Low-altitude Networked UAV Identification Method Based on 4G and 5G Mobile Communication Networks

Abstract

This application discloses a method for identifying low-altitude networked drones based on a 4G5G mobile communication network, which relates to the field of low-altitude networked drones. The method includes: obtaining low-altitude radar data within a preset time period and user signaling in the 4G5G mobile communication network, the user signaling including signaling events; determining drone characteristic values in the user signaling, and determining a suspected drone result based on a preset networked drone event sequence and the event generation time of each signaling event in the user signaling; determining a drone detection value in the low-altitude radar data, and when the sum of the drone characteristic value and the drone detection value is greater than a preset drone suspected threshold and the suspected drone result includes a suspected drone, determining that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone using the user number. This application solves the problem of low accuracy in identifying networked drones, thereby improving the accuracy of intercepting networked drones.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of low-altitude networked drones, and in particular to a method for identifying low-altitude networked drones based on 4G5G mobile communication networks. Background Art

[0002] Drone technology has been widely used in agriculture, construction, logistics, and other fields. This raises the question of how to effectively manage and monitor drone flights to ensure their safe and legal use. Current drone interception solutions primarily target drones that use radio frequency transmissions. These solutions can be implemented by jamming the corresponding radio frequency bands.

[0003] However, connected drones operating over carrier networks (e.g., 4G (Fourth Generation) and 5G (Fifth Generation) mobile networks) use the same frequency bands as regular telecom users (e.g., mobile phones). Interference with the frequency bands corresponding to connected drones operating over carrier networks will impact regular telecom users using the carrier networks. Because connected drones and regular telecom users share the same frequency bands, accurately identifying connected drones on carrier networks is difficult, leading to the current technical issue of low identification accuracy for connected drones.

[0004] The above content is only used to assist in understanding the technical solutions of the embodiments of the present application and does not constitute an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of the embodiments of this application is to provide a low-altitude networked drone identification method based on 4G5G mobile communication network, aiming to solve the problem of low accuracy in identifying networked drones.

[0006] To achieve the above objectives, the present invention provides a method for identifying low-altitude networked drones based on a 4G5G mobile communication network, the method comprising:

[0007] Obtaining low-altitude radar data within a preset time period and user signaling in a 4G5G mobile communication network, wherein the user signaling includes one or more different signaling events, wherein the signaling event is a terminal type event, a power-on event, an Internet access event, a domain name event, a switching event, or a power-off event;

[0008] Determine the drone feature value in the user signaling, and determine the drone suspected result based on a preset networked drone event sequence and the event generation time of each signaling event in the user signaling;

[0009] Determine the drone detection value in the low-altitude radar data. When the sum of the drone characteristic value and the drone detection value is greater than a preset drone suspicion threshold and the drone suspicion result includes a suspected drone, determine that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone through the user number.

[0010] In one embodiment, the step of determining the drone characteristic value in the user signaling includes:

[0011] Determine the sub-eigenvalue of each signaling event, and perform weighted summation on the sub-eigenvalues to obtain the drone eigenvalue.

[0012] In one embodiment, the step of determining the sub-feature value of each signaling event includes:

[0013] When the signaling event is a terminal type event, obtaining the terminal type from the terminal type event;

[0014] Searching for a terminal feature value corresponding to the terminal type in a preset terminal feature mapping relationship;

[0015] Using the terminal feature value as a sub-feature value of the terminal type event;

[0016] The preset terminal feature mapping relationship includes preset terminal feature values corresponding to a plurality of preset terminal types.

[0017] In one embodiment, the step of determining the sub-feature value of each signaling event includes:

[0018] When the signaling event is a domain name event, obtaining a domain name name from the domain name event;

[0019] If the domain name exists in the preset drone domain name whitelist, then determine that the sub-feature value of the domain name event is the preset drone domain name value;

[0020] If the domain name does not exist in the preset drone domain name whitelist, determining that the sub-feature value of the domain name event is a preset null value;

[0021] If the sub-feature value of the domain name event is the preset drone domain name value, then determining that the signaling event is an Internet access event sub-feature value is the preset drone Internet access value;

[0022] If the sub-feature value of the domain name event is a preset null value, then the sub-feature value of determining whether the signaling event is an Internet access event is a preset null value.

[0023] In one embodiment, the step of determining the sub-feature value of each signaling event includes:

[0024] When the signaling event is a handover event, obtaining, from the handover event, a first handover base station location, a second handover base station location, a first time of entering a base station service area where the first handover base station location is located, and a second time of entering a base station service area where the second handover base station location is located;

[0025] Calculating a switching motion speed based on the first moment, the second moment, the first switching base station position, and the second switching base station position;

[0026] If the switching motion speed is greater than a preset speed threshold, determining the sub-feature value of the switching event as a preset drone switching value;

[0027] If the switching movement speed is less than or equal to the preset speed threshold, the sub-feature value of the switching event is determined to be a preset null value.

[0028] In one embodiment, the step of determining the sub-feature value of each signaling event includes:

[0029] When there is a shutdown event and a power-on event in the user signaling, the difference between the shutdown moment in the shutdown event and the power-on moment in the power-on event is less than a preset duration threshold, the sub-feature value of the domain name event in the user signaling is a preset drone domain name value, and the sub-feature value of the switching event is a preset drone switching value, the sub-feature value of the power-on event is determined to be the preset drone power-on value, and the sub-feature value of the shutdown event is determined to be the preset drone shutdown value.

[0030] In one embodiment, the preset networked drone event sequence includes a plurality of preset events arranged in sequence;

[0031] The step of determining a suspected drone result according to a preset networked drone event sequence and the event generation time of each signaling event in the user signaling includes:

[0032] For each signaling event present in the user signaling, obtaining an event generation time from the signaling event, and sorting the signaling events according to the event generation time corresponding to each signaling event to obtain an event sorting, wherein the event generation time of a signaling event sorted earlier in the event sorting is earlier than that of a signaling event sorted later;

[0033] When the number of signaling events present in the user signaling is the same as the number of preset events in the preset networked drone event sequence, and if the event sequence is consistent with the preset networked drone event sequence, determining that the suspected drone result includes a suspected drone;

[0034] Among them, the preset networked drone event sequence represents the event generation sequence when the networked drone is running, and the preset events arranged in sequence in the event generation sequence are respectively the preset terminal type event, the preset power-on event, the preset Internet access event, the preset domain name event, the preset switching event and the preset shutdown event.

[0035] In one embodiment, after the step of sorting the signaling events according to the event generation time corresponding to each of the signaling events to obtain the event sorting step, the method further includes:

[0036] In the case where the number of signaling events present in the user signaling is less than the number of preset events in the preset networked drone event sequence, if the relative order between any two signaling events in the event sorting is the same as the relative order between the corresponding two preset events in the preset networked drone event sequence, then it is determined that the suspected drone result includes a suspected drone.

[0037] In one embodiment, the step of determining the drone detection value in the low-altitude radar data includes:

[0038] Obtaining a detected drone, a detection position of the drone, and a detection time from the low-altitude radar data;

[0039] Determining, from the handover event of the user signaling, a first handover base station location, a second handover base station location, a first time of entering a base station service area where the first handover base station location is located, and a second time of entering a base station service area where the second handover base station location is located;

[0040] If the detection moment is between the first moment and the second moment, and the detection location belongs to the base station service area where the first switching base station is located and / or the base station service area where the second switching base station is located, then the drone detection value is determined to be the product of the preset drone presence value and the preset detection weight.

[0041] In one embodiment, the method further comprises:

[0042] When it is determined that the terminal device bound to the user number is a networked drone, if the networked drone is detected to enter a preset area and the networked drone belongs to the preset no-fly list of the preset area, the networked drone will be disconnected from the network through the user number corresponding to the networked drone to intercept the networked drone corresponding to the user number.

[0043] In addition, to achieve the above objectives, the present application provides a low-altitude networked drone identification device based on a 4G5G mobile communication network, the device comprising:

[0044] An acquisition module is configured to acquire low-altitude radar data within a preset time period and user signaling in a 4G5G mobile communication network, wherein the user signaling includes one or more different signaling events, wherein the signaling event is a terminal type event, a power-on event, an Internet access event, a domain name event, a switching event, or a power-off event;

[0045] a determination module, configured to determine a drone characteristic value in the user signaling, and determine a suspected drone result based on a preset networked drone event sequence and the event generation time of each signaling event in the user signaling;

[0046] An identification module is configured to determine a drone detection value in the low-altitude radar data, and when the sum of the drone characteristic value and the drone detection value is greater than a preset drone suspicion threshold and the drone suspicion result includes a suspected drone, determine that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone through the user number.

[0047] In addition, to achieve the above-mentioned purpose, an embodiment of the present application also provides an electronic device, which includes: a memory, a processor, and a program of the low-altitude networked drone identification method based on the 4G5G mobile communication network, which is stored on the memory and can be run on the processor. When the program of the low-altitude networked drone identification method based on the 4G5G mobile communication network is executed by the processor, the steps of the low-altitude networked drone identification method based on the 4G5G mobile communication network as described above can be implemented.

[0048] In addition, to achieve the above-mentioned purpose, an embodiment of the present application also provides a computer-readable storage medium, on which is stored a program for implementing a method for identifying low-altitude networked drones based on a 4G5G mobile communication network. When the program for the method for identifying low-altitude networked drones based on a 4G5G mobile communication network is executed by a processor, the steps of the method for identifying low-altitude networked drones based on a 4G5G mobile communication network as described above are implemented.

[0049] In addition, to achieve the above-mentioned purpose, an embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for identifying low-altitude networked drones based on a 4G5G mobile communication network.

[0050] One or more technical solutions proposed in the embodiments of the present application have at least the following technical effects: user signaling in the 4G5G mobile communication network can be obtained in the present application. Since the networked drone communicates in the 4G5G mobile communication network, and there are certain differences between the signaling generated by the networked drone and the signaling generated by ordinary public network users, the user signaling generated in the 4G5G mobile communication network can be obtained, so that the networked drone can be identified in combination with the user signaling later. Since the signaling events corresponding to the networked drone have a predetermined order of generation, the order of networked drone events and the event generation time of each signaling event in the user signaling can also be preset to determine the suspected drone result, and then the drone detection value is determined by low-altitude radar data, so that the presence of a drone in the low altitude can be determined by low-altitude radar data. Furthermore, the present application can determine that the terminal device bound to the user number corresponding to the user signaling is a networked drone when the sum of the drone characteristic value and the drone detection value is greater than the preset drone suspicion threshold and the drone suspicion result includes a suspected drone, thereby realizing the identification of networked drones through user signaling and low-altitude radar data, improving the recognition accuracy of networked drones in 4G5G mobile communication networks, and facilitating the subsequent interception of the networked drone corresponding to the user number through the user number. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the embodiments of the present application, and together with the specification are used to explain the principles of the embodiments of the present application.

[0052] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0053] Figure 1 This is a flow chart of an embodiment of a method for identifying low-altitude networked drones based on a 4G5G mobile communication network according to an embodiment of the present application;

[0054] Figure 2 This is a schematic diagram of a scenario corresponding to a networked drone in a method for identifying a low-altitude networked drone based on a 4G5G mobile communication network according to an embodiment of the present application;

[0055] Figure 3 This is a schematic diagram of the process of identifying a networked drone in a method for identifying a low-altitude networked drone based on a 4G5G mobile communication network according to an embodiment of the present application;

[0056] Figure 4This is a schematic diagram of a module for intercepting a networked drone in a method for identifying a low-altitude networked drone based on a 4G5G mobile communication network according to an embodiment of the present application;

[0057] Figure 5 This is a schematic diagram of the module structure of a low-altitude networked drone identification device based on a 4G5G mobile communication network according to an embodiment of the present application;

[0058] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the low-altitude networked drone identification method based on the 4G5G mobile communication network in the embodiment of the present application.

[0059] The purpose, features and advantages of the embodiments of the present application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0060] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the embodiments of the present application and are not intended to limit the embodiments of the present application.

[0061] In order to better understand the technical solutions of the embodiments of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0062] With the continuous development of science and technology, drone technology has been widely used in various fields such as agriculture, construction, logistics, security, and scientific research. The subsequent problem is how to effectively manage and monitor drone flights to ensure their safe and legal use. Currently, the country has formulated relevant laws and regulations to regulate the use of drones, and has also conducted corresponding research on drone control technology.

[0063] The communication methods of drones can be divided into several main types according to the technology and transmission medium they use, including radio frequency transmission, satellite communication transmission, optical communication transmission and operator public network transmission.

[0064] Radio frequency transmission: This is the most common communication method for drones, utilizing radio waves propagating through space to communicate between drones and ground control stations. It offers advantages such as long transmission distance, high transmission rates, and strong anti-interference capabilities. Key technologies in radio frequency transmission include coding, modulation, signal processing, and antenna technology. Planned frequency bands for drone systems include 1430-1444 MHz (megahertz), 2400-2476 MHz, and 5725-5829 MHz.

[0065] Satellite communication transmission: Using satellites as relay stations, communication between drones and ground control stations is achieved. This method has a wide coverage area and is suitable for long-distance and large-scale drone communication.

[0066] Optical communication transmission: Utilizing optical means such as lasers or optical fibers for communication, it is suitable for short-distance, high-bandwidth drone communications. Optical communication transmission is characterized by high transmission rates, strong anti-interference capabilities, and excellent confidentiality.

[0067] Operator public network transmission: UAV data and video can be transmitted over unlimited distances via 4G or even 5G networks. This method increases data transmission speed, enhances real-time performance and reliability, and is suitable for applications requiring high bandwidth and low latency. Drones using operator public network transmission are referred to as networked drones.

[0068] The most commonly used drone communication methods are radio frequency transmission and operator public network transmission, while satellite communication transmission and optical communication transmission have high technical barriers to entry for drones and are rarely used in civilian drones. The current drone interception solutions are mainly aimed at drones that use radio frequency transmission and have no interception effect on drones that use operator public network transmission.

[0069] The following describes drones that use radio frequency transmission: Applications for drones using radio frequency transmission include, but are not limited to, sending remote control commands, receiving telemetry data, and transmitting real-time video. These applications require the drone's radio transmission solution to be highly reliable and resistant to interference. Radio frequency transmission, based on the principle of electromagnetic wave propagation in air, transmits information from the drone to a ground control station via radio waves.

[0070] Therefore, the current main approach is to interfere with the radio frequency transmission of the drone's communication link, making it unable to receive control signals or navigation signals normally. For example, the following are some of the main interception schemes:

[0071] 1. Omnidirectional radio jammers: These devices emit strong jamming signals that match the drone's communication frequency band, drowning out or confusing legitimate signals received by the drone. This prevents the drone from correctly interpreting control commands or positioning information, thereby forcing it to make an emergency landing, hover, or return.

[0072] 2. UAV radio jammers: This type of equipment interferes with UAV communication links, navigation signals, or control signals by emitting radio waves of a specific frequency.

[0073] 3. Fixed radio monitoring stations: These monitoring stations can monitor and find the direction of radio signals, measure the parameters of radio signals, and automatically complete signal attribute identification, measurement, statistics, and analysis.

[0074] 4. Transportable radio monitoring and direction-finding system: This type of system is suitable for immediate field application needs such as major event support and emergency response support. It has the characteristics of small size, light weight, low power consumption and fast deployment.

[0075] Therefore, the current interception plan mainly interferes by interfering with designated communication frequency bands. The communication frequency bands occupied by radio frequency drones are mainly concentrated in 1430-1444MHz, 2400-2476MHz, 5725-5829MHz, etc., and the communication frequency bands used by drones using the operator's public network transmission are inconsistent with the communication frequencies used for radio frequency transmission.

[0076] Therefore, the current interception scheme cannot be effective when intercepting drones using the operator's public network transmission due to the inconsistent frequency bands used. If the interception equipment uses the operator's public network transmission to occupy the interception, it will cause serious interference to ordinary telecommunications public network users (for example, mobile phone users) and affect the operator's normal business.

[0077] In summary, the current radio frequency transmission drone interception solution has defects when intercepting drones using operator public network transmission due to frequency band reasons.

[0078] Therefore, the present application proposes a method for identifying low-altitude networked drones based on the 4G5G mobile communication network. In the embodiment of the present application, user signaling in the 4G5G mobile communication network can be obtained. Since the networked drones communicate in the 4G5G mobile communication network, and there are certain differences between the signaling generated by the networked drones and the signaling generated by ordinary public network users, the user signaling generated in the 4G5G mobile communication network can be obtained, so that the networked drones can be identified in combination with the user signaling in the future. Since the signaling events corresponding to the networked drones have a predetermined order of generation, the order of networked drone events and the event generation time of each signaling event in the user signaling can also be preset to determine the suspected drone result, and then the drone detection value is determined through the low-altitude radar data, so that the presence of a drone in the low altitude can be determined through the low-altitude radar data. Furthermore, the embodiment of the present application can determine that the terminal device bound to the user number corresponding to the user signaling is a networked drone when the sum of the drone characteristic value and the drone detection value is greater than the preset drone suspicion threshold and the drone suspicion result includes a suspected drone, thereby realizing the identification of networked drones through user signaling and low-altitude radar data, improving the recognition accuracy of networked drones in 4G5G mobile communication networks, and facilitating the subsequent interception of the networked drone corresponding to the user number through the user number.

[0079] Based on this, the embodiment of the present application provides a low-altitude networked drone identification method based on 4G5G mobile communication network, referring to Figure 1 , Figure 1This is a flow chart of the first embodiment of the low-altitude networked drone identification method based on the 4G5G mobile communication network of the present application. The low-altitude networked drone identification method based on the 4G5G mobile communication network includes steps S10 to S30:

[0080] Step S10: acquiring low-altitude radar data within a preset time period and user signaling in the 4G5G mobile communication network, where the user signaling includes one or more different signaling events, where the signaling event is a terminal type event, a power-on event, an Internet access event, a domain name event, a switching event, or a power-off event;

[0081] It should be noted that connected drones communicate via 4G and 5G mobile communication networks. 4G and 5G networks offer low latency and high bandwidth, providing significant growth potential for connected drones. 4G / 5G networks empower connected drones with key capabilities such as real-time ultra-high-definition backhaul, massive connections, and remote low-latency control. The preset time period can be customized, with durations ranging from 30 minutes to 5 minutes. For example, the preset time period can be between 9:00 and 9:30, though this embodiment does not impose specific limitations on this.

[0082] Low-altitude radar data is captured by radar at low altitudes, defined as 120 to 300 meters above ground level. Radar data can detect objects in the low altitudes, facilitating subsequent verification and confirmation of the presence of connected drones using low-altitude radar data.

[0083] User signaling can be the signaling corresponding to the user number, and the user signaling corresponding to different user numbers is not necessarily the same. User signaling may include at least one signaling event, and user signaling may also include multiple signaling events. For example, user signaling may include terminal type events, power-on events, Internet access events, domain name events, switching events and / or power-off events. The signaling events included in the same user signaling are different. User signaling is a signaling event generated by the terminal device corresponding to the user number communicating through the 4G5G mobile communication network, and can be obtained from the core network (CoreNetwork, CN) corresponding to the 4G5G mobile communication network. For example, you can refer to Figure 2 , Figure 2 The communication diagram of the networked drone is shown in the figure. Figure 2 It includes the core network, which is connected to base station J. Base station J is a 4G / 5G base station. Networked drones can communicate with base stations, and base stations can communicate with the core network. The core network has corresponding service terminals, and user signaling can be obtained from the corresponding service terminals of the core network.

[0084] For example, it can be obtained from interfaces such as the Measurement Report for Optimization (MRO), Mobility Management Entity (MME), HTTP (Hyper-Text Transfer Protocol), New Radio Measurement Report for Optimization (NRMRO), N1 / N2 (key interfaces between the core network and terminal equipment (UE) and base station), and N3 (user plane interface) in the core network's service terminal. This embodiment does not specifically limit this. N3 is the interface between the base station and the User Plane Function (UPF) in 5G, responsible for data transmission. For example, the terminal type event can be used to determine the type of terminal device bound to a user number. Terminal type events and power-on events can be obtained from the N1 / N2 interface. Power-on events are events generated when the terminal device bound to the user number is turned on. Internet access events can be obtained from the HTTP interface. Internet access events are events generated when the terminal device bound to the user number applies for Internet access. Domain name events of the user number within a preset time period can be obtained from the HTTP interface. Domain name events can include domain name names accessed by the terminal device through the 4G5G mobile communication network. Domain name names can be website names, such as DNS domain names. Switching events can be obtained from the MME interface. Switching events are events generated when the terminal device bound to the user number moves. Shutdown events can also be obtained from N1 / N2. Shutdown events are events generated when the terminal device bound to the user number is shut down.

[0085] Since the behavior of networked drones differs from that of ordinary telecom users, for example, the length of time a networked drone stays on the network and the time between power on and power off are similar to those of ordinary telecom users, it is possible to identify whether it is a networked drone based on user signaling.

[0086] Exemplarily, low-altitude radar data can be obtained within a preset time period, as well as terminal type events, power-on events, Internet access events, domain name events, switching events and / or power-off events corresponding to the same user number in the 4G5G mobile communication network.

[0087] Step S20: determining the drone feature value in the user signaling, and determining the drone suspected result based on the preset networked drone event sequence and the event generation time of each signaling event in the user signaling;

[0088] It should be noted that the drone characteristic value can be used to assess the likelihood that user signaling is generated by a connected drone in a 4G5G mobile communication network. The higher the drone characteristic value, the more likely the user signaling is generated by a connected drone, while the lower the drone characteristic value, the less likely the user signaling is generated by a connected drone. The generation time of different signaling events may not be the same; the event generation time represents the moment when the signaling event occurs.

[0089] The preset networked drone event sequence represents the order in which events are generated during the operation of a networked drone. The suspected drone result can reflect whether the order in which the signaling events in the user signaling occur complies with the preset networked drone event sequence. Therefore, this embodiment can determine the suspected drone result based on the preset networked drone event sequence and the time at which each event is generated, thereby enabling subsequent determination of whether the terminal device corresponding to the user signaling is a networked drone.

[0090] For example, the characteristic value of the drone can be determined based on each signaling event in the user signaling, and the suspected drone result can be determined based on the preset networked drone event sequence and the event generation time of each signaling event in the user signaling.

[0091] In a feasible embodiment, step S20 further includes step S21: determining the sub-feature value of each signaling event, and performing weighted summation on each sub-feature value to obtain the drone feature value.

[0092] It should be noted that the sub-feature value can be used to assess the likelihood of the signaling event involving a connected drone occurring in a 4G5G mobile communication network. The sub-feature value of the signaling event can be determined based on the signaling event itself, or based on the signaling event itself and other signaling events in the user signaling.

[0093] The weights corresponding to different signaling events can be the same or different, and this embodiment does not specifically limit this. The signaling event that has a greater impact on determining whether it is a network-connected drone has a higher weight.

[0094] For example, based on each signaling event, a sub-feature value of each signaling event is determined, and each sub-feature value can be weighted and summed to obtain the drone feature value. This embodiment improves the accuracy of the drone feature value by comprehensively evaluating each signaling event present in the user signaling.

[0095] In a feasible embodiment, step S21 further includes steps S211 to S213:

[0096] Step S211: when the signaling event is a terminal type event, obtaining the terminal type from the terminal type event;

[0097] Step S212: searching for a terminal feature value corresponding to the terminal type in a preset terminal feature mapping relationship;

[0098] Step S213: Using the terminal feature value as a sub-feature value of the terminal type event;

[0099] The preset terminal feature mapping relationship includes preset terminal feature values corresponding to a plurality of preset terminal types.

[0100] It should be noted that the terminal type event includes the terminal type corresponding to the user number. Networked drones are equipped with communication cards for communication within the 4G5G mobile communication network. Each communication card has its own corresponding communication number, which can be a user number. Non-networked drone terminals, such as ordinary mobile phones or IoT terminals, are also equipped with corresponding communication cards. The communication cards installed on non-networked drone terminals are generally SIM cards, which also have corresponding numbers. Different communication cards are not necessarily compatible with the same terminal type, so the terminal type corresponding to the user number in the terminal type event can be obtained to determine whether the user number is compatible with networked drones.

[0101] For example, when a connected drone communicates on a 4G or 5G mobile communication network, it typically reports a terminal type of "dongle" (wireless data adapter) or "module," whereas a typical mobile phone user typically reports a terminal type of "mobile phone." Dongle and module adapters can support not only connected drones but also other IoT devices. Therefore, simply obtaining a terminal type event doesn't guarantee that a dongle or module type corresponds to a connected drone. Therefore, other signaling events must be considered for accurate determination.

[0102] The preset terminal feature mapping relationship can be set based on the 3GPP (3rd Generation Partnership Project) specification. For example, the preset terminal feature mapping relationship includes multiple preset terminal types, which can be a preset Dongle adapter, a preset Module adapter, a preset Mobile Phone, and a preset unknown terminal type. The preset terminal feature values of the preset Dongle adapter and the preset Module adapter are both 1, the preset terminal feature value of the preset Mobile Phone is 0, and the preset terminal feature value of the preset unknown terminal type is -1. The preset unknown terminal type indicates that it is unknown what terminal type corresponds to the user number. It can be considered that terminal types other than the Dongle adapter, Module adapter, and MobilePhone are all unknown terminal types.

[0103] The preset terminal characteristic value of 1 indicates that it is a terminal type that is adapted to the networked drone, the preset terminal characteristic value of 0 indicates that it is not a terminal type that is adapted to the networked drone, and the preset terminal characteristic value of -1 indicates the terminal type corresponding to an unknown user number.

[0104] Exemplarily, when the signaling event is a terminal type event, the terminal type is obtained from the terminal type event; when the terminal type is a Dongle adapter or a Module adapter, the terminal feature value corresponding to the terminal type is found to be 1 in the preset terminal feature mapping relationship; when the terminal type is a Mobile Phone, the terminal feature value corresponding to the terminal type is found to be 0 in the preset terminal feature mapping relationship; when the terminal type is a preset unknown terminal type, the terminal feature value corresponding to the terminal type is found to be -1 in the preset terminal feature mapping relationship, and the terminal feature value is used as the sub-feature value of the terminal type event.

[0105] This embodiment facilitates improving the accuracy of identifying networked drones by identifying the terminal type.

[0106] In a feasible embodiment, step S21 further includes steps A10 to A50:

[0107] Step A10: When the signaling event is a domain name event, obtain the domain name from the domain name event;

[0108] Step A20: If the domain name exists in the preset drone domain name whitelist, determine that the sub-feature value of the domain name event is the preset drone domain name value;

[0109] Step A30: If the domain name does not exist in the preset drone domain name whitelist, the sub-feature value of the domain name event is determined to be a preset null value;

[0110] Step A40: If the sub-feature value of the domain name event is the preset drone domain name value, then determining that the sub-feature value of the signaling event is an Internet access event is the preset drone Internet access value;

[0111] In step A50, if the sub-feature value of the domain name event is a preset null value, then the sub-feature value of determining that the signaling event is an Internet access event is a preset null value.

[0112] It should be noted that domain names are the URLs accessed by terminal devices. The URLs accessed by connected drones are generally the names of the server URLs corresponding to the drone manufacturer, not the terminal devices themselves. For example, ordinary mobile phone users generally do not access the server URLs corresponding to drones. The preset drone domain whitelist contains pre-determined drone URLs related to drones. You can manually add corresponding drone URLs to the preset drone domain whitelist.

[0113] The preset drone domain name whitelist can be pre-configured, and this embodiment does not make specific limitations on this. For example, when configuring the drone domain name whitelist, you can first obtain a set of URL names, and automatically remove the URL names corresponding to mobile phones, tablets, vehicle terminals, and shared bicycles from the URL name set, so that you can initially obtain a list containing drone domain names. Then, you can manually delete the list of drone domain names to obtain the preset drone domain name whitelist. Because the URL names corresponding to mobile phones, tablets, vehicle terminals, and shared bicycles are limited, the preset drone domain name whitelist can be determined by screening.

[0114] The preset drone domain name value can be 1. When the sub-feature value of the domain name event is the preset drone domain name value, it indicates that the domain name event is likely to be generated by a networked drone. The preset null value can be 0. When the sub-feature value of the domain name event is the preset null value, it indicates that the domain name event is likely to be generated by a networked drone.

[0115] The sub-feature values of Internet access events need to be determined based on domain name events. Since ordinary mobile phone users also have Internet access operations, there will also be Internet access events. Therefore, if you want to distinguish whether an Internet access event is generated by a connected drone, you can determine it based on the domain name events.

[0116] The preset drone Internet access value can be 1. When the sub-feature value of the Internet access event is the preset drone Internet access value, it indicates that the Internet access event is likely to be generated by a networked drone. When the sub-feature value of the Internet access event is the preset null value, it indicates that the Internet access event is likely to be generated by a networked drone and is likely not generated by a networked drone.

[0117] Exemplarily, when the signaling event is a domain name event, the domain name name is obtained from the domain name event. If the domain name name exists in the preset drone domain name whitelist, the sub-feature value of the domain name event is determined to be the preset drone domain name value; if the domain name name does not exist in the preset drone domain name whitelist, the sub-feature value of the domain name event is determined to be a preset null value; if the sub-feature value of the domain name event is the preset drone domain name value, it can be explained that the domain name event corresponding to the user number is very likely to be generated by a networked drone, so the sub-feature value of the Internet access event can be the preset drone Internet access value; if the sub-feature value of the domain name event is a preset null value, it can be explained that the domain name event corresponding to the user number is most likely not generated by a networked drone, so it can be determined that the sub-feature value of the signaling event as the Internet access event is the preset null value.

[0118] This embodiment evaluates whether it is a networked drone by the domain name, thereby improving the accuracy of drone identification, and the sub-feature value of the Internet access event is also determined in combination with the domain name event, thereby also improving the accuracy of networked drone identification.

[0119] In a feasible embodiment, step S21 further includes steps B10 to B40:

[0120] Step B10: When the signaling event is a handover event, obtain from the handover event the first handover base station location, the second handover base station location, the first time of entering the base station service area where the first handover base station location is located, and the second time of entering the base station service area where the second handover base station location is located;

[0121] Step B20, calculating the switching movement speed based on the first moment, the second moment, the first switching base station position, and the second switching base station position;

[0122] Step B30: If the switching motion speed is greater than the preset speed threshold, determining the sub-feature value of the switching event as a preset drone switching value;

[0123] Step B40: If the switching motion speed is less than or equal to the preset speed threshold, the sub-feature value of the switching event is determined to be a preset null value.

[0124] It should be noted that a handover event can include two handover sub-events. Each time a terminal device switches to a new base station, a handover sub-event is generated. Therefore, at least two handover sub-events can be determined from a handover event. For example, a first handover sub-event and a second handover sub-event can be used to determine the first handover base station location and the first moment of entry into the base station service area where the first handover base station location is located. The second handover sub-event can be used to determine the second handover base station location and the second moment of entry into the base station service area where the second handover base station location is located.

[0125] Each base station has its own service range, and the service ranges of different base stations may overlap. The first switching base station location can be the location of the base station itself, for example, the center of the base station's service range, and the second switching base station location is also the location of the corresponding base station itself.

[0126] During flight, as a connected drone increases in altitude and moves, the base station it communicates with changes. This change in base station generates a handover event. For ordinary mobile phone users, base stations also change when they move on the ground. Therefore, in this embodiment, the handover motion speed of the terminal device corresponding to the user number can be calculated based on the handover event to assess whether the handover event originated from the connected drone. For example, the handover event can be obtained from the decoded S1AP (S1 Application Protocol)-NAS (Non-Access Stratum) data in the XDR information, referring to the Deep Packet Inspection (DPI) specification. For example, the handover event can be obtained from the decoded fields such as X2 handover, S1 handoverinS1 (handover input via the S1 interface, S1 being the interface between the MME and the base station), and S1 handover outS1 (handover output via the S1 interface). The base station to which the terminal device is most recently switched can be obtained from S1 handover inS1, and the base station before the terminal device is switched to the new base station can be obtained from S1 handover outS1.

[0127] The preset drone switching value can be 1. When the sub-feature value of the switching event is the preset drone switching value, it indicates that the switching event is likely to be caused by a connected drone. When the sub-feature value of the switching event is the preset null value, it indicates that the switching event is likely to be caused by a connected drone and is unlikely to be caused by a connected drone. The preset speed threshold can be set based on actual conditions and is not specifically limited in this embodiment. When the switching motion speed is greater than the preset speed threshold, it indicates that the switching motion speed is fast and the switching event is likely caused by a connected drone. When the switching motion speed is less than or equal to the preset speed threshold, it indicates that the switching motion speed is slow and the switching event is likely not caused by a connected drone. Since connected drones may be stationary and ordinary mobile phone users may be traveling by public transportation, the switching speed of the base station corresponding to the mobile phone user may also be faster. Therefore, it is difficult to determine whether a terminal device is a connected drone based solely on the switching motion speed. Therefore, a comprehensive evaluation of other signaling events in user signaling besides the switching event is required to accurately identify a connected drone.

[0128] Exemplarily, when the signaling event is a handover event, the first handover base station location, the second handover base station location, the first moment of entering the base station service area where the first handover base station location is located, and the second moment of entering the base station service area where the second handover base station location is located are obtained from the handover event, the difference between the first moment and the second moment is calculated to obtain the handover duration, the relative distance between the first handover base station location and the second handover base station location is calculated, and the handover movement speed is calculated by the handover duration and the relative distance; if the handover movement speed is greater than a preset speed threshold, the sub-feature value of the handover event is determined to be a preset drone handover value; if the handover movement speed is less than or equal to the preset speed threshold, the sub-feature value of the handover event is determined to be a preset null value. In other embodiments, the handover event can also be combined to identify the motion state. For example, when the handover movement speed is 0, it can be considered to be a stationary state, and when the handover movement speed is greater than 0, it can be considered to be a motion state. This embodiment combines handover events for identification, thereby facilitating improved recognition accuracy of networked drones.

[0129] In a feasible embodiment, step S21 also includes step C10: when there is a shutdown event and a power-on event in the user signaling, the difference between the shutdown time in the shutdown event and the power-on time in the power-on event is less than the preset duration threshold, the sub-feature value of the domain name event in the user signaling is the preset drone domain name value, and the sub-feature value of the switching event is the preset drone switching value, the sub-feature value of the power-on event is determined to be the preset drone power-on value, and the sub-feature value of the shutdown event is determined to be the preset drone shutdown value.

[0130] It should be noted that when the connected drone is turned on, the communication card of the adapter of the connected drone will interact with the 4G5G mobile communication network to generate a connection request signaling. If the connection request signaling corresponding to the user number can be obtained, it can be determined that there is a power-on event. For example, the connection request signaling can be included in the user signaling, and the connection request signaling represents the generation of a power-on event.

[0131] Due to power reasons, connected drones need to replace batteries or shut down after completing flight missions, so shutdown signaling will also be generated in the 4G5G mobile communication network. For example, user signaling can include shutdown signaling, and shutdown signaling includes shutdown events.

[0132] Ordinary mobile phone users may also have corresponding power-on and power-off events, but the power-off and power-on events generated by ordinary mobile phone users may not be so frequent, and the power-on time is generally longer than that of a networked drone. Therefore, when evaluating whether a power-on event and / or power-off event is caused by a networked drone, the power-on time can be determined from the power-on event, and the power-off time can be determined from the power-off event. The difference between the power-off time and the power-on time can then be calculated to obtain the power-on time. Combined with the power-on time, it can be evaluated whether the power-on event and / or power-off event is likely to be caused by a networked drone.

[0133] In addition, if the sub-feature value of the domain name event is the preset drone domain name value, and the sub-feature value of the switching event is the preset drone switching value, it means that the terminal device corresponding to the user number is very likely to be a networked drone. Therefore, the domain name event and the switching event can also be combined to jointly evaluate whether the terminal device is likely to be a networked drone, because ordinary mobile phone users may not have the switching movement speed corresponding to the networked drone, nor may they necessarily access the corresponding website of the drone.

[0134] Furthermore, if both power-off events and power-on events exist in the user signaling, it is likely that the device is a network-connected drone. This is because the user signaling is collected within a preset period of time, and ordinary mobile phone users do not necessarily generate both power-on and power-off events within the preset period of time. Therefore, this embodiment can improve the accuracy of identifying network-connected drones by combining the power-on duration, the presence of both power-on and power-off events, and domain name events and switching events.

[0135] The preset drone power-on value can be 1, and the preset drone power-off value can be 1. When the sub-feature value of the power-on event is the preset drone power-on value, it indicates that the power-on event is likely to be generated by a networked drone. When the sub-feature value of the power-on event is the preset null value, it indicates that the power-on event is likely to be generated by a networked drone. When the sub-feature value of the power-off event is the preset drone power-off value, it indicates that the power-off event is likely to be generated by a networked drone. When the sub-feature value of the power-off event is the preset null value, it indicates that the power-off event is likely to be generated by a networked drone.

[0136] For example, when there are shutdown events and power-on events in the user signaling, the difference between the shutdown time in the shutdown event and the power-on time in the power-on event is less than the preset duration threshold, the sub-feature value of the domain name event in the user signaling is the preset drone domain name value, and the sub-feature value of the switching event is the preset drone switching value, the sub-feature value of the power-on event is determined to be the preset drone power-on value, and the sub-feature value of the shutdown event is determined to be the preset drone shutdown value.

[0137] If a shutdown event is present in user signaling, the sub-feature value of the domain name event in the user signaling is a preset drone domain name value, and the sub-feature value of the switch event is a preset drone switch value, the sub-feature value of the power-on event is determined to be a preset null value, and the sub-feature value of the power-off event is determined to be a preset drone shutdown value. In this case, the power-on event may have been lost, but the shutdown event may also have been generated by a connected drone, so the sub-feature value of the shutdown event is the preset drone shutdown value.

[0138] If a power-on event is present in user signaling, the sub-feature value of the domain name event in the user signaling is a preset drone domain name value, and the sub-feature value of the switch event is a preset drone switch value, the sub-feature value of the power-on event is determined to be the preset drone power-on value, and the sub-feature value of the power-off event is determined to be a preset null value. In this case, the power-off event may have been lost, but the power-on event may have been generated by a connected drone, so the sub-feature value of the power-on event is determined to be the preset drone power-on value.

[0139] If the sub-feature value of the domain name event in the user signaling is a preset null value and / or the sub-feature value of the handover event is a preset null value, the sub-feature value of the power-on event is determined to be a preset null value, and the sub-feature value of the power-off event is determined to be a preset null value. In this case, the probability that the domain name event and / or the handover event is generated by a networked drone is low, so the power-on event and the power-off event may not be generated by a networked drone. The sub-feature value of the power-on event is a preset null value, and the sub-feature value of the power-off event is determined to be a preset null value.

[0140] If the user signaling contains both a power-off event and a power-on event, and the difference between the power-off time in the power-off event and the power-on time in the power-on event is greater than a preset duration threshold, the power-on event's sub-feature value is determined to be a preset null value, and the power-off event's sub-feature value is determined to be a preset null value. In this case, it indicates that the power-on duration is too long, and the power-on and power-off events may not be generated by a connected drone.

[0141] To better understand the drone characteristic values and drone detection values in this embodiment, please refer to Table 1:

[0142] Table 1:

[0143]

[0144] Table 1 shows the user signaling and low-altitude radar data corresponding to three user numbers, namely user number 1 to user number 3. The data of 0 in Table 1 indicates that there is no signaling event corresponding to the user number 0. For example, user number 1 corresponds to no Internet access event and switching event, and user number 3 corresponds to no power-on event, Internet access event, and switching event. Among them, the weight a in the table is the weight corresponding to the terminal type event. When there is a terminal type event, the corresponding sub-feature value can be 1. Therefore, when there is a terminal type event, it can be the sub-feature value of the terminal type event 1 multiplied by the weight a, so the weight a will be displayed in the table, and the corresponding weights b, c, d, and e are as follows. The weight f is the weight corresponding to the power-on event, Internet access event, domain name event, switching event, and shutdown event respectively. The weight g is the preset detection weight corresponding to the low-altitude radar data. Correspondingly, when there is a power-on event, the sub-feature value corresponding to the power-on event is 1. When there is an Internet access event, the sub-feature value corresponding to the Internet access event is 1. When there is a domain name event, the sub-feature value corresponding to the domain name event is 1. When there is a switching event, the sub-feature value corresponding to the switching event is 1. When there is a shutdown event, the sub-feature value corresponding to the shutdown event is 1. When there is a drone matching the user signaling in the low-altitude radar data, the corresponding drone detection value is 1. Therefore, the corresponding weights will be displayed in the table.

[0145] The sum of the drone feature value and drone detection value of user number 1 is: weight a + weight b + weight c + weight d + weight e + weight f + weight g;

[0146] The sum of the drone feature value and drone detection value of user number 2 is: weight a + weight b + 0 + weight d + 0 + weight f + weight g;

[0147] The sum of the drone feature value and drone detection value of user number 3 is: weight a+0+0+weight d+0+weight f+weight g; then, the sum of the drone feature value and drone detection value can be used to identify whether the terminal device corresponding to each user number is a networked drone.

[0148] In a feasible embodiment, the preset networked drone event sequence includes a plurality of preset events arranged in sequence, and step S21 further includes steps D21 and D22:

[0149] Step D21: For each signaling event in the user signaling, obtain the event generation time from the signaling event, and sort the signaling events according to their corresponding event generation times to obtain an event ranking, wherein the event generation time of the signaling event ranked earlier in the event ranking is earlier than that of the signaling event ranked later;

[0150] Step D22: If the number of signaling events in the user signaling is the same as the number of events in the preset networked drone event sequence, and if the event sequence is consistent with the preset networked drone event sequence, then determining that the suspected drone result includes a suspected drone;

[0151] Among them, the preset networked drone event sequence represents the event generation sequence when the networked drone is running. The preset events arranged in sequence in the event generation sequence are preset terminal type events, preset power-on events, preset Internet access events, preset domain name events, preset switching events, and preset shutdown events.

[0152] It should be noted that the event generation time is the generation time corresponding to the signaling event. For example, the event generation time of the power-on event can be the power-on time, the event generation time of the power-off event can be the power-off time, and the event generation time of the switching event can be the first time or the second time. Because, for connected drones, the power-on event is performed first, and then the Internet access event and domain name event are performed, and then the switching event is generated. Therefore, the first time and second time in the switching event will be after the power-on event, Internet access event, and domain name event, and before the power-off event. Therefore, the event generation time of the switching event can be the first time or the second time. The event generation time of the terminal type event may be the same as the power-on event.

[0153] Event sequencing is the sequencing of signaling events in user signaling. In the event sequencing, signaling events that are ranked earlier have event generation times earlier than signaling events that are ranked later.

[0154] The preset event sequence for connected drones represents the order in which events are generated during the operation of a connected drone. The order in which the preset events are generated is, in the following order: preset terminal type event, preset power-on event, preset internet access event, preset domain name event, preset switching event, and preset power-off event. The preset terminal type event and the preset power-on event can also occur at the same time, and both can be arranged in the same order.

[0155] The number of events in the preset connected drone event sequence is 6. If the number of signaling events in the user signaling is also 6, then the user signaling includes all signaling events and there is no signaling loss in the user signaling. Therefore, the event sequence can be directly compared with the preset connected drone sequence. If the event sequence is the same as the preset connected drone sequence, then the suspected drone result is confirmed to include a suspected drone, and the suspected drone characterization event sequence is the same as the preset connected drone event sequence. Suspected drone results can also include non-connected drones.

[0156] Exemplarily, for each signaling event present in the user signaling, the event generation time is obtained from the signaling event, and the signaling events are sorted according to their respective corresponding event generation times to obtain an event ranking. If the number of signaling events present in the user signaling is the same as the number of events preset in the preset networked drone event sequence, and if the event ranking is consistent with the preset networked drone event sequence, then the suspected drone result is determined to include a suspected drone. If the event ranking is different from the preset networked drone event sequence, then the suspected drone result is determined to include a non-networked drone. If it is determined that the suspected drone result includes a non-networked drone, then it can be directly determined that the terminal device corresponding to the user number is not a networked drone, and subsequent verification using low-altitude radar data is no longer necessary.

[0157] In a feasible embodiment, step D21 is followed by step D211: when the number of signaling events in the user signaling is less than the number of preset events in the preset networked drone event sequence, if the relative order between any two signaling events in the event sorting is the same as the relative order between the corresponding two preset events in the preset networked drone event sequence, then it is determined that the suspected drone result includes a suspected drone.

[0158] It should be noted that if the number of signaling events in a user signaling is less than the number of events in the preset sequence of networked drone events, it indicates that there may be lost signaling events in the user signaling. It is also possible that the terminal device corresponding to the user signaling has not generated signaling events. For example, the terminal device may not generate a shutdown event or a handover event. If the user signaling is generated by a networked drone, there may be signaling loss, resulting in the user signaling not containing all signaling events. Therefore, if the number of signaling events in the user signaling is less than the number of events in the preset sequence of networked drone events, it cannot be directly determined that the terminal device corresponding to the user signaling is not a networked drone.

[0159] Therefore, this embodiment can compare whether the relative order between any two signalings in the event sorting is the same as the relative order between the corresponding two preset events in the preset networked drone event sequence. If they are the same, it can be determined that the suspected drone results include suspected drones. If there is a reverse order in the event sequence that contradicts the preset networked drone event sequence, it is determined that the suspected drone results include not being a networked drone.

[0160] The reverse order characterizes that the relative order of two signaling events is not a preset relative order. The preset relative order can be determined from the preset networked drone event order. For example, any first target signaling event and any second target signaling event are determined in the event sorting. The first target signaling event is different from the second target signaling event. The first target signaling event is any signaling event existing in the user signaling, and the second target signaling event is any signaling event existing in the user signaling.

[0161] The first target signaling event corresponds to the first target preset signaling event in the preset networked drone event sequence, and the second target signaling event corresponds to the second target preset signaling event in the preset networked drone event sequence. The preset relative order is determined based on the first target preset signaling event and the second target preset signaling event. If the preset relative order is different from the relative order between the first target signaling event and the second target signaling event, it is determined that the suspected drone result includes not being a networked drone. In other embodiments, if there is no reverse order in the event sequence that contradicts the preset networked drone event sequence, it can be determined that the suspected drone result includes a suspected drone.

[0162] For example, when the event sorting is: switching event, Internet access event and power-on event, the relative order between the power-on event and the Internet access event in the event sorting is that the power-on event is sorted after the Internet access event. Then the power-on event corresponds to the preset power-on event in the preset networked drone event sequence, and the Internet access event corresponds to the preset Internet access event in the preset networked drone event. The preset relative order of the preset power-on event and the preset Internet access event is: the preset power-on event is sorted before the preset Internet access event. The preset relative order is different from the relative order in the event sorting, so it can be determined that the suspected drone result does not include the networked drone.

[0163] This embodiment can also evaluate whether the terminal device corresponding to the user signaling is a networked drone when a signaling event is missing in the user signaling, thereby improving the accuracy of networked drone identification and avoiding missing networked drones.

[0164] Step S30, determine the drone detection value in the low-altitude radar data. When the sum of the drone characteristic value and the drone detection value is greater than the preset drone suspicion threshold and the drone suspicion result includes a suspected drone, determine that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone through the user number.

[0165] It should be noted that the drone detection value indicates that a drone matching the user signaling has been detected through low-altitude radar data, indicating that the detection time of the drone detected by the low-altitude radar data is between the first moment and the second moment of the switching event, and the detection position of the drone is within the base station service area corresponding to the switching event.

[0166] If the sum of the drone characteristic value and the drone detection value is greater than the preset drone suspected threshold, and the drone suspected result includes a suspected drone, it means that the user signaling is very likely generated by a networked drone. However, if the drone characteristic value is less than or equal to the preset drone suspected threshold, it is determined that the user signaling is not generated by a networked drone. If the drone suspected result includes not a networked drone, it means that the user signaling is not generated by a networked drone.

[0167] Low-altitude radar data can be used to identify drones detected at low altitudes, along with the time and location of detection, to determine whether a drone actually existed at the location and time corresponding to the handover event. Low-altitude radar data can detect drones appearing at low altitudes, but it cannot identify the type of drone, or whether it is a connected drone. Therefore, low-altitude radar data can be combined to assess whether the terminal device corresponding to the user signaling is a connected drone.

[0168] Exemplarily, when the sum of the drone characteristic value and the drone detection value is greater than a preset drone suspected threshold, and the drone suspected result includes a suspected drone, it is determined that the terminal device bound to the user number corresponding to the user signaling is a networked drone; when the sum of the drone characteristic value and the drone detection value is less than or equal to the preset drone suspected threshold, and / or the drone suspected result includes a suspected drone, it is determined that the terminal device bound to the user number corresponding to the user signaling is not a networked drone.

[0169] In the embodiment of the present application, user signaling in the 4G5G mobile communication network can be obtained. Since the networked drone communicates in the 4G5G mobile communication network, and there are certain differences between the signaling generated by the networked drone and the signaling generated by ordinary public network users, the user signaling generated in the 4G5G mobile communication network can be obtained, so that the networked drone can be identified in combination with the user signaling later. Since the signaling events corresponding to the networked drone have a predetermined order of generation, the order of networked drone events and the event generation time of each signaling event in the user signaling can also be preset to determine the suspected drone result, and then determine the drone detection value through low-altitude radar data, so that it can be determined whether there is a drone in the low altitude through low-altitude radar data. Furthermore, the embodiment of the present application can determine that the terminal device bound to the user number corresponding to the user signaling is a networked drone when the sum of the drone characteristic value and the drone detection value is greater than the preset drone suspicion threshold and the drone suspicion result includes a suspected drone, thereby realizing the identification of networked drones through user signaling and low-altitude radar data, improving the recognition accuracy of networked drones in 4G5G mobile communication networks, and facilitating the subsequent interception of the networked drone corresponding to the user number through the user number.

[0170] In a feasible embodiment, step S30 further includes steps S31 to S33:

[0171] Step S31, obtaining the detected UAV, the detection position and the detection time of the UAV from the low-altitude radar data;

[0172] Step S32, determining the first switching base station location, the second switching base station location, the first time of entering the base station service area where the first switching base station location is located, and the second time of entering the base station service area where the second switching base station location is located from the switching event of the user signaling;

[0173] In step S33, if the detection time is between the first time and the second time, and the detection position belongs to the base station service area where the first switching base station is located and / or the base station service area where the second switching base station is located, then the drone detection value is determined to be the product of the preset drone presence value and the preset detection weight.

[0174] It should be noted that low-altitude radar data includes drones detected by radar at low altitudes, their detection locations, and detection times. The detection location refers to the location of the drone at the time of detection. Low-altitude radar data can contain multiple detected drones, each with its own corresponding detection location and detection time. When the preset drone presence value is 1 and the drone detection value is the preset drone presence value, it indicates that the drone detected in the low-altitude radar data matches the user signaling. The preset detection weight can be set based on actual circumstances and is not specifically limited in this embodiment.

[0175] For example, if the low-altitude radar data contains a detection time of the same drone between the first and second moments, and the detection location is in the base station service area where the first switching base station is located and / or the base station service area where the second switching base station is located, it can be determined that the user signaling is indeed generated by a networked drone. If the low-altitude radar data does not contain a detection time of the same drone between the first and second moments, and the detection location is in the base station service area where the first switching base station is located and the base station service area where the second switching base station is located, the drone detection value is a preset null value. This indicates that the suspected networked drone determined by user signaling is not actually a networked drone.

[0176] This embodiment determines the drone detection value through low-altitude radar data, thereby improving the accuracy of networked drone identification.

[0177] In a feasible embodiment, step Y10 is further included after step S30: when it is determined that the terminal device bound to the user number is a networked drone, if the networked drone is detected to enter a preset area, and the networked drone belongs to the preset no-fly list of the preset area, the networked drone is disconnected from the network through the user number corresponding to the networked drone to intercept the networked drone corresponding to the user number.

[0178] It should be noted that when a terminal device bound to a user number is identified as a networked drone, the user number can be used to intercept the drone, thereby improving interception accuracy and preventing interference with other ordinary telecom network users. The preset area may be, for example, a city or industrial park, and this embodiment does not specifically limit this. To ensure low-altitude safety within the preset area, drones not permitted to enter the preset area must be intercepted. Therefore, if a networked drone is detected entering the preset area and is on a preset no-fly list within the preset area, the user number corresponding to the networked drone can be disconnected from the network to intercept the drone. The preset no-fly list can be predetermined, and this embodiment does not specifically limit this. For example, a preset flight whitelist can be determined. The preset flight whitelist may include drones permitted to enter the preset area, and all other drones not on the preset flight whitelist will be placed on the preset no-fly list. In addition, when it is determined that the terminal device bound to the user number is a networked drone, the MR (Measurement Report) data of the networked drone can be obtained through the user number for trajectory simulation, or the location server platform can be used to backfill the location, so as to identify the movement trajectory of the networked drone, and then determine whether the networked drone has entered the preset area or is about to enter the preset area based on the movement trajectory, so as to intercept the networked drone later.

[0179] For example, if the terminal device bound to the user number is determined to be a networked drone, if the networked drone is detected to have entered a preset area and is on a preset no-fly list for that area, the networked drone will be disconnected from the network using the user number associated with the networked drone, thereby intercepting the networked drone associated with the user number. In other embodiments, if the networked drone is detected to have entered a preset area and the user number associated with the networked drone is not found in the preset flight whitelist, the networked drone will be disconnected from the network using the user number associated with the networked drone, thereby intercepting the networked drone associated with the user number. This allows for successful interception and ensures safety.

[0180] For a better understanding of this embodiment, please refer to Figure 3 , Figure 3The identification process for identifying networked drones is shown in Figure 2. Signaling events corresponding to user numbers can be obtained from the core network, including terminal type events, power-on events, Internet access events, domain name events, switching events, or power-off events. Sub-feature values corresponding to each signaling event are determined. Low-altitude radar data can be obtained from a third party, which can be a platform with low-altitude radar detection capabilities. Low-altitude radar data can be obtained and a detection value corresponding to the low-altitude radar data can be determined. The detection value can be 0 or 1. A detection value of 0 indicates that the drone detection value of the low-altitude radar data is a preset null value, and a detection value of 1 indicates that the drone detection value of the low-altitude radar data is a preset drone presence value. A drone feature value is obtained by weighted summing each sub-feature value. The detection value is weighted to obtain a drone detection value. It is determined whether the sum of the drone detection value and the drone feature value is greater than a preset drone suspicion threshold. If the sum of the drone detection value and the drone feature value is greater than the preset drone suspicion threshold, the terminal device corresponding to the user number is determined to be a networked drone. If the sum of the drone detection value and the drone feature value is less than or equal to the preset drone suspicion threshold, the terminal device corresponding to the user number is determined to be not a networked drone. After determining that it is a networked drone, the MR data of the networked drone can be obtained. For example, the corresponding MR data can be obtained in the core network through the user number to identify the movement trajectory of the networked drone. Figure 3 The 5 minutes here means that terminal type events, power-on events, Internet access events, and domain name events can be obtained within 5 minutes. The 30 minutes means that power-off events can be obtained within 30 minutes, and switching events and low-altitude radar data can be obtained within 5 minutes or 30 minutes.

[0181] For further information, please refer to Figure 4 , Figure 4The networked drone interception system is demonstrated in [1]. It includes a shutdown and restart platform, a startup platform, and a drone identification platform. The shutdown and restart platform allows users to control whether the user number corresponding to the networked drone is to be shut down or restarted. If the networked drone is shut down, it cannot take off. If it is restarted, it indicates that the user number corresponding to the networked drone has returned to normal and can be used normally to connect to the network, allowing the networked drone to take off normally. The startup platform is an open capability platform that provides shutdown and restart capabilities for the shutdown and restart platform. This embodiment does not specifically limit the capabilities provided by the startup platform. The drone identification platform includes a real-time interface service and a MySQL (MySQL Database Management System) database. SQL (Structured Query Language) is the standard interface language used for interaction with the MySQL database. The MySQL database and the real-time interface service communicate via SQL. The platform also provides various APIs (Application Programming Interfaces) for interacting with the platform. The MySQL database includes a list of suspected drones, service list management, customizable power on / off, a pre-set drone domain whitelist, and interface logs. The interface logs record intercepted and permitted drones. Service list management includes a pre-set no-fly list and a pre-set whitelist. Drones on the pre-set whitelist are permitted to fly, while those on the no-fly list are prohibited from flying. Customized power on / off allows for customized power on / off of drones that are required to be added to the pre-set whitelist but are not yet added to the whitelist, should they be intercepted by mistake. The list of suspected drones is a list of connected drones identified through user signaling and low-altitude radar data.

[0182] For example, when the drone identification platform identifies a networked drone that needs to be banned from flying, the drone identification platform will inform the operating platform through the real-time interface service that there is a networked drone that needs to be intercepted. The operating platform will send the user number corresponding to the networked drone that needs to be banned to the shutdown and recovery platform, and perform a network disconnection or shutdown operation on the user number to intercept the networked drone.

[0183] The present application also provides a low-altitude networked drone identification device based on a 4G5G mobile communication network. Figure 5 , the device includes:

[0184] The acquisition module 10 is used to obtain low-altitude radar data within a preset time period and user signaling in the 4G5G mobile communication network. The user signaling includes one or more different signaling events, and the signaling events are terminal type events, power-on events, Internet access events, domain name events, switching events or shutdown events; the determination module 20 is used to determine the drone characteristic value in the user signaling, and determine the drone suspected result based on the preset networked drone event sequence and the event generation time of each signaling event in the user signaling; the identification module 30 is used to determine the drone detection value in the low-altitude radar data. When the sum of the drone characteristic value and the drone detection value is greater than the preset drone suspected threshold and the drone suspected result includes a suspected drone, it is determined that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone through the user number.

[0185] The low-altitude networked drone identification device based on the 4G5G mobile communication network provided in the embodiment of the present application adopts the low-altitude networked drone identification method based on the 4G5G mobile communication network in the above embodiment, aiming to solve the problem of low accuracy in networked drone identification. Compared with the prior art, the beneficial effects of the low-altitude networked drone identification method based on the 4G5G mobile communication network provided in the embodiment of the present application are the same as the beneficial effects of the low-altitude networked drone identification method based on the 4G5G mobile communication network provided in the above embodiment, and the other technical features of the low-altitude networked drone identification device based on the 4G5G mobile communication network are the same as the features disclosed in the above embodiment method, and are not further described here.

[0186] The present application provides an electronic device, comprising: the electronic device further comprising at least one processor, and a memory in communication with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the low-altitude networked drone identification method based on the 4G5G mobile communication network in the above-mentioned embodiment 1. Figure 6 , which shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic devices in the embodiments of the present application may include, but are not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), etc., as well as fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0187] like Figure 6 As shown, the electronic device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory 1002 or programs loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the electronic device. The processing device 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems may be connected to the input / output interface 1006: an input device 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; a storage device 1003 including, for example, a magnetic tape or hard disk; and a communication device 1009. The communication device 1009 may allow the electronic device to communicate with other devices wirelessly or wired to exchange data. Although the figures show electronic devices with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have instead.

[0188] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a read-only memory 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are performed.

[0189] The electronic device provided in this application uses the low-altitude networked drone identification method based on the 4G5G mobile communication network in the above-mentioned embodiment to solve the problem of low accuracy in identifying networked drones. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as the beneficial effects of the low-altitude networked drone identification method based on the 4G5G mobile communication network provided in the above-mentioned embodiment, and the other technical features of the electronic device are the same as those disclosed in the method of the previous embodiment, and are not further described here.

[0190] It should be understood that the various parts disclosed in this application can be implemented with hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in a suitable manner in any one or more embodiments or examples. The above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be included in the scope of protection of this application. Therefore, the scope of protection of the present application shall be based on the scope of protection of the claims.

[0191] This embodiment provides a computer-readable storage medium having computer-readable program instructions stored thereon, the computer-readable program instructions being used to execute the method for identifying low-altitude networked drones based on a 4G or 5G mobile communication network described in the first embodiment above. The computer-readable storage medium provided in this embodiment may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor devices, equipment, or components, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable EPROM (Electrical Programmable Read Only Memory) or flash memory, optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution device, equipment, or component. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof. The computer-readable storage medium may be included in an electronic device or may exist independently without being incorporated into the electronic device. The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by an electronic device, the electronic device: obtains low-altitude radar data within a preset time period and user signaling in the 4G5G mobile communication network, wherein the user signaling includes one or more different signaling events, and the signaling event is a terminal type event, a power-on event, an Internet access event, a domain name event, a switching event or a power-off event; determines the drone characteristic value in the user signaling, and determines the drone suspected result based on the preset networked drone event sequence and the event generation time of each signaling event in the user signaling; determines the drone detection value in the low-altitude radar data, and when the sum of the drone characteristic value and the drone detection value is greater than the preset drone suspected threshold and the drone suspected result includes a suspected drone, determines that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone through the user number.

[0192] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a LAN (local area network) or WAN (wide area network), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0193] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the equipment, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based device that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0194] The modules involved in the embodiments described in the present disclosure can be implemented by software or by hardware. The name of the module does not constitute a limitation on the unit itself under certain circumstances. The computer-readable storage medium provided in the embodiment of the present application stores computer-readable program instructions for executing the above-mentioned low-altitude networked drone identification method based on 4G5G mobile communication network, which aims to solve the problem of low accuracy in the identification of networked drones. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in the embodiment of the present application are the same as the beneficial effects of the low-altitude networked drone identification method based on 4G5G mobile communication network provided in the above-mentioned embodiment, and will not be elaborated here.

[0195] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for identifying low-altitude networked drones based on a 4G5G mobile communication network.

[0196] The computer program product provided in the embodiments of this application is intended to address the problem of low accuracy in identifying networked drones. Compared to the prior art, the beneficial effects of the computer program product provided in the embodiments of this application are the same as those of the method for identifying low-altitude networked drones based on 4G5G mobile communication networks provided in the above embodiments, and will not be further elaborated here.

[0197] The above are only preferred embodiments of the embodiments of the present application, and do not limit the patent scope of the embodiments of the present application. Any equivalent structure or equivalent process transformation made using the contents of the description and drawings of the embodiments of the present application, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the embodiments of the present application.

Claims

1. A method for identifying low-altitude networked drones based on 4G5G mobile communication networks, characterized in that: The method includes: Obtain low-altitude radar data within a preset time period and user signaling in a 4G5G mobile communication network, wherein the user signaling includes one or more different signaling events, wherein the signaling event is a terminal type event, a power-on event, an Internet access event, a domain name event, a switching event, or a power-off event; Determine a drone characteristic value in the user signaling, and determine a drone suspected result based on a preset networked drone event sequence and the event generation time of each signaling event in the user signaling, wherein the preset networked drone event sequence includes a plurality of preset events arranged in sequence; Determining a drone detection value in the low-altitude radar data, and if the sum of the drone characteristic value and the drone detection value is greater than a preset drone suspicion threshold, and the drone suspicion result includes a suspected drone, determining that the terminal device bound to the user number corresponding to the user signaling is a networked drone, so as to intercept the networked drone using the user number; The step of determining a suspected drone result according to a preset networked drone event sequence and the event generation time of each signaling event in the user signaling includes: For each signaling event present in the user signaling, obtaining an event generation time from the signaling event, and sorting the signaling events according to the event generation time corresponding to each signaling event to obtain an event sorting, wherein the event generation time of a signaling event sorted earlier in the event sorting is earlier than that of a signaling event sorted later; When the number of signaling events present in the user signaling is the same as the number of preset events in the preset networked drone event sequence, and if the event sequence is consistent with the preset networked drone event sequence, determining that the suspected drone result includes a suspected drone; The preset event sequence of the networked drone represents the event generation sequence when the networked drone is running, and the preset events sequentially arranged in the event generation sequence are respectively a preset terminal type event, a preset power-on event, a preset Internet access event, a preset domain name event, a preset switching event, and a preset shutdown event; In a case where the number of signaling events present in the user signaling is less than the number of preset events in the preset networked drone event sequence, if the relative order between any two signaling events in the event sequence is the same as the relative order between the corresponding two preset events in the preset networked drone event sequence, then it is determined that the suspected drone result includes a suspected drone; The step of determining the drone detection value in the low-altitude radar data includes: Obtaining a detected drone, a detection position of the drone, and a detection time from the low-altitude radar data; Determining, from the handover event of the user signaling, a first handover base station location, a second handover base station location, a first time of entering a base station service area where the first handover base station location is located, and a second time of entering a base station service area where the second handover base station location is located; If the detection moment is between the first moment and the second moment, and the detection location belongs to the base station service area where the first switching base station is located and / or the base station service area where the second switching base station is located, then the drone detection value is determined to be the product of the preset drone presence value and the preset detection weight.

2. The method for identifying low-altitude networked drones based on a 4G5G mobile communication network according to claim 1, wherein: The step of determining the drone characteristic value in the user signaling includes: Determine the sub-eigenvalue of each signaling event, and perform weighted summation on the sub-eigenvalues to obtain the drone eigenvalue.

3. The low-altitude networked drone identification method based on the 4G5G mobile communication network according to claim 2 is characterized in that: The step of determining the sub-feature value of each signaling event includes: When the signaling event is a terminal type event, obtaining the terminal type from the terminal type event; Searching for a terminal feature value corresponding to the terminal type in a preset terminal feature mapping relationship; Using the terminal feature value as a sub-feature value of the terminal type event; The preset terminal feature mapping relationship includes preset terminal feature values corresponding to a plurality of preset terminal types.

4. The method for identifying low-altitude networked drones based on a 4G5G mobile communication network according to claim 3, wherein: The step of determining the sub-feature value of each signaling event includes: When the signaling event is a domain name event, obtaining a domain name name from the domain name event; If the domain name exists in the preset drone domain name whitelist, then determine that the sub-feature value of the domain name event is the preset drone domain name value; If the domain name does not exist in the preset drone domain name whitelist, determining that the sub-feature value of the domain name event is a preset null value; If the sub-feature value of the domain name event is the preset drone domain name value, then determining that the signaling event is an Internet access event sub-feature value is the preset drone Internet access value; If the sub-feature value of the domain name event is a preset null value, then the sub-feature value of determining whether the signaling event is an Internet access event is a preset null value.

5. The low-altitude networked drone identification method based on 4G5G mobile communication network according to claim 4 is characterized in that: The step of determining the sub-feature value of each signaling event includes: When the signaling event is a handover event, obtaining, from the handover event, a first handover base station location, a second handover base station location, a first time of entering a base station service area where the first handover base station location is located, and a second time of entering a base station service area where the second handover base station location is located; Calculating a switching motion speed based on the first moment, the second moment, the first switching base station position, and the second switching base station position; If the switching motion speed is greater than a preset speed threshold, determining the sub-feature value of the switching event as a preset drone switching value; If the switching movement speed is less than or equal to the preset speed threshold, the sub-feature value of the switching event is determined to be a preset null value.

6. The method for identifying low-altitude networked drones based on a 4G5G mobile communication network according to claim 5, wherein: The step of determining the sub-feature value of each signaling event includes: When there is a shutdown event and a power-on event in the user signaling, the difference between the shutdown moment in the shutdown event and the power-on moment in the power-on event is less than a preset duration threshold, the sub-feature value of the domain name event in the user signaling is a preset drone domain name value, and the sub-feature value of the switching event is a preset drone switching value, the sub-feature value of the power-on event is determined to be the preset drone power-on value, and the sub-feature value of the shutdown event is determined to be the preset drone shutdown value.

7. The method for identifying low-altitude networked drones based on a 4G5G mobile communication network according to claim 1, wherein: The method further comprises: When it is determined that the terminal device bound to the user number is a networked drone, if the networked drone is detected to enter a preset area and the networked drone belongs to the preset no-fly list of the preset area, the networked drone will be disconnected from the network through the user number corresponding to the networked drone to intercept the networked drone corresponding to the user number.

Images