make specific limitations in this regard. For example, a preset flight whitelist can be determined first. The preset flight whitelist may include drones allowed to enter the preset area. Then, all other drones not in the preset flight whitelist belong to the preset no-fly list. In addition, when it is determined that the terminal device bound to the user number is an internet-connected drone, the MR (Measurement Report) data of the internet-connected drone can also be obtained through the user number for trajectory simulation, or the location server platform can perform location backfilling, so as to identify the movement trajectory of the internet-connected drone, and then facilitate determining whether the internet-connected drone enters or is about to enter the preset area based on the movement trajectory, so as to intercept the internet-connected drone subsequently.

[0115] For example, when it is determined that the terminal device bound to the user number is an internet-connected drone, if it is detected that the internet-connected drone enters the preset area and the internet-connected drone belongs to the preset no-fly list of the preset area, the network of the internet-connected drone is disconnected through the user number corresponding to the internet-connected drone to intercept the internet-connected drone corresponding to the user number. In other embodiments, if it is detected that the internet-connected drone enters the preset area and the user number corresponding to the internet-connected drone cannot be found in the preset flight whitelist, the network of the internet-connected drone is disconnected through the user number corresponding to the internet-connected drone to intercept the internet-connected drone corresponding to the user number. Thus, successful interception is achieved, which is convenient for ensuring safety.

[0116] For a better understanding of this embodiment, please refer to Figure 3 , Figure 3The identification process of identifying connected drones is shown. Signaling events corresponding to the user number can be obtained from the core network, which are respectively the terminal type event, the power-on event, the Internet access event, the domain name event, the handover event or the power-off event. Sub-feature values corresponding to each signaling event are determined respectively. The low-altitude radar data can be obtained from a third party, and the third party can be a platform with low-altitude radar detection capabilities, which can obtain the low-altitude radar data and determine the detection value corresponding to the low-altitude radar data. The detection value can be 0 or 1. A detection value of 0 indicates that the drone detection value of the low-altitude radar data is a preset null value, and a detection value of 1 indicates that the drone detection value of the low-altitude radar data is a preset drone presence value. The sub-feature values are weighted and summed to obtain the drone feature value, and the detection value is weighted to obtain the drone detection value. It is judged whether the sum of the drone detection value and the drone feature value is greater than the preset drone suspicion threshold. If the sum of the drone detection value and the drone feature value is greater than the preset drone suspicion threshold, it is determined that the terminal device corresponding to the user number is a connected drone. If the sum of the drone detection value and the drone feature value is less than or equal to the preset drone suspicion threshold, it is determined that the terminal device corresponding to the user number is not a connected drone. After determining that it is a connected drone, the MR data of the connected drone can be obtained. For example, the corresponding MR data can be obtained in the core network through the user number to identify the movement trajectory of the connected drone. Figure 3 The 5 minutes in it refers to obtaining the terminal type event, the power-on event, the Internet access event and the domain name event within 5 minutes. The 30 minutes refers to that the power-off event can be obtained within 30 minutes, and the handover event and the low-altitude radar data can be obtained within 5 minutes or within 30 minutes.

[0117] Furthermore, reference can be made to Figure 4 , Figure 4The networked UAV interception system is shown in [description]. The networked UAV interception system includes a suspension / resumption platform, an enabling platform, and a UAV identification platform. Among them, the suspension / resumption platform is used by users to control whether the user number corresponding to the networked UAV is suspended or resumed. If it is suspended, the networked UAV cannot take off. If it is resumed, it means that the user number corresponding to the networked UAV has returned to normal and can be normally connected to the network for use, so that the networked UAV can take off normally. The enabling platform is an enabling platform that can provide capabilities such as suspension and resumption for the suspension / resumption platform. In this embodiment, the capabilities that the enabling platform can provide are not specifically limited. The UAV identification platform includes a real-time interface service and a MYSQL (MySQL Database Management System) database. Usually, the language that interacts with the MYSQL database is SQL (Structured Query Language). Communication between the MYSQL database and the real-time interface service is achieved through an SQL interface, and it can provide multiple API (Application Programming Interface) interfaces for interacting with the enabling platform. Communication between the MYSQL database and the real-time interface service is achieved through an SQL interface. The MYSQL database includes a list of suspected UAVs, business list management, custom power-on / off, a preset UAV domain name whitelist, and interface logs. The interface logs are used to record intercepted networked UAVs and networked UAVs allowed to fly. The business list management includes a preset no-fly list and a preset flight whitelist. Networked UAVs within the preset flight whitelist can fly, and networked UAVs within the preset no-fly list are prohibited from flying. The custom power-on / off indicates that for networked UAVs that need to be added but have not yet been added to the preset flight whitelist, if a networked UAV is misintercepted, it supports custom power-on / off for the networked UAV. The list of suspected UAVs is a networked UAV identified through user signaling and low-altitude radar data.

[0118] For example, when the UAV identification platform identifies a networked UAV and the networked UAV needs to be grounded, the UAV identification platform will inform the enabling platform through the real-time interface service that there is a networked UAV that needs to be intercepted. The enabling platform will send the user number corresponding to the networked UAV that needs to be grounded to the suspension / resumption platform, and perform an operation to disconnect the network or suspend the user number to intercept the networked UAV.

[0119] This application embodiment also provides a low-altitude networked UAV identification device based on a 4G / 5G mobile communication network. Please refer to Figure 5 , the device includes: An acquisition module 10 is configured to acquire low-altitude radar data within a preset time period and user signaling in a 4G / 5G mobile communication network. The user signaling includes one or more different signaling events, and the signaling events are terminal type events, power-on events, Internet access events, domain name events, handover events, or power-off events. A determination module 20 is configured to determine the UAV feature value in the user signaling, and determine the UAV suspected result according to the preset order of network-connected UAV events and the event generation time of each signaling event in the user signaling. An identification module 30 is configured to determine the UAV detection value in the low-altitude radar data. When the sum of the UAV feature value and the UAV detection value is greater than a preset UAV suspicion threshold and the UAV suspected result includes a suspected UAV, it is determined that the terminal device bound to the user number corresponding to the user signaling is a network-connected UAV, so as to intercept the network-connected UAV through the user number.

[0120] The low-altitude network-connected UAV identification device based on a 4G / 5G mobile communication network provided in the embodiments of the present application adopts the low-altitude network-connected UAV identification method based on a 4G / 5G mobile communication network in the above embodiments, aiming to solve the problem of low accuracy in identifying network-connected UAVs. Compared with the prior art, the beneficial effects of the low-altitude network-connected UAV identification method based on a 4G / 5G mobile communication network provided in the embodiments of the present application are the same as those of the low-altitude network-connected UAV identification method based on a 4G / 5G mobile communication network provided in the above embodiments, and other technical features in the low-altitude network-connected UAV identification device based on a 4G / 5G mobile communication network are the same as the features disclosed in the above embodiment method, and will not be elaborated here.

[0121] The present application provides an electronic device. The electronic device includes: The electronic device further includes at least one processor and a memory communicatively connected to the at least one processor. Wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the low-altitude network-connected UAV identification method based on a 4G / 5G mobile communication network in the first embodiment above. Refer to the following Figure 6 , which shows a schematic structural diagram of an electronic device suitable for implementing the embodiments of the present application. The electronic device in the embodiments of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not impose any limitations on the functions and usage scope of the embodiments of the present application.

[0122] As shown Figure 6 in the figure, the electronic device may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which may perform various appropriate actions and processes according to a program stored in the read-only memory 1002 or a program loaded from the storage device 1003 into the random access memory 1004. In the random access memory 1004, various programs and data required for the operation of the electronic device are also stored. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are connected to each other through a bus 1005. The input / output interface 1006 is also connected to the bus. Generally, the following systems may be connected to the input / output interface 1006: an input device 1007 including, for example, a touch screen, a touch pad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the electronic device to communicate with other devices wirelessly or wiredly to exchange data. Although the figure shows an electronic device having various systems, it should be understood that it is not required to implement or have all the shown systems. More or fewer systems may be alternatively implemented or had.

[0123] Specifically, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts may be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program codes for performing the methods shown in the flowcharts. In such an embodiment, the computer program may be downloaded and installed from the network through the communication device, or installed from the storage device 1003, or installed from the read-only memory 1002. When the computer program is executed by the processing device 1001, the above functions defined in the methods of the embodiments disclosed in the present application are executed.

[0124] The electronic device provided by the present application adopts the method for identifying low-altitude networked unmanned aerial vehicles based on 4G / 5G mobile communication networks in the above embodiments, and can solve the problem of low accuracy in identifying networked unmanned aerial vehicles. Compared with the prior art, the beneficial effects of the electronic device provided by the present application are the same as those of the method for identifying low-altitude networked unmanned aerial vehicles based on 4G / 5G mobile communication networks provided in the above embodiments, and other technical features in this electronic device are the same as those disclosed in the method of the previous embodiment, and will not be elaborated here.

[0125] It should be understood that each part disclosed in this application can be implemented by hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in a suitable manner in any one or more embodiments or examples. As described above, these are only specific embodiments of this application, but the protection scope of this application is not limited thereto. Any person skilled in the art within the technical scope disclosed in this application can easily think of changes or substitutions, which should all be covered within the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

[0126] This embodiment provides a computer-readable storage medium with computer-readable program instructions stored thereon. The computer-readable program instructions are used to execute the method for identifying low-altitude network-connected drones based on 4G / 5G mobile communication networks in the first embodiment above. The computer-readable storage medium provided by the embodiments of the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor devices, apparatuses, or components, or any combination of the above. More specific examples of the computer-readable storage medium may include, but are not limited to: electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable EPROM (Electrical Programmable Read Only Memory), or flash memory, optical fibers, portable compact disc CD-ROM (compact disc read-only memory), optical storage devices, magnetic storage devices, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program, and this program can be used by or combined with an instruction execution device, apparatus, or component. The program code contained on the computer-readable storage medium can be transmitted by any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above. The above computer-readable storage medium may be included in an electronic device; or it may exist separately without being assembled into the electronic device. The above computer-readable storage medium carries one or more programs. When the above one or more programs are executed by an electronic device, the electronic device is caused to: obtain low-altitude radar data and user signaling in the 4G / 5G mobile communication network during a preset time period, where the user signaling includes one or more different signaling events, and the signaling events are terminal type events, power-on events, Internet access events, domain name events, handover events, or power-off events; determine the drone characteristic values in the user signaling, and determine the drone suspicion result according to the preset network-connected drone event sequence and the respective event generation times of the signaling events in the user signaling; determine the drone detection values in the low-altitude radar data, and when the sum of the drone characteristic values and the drone detection values is greater than a preset drone suspicion threshold and the drone suspicion result includes a suspected drone, determine that the terminal device bound to the user number corresponding to the user signaling is a network-connected drone, so as to intercept the network-connected drone through the user number.

[0127] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages or combinations thereof. The above-mentioned programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, executed as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a LAN (local area network) or a WAN (Wide Area Network), or it may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0128] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of devices, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a portion of code that contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and the combinations of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based device for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0129] The modules described in the embodiments of the present disclosure may be implemented in software or in hardware. Among them, the name of the module does not constitute a limitation to the unit itself in some cases. The computer-readable storage medium provided by the embodiments of the present application stores computer-readable program instructions for executing the above-mentioned method for identifying low-altitude network-connected unmanned aerial vehicles based on 4G / 5G mobile communication networks, aiming to solve the problem of low accuracy in identifying network-connected unmanned aerial vehicles. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the embodiments of the present application are the same as those of the method for identifying low-altitude network-connected unmanned aerial vehicles based on 4G / 5G mobile communication networks provided by the above embodiments, and will not be elaborated here.

[0130] The embodiment of the present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned method for identifying low-altitude networked unmanned aerial vehicles based on 4G / 5G mobile communication networks when executed by a processor.

[0131] The computer program product provided by the embodiment of the present application aims to solve the problem of low accuracy in identifying networked unmanned aerial vehicles. Compared with the prior art, the beneficial effects of the computer program product provided by the embodiment of the present application are the same as those of the method for identifying low-altitude networked unmanned aerial vehicles based on 4G / 5G mobile communication networks provided by the above embodiment, and will not be elaborated here.

[0132] The above are only the preferred embodiments of the embodiment of the present application, and do not limit the patent scope of the embodiment of the present application. Any equivalent structure or equivalent process transformation made by using the description and drawings of the embodiment of the present application, or directly or indirectly applied in other related technical fields, shall be equally included in the patent scope of the embodiment of the present application.

Claims

1. A method for identifying low-altitude networked drones based on 4G5G mobile communication networks, characterized in that: The method includes: Acquire low-altitude radar data within a preset time period and user signaling in a 4G5G mobile communication network, wherein the user signaling includes one or more different signaling events, wherein the signaling event is a terminal type event, a power-on event, an Internet access event, a domain name event, a switching event, or a power-off event; Determine the drone feature value in the user signaling, and determine the drone suspected result according to the preset networked drone event sequence and the event generation time of each of the signaling events in the user signaling; Determine the drone detection value in the low-altitude radar data. When the sum of the drone feature value and the drone detection value is greater than a preset drone suspected threshold, and the drone suspected result includes a suspected drone, determine that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone through the user number.

2. The low-altitude networked drone identification method based on the 4G5G mobile communication network as claimed in claim 1 is characterized in that: The step of determining the drone characteristic value in the user signaling comprises: Determine the sub-feature value of each of the signaling events, and perform weighted summation on the sub-feature values ​​to obtain the drone feature value.

3. The low-altitude networked drone identification method based on 4G5G mobile communication network as claimed in claim 2 is characterized in that: The step of determining the sub-feature value of each signaling event comprises: When the signaling event is a terminal type event, obtaining the terminal type from the terminal type event; Searching for a terminal feature value corresponding to the terminal type in a preset terminal feature mapping relationship; Using the terminal feature value as a sub-feature value of the terminal type event; The preset terminal feature mapping relationship includes preset terminal feature values ​​corresponding to a plurality of preset terminal types.

4. The low-altitude networked drone identification method based on 4G5G mobile communication network as claimed in claim 3 is characterized in that: The step of determining the sub-feature value of each signaling event comprises: When the signaling event is a domain name event, obtaining a domain name name from the domain name event; If the domain name exists in the preset drone domain name whitelist, determining the sub-feature value of the domain name event to be the preset drone domain name value; If the domain name does not exist in the preset drone domain name whitelist, determining that the sub-feature value of the domain name event is a preset null value; If the sub-feature value of the domain name event is the preset drone domain name value, then determining that the signaling event is an Internet access event sub-feature value is the preset drone Internet access value; If the sub-characteristic value of the domain name event is a preset null value, then determining that the sub-characteristic value of the signaling event is an Internet access event is a preset null value.

5. The low-altitude networked drone identification method based on 4G5G mobile communication network as claimed in claim 4 is characterized in that: The step of determining the sub-feature value of each signaling event comprises: When the signaling event is a switching event, obtaining from the switching event a first switching base station position, a second switching base station position, a first time of entering a base station service area where the first switching base station position is located, and a second time of entering a base station service area where the second switching base station position is located; Calculating a switching motion speed according to the first moment, the second moment, the first switching base station position, and the second switching base station position; If the switching motion speed is greater than a preset speed threshold, determining the sub-characteristic value of the switching event as a preset drone switching value; If the switching movement speed is less than or equal to the preset speed threshold, the sub-characteristic value of the switching event is determined to be a preset null value.

6. The low-altitude networked drone identification method based on 4G5G mobile communication network as claimed in claim 5 is characterized in that: The step of determining the sub-feature value of each signaling event comprises: When there is a shutdown event and a power-on event in the user signaling, the difference between the shutdown time in the shutdown event and the power-on time of the power-on event is less than a preset duration threshold, the sub-feature value of the domain name event in the user signaling is a preset drone domain name value, and the sub-feature value of the switching event is a preset drone switching value, the sub-feature value of the power-on event is determined to be the preset drone power-on value, and the sub-feature value of the shutdown event is determined to be the preset drone shutdown value.

7. The low-altitude networked drone identification method based on 4G5G mobile communication network as claimed in claim 5 is characterized in that: The preset networked drone event sequence includes a plurality of preset events arranged in sequence; According to the preset networked drone event sequence and the event generation time of each of the signaling events in the user signaling, the step of determining the suspected drone result includes: For each of the signaling events present in the user signaling, obtaining an event generation time from the signaling event, and sorting the signaling events according to the event generation time corresponding to each of the signaling events to obtain an event sorting, wherein the event generation time of the signaling event sorted earlier in the event sorting is earlier than that of the signaling event sorted later; In the case where the number of signaling events present in the user signaling is the same as the number of preset events in the preset networked drone event sequence, if the event sequence is consistent with the preset networked drone event sequence, determining that the suspected drone result includes a suspected drone; Among them, the preset networked drone event sequence represents the event generation sequence when the networked drone is running, and the preset events arranged in sequence in the event generation sequence are respectively a preset terminal type event, a preset power-on event, a preset Internet access event, a preset domain name event, a preset switching event, and a preset shutdown event.

8. The low-altitude networked drone identification method based on 4G5G mobile communication network as claimed in claim 7, characterized in that: After the step of sorting the signaling events according to the event generation time corresponding to each of the signaling events to obtain the event sorting step, the method further includes: When the number of signaling events existing in the user signaling is less than the number of preset events in the preset networked drone event sequence, if the relative order between any two signaling events existing in the event sorting is the same as the relative order between the corresponding two preset events in the preset networked drone event sequence, it is determined that the suspected drone result includes a suspected drone.

9. The low-altitude networked drone identification method based on 4G5G mobile communication network as claimed in claim 1, characterized in that: The step of determining the drone detection value in the low altitude radar data comprises: Acquire the detected UAV, the detection position and the detection time of the UAV from the low-altitude radar data; Determine, from the switching event of the user signaling, a first switching base station location, a second switching base station location, a first time of entering a base station service area where the first switching base station location is located, and a second time of entering a base station service area where the second switching base station location is located; If the detection time is between the first time and the second time, and the detection location belongs to the base station service area where the first switching base station is located and / or the base station service area where the second switching base station is located, then the drone detection value is determined as the product of the preset drone presence value and the preset detection weight.

10. The low-altitude networked drone identification method based on 4G5G mobile communication network as claimed in claim 1, characterized in that: The method further comprises: When it is determined that the terminal device bound to the user number is a networked drone, if the networked drone is detected to enter a preset area, and the networked drone belongs to the preset no-fly list of the preset area, the networked drone is disconnected from the network through the user number corresponding to the networked drone to intercept the networked drone corresponding to the user number.

Images