Attack detection method and system based on unmanned aerial vehicle group log graph overlap calculation

Abstract

The invention discloses an attack detection method and system based on unmanned aerial vehicle group log graph overlap calculation, and belongs to the technical field of unmanned aerial vehicle detection, and the attack detection method comprises the steps: constructing an attack sample graph according to attack logs of an unmanned aerial vehicle group in a historical time period; according to the damping coefficient of each node in the attack sample graph and the frequency among the nodes, generating an attack feature sub-graph in combination with a dynamic expansion strategy; constructing a graph structure of unmanned aerial vehicle behaviors according to the behavior log of the unmanned aerial vehicle cluster, expanding core nodes of the graph structure of the unmanned aerial vehicle by adopting a sampling algorithm, and constructing an overlapping region graph of attack behavior characteristics; determining the similarity between each attack feature sub-graph and the overlapping area graph, superposing the similarity of the overlapping area graph to obtain the attack credibility of the overlapping area graph, and determining an attack behavior according to the attack credibility; according to the method, unmanned aerial vehicle behaviors are comprehensively resumed through a graph operation technology, an attack mode is identified, and an attack path is traced, so that efficient unmanned aerial vehicle group intrusion detection is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of unmanned aerial vehicle (UAV) detection, and particularly to an attack detection method and system based on the overlap calculation of UAV swarm log graphs. Background Art

[0002] With the rapid development of UAV technology, the applications of UAVs have been continuously expanding in multiple fields. From military reconnaissance, border patrol to logistics distribution, agricultural monitoring, etc., more and more industries are beginning to rely on UAV swarm operations to complete more complex and efficient tasks. UAV swarm operations not only improve the efficiency and flexibility of task execution, but also enable cooperation and coordination among multiple UAVs, enhancing the overall operation ability. However, with the increase in the scale and application scenarios of UAV swarms, security issues have become prominent, especially the attack threats against UAV swarms have gradually become an urgent problem to be solved.

[0003] UAV attacks are highly concealed, have long latency and complexity. Attackers usually penetrate and invade UAVs through various means. Attackers may invade the flight control system, communication system or other key systems of UAVs, resulting in the loss of control, deviation from the flight path or complete paralysis of UAVs. Especially in UAV swarm operations, attacks may be carried out through the synergistic effects among multiple UAVs, causing more serious consequences. For example, by controlling a part of the UAVs in the swarm, attackers can manipulate the behavior of the entire UAV swarm, change the flight trajectory, interfere with the operation tasks or inject malicious instructions into the flight control system.

[0004] Traditional UAV intrusion detection technologies are often limited to single detection means, such as log analysis, traffic analysis or anomaly detection based on sensor data. However, these methods often seem inadequate when dealing with complex UAV swarm attacks. First, there are close synergistic relationships among the nodes in the UAV swarm. Attacks may be multi-stage and multi-link, and their traces are often distributed on multiple flight nodes. Traditional methods are difficult to effectively track the attack paths across nodes. Second, the diversity and huge volume of log data make log-based analysis extremely complex, and attackers usually tamper with or delete log data to cover up attack behaviors. Traffic analysis is also difficult to effectively identify attack behaviors when facing encrypted communications or disguised network traffic. Summary of the Invention

[0005] Aiming at the intrusion detection problem in existing UAV swarm operations, the present invention provides an attack detection method based on the overlap calculation of UAV swarm log graphs. This method can comprehensively review UAV behaviors through graph operation technologies, identify attack patterns and accurately trace the attack paths, so as to achieve efficient UAV swarm intrusion detection.

[0006] The present invention is realized through the following technical solutions: An attack detection method based on the overlap calculation of drone swarm log graphs, comprising the following processes: Construct an attack sample graph based on the attack logs of the drone swarm in a historical time period; Generate an attack feature sub-graph according to the damping coefficient of each node in the attack sample graph and the frequency between nodes, and in combination with a dynamic expansion strategy; Construct a graph structure of the drone behavior based on the behavior logs of the drone swarm, and use a sampling algorithm to expand the core nodes of the drone graph structure to construct an overlapping area graph of the attack behavior characteristics; Determine the similarity between each attack feature sub-graph and the overlapping area graph, superimpose the similarities of the overlapping area graph to obtain the attack credibility of the overlapping area graph, and determine the attack behavior according to the attack credibility; Trace the attack behavior according to the attack credibility of the overlapping area graph.

[0007] Preferably, the construction of the attack sample graph includes: Obtain each attack event in the attack log, and construct an attack sample graph according to the time stamp and node relationship of the attack event.

[0008] Preferably, the generation of the attack feature sub-graph in combination with the dynamic expansion strategy includes: Use the Pagerank algorithm to calculate the Pagerank coefficient of each node in the attack sample graph; Calculate the frequency between nodes in the attack sample graph; According to the Pagerank coefficient of the node and the frequency between nodes, and in combination with the depth-first expansion method, calculate the priority coefficient of the neighbor nodes of the initial node; Generate a random probability according to the probability algorithm, determine the expansion node according to the random probability and the priority coefficient of the node, and stop the expansion according to the set number of nodes to obtain the attack feature sub-graph.

[0009] Preferably, determining the expansion node according to the random probability and the priority coefficient of the node includes: Compare the random probability with the priority coefficient of the node, and use the node with the priority coefficient greater than the random probability as the expansion node.

[0010] Preferably, the construction method of the graph structure of the drone behavior includes: Obtain the behavior logs of the drone swarm, which include flight data, network communication data, and control instruction data; Obtain log events according to the behavior logs and use them as graph nodes, and perform edge connection according to the time sequence relationship and dependency relationship of the log events to construct the graph structure of the drone swarm.

[0011] Preferably, constructing an overlapping region graph of attack behavior features includes: Using the Maximin Distance Sampling algorithm, taking the node with the highest damping coefficient as the core node, and expanding from the neighbor nodes according to the set radius until the set number of nodes is reached to obtain the overlapping region graph.

[0012] Preferably, the similarity between the attack feature subgraph and the overlapping region graph includes: Using the maximum common subgraph algorithm to calculate the similarity between the attack sample graph and each overlapping region; Using the Sigmoid activation function to superimpose the similarity of the overlapping region graph to obtain the shading degree, taking the shading degree as the attack credibility, comparing the shading degree with the set threshold, and when the shading degree is greater than the set threshold, there is a workpiece behavior in the region corresponding to the shading degree.

[0013] Preferably, tracing the attack behavior according to the attack credibility of the overlapping region graph includes: Lifting the attack chain based on the nodes in the region corresponding to the shading degree and tracing the attack source according to the attack chain.

[0014] An attack detection system based on the overlapping calculation of UAV swarm log graphs includes: An attack sample graph module for constructing an attack sample graph according to the attack logs of the UAV swarm in the historical time period; An attack feature subgraph module for generating an attack feature subgraph according to the damping coefficient of each node in the attack sample graph and the frequency between nodes, and combining with the dynamic expansion strategy; An overlapping region graph module for constructing a graph structure of UAV behavior according to the behavior logs of the UAV cluster, expanding the core nodes of the UAV graph structure by using a sampling algorithm, and constructing an overlapping region graph of attack behavior features; An attack detection module for determining the similarity between each attack feature subgraph and the overlapping region graph, superimposing the similarity of the overlapping region graph to obtain the attack credibility of the overlapping region graph, and determining the attack behavior according to the attack credibility; An attack tracing module for tracing the attack behavior according to the attack credibility of the overlapping region graph.

[0015] An electronic device includes: A memory for storing a computer program; A processor for implementing the steps of the attack detection method based on the overlapping calculation of UAV swarm log graphs when executing the computer program.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: An attack detection method based on the overlapping calculation of drone swarm log graphs provided by the present application aims at the intrusion detection problem in the operation of drone swarms in the prior art, especially the problems such as the difficulty in detecting multi-stage and multi-node attack behaviors, the complexity and massiveness of log data leading to difficult analysis, the high concealment of attack behaviors and untimely traceability. It converts the drone behavior log data into a graph representation, solves the problems of complex data and difficult revelation of the temporal relationship between events in traditional log analysis, and can comprehensively display the association between different drone behaviors and the structure of the attack chain. Then, through graph matching technology and overlapping calculation strategies, it solves the problem of low graph matching calculation efficiency in a large-scale drone cluster environment, effectively reduces the calculation complexity, and ensures the feasibility and efficiency of the graph overlapping calculation process. Then, through the exact matching based on the maximum common subgraph algorithm, it can efficiently identify known attack patterns, quickly locate the attack path and trace back to the potential attack source. In addition, based on the shadow degree calculation of the overlapping area, it can accurately identify abnormal areas, thereby judging whether an attack has occurred and making an effective early warning for unknown attacks. This detection method significantly improves the accuracy and efficiency of drone swarm intrusion detection and provides strong technical support for drone security protection.

[0017] The present application also proposes an attack detection system based on the overlapping calculation of drone swarm log graphs, an electronic device, and a computer storage medium, which have all the advantages of the above-mentioned attack detection method based on the overlapping calculation of drone swarm log graphs. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings required for use in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as limiting the scope. For those of ordinary skill in the art, other related drawings can be obtained based on these drawings without creative efforts.

[0019] Figure 1 It is a flowchart of the attack detection of the overlapping calculation of the drone swarm log graph of the present invention Figure 2 It is the subgraph segmentation and self-expanding graph of the drone sample of the present invention; Figure 3 It is a schematic diagram of the overlapping subgraph division of the graph to be overlapped of the present invention; Figure 4 It is a schematic diagram of the effect and attack path of the drone network intrusion attack detection of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will clearly and completely describe the technical solutions in the embodiments of this application with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are some, but not all, of the embodiments of this application. Components of the embodiments of this application described and illustrated in the accompanying drawings here can be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of this application provided in the drawings is not intended to limit the scope of this application that is claimed, but merely represents selected embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in this application without creative efforts fall within the scope of protection of this application.

[0022] An attack detection method based on the overlap calculation of the drone swarm log graph includes the following steps: Step 1: Construct an attack sample graph based on the attack logs of the drone swarm in the historical time period.

[0023] Step 2: Generate an attack feature sub-graph according to the damping system of each node in the attack sample graph and the frequency between nodes, and in combination with the dynamic expansion strategy.

[0024] Step 3: Construct a graph structure of the drone behavior based on the behavior logs of the drone cluster, use the sampling algorithm to expand the core nodes of the drone graph structure, and construct an overlapping area graph of the attack behavior characteristics; Step 4: Determine the similarity between each attack feature sub-graph and the overlapping area graph, superimpose the similarities of the overlapping area graph to obtain the attack credibility of the overlapping area graph, and determine the attack behavior according to the attack credibility.

[0025] Step 5: Trace the attack behavior according to the attack credibility of the overlapping area graph.

[0026] This application converts the multi-source logs, flight behaviors, and key events of drones into a graph structure. Each node in the graph represents a key event or state of the drone, and the edges represent the temporal relationship or causal connection between events. The graph operation method can accurately identify attack behaviors and trace the attack paths by analyzing the relationships between drone behaviors. The advantage of this method is that it can effectively display the behavior patterns in the drone system, identify latent attack behaviors from the global perspective of the graph, and can trace the key nodes and paths of the attack.

[0027] Furthermore, by adopting graph matching techniques, especially the Maximum Common Subgraph (MCS) algorithm and the subgraph isomorphism algorithm, known attack patterns can be efficiently identified and compared with the real-time generated flight graphs to quickly locate potential attack behaviors. These techniques can significantly improve the accuracy and real-time performance of attack detection and effectively handle complex attack patterns and large-scale UAV network environments. By combining pruning strategies, graph overlap calculations, etc., the calculation process can be further optimized, the computational complexity can be reduced, and the adaptability of the system to different attack patterns can be enhanced.

[0028] Embodiment 1 Refer to Figures 1-4 , an attack detection method based on the overlap calculation of UAV swarm log graphs, comprising the following steps: Step 10: Collect the flight behavior logs of UAVs, convert the logs into graph representations, construct the behavior graph of the UAV swarm according to the graph representations, and construct the graph structure of UAV behaviors according to the relationships of log events in the behavior graph.

[0029] First, collect the flight behavior logs of the UAV swarm, including flight data, network communication data, control instruction data, etc., and use existing tools to convert these log data into graph representations to form the UAV swarm behavior graph. Each log event will be used as a node in the graph, and the temporal relationships and dependencies between events are connected by edges to construct a graph structure that comprehensively reflects UAV behaviors.

[0030] Step 20: Construct an attack sample graph according to the attack logs of the UAV swarm in the historical time period.

[0031] Collect logs for the UAV swarm that has suffered attacks. For each attack event (such as intrusion, data tampering, command hijacking, etc.), collect multiple attack log data and construct the corresponding attack sample graph. The log data collected within the time window when each attack occurs will be constructed into an independent attack sample graph according to information such as timestamps and node relationships. These attack sample graphs are used as attack samples for subsequent detection and comparison.

[0032] Step 30: Generate an attack feature subgraph according to the damping system of each node in the attack sample graph and the frequency between nodes, and combine with the dynamic expansion strategy.

[0033] Node Pagerank coefficient calculation: Sort the importance of each node in the sample graph through the Pagerank algorithm and calculate the Pagerank coefficient of each node.

[0034] Frequency calculation: Calculate the edge frequency between nodes, count the occurrence times of edge-node combinations, and calculate the frequency using the formula. Edge-node combinations with higher frequencies will be used as the core features of the attack chain, while combinations with lower frequencies may be normal behaviors or noises.

[0035] Depth - first extended random walk to generate attack feature sub - graphs: Select a random initial node, calculate the priority coefficient of neighbor nodes according to the Pagerank coefficient and frequency of the node, and determine whether to expand the node through a probability algorithm, and stop expanding according to the set number of nodes to obtain an attack feature sub - graph. Multiple attack feature sub - graphs are generated through multiple expansions.

[0036] Step 40: Use a sampling algorithm to expand the core nodes of the UAV graph structure and construct an overlapping region graph of attack behavior characteristics.

[0037] Selection of core nodes: Use the Maximin Distance Sampling algorithm to select the core node with the smallest distance and expand it to form an overlapping region graph. Each overlapping region graph consists of core nodes and related nodes around them, meeting the characteristics of attack behavior.

[0038] Expansion algorithm: Starting from the core node, expand step by step according to the set radius until the number of nodes in the expanded area reaches the requirement, forming an effective overlapping region graph.

[0039] Step 50: Determine the similarity between each attack feature sub - graph and the overlapping region graph, superimpose the similarities of the overlapping region graphs to obtain the attack credibility of the overlapping region graph, and determine the attack area according to the attack credibility.

[0040] Calculation of graph similarity: Based on the Maximum Common Subgraph (MCS) algorithm, calculate the similarity between the attack feature sub - graph and the overlapping region graph to determine the similarity between them.

[0041] Calculation of shadow degree: Use the Sigmoid activation function to superimpose the similarities of the overlapping region graphs and calculate the shadow degree of each overlapping region. The shadow degree represents the attack credibility of the region. If the similarity exceeds the set threshold, the region is marked as a potential attack area.

[0042] Step 60: Obtain the attack chain of the attack area and trace the attack source according to the attack chain.

[0043] Traceability and positioning: According to the graph overlap result, select the overlapping regions with shadow degrees exceeding the set threshold, extract the attack chains therein, and trace the attack source.

[0044] Abnormal report and organization identification: Report possible unknown attacks on UAVs by analyzing the overlapping regions with low shadow degrees.

[0045] Embodiment 2 An attack detection method based on UAV swarm log graph overlap calculation, including the following steps: S100: Collect the attack logs of the UAV swarm and construct an attack sample graph.

[0046] For the group of attacked UAVs, collect the attack log data multiple times and construct an attack sample graph. Within the time window when each attack occurs, the collected log data will be constructed into independent graphs according to information such as timestamps and node relationships. These graphs serve as attack samples for subsequent detection and comparison.

[0047] For example, when an attack occurs, the log data is as follows: 2025-02-01 11:00:00, UAV: 1, Action: Hijack Command 2025-02-01 11:05:00, UAV: 1, Action: Data Transmission to Unknown IP This event is transformed into an attack sample graph: Node set V = {v1, v2, v3} Edge set E = {(v1, v2), (v2, v3)} Among them, v1 represents the hijacking instruction, v2 represents the data transmission behavior, and v3 represents the behavior of connecting to an unknown IP.

[0048] S200: Determine the PageRank value of each node in the attack sample graph using the node PageRank coefficient, as well as the frequency of the edges between two nodes. Construct and generate an attack feature subgraph based on the PageRank value of the nodes and the frequency of the edges, combined with the depth-first expansion strategy.

[0049] First, calculate the PageRank value for each node. Suppose the calculated PageRank coefficients are as follows: v1 = 0.2, v2 = 0.25, v3 = 0.3, v4 = 0.15, v5 = 0.4, v6 = 0.35, v7 =0.5, v8 = 0.3, v9 = 0.45, v10 = 0.4 According to the PageRank algorithm, the PageRank coefficient of node v7 is the highest, so it may be the most important node.

[0050] Secondly, calculate the frequency of each edge (the line between two nodes). Suppose the occurrence frequency of each edge is the same (for example, each edge appears once), then calculate the frequency of each edge as follows: Frequency = Number of occurrences of edge-node combination / (In-degree + Out-degree) For edge (1,2), its frequency = 1 / (2+1) = 0.33 Opposite side (1, 3), its frequency = 1 / (2 + 1) = 0.33 Opposite side (1, 4), its frequency = 1 / (2 + 1) = 0.33 And so on for other sides... Select the initial node and expand it. Assume that v7 is selected as the initial node because it has the highest PageRank value. Determine which neighbor nodes to expand according to the priority coefficients of the neighbor nodes of the initial node: Assume that for the neighbor nodes v8 and v9 of node v7, calculate their priority coefficients. Assume that the priority coefficient of v8 is 0.5 and that of v9 is 0.6. Then use a probability algorithm to generate a random probability p, compare the random probability p with the priority coefficients of the nodes, and take the node with a priority coefficient greater than the random probability p as the expansion node.

[0051] For example, the random probability p = 0.6. If p is greater than the priority coefficient of v8, then select v9 as the expansion node. The attack feature subgraph obtained after expansion will include v7, v9 and their adjacent nodes.

[0052] Assume that the condition for expanding the subgraph is that the number of nodes reaches 6, and the expansion process stops, obtaining an attack feature subgraph containing 6 nodes, which may be v7, v9, v10, v6, v8, v3.

[0053] S300: Collect the behavior logs of the UAV swarm and construct a detection graph based on the behavior logs.

[0054] Collect the flight behavior logs of the UAV swarm, including flight data, network communication data, control instruction data, etc. The collected log data will be converted into a graph representation as the detection graph through conversion tools (such as flight control software, ground control systems, flight sensors, etc.).

[0055] In the graph representation, each node in the graph represents a behavior event, and the edge represents the temporal relationship between behaviors. Take the following log data as an example: 2025-02-01 10:00:00, UAV: 1, Action: Takeoff 2025-02-01 10:10:00, UAV: 1, Action: Waypoint Reached 2025-02-01 10:20:00, UAV: 2, Action: Takeoff 2025-02-01 10:30:00, UAV: 1, Action: Data Transfer Through the conversion tool, these log data will be converted into the following representation: The set of nodes V = {v1, v2, v3, v4}, where v1, v2, v3, v4 represent different behavioral events.

[0056] The set of edges E = {(v1, v2), (v2, v3), (v3, v4)}, and the edges represent the temporal relationship between behavioral events. For example, v1 to v2 represents the time relationship of UAV 1 taking off and arriving.

[0057] S400: Adopt the Maximin Distance Sampling algorithm to detect the node with the minimum distance in the graph as the core node, and expand along the core node to construct an overlapping region graph.

[0058] Use the Maximin Distance Sampling algorithm to select the core node with the minimum distance. Suppose we select node v7 as the core node because it has the highest Pagerank value and is connected to multiple nodes, and then expand with v7 as the center.

[0059] Suppose the set radius d is 2, with v7 as the center, start to expand to its adjacent nodes v8, v9, v6. Then continue to expand to v10 (v7 -> v9 -> v10) until the set number of expanded nodes is reached, forming an overlapping region graph containing v7, v8, v9, v6, and v10.

[0060] Suppose when the number of expanded nodes reaches 5 (meeting the requirements of 2a), stop expanding and record this overlapping region graph. The overlapping region graph contains nodes v7, v8, v9, v6, and v10.

[0061] Repeat the above process to form multiple overlapping region graphs.

[0062] S500: Adopt the maximum common subgraph algorithm to calculate the similarity between the attack sample graph and each overlapping region, superimpose the similarities of each overlapping region graph to obtain the shadow degree, and determine the attack behavior according to the shadow degree.

[0063] Suppose an overlapping region graph is generated according to a graph G' to be detected, and this overlapping region graph contains nodes v7, v9, v10. Use the maximum common subgraph (MCS) algorithm to calculate the similarity between the attack sample graph and the overlapping region graph.

[0064] Suppose the similarity between the overlapping region graph and the attack sample graph is 80%, which means that this overlapping region graph may involve the high-risk part of the attack chain.

[0065] Similarity formula: Similarity = Number of nodes in the maximum common subgraph / (2a). Assume that the obtained maximum common subgraph contains 4 nodes. Therefore, the similarity is 4 / 10 = 0.4.

[0066] Use the Sigmoid activation function to superimpose the similarities of the overlapping region graphs to obtain the shading degree. For example, set the threshold b = 0.7. If the similarity > b, then update the shading degree. Assume the shading degree of this region is 0.8.

[0067] Shading degree formula: If the similarity > threshold b, then s = s + similarity, and the shading degree s of this region is obtained as 0.8.

[0068] Identify the attack behavior of the graph to be detected based on the shading degree. For example, a higher shading degree in certain regions may indicate that these regions are the core parts of the attack behavior.

[0069] Step 6: According to the shading degree of the overlapping region graph, select the regions where the shading degree exceeds the set threshold, and trace the attack behavior according to the set regions, including the attack source and the attack path.

[0070] For example, assume that the shading degree of an overlapping region is 0.85, indicating that this region may be the attack source.

[0071] Conduct further analysis on the regions with low shading degrees to identify unknown attacks and report potential security risks.

[0072] The UAV intrusion detection method based on graph operations of this application has broad application prospects. It can effectively cope with security threats in the UAV cluster environment, solve the deficiencies of traditional detection methods in the face of complex attacks and large-scale data, and provide a more accurate and efficient UAV group intrusion detection solution.

[0073] It should be noted that in several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of each module is only a logical function division. In actual implementation, there may be other division methods. For example, multiple modules can be combined or integrated into another device, or some features can be ignored or not executed. The modules described as separate components may or may not be physically separated. The components shown as modules can be one physical unit or multiple physical units, that is, they can be located in one place, or they can be distributed to multiple different places. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0074] In addition, in each embodiment of the present invention, each module can be integrated into a processing unit, or each module can exist physically alone, or two or more modules can be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

[0075] An electronic device provided by an embodiment of the present application includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the steps of the attack detection method based on the overlapping calculation of the drone swarm log graphs described in any of the above embodiments are implemented.

[0076] Another electronic device provided by an embodiment of the present application may further include: an input port connected to the processor, configured to transmit multi-modal data collected by an external acquisition device to the processor; and a display unit connected to the processor, configured to display the processing result of the processor to the outside; a communication module connected to the processor, configured to implement communication between the electronic device and the outside. The display unit can be a display panel, a laser scanning display, etc.; the communication methods adopted by the communication module include but are not limited to Mobile High-Definition Link technology (HML), Universal Serial Bus (USB), High-Definition Multimedia Interface (HDMI), wireless connection (including Wireless Fidelity technology (WiFi), Bluetooth communication technology, Low-Energy Bluetooth communication technology, communication technology based on IEEE802.11s).

[0077] A computer-readable storage medium provided by an embodiment of the present application stores a computer program. When the computer program is executed by a processor, the steps of the attack detection method based on the overlapping calculation of the drone swarm log graphs described in any of the above embodiments are implemented.

[0078] For the description of the relevant parts in the attack detection system, electronic device, and computer-readable storage medium based on the overlapping calculation of the drone swarm log graphs provided by the embodiments of the present application, please refer to the corresponding detailed description in the attack detection method based on the overlapping calculation of the drone swarm log graphs provided by the embodiments of the present application, and will not be elaborated here. In addition, the parts of the above technical solutions provided by the embodiments of the present application that are consistent with the corresponding technical solutions in the prior art in terms of implementation principles are not described in detail to avoid excessive elaboration.

[0079] The above content is only to illustrate the technical idea of the present invention and cannot be used to limit the protection scope of the present invention. Any modification made on the basis of the technical solution according to the technical idea proposed by the present invention falls within the protection scope of the claims of the present invention.

Claims

1. An attack detection method based on overlapping calculation of drone swarm log graphs, characterized in that: The process includes: Construct an attack sample graph based on the attack logs of the drone group in historical time periods; Generate an attack feature subgraph based on the damping coefficient of each node in the attack sample graph and the frequency between nodes, combined with a dynamic expansion strategy; The graph structure of drone behaviors is constructed based on the behavior logs of the drone cluster. The core nodes of the drone graph structure are expanded using a sampling algorithm to construct an overlapping area graph of attack behavior features. Determine the similarity between each attack feature subgraph and the overlapping area graph, superimpose the similarities of the overlapping area graphs to obtain the attack credibility of the overlapping area graphs, and determine the attack behavior according to the attack credibility; The attack behavior is traced back according to the attack credibility of the overlapping area graph.

2. The attack detection method based on the overlapping calculation of drone group log graph according to claim 1 is characterized in that: The construction of the attack sample graph includes: Get each attack event in the attack log and build an attack sample graph based on the timestamp and node relationship of the attack event.

3. The attack detection method based on the overlapping calculation of drone group log graph according to claim 1 is characterized in that: The generating of the attack feature subgraph in combination with the dynamic expansion strategy includes: Use the Pagerank algorithm to attack the Pagerank coefficient of each node in the sample graph; Calculate the frequency between nodes in the attack sample graph; According to the Pagerank coefficient of the node and the frequency between nodes, the priority coefficient of the neighboring nodes of the initial node is calculated in combination with the depth-first expansion method; Generate random probability according to the probability algorithm, determine the expansion node according to the random probability and the priority coefficient of the node, and stop expanding according to the set number of nodes to obtain the attack feature subgraph.

4. The attack detection method based on the overlapping calculation of drone group log graph according to claim 3 is characterized in that: Determining the expansion nodes based on random probability and node priority coefficients includes: The random probability is compared with the priority coefficient of the node, and the node with a priority coefficient greater than the random probability is taken as the expansion node.

5. The attack detection method based on the overlapping calculation of drone group log graph according to claim 1 is characterized in that: The method for constructing the graph structure of the drone behavior includes: Obtain the behavior logs of the drone group, which include flight data, network communication data, and control command data; Log events are obtained according to the behavior logs and used as graph nodes. Edge connections are made according to the temporal relationship and dependency relationship of the log events to build the graph structure of the drone swarm.

6. The attack detection method based on drone swarm log graph overlap calculation according to claim 1 or 5, characterized in that: The overlapping area map for constructing attack behavior characteristics includes: The Maximin Distance Sampling algorithm is used to take the node with the highest damping coefficient as the core node, and expand from the neighboring nodes according to the set radius until the set number of nodes is reached to obtain the overlapping area graph.

7. The attack detection method based on the overlapping calculation of drone group log graph according to claim 1 is characterized in that: The similarity between the attack feature subgraph and the overlapping area graph includes: The maximum common subgraph algorithm is used to calculate the similarity between the attack sample graph and each overlapping area; The Sigmoid activation function is used to superimpose the similarities of the overlapping area graphs to obtain the shadow degree, which is used as the attack credibility and compared with the set threshold. When the shadow degree is greater than the set threshold, the area corresponding to the shadow degree is considered to have artifact behavior.

8. The attack detection method based on the overlapping calculation of drone group log graph according to claim 7 is characterized in that: Tracing the attack behavior based on the attack credibility of the overlapping area graph includes: An attack chain is initiated based on the nodes in the area corresponding to the shadow degree, and the attack source is traced based on the attack chain.

9. An attack detection system based on overlapping calculation of drone swarm log graphs, characterized in that: include: The attack sample graph module is used to construct an attack sample graph based on the attack logs of the drone group in the historical time period; The attack feature subgraph module is used to generate an attack feature subgraph based on the damping coefficient of each node in the attack sample graph and the frequency between nodes, combined with a dynamic expansion strategy; The overlapping area graph module is used to build a graph structure of drone behaviors based on the behavior logs of drone clusters, and uses a sampling algorithm to expand the core nodes of the drone graph structure to build an overlapping area graph of attack behavior characteristics; An attack detection module is used to determine the similarity between each attack feature subgraph and the overlapping area graph, superimpose the similarities of the overlapping area graphs to obtain the attack credibility of the overlapping area graphs, and determine the attack behavior according to the attack credibility; The attack tracing module is used to trace the attack behavior according to the attack credibility of the overlapping area graph.

10. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the attack detection method based on overlapping calculation of drone swarm log graphs as described in any one of claims 1 to 8 when executing the computer program.

Images