Dynamic threat spectrum library construction method based on gallium oxide solar blind antenna detection module

Abstract

The invention relates to the technical field of electronics, in particular to a dynamic threat spectrum library construction method based on a gallium oxide solar blind antenna detection module. According to the method, through cooperative acquisition and analysis of a gallium oxide solar blind antenna detection module and a radio frequency signal, a low-altitude target is accurately positioned by utilizing the low-noise characteristic of solar blind ultraviolet detection, the signal response speed is effectively improved, the target positioning capability and speed in a complex environment are improved, and the target positioning accuracy is improved through protocol feature extraction and dynamic fingerprint construction. Identity recognition and behavior tracking of a threat source are achieved, a closed-loop optimization mechanism is formed, the system has the continuous self-adaptive active detection capability, and the protection level of an existing low-altitude defense system from passive defense to active early warning is effectively upgraded.

Description

Technical Field

[0001] The present invention relates to the field of electronic technology, and particularly to a method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module. Background Art

[0002] In recent years, with the widespread application of low-altitude unmanned aerial vehicles (UAVs), the security threats they bring have become increasingly prominent. Traditional radar and optoelectronic detection means face challenges such as high false alarm rates and insufficient anti-interference capabilities in complex electromagnetic environments. Gallium oxide (Ga2O3) solar-blind ultraviolet detectors can effectively capture ultraviolet pulse signals generated by UAV discharges in strong background noise due to their high sensitivity to the 200 - 280 nm wavelength band. However, existing technologies mainly focus on single optoelectronic detection and lack the ability to cooperate and analyze with radio frequency signals. In the field of spectrum sensing, although protocol recognition technologies based on software-defined radio (SDR) are relatively mature, multipath effects and dynamic frequency offsets in the low-altitude environment make it difficult for traditional spectrum library construction methods to accurately associate and trace threat targets. In addition, existing threat feature libraries are mostly static protocol template sets and cannot adapt to new threat scenarios such as the rapid iteration of UAV communication protocols and adaptive frequency hopping. Summary of the Invention

[0003] The present invention overcomes the deficiencies of the prior art and provides a method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module.

[0004] The technical solution adopted by the present invention to achieve the above object is as follows: The present invention discloses a method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module, including the following steps: S102: Use a gallium oxide solar-blind antenna detection module and a radio frequency receiving module to synchronously collect ultraviolet light pulse signals and electromagnetic radio frequency signals in the target low-altitude area, and extract the original time-domain waveform and preliminary spectrum characteristics of the electromagnetic radio frequency signals; S104: Based on the low-altitude target positioning information provided by the ultraviolet light pulse signals, perform anti-interference filtering and dynamic time-frequency resolution improvement on the original time-domain waveform and preliminary spectrum characteristics to generate an enhanced time-frequency feature matrix suitable for the low-altitude complex environment; S106: Input the enhanced time-frequency feature matrix into an anti-interference spectrum analysis engine to identify the remote control communication protocol mode of low-altitude UAV threat targets, and separate the unique key protocol feature vectors representing the identity of the threat source from them; S108: Dynamically bind the key protocol feature vectors with the ultraviolet detection spatio-temporal coordinates to generate a traceable dynamic threat fingerprint, and update it to the threat spectrum library in real time to establish a threat behavior association chain among low-altitude targets; S110: Based on the threat behavior association chain, perform multi-source heterogeneous signal fusion analysis on the dynamic threat fingerprint, extract cross-modal threat behavior pattern features, construct a dynamic threat behavior map, and update it backward to the threat spectrum library.

[0005] Further, the S102 is specifically as follows: Capture the ultraviolet light pulse signal in the target low-altitude area through a gallium oxide solar-blind antenna detection module. At the same time, use a radio frequency receiving module to synchronously collect the electromagnetic radio frequency signal in the corresponding airspace, and record the spatio-temporal synchronization mark of the two. Perform band-pass filtering and baseline drift correction on the electromagnetic radio frequency signal, extract the original time-domain waveform, combine the pulse intensity and time stamp of the ultraviolet light pulse signal, and eliminate the environmental noise interference section to generate an anti-interference time-domain waveform segment. Perform short-time Fourier transform on the anti-interference time-domain waveform segment to generate an initial time-frequency spectrum diagram, and based on the target movement trajectory provided by the ultraviolet light pulse signal, adaptively adjust the time window length and overlap rate to extract the preliminary spectrum features including the target-related frequency band. Calculate the Doppler frequency shift amount of the electromagnetic radio frequency signal according to the velocity vector of the target in the ultraviolet light pulse signal, and perform dynamic frequency offset correction on the preliminary spectrum features according to the Doppler frequency shift amount to obtain enhanced spectrum features with frequency-domain alignment. In the enhanced spectrum features, separate the continuous carrier component and the burst pulse component through peak clustering and harmonic correlation analysis, and combine the spatio-temporal mark of the ultraviolet signal to screen out the candidate protocol feature segments synchronized with the target behavior, and complete the extraction of the original time-domain waveform and the preliminary spectrum features.

[0006] Further, the S104 is specifically as follows: Based on the ultraviolet light pulse signal, calculate the real-time position and velocity information of the low-altitude target, generate a spatio-temporal motion feature vector, and align the time stamp with the original time-domain waveform to mark the target effective signal interval. Use the velocity component in the spatio-temporal motion feature vector to perform Doppler phase compensation on the target effective signal interval to eliminate the carrier frequency offset caused by the target movement and obtain a motion-compensated time-domain signal. Construct an airspace filtering weight according to the azimuth angle information in the spatio-temporal motion feature vector, perform beamforming processing on the motion-compensated time-domain signal to suppress the interference signals in non-target directions, and generate an airspace filtering signal. Adaptively adjust the window length according to the target speed magnitude, perform variable-window-length short-time Fourier transform on the airspace filtering signal to generate a speed-adaptive time-frequency spectrum diagram. Extract the harmonic components synchronized with the target motion feature vector in the time-frequency spectrum diagram, strengthen the transient features through the Teager-Kaiser energy operator, and finally output an enhanced time-frequency feature matrix containing the target motion characteristics.

[0007] Further, the S106 is specifically as follows: Perform multi-scale decomposition on the enhanced time-frequency feature matrix, extract the carrier fundamental frequency, modulation sidebands, and synchronization header pulse features in the time-frequency domain, and generate a set of protocol primitives; Perform a sliding correlation operation on the set of protocol primitives and a preset typical UAV remote control protocol template library. When the correlation coefficient is greater than the preset coefficient threshold, it is determined as a valid protocol matching mode, and the candidate protocol type identifier is output; Based on the matched candidate protocol type, extract its transient modulation envelope features through Hilbert-Huang transform, combine with the frequency hopping pattern in the enhanced time-frequency feature matrix, calculate the protocol individual variation parameters, and generate a protocol fingerprint feature group; Perform principal component analysis on the protocol fingerprint feature group, screen out the feature components with a variance contribution rate greater than the preset contribution rate threshold, and perform feature fusion with the corresponding protocol type identifier to generate a unique key protocol feature vector containing the protocol category and individual fingerprint; Compare the Euclidean distance between the key protocol feature vector and the records in the historical threat spectrum library. When the distance value is less than the dynamic adaptive threshold, it is determined as a verified threat feature, otherwise it is marked as a new protocol variant feature.

[0008] Further, the S108 is specifically as follows: Perform feature concatenation on the key protocol feature vector with the real-time three-dimensional space coordinates and time stamps obtained by the gallium oxide solar-blind antenna detection module to generate a spatio-temporal-protocol joint feature vector; Perform hash coding operation on the spatio-temporal-protocol joint feature vector, and combine with the curvature feature of the target motion trajectory to generate a variable-length fingerprint identifier to form a dynamic threat fingerprint code; Calculate the Hamming distance between the current dynamic threat fingerprint code and the existing fingerprints in the threat spectrum library. When the Hamming distance value is less than the adaptive similarity threshold, it is determined as an associated target; Based on the principle of spatio-temporal continuity, perform Markov chain modeling on the motion trajectory and protocol feature change law of the associated target to construct a threat behavior transition probability matrix; According to the update result of the threat behavior transition probability matrix, perform time-dependent weighted processing on the fingerprint features in the threat spectrum library to obtain the feature activity; When the feature activity exceeds the preset activity threshold, increase its retrieval priority to complete the establishment and maintenance of the low-altitude target threat behavior association chain.

[0009] Among them, performing a hash encoding operation on the spatio-temporal - protocol joint feature vector, and generating a variable-length fingerprint identifier in combination with the curvature feature of the target motion trajectory to form a dynamic threat fingerprint encoding, specifically: Performing a normalization process on the spatio-temporal - protocol joint feature vector to eliminate the dimensional differences of the features in each dimension and generate a normalized feature vector; Based on the continuous spatio-temporal coordinates of the target motion trajectory, calculating its curvature change feature and generating a trajectory curvature feature vector; Performing feature splicing on the normalized feature vector and the trajectory curvature feature vector to generate a mixed feature vector; Performing a SHA-256 hash operation on the mixed feature vector to generate a 256-bit fixed-length hash encoding; Dynamically determining the final encoding length according to the information entropy value of the mixed feature vector. When the entropy value is higher than the set threshold, all 256-bit encodings are retained. Otherwise, the first 128 bits are intercepted as the final encoding; Attaching an 8-bit check code after the finally determined encoding to form a complete dynamic threat fingerprint encoding.

[0010] Furthermore, the S110 is specifically: Based on the spatio-temporal coordinates in the threat behavior association chain, performing time synchronization calibration on the ultraviolet light signal feature and the electromagnetic radio frequency signal feature corresponding to the dynamic threat fingerprint to generate a spatio-temporally aligned cross-modal feature pair; Performing joint sparse encoding on the cross-modal feature pair, extracting the coupling mode of the ultraviolet pulse sequence and the radio frequency protocol feature. When the joint sparse coefficient of the two is greater than the preset threshold, it is determined as a valid cross-modal behavior pattern segment; According to the spatio-temporal distribution of the valid cross-modal behavior pattern segment, constructing an initial threat behavior graph with the threat source as the node and the signal coupling strength as the edge weight; Dynamically adjusting the edge weights of the initial threat behavior graph using the transition probability matrix in the threat behavior association chain. When the behavior transfer frequency between nodes exceeds the adaptive threshold, strengthening the topological connection relationship of the corresponding edges to generate an optimized dynamic threat behavior graph; Extracting the high-frequency coupling mode features in the dynamic threat behavior graph as a new protocol template and supplementing them to the protocol feature vector set in the threat spectrum library to complete the closed-loop update.

[0011] Among them, the gallium oxide solar-blind antenna detection module includes: An ultraviolet signal acquisition unit, which consists of a β-phase gallium oxide solar-blind ultraviolet detector array and is used to receive ultraviolet radiation signals in the 200 - 280 nm band; An optical filtering unit, which is optically coupled to the ultraviolet signal acquisition unit and includes a band-pass filter and an optical lens group, and is used to suppress interference optical signals in non-solar-blind bands; A signal conditioning unit, connected to the output end of the ultraviolet signal acquisition unit, includes a transimpedance amplifier circuit and an adaptive gain control module, and is used to convert the ultraviolet pulse signal into a processable electrical signal; A spatio-temporal marking unit, integrated with a GPS module and an atomic clock, is used to attach a nanosecond-level timestamp and three-dimensional spatial coordinates to the collected ultraviolet light signal; A data preprocessing unit, connected to the signal conditioning unit and the spatio-temporal marking unit, includes a digital filter and a pulse shaping circuit, and is used to eliminate the signal baseline drift and extract effective ultraviolet pulse characteristics.

[0012] The present invention solves the technical defects existing in the background art, and the present invention has the following beneficial effects: through the collaborative acquisition and analysis of the gallium oxide solar-blind antenna detection module and the radio frequency signal, the low-noise characteristics of solar-blind ultraviolet detection are used to accurately locate low-altitude targets, effectively improving the signal response speed, thereby enhancing the target positioning ability and speed in complex environments. Through protocol feature extraction and dynamic fingerprint construction, the identity recognition and behavior tracking of threat sources are realized, forming a closed-loop optimization mechanism, enabling the system to have continuous adaptive active detection capabilities, and effectively upgrading the protection level of the existing low-altitude defense system from passive defense to active early warning. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0014] Figure 1 It is the overall method flowchart of the method for constructing the present dynamic threat spectrum library; Figure 2 It is the partial method flowchart of the method for constructing the present dynamic threat spectrum library; Figure 3 It is the unit schematic diagram of the present gallium oxide solar-blind antenna detection module. DETAILED DESCRIPTION OF THE INVENTION

[0015] In order to be able to more clearly understand the above-mentioned objects, features and advantages of the present invention, the following will further describe the present invention in detail with reference to the drawings and specific embodiments. It should be noted that, without conflict, the embodiments of the present application and the features in the embodiments can be combined with each other.

[0016] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Therefore, the protection scope of the present invention is not limited to the specific embodiments disclosed below.

[0017] like Figure 1 As shown, the present invention discloses a method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module, comprising the following steps: S102: using the gallium oxide solar-blind antenna detection module and the radio frequency receiving module, synchronously collecting ultraviolet light pulse signals and electromagnetic radio frequency signals in the target low-altitude area, and extracting the original time domain waveform and preliminary spectrum characteristics of the electromagnetic radio frequency signals; S104: Based on the low-altitude target positioning information provided by the ultraviolet light pulse signal, anti-interference filtering and dynamic time-frequency resolution enhancement are performed on the original time domain waveform and preliminary spectrum characteristics to generate an enhanced time-frequency feature matrix suitable for low-altitude complex environments; S106: Input the enhanced time-frequency feature matrix into the anti-interference spectrum analysis engine to identify the remote control communication protocol mode of the low-altitude UAV threat target, and separate the unique key protocol feature vector representing the identity of the threat source; S108: Dynamically bind the key protocol feature vector to the ultraviolet detection time and space coordinates to generate a traceable dynamic threat fingerprint, and update it to the threat spectrum library in real time to establish a threat behavior association chain between low-altitude targets; S110: Based on the threat behavior association chain, perform multi-source heterogeneous signal fusion analysis on the dynamic threat fingerprint, extract cross-modal threat behavior pattern features, construct a dynamic threat behavior map and reversely update it to the threat spectrum library.

[0018] Furthermore, if Figure 2 As shown, the S102 is specifically: S202: The ultraviolet light pulse signal of the target low-altitude area is captured by the gallium oxide solar-blind antenna detection module, and the electromagnetic radio frequency signal of the corresponding airspace is synchronously collected by the radio frequency receiving module, and the time-space synchronization marks of the two are recorded; S204: performing bandpass filtering and baseline drift correction on the electromagnetic radio frequency signal, extracting the original time domain waveform, combining the pulse intensity and timestamp of the ultraviolet light pulse signal, removing the environmental noise interference segment, and generating an anti-interference time domain waveform segment; S206: performing short-time Fourier transform on the anti-interference time domain waveform segment to generate an initial time-frequency spectrum diagram, and adaptively adjusting the time window length and overlap rate based on the target motion trajectory provided by the ultraviolet light pulse signal to extract preliminary spectrum features including the target-related frequency band; It should be noted that based on the target motion trajectory (including speed and direction) obtained in real time from the ultraviolet light pulse signal, the time window length and overlap rate of the short-time Fourier transform are dynamically adjusted: when the target moves rapidly (such as when the speed exceeds 10 m / s), a shorter time window (such as 20 ms) and a high overlap rate (such as 75%) are adopted to improve the time-frequency resolution; when the target moves at a low speed or hovers, a longer time window (such as 100 ms) and a lower overlap rate (such as 50%) are adopted to enhance the frequency-domain stability. Through this adaptive adjustment, the spectral changes caused by the target motion can be accurately captured, and the frequency-band characteristics associated with the target behavior (such as the carrier of the remote control signal, the hopping frequency points, etc.) can be effectively extracted.

[0019] S208: Calculate the Doppler frequency shift amount of the electromagnetic radio frequency signal according to the velocity vector of the target in the ultraviolet light pulse signal, and perform dynamic frequency offset correction on the preliminary spectral characteristics according to the Doppler frequency shift amount to obtain enhanced spectral characteristics with frequency-domain alignment; It should be noted that according to the target velocity vector (including the radial velocity component) calculated in real time from the ultraviolet light pulse signal, combined with the radio frequency signal carrier frequency (such as the 2.4 GHz or 5.8 GHz frequency band), the theoretical frequency offset value of the current radio frequency signal is dynamically calculated through the Doppler frequency shift formula (for example, when the target approaches radially at 20 m / s, the 2.4 GHz signal generates a frequency shift of approximately ±160 Hz). In the time-frequency spectrum analysis, the detected signal peak frequency is compensated in the reverse direction to eliminate the spectral shift caused by the motion. At the same time, the compensation amount is updated in real time according to the change in the target motion direction to ensure that the spectral characteristics at different times are aligned in the frequency domain, and the enhanced spectral characteristics eliminating the Doppler effect are output.

[0020] S210: In the enhanced spectral characteristics, through peak clustering and harmonic correlation analysis, separate the continuous carrier component and the burst pulse component, and combined with the spatio-temporal markers of the ultraviolet signal, screen out the candidate protocol feature segments synchronized with the target behavior to complete the extraction of the original time-domain waveform and the preliminary spectral characteristics.

[0021] In one embodiment of the present invention, in the monitoring scenario of the airport no-fly zone, the ultraviolet light pulse signal in the target area (such as altitude ≤ 100m) is captured by the gallium oxide solar-blind antenna detection module at a sampling rate of 10Hz. At the same time, the RF receiving module synchronously collects electromagnetic signals in the frequency band of 2.4GHz - 5.8GHz, and records the GPS timestamp and spatial coordinates. The collected electromagnetic signals are subjected to 5th-order Chebyshev band-pass filtering (passband 2.402 - 2.480GHz / 5.725 - 5.850GHz) and baseline correction, and the environmental noise segments are removed by combining the ultraviolet pulse intensity threshold (>200nW / cm²) to generate a pure time-domain segment. The adaptive short-time Fourier transform (the time window length is dynamically adjusted from 20 - 100ms, and the overlap rate is 50% - 75%) is used to generate the time-frequency spectrogram. The Doppler frequency offset (±1.2kHz) is calculated based on the target movement speed (such as 15m / s) and compensated. The 2.483GHz continuous carrier and the burst pulse group are separated by DBSCAN clustering (neighborhood radius 50Hz), and the candidate protocol segments that are spatio-temporally synchronized with the ultraviolet signal (time difference < 5ms) are screened, and finally the enhanced spectral features including the frequency hopping interval (±12MHz) are extracted.

[0022] In summary, through the ultraviolet-RF synchronous acquisition and spatio-temporal marking, the present invention realizes the accurate removal of noise segments, and based on the adaptive time-frequency analysis of the target movement trajectory, effectively suppresses the influence of Doppler frequency shift. At the same time, combined with the harmonic correlation analysis, it improves the accuracy of target-associated signal extraction, providing a high signal-to-noise ratio spectral data basis for subsequent threat feature recognition.

[0023] Further, the S104 is specifically: Based on the ultraviolet light pulse signal, the real-time position and velocity information of the low-altitude target are calculated to generate a spatio-temporal motion feature vector, and time-stamp alignment is performed with the original time-domain waveform to mark the target effective signal interval; Using the velocity component in the spatio-temporal motion feature vector, Doppler phase compensation is performed on the target effective signal interval to eliminate the carrier frequency offset caused by target movement, and the motion-compensated time-domain signal is obtained; According to the azimuth information in the spatio-temporal motion feature vector, the spatial filtering weight is constructed, and beamforming processing is performed on the motion-compensated time-domain signal to suppress the interference signals in non-target directions and generate the spatial filtering signal; The window length is adaptively adjusted according to the target speed, and variable-window-length short-time Fourier transform is performed on the spatial filtering signal to generate a speed-adaptive time-frequency spectrogram; The harmonic components synchronized with the target motion feature vector in the time-frequency spectrogram are extracted, and the transient features are enhanced through the Teager-Kaiser energy operator, and finally the enhanced time-frequency feature matrix containing the target motion characteristics is output.

[0024] In an embodiment of the present invention, in the monitoring scenario of the airport no-fly zone, the ultraviolet light pulse signal is used to calculate the three-dimensional position (X / Y / Z coordinates) and velocity vector of the drone in real time through a four-element array detector, generating a spatio-temporal motion feature vector (including time stamp, coordinate values, velocity components). Align this vector with the original radio frequency waveform in the 2.4 GHz frequency band in time to mark the effective signal interval of the target. Perform Doppler phase compensation on the carrier frequency according to the radial velocity component (such as 12 m / s) (such as the compensation amount φ = 4πvt / λ), and generate a motion-compensated time-domain signal after eliminating the frequency offset. Construct the spatial domain filtering weight based on the target azimuth angle (such as azimuth 30°, pitch -5°). Adaptively select the STFT window length according to the target speed (such as window length 50 ms when the speed > 10 m / s, window length 100 ms when ≤ 10 m / s), and generate a time-frequency spectrogram (frequency resolution 2 kHz). Extract the 5.8 GHz second harmonic component (bandwidth ±50 kHz), and strengthen the transient pulse characteristics through the Teager-Kaiser operator (energy calculation window 3 ms), and finally output a 128×256-dimensional enhanced time-frequency feature matrix for drone protocol fingerprint extraction.

[0025] Overall, the present invention effectively eliminates the motion frequency offset and directional interference through Doppler compensation and spatial domain filtering, improves the accuracy of dynamic signal feature extraction by using adaptive time-frequency analysis, and combines the transient feature enhancement technology to finally output a high-fidelity time-frequency feature matrix, improving the accuracy and anti-interference ability of low-altitude moving target signal analysis.

[0026] Further, S106 is specifically: Perform multi-scale decomposition on the enhanced time-frequency feature matrix, extract the carrier fundamental frequency, modulation sideband, and synchronization head pulse features in the time-frequency domain, and generate a set of protocol primitives; Perform sliding correlation operations on the set of protocol primitives and a preset typical drone remote control protocol template library. When the correlation coefficient is greater than the preset coefficient threshold, it is determined as an effective protocol matching mode, and the candidate protocol type identifier is output; It should be noted that the preset typical drone remote control protocol template library refers to a pre-established database containing the characteristic parameters of the remote control communication protocols of mainstream drone manufacturers.

[0027] Based on the matched candidate protocol type, extract its transient modulation envelope features through Hilbert-Huang transform, combine the frequency hopping pattern in the enhanced time-frequency feature matrix, calculate the protocol individual variation parameters, and generate a protocol fingerprint feature group; It should be noted that after identifying the candidate protocol type (such as DJIOcuSync2.0), first, the empirical mode decomposition of the time-frequency components of the signal is performed using the Hilbert-Huang transform (HHT) to extract its instantaneous modulation envelope features (including the instantaneous frequency fluctuation range and modulation depth). At the same time, the frequency hopping pattern (such as the frequency hopping period, frequency point interval, and its deviation) is parsed from the enhanced time-frequency feature matrix. Then, the modulation envelope features and the frequency hopping parameters are jointly analyzed to calculate individualized variation parameters such as the carrier frequency jitter rate and the frequency hopping time deviation. Finally, these parameters reflecting the unique characteristics of the device are combined into a multi-dimensional fingerprint feature group (such as [frequency jitter rate 0.8%, frequency hopping interval deviation 1.2%, modulation fluctuation 150Hz]) as the basis for unique identification.

[0028] Perform principal component analysis on the protocol fingerprint feature group, screen out the feature components with a variance contribution rate greater than the preset contribution rate threshold, and fuse them with the corresponding protocol type identifiers to generate a unique key protocol feature vector containing the protocol category and individual fingerprints. Compare the Euclidean distance between the key protocol feature vector and the records in the historical threat spectrum library. When the distance value is less than the dynamic adaptive threshold, it is determined as a verified threat feature; otherwise, it is marked as a new protocol variant feature.

[0029] It should be noted that the historical threat spectrum library refers to a feature database that dynamically stores the protocol features, behavior patterns, and their spatio-temporal records of the identified threat targets.

[0030] In the UAV countermeasure system, perform three-layer wavelet multi-scale decomposition on the previously generated 128×256-dimensional enhanced time-frequency feature matrix: extract the 2.483GHz carrier fundamental frequency (tolerance ±50kHz), the 16QAM modulation sideband (bandwidth ±200kHz), and the 5ms synchronization header pulse features to form a protocol primitive set. Perform a sliding correlation operation between it and the preset template library (including 12 protocols such as DJIOcuSync / AutelSkyLink). When the correlation coefficient of the DJIOcuSync2.0 template reaches 0.92 (threshold >0.85), output the "OcuSync2.0" protocol identifier. Extract the transient modulation envelope (instantaneous frequency fluctuation ±150Hz) through the Hilbert-Huang transform, and calculate the individual variation parameters (carrier jitter rate 0.8%, frequency hopping offset standard deviation 1.2%) in combination with the frequency hopping pattern (interval 12MHz ±0.5%) to generate a four-dimensional fingerprint feature group [0.8, 1.2, 150, 12]. After principal component analysis, screen out the first three-dimensional components [0.82, 1.15, 149] with a variance contribution rate >85%, and encode them with the protocol identifier "DJI" OS2"Fuse to generate the key protocol feature vector [0.82, 1.15, 149, 0x4A3B]. Compare the Euclidean distance with the historical database (the threshold is dynamically set to 1.2 times the historical mean). When the distance value 0.18 < threshold 0.25, it is determined as a known threat device "DJI" Mavic3 ".

[0031] In summary, through multi-scale feature extraction and Hilbert-Huang transform, the transient modulation characteristics of the protocol are effectively captured; combined with principal component analysis and dynamic threshold comparison, both known protocol types can be accurately identified and new protocol variants can be detected. Finally, a unique feature vector with both protocol categories and individual fingerprints is generated, thus improving the accuracy of UAV identity recognition and threat assessment.

[0032] Further, the S108 is specifically as follows: Cascade the key protocol feature vector with the real-time three-dimensional space coordinates and time stamps obtained by the gallium oxide solar-blind antenna detection module to generate a spatio-temporal-protocol joint feature vector; Perform hash coding operation on the spatio-temporal-protocol joint feature vector, and combine the curvature feature of the target motion trajectory to generate a variable-length fingerprint identifier to form a dynamic threat fingerprint code; Calculate the Hamming distance between the current dynamic threat fingerprint code and the existing fingerprints in the threat spectrum library. When the Hamming distance value is less than the adaptive similarity threshold, it is determined as an associated target; Based on the principle of spatio-temporal continuity, perform Markov chain modeling on the motion trajectory and protocol feature change law of the associated target to construct a threat behavior transition probability matrix; It should be noted that based on the spatio-temporal position and protocol feature change law of the continuous appearance of the target, first discretize the motion trajectory into a grid coordinate sequence (such as a 100m×100m grid), and at the same time quantify the protocol feature change into state classification (such as frequency hopping mode A / B / C), then count the state transition frequencies at adjacent moments (such as the number of times transferred from grid G1 mode A to grid G2 mode B), construct a state transition count matrix, and then solve the zero-frequency problem through Laplace smoothing, calculate the transition probability between each state, and finally generate a threat behavior transition probability matrix, where each element represents the probability of a certain transition of the protocol feature at a specific spatio-temporal position (such as the transition probability from A to B at position G1 is 0.7), which is used to predict the evolution trend of the target behavior.

[0033] According to the update result of the threat behavior transition probability matrix, perform time-dependent weighting processing on the fingerprint features in the threat spectrum library to obtain feature activity; When the feature activity exceeds the preset activity threshold, increase its retrieval priority to complete the establishment and maintenance of the threat behavior association chain of low-altitude targets.

[0034] It should be noted that according to the latest state transition data of the threat behavior transition probability matrix, dynamic weight adjustment is implemented for the fingerprint features in the threat spectrum library: by establishing a time decay function for each fingerprint feature, features with a high frequency of occurrence recently are given a higher weight (for example, the weight increases by 0.1 for each occurrence within 7 days). Combining the state transition trend in the transition probability matrix, the weight coefficient of the features involved in the high-frequency transition path is additionally increased (for example, the weight of the features in the high-probability transition chain is multiplied by 1.2). Then, exponential decay is implemented for the features that have not been updated for more than the set time limit (for example, 30 days) (the weight is multiplied by 0.8 per month). Finally, the real-time activity score (range 0 - 1) of each feature is calculated through normalization processing. When the score exceeds the set threshold (for example, 0.6), the priority of this feature in the retrieval queue is automatically increased to ensure that the system focuses on the current active threat targets. Among them, when a certain state transition probability (such as the transition from protocol mode A to B or grid X to Y) continues to be ≥0.6 (range 0 to 1), it is determined as a high-frequency transition path.

[0035] Among them, performing a hash encoding operation on the spatio-temporal - protocol joint feature vector, and generating a variable-length fingerprint identifier in combination with the curvature feature of the target motion trajectory to form a dynamic threat fingerprint encoding, specifically: Performing a normalization process on the spatio-temporal - protocol joint feature vector to eliminate the dimensional differences of the features in each dimension and generating a normalized feature vector; Based on the continuous spatio-temporal coordinates of the target motion trajectory, calculating its curvature change feature and generating a trajectory curvature feature vector; Performing feature splicing on the normalized feature vector and the trajectory curvature feature vector to generate a mixed feature vector; Performing a SHA-256 hash operation on the mixed feature vector to generate a 256-bit fixed-length hash encoding; Dynamically determining the final encoding length according to the information entropy value of the mixed feature vector. When the entropy value is higher than the set threshold, all 256-bit encodings are retained, otherwise the first 128 bits are intercepted as the final encoding; Attaching an 8-bit check code after the finally determined encoding to form a complete dynamic threat fingerprint encoding.

[0036] In one embodiment of the present invention, the system obtains the real-time three-dimensional coordinates of a certain UAV target (such as [X = 1250.3m, Y = 680.7m, Z = 85.2m]) and the timestamp (2025-05-20T14:30:25.123Z) through a gallium oxide solar-blind antenna, and cascades them with the key protocol feature vector (such as [0.82, 1.15, 149, 0x4A3B]) to generate a spatio-temporal - protocol joint feature vector (12-dimensional). Calculate the curvature feature based on the movement trajectory of the target in the past 30 seconds, and splice it with the normalized feature vector to generate an 18-dimensional hybrid feature vector. Generate a 256-bit code (such as "3A7F...E2C1") through SHA-256 hashing operation. According to the information entropy value (1.8 > threshold 1.5), retain the full code and append a CRC-8 check code (such as "3A7F...E2C1 5B "), forming the final fingerprint code. Compare the Hamming distance with the threat spectrum library (current minimum distance = 6 < adaptive threshold 8), and associate it with a known target. Model its behavior through a Markov chain (the transition probability from protocol mode B to C when moving from grid G23 to G24 is 0.72 > high-frequency path threshold 0.6), update the weight (activity score 0.68 > threshold 0.6), and promote its priority in the retrieval queue to TOP10%, so as to realize the real-time tracking and behavior prediction of the threat target.

[0037] In summary, through spatio-temporal - protocol feature fusion and hash coding, a unique and traceable dynamic threat fingerprint is generated. Using Hamming distance comparison and Markov chain modeling, accurate association and behavior prediction of threat targets are realized, and the threat feature library is dynamically maintained through a timeliness weighting mechanism. Finally, an association chain reflecting the evolution law of target behavior is constructed to improve the continuous tracking and threat assessment capabilities for low-altitude threat targets.

[0038] Further, the S110 is specifically as follows: Based on the spatio-temporal coordinates in the threat behavior association chain, time-synchronize and calibrate the ultraviolet light signal features and electromagnetic radio frequency signal features corresponding to the dynamic threat fingerprint to generate a spatio-temporally aligned cross-modal feature pair; Perform joint sparse coding on the cross-modal feature pair, extract the coupling mode of the ultraviolet pulse sequence and the radio frequency protocol feature. When the joint sparse coefficient of the two is greater than the preset threshold, it is determined as a valid cross-modal behavior pattern segment; According to the spatio-temporal distribution of the valid cross-modal behavior pattern segments, construct an initial threat behavior map with the threat source as the node and the signal coupling strength as the edge weight; Use the transition probability matrix in the threat behavior association chain to dynamically adjust the edge weights of the initial threat behavior map. When the behavior transfer frequency between nodes exceeds the adaptive threshold, strengthen the topological connection relationship of the corresponding edges to generate an optimized dynamic threat behavior map; It should be noted that based on the established transition probability matrix in the threat behavior correlation chain (for example, the transition probability from node A to node B is 0.7), by setting an adaptive threshold (such as 1.2 times the historical average transition frequency), the actual behavior transition frequency between nodes is monitored in real time. When it is detected that the transition frequency between specific nodes exceeds the threshold (for example, the number of transitions from A to B per hour is 8 times > the threshold of 6 times), the weight coefficient of the corresponding edge is increased according to the preset rules (for example, the original weight of 0.5 × 1.5 reinforcement factor = 0.75). At the same time, according to the temporal change trend of the transition probability, the weight reinforcement amplitude is dynamically adjusted (for example, when the probability increases by 0.1, the reinforcement factor increases by 0.2). Finally, an optimized behavior graph is generated where the edge weights reflect the real-time threat correlation intensity.

[0039] Extract the high-frequency coupling mode features in the dynamic threat behavior graph as new protocol templates and supplement them to the protocol feature vector set of the threat spectrum library to complete the closed-loop update.

[0040] In an embodiment of the present invention, for the threat target tracked by S108, based on the spatio-temporal coordinates in its threat behavior correlation chain (such as [X = 1532.1m, Y = 421.8m, Z = 62.3m]), the ultraviolet pulse sequence captured by the gallium oxide module is time-synchronized and calibrated with the 2.483 GHz radio frequency protocol features to generate a spatio-temporally aligned cross-modal feature pair. Through K-SVD joint sparse coding (dictionary size 256), the coupling coefficient between the ultraviolet pulse group and the radio frequency hopping signal is calculated to be 0.83, which is greater than the threshold of 0.75, and it is determined as a valid behavior pattern segment. Taking this target as a node, an initial threat behavior graph is constructed by combining 3 surrounding threat sources (the coupling strength weight between nodes is 0.4 to 0.9). Using the updated Markov transition probability matrix of S108 (such as the behavior transition frequency between nodes > 5 times / hour), the edge weights are dynamically adjusted (reinforcement coefficient × 1.5) to generate an optimized graph (the edge weights are updated to 0.6 - 1.35). Extract the high-frequency coupling mode features (such as the probability of frequency hopping within 200 ms after the ultraviolet pulse reaches 92%), convert them into a new protocol template "pulse-frequency hopping synchronization mode", and supplement it to the protocol feature set of the threat spectrum library to achieve closed-loop knowledge update.

[0041] Generally speaking, through the self-learning update mechanism of the high-frequency mode, the present invention enables the system to have the ability of continuous evolution in threat recognition, thereby effectively improving the overall perception and early warning level of complex low-altitude threat behaviors.

[0042] In this embodiment, the method for constructing the dynamic threat spectrum library further includes the following steps: Separate the target ultraviolet pulse sequence from the gallium oxide solar-blind antenna signal, calculate its discharge pulse width standard deviation and pulse cluster interval jitter rate, and generate a discharge ripple feature vector; It should be noted that based on the target ultraviolet pulse sequence captured by the gallium oxide solar-blind antenna, the rising edge and falling edge of each pulse are fitted, the duration (pulse width) of each pulse is measured, the standard deviation of all pulse widths is calculated as the pulse width stability index, and at the same time, the time interval between adjacent pulse clusters is extracted. The variance of the interval time is calculated through a sliding window to obtain the cluster interval jitter rate. Then, these two characteristic parameters (pulse width standard deviation and cluster interval jitter rate) are normalized with the coefficient of variation of the pulse amplitude and combined into a three-dimensional discharge ripple feature vector.

[0043] Perform high-order harmonic decomposition (up to the 5th order) on the electromagnetic radio frequency signal, measure the phase nonlinear perturbation and amplitude asymmetry of each harmonic, and form a harmonic distortion feature group; Perform time-domain mutual information calculation on the discharge ripple feature vector and the harmonic distortion feature group to quantify the statistical dependence of the two on transient fluctuations, and output a harmonic-ripple coupling coefficient matrix; Based on the harmonic-ripple coupling coefficient matrix, extract the carrier-discharge joint distortion component characterizing the hardware defects of the device through principal component analysis, and calculate the composite distortion factor in combination with the envelope intermodulation parameter; Perform dynamic time warping matching on the composite distortion factor and a preset emission device defect database (including the phase noise characteristics of the power amplifier and the aging mode of the ultraviolet lamp tube), and output the physical fingerprint template closest to the target hardware process deviation to complete device traceability.

[0044] Among them, the preset emission device defect database refers to a reference database established in advance that contains the inherent signal distortion characteristics of various electronic emission devices (such as drone remote controllers, radio frequency modules, etc.) due to hardware manufacturing process differences or device aging.

[0045] It should be noted that in this embodiment, the technical problem of low-altitude threat targets such as drones evading traditional radio frequency identification through protocol camouflage means is solved. Through the in-depth coupling analysis of fusing ultraviolet discharge ripple characteristics and radio frequency harmonic distortion characteristics, the identification limitation of a single signal modality is broken through. By using the cross-modal correlation characteristics generated by the inherent hardware defects, an unforgeable device physical fingerprint is constructed, and finally, accurate device traceability against protocol camouflage behavior is realized, improving the real identity recognition ability and countermeasure effectiveness for camouflaged targets.

[0046] In this embodiment, the method for constructing the dynamic threat spectrum library further includes the following steps: Input the key protocol feature vector into the quantum state encoder, and generate a protocol hair feature group with quantum indistinguishability through the principle of non-orthogonal state superposition, where each feature component corresponds to the angular quantum number distribution of the Hawking radiation mode; The protocol hair feature group is converted into a gravitational entropy parameter under the constraint of space-time curvature by using the Bekenstein-Hawking entropy formula, and this parameter characterizes the information compression limit of the threat fingerprint at the event horizon; When a new threat source is accessed, the quantum fidelity between its protocol hair feature group and the historical threat spectrum library is calculated in real time. By simulating the Hawking radiation process, a radiation entropy difference spectrum is generated. If there are negative entropy oscillation components exceeding the classical Shannon limit in the entropy difference spectrum, an unclonable alarm is triggered; The protocol hair feature group verified by the entropy difference is subjected to a conformal mapping transformation, and the topological invariant at its conformal singularity is extracted as a quantum gravity authentication label, which forms a quantum entanglement binding with the three-dimensional space-time coordinates of the threat source; The quantum gravity authentication label is back-projected onto the threat spectrum library, and the causal update of the historical threat fingerprint is realized by adjusting the information compression threshold in the gravitational entropy parameter, ensuring that the protocol feature vectors in the library satisfy the information conservation law of the black hole no-hair theorem.

[0047] It should be noted that this embodiment solves the technical problems that the traditional threat fingerprint library is vulnerable to being copied and cracked in the quantum computing environment and it is difficult to ensure the absolute security of the feature information. By constructing protocol hair features with physical unclonable characteristics through quantum state encoding and Hawking entropy conversion, quantum-level identity authentication of threat sources is realized by using quantum fidelity comparison and negative entropy oscillation detection. Finally, through the quantum entanglement binding of the conformal topological invariant and the space-time coordinates, a dynamic protection system that satisfies the black hole information conservation law is formed, fundamentally eliminating the possibility of threat fingerprints being counterfeited or tampered with, and providing ultimate security guarantee based on the principle of quantum gravity for low-altitude security.

[0048] As Figure 3 shown, the gallium oxide solar-blind antenna detection module includes: An ultraviolet signal acquisition unit 1, which is composed of a β-phase gallium oxide solar-blind ultraviolet detector array and is used to receive ultraviolet radiation signals in the 200 - 280 nm band; An optical filtering unit 2, which is optically coupled to the ultraviolet signal acquisition unit and includes a band-pass filter and an optical lens group, and is used to suppress interference optical signals in non-solar-blind bands; A signal conditioning unit 3, which is connected to the output end of the ultraviolet signal acquisition unit and includes a transimpedance amplifier circuit and an adaptive gain control module, and is used to convert ultraviolet pulse signals into processable electrical signals; A space-time marking unit 4, which integrates a GPS module and an atomic clock and is used to attach a nanosecond-level time stamp and three-dimensional space coordinates to the collected ultraviolet light signals; A data preprocessing unit 5, which is connected to the signal conditioning unit and the space-time marking unit and includes a digital filter and a pulse shaping circuit, and is used to eliminate signal baseline drift and extract effective ultraviolet pulse characteristics.

[0049] In several embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units or components can be combined, or can be integrated into another system, or some features can be ignored, or not executed. In addition, the couplings, direct couplings, or communication connections between the components shown or discussed can be through some interfaces, and the indirect couplings or communication connections of devices or units can be electrical, mechanical, or other forms.

[0050] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units; they can be located in one place or distributed to multiple network units; some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0051] In addition, each functional unit in the embodiments of the present invention can be all integrated in a processing unit, or each unit can be separately used as a unit, or two or more units can be integrated in a unit; the above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

[0052] Those of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions. The foregoing program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps including the above method embodiments; and the foregoing storage medium includes: removable storage devices, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks, or optical disks, etc., which can store program codes.

[0053] Alternatively, if the above-mentioned integrated units of the present invention are implemented in the form of software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiments of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods of the various embodiments of the present invention. And the foregoing storage medium includes: removable storage devices, ROM, RAM, magnetic disks, or optical disks, etc., which can store program codes.

[0054] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of changes or substitutions, which should all be covered within the protection scope of the present invention.

Claims

1. A method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module, characterized in that The following steps are involved: S102: using the gallium oxide solar-blind antenna detection module and the radio frequency receiving module, synchronously collecting ultraviolet light pulse signals and electromagnetic radio frequency signals in the target low-altitude area, and extracting the original time domain waveform and preliminary spectrum characteristics of the electromagnetic radio frequency signals; S104: Based on the low-altitude target positioning information provided by the ultraviolet light pulse signal, anti-interference filtering and dynamic time-frequency resolution enhancement are performed on the original time domain waveform and preliminary spectrum characteristics to generate an enhanced time-frequency feature matrix suitable for low-altitude complex environments; S106: Input the enhanced time-frequency feature matrix into the anti-interference spectrum analysis engine to identify the remote control communication protocol mode of the low-altitude UAV threat target, and separate the unique key protocol feature vector representing the identity of the threat source; S108: Dynamically bind the key protocol feature vector to the ultraviolet detection time and space coordinates to generate a traceable dynamic threat fingerprint, and update it to the threat spectrum library in real time to establish a threat behavior association chain between low-altitude targets; S110: Based on the threat behavior association chain, perform multi-source heterogeneous signal fusion analysis on the dynamic threat fingerprint, extract cross-modal threat behavior pattern features, construct a dynamic threat behavior map and reversely update it to the threat spectrum library.

2. The method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module according to claim 1, wherein The S102 is specifically: The gallium oxide solar-blind antenna detection module is used to capture the ultraviolet light pulse signal in the target low-altitude area, and the radio frequency receiving module is used to synchronously collect the electromagnetic radio frequency signal in the corresponding airspace, and the time and space synchronization marks of the two are recorded; Performing bandpass filtering and baseline drift correction on the electromagnetic radio frequency signal, extracting the original time domain waveform, combining the pulse intensity and timestamp of the ultraviolet light pulse signal, removing the environmental noise interference segment, and generating an anti-interference time domain waveform segment; Performing short-time Fourier transform on the anti-interference time domain waveform fragment to generate an initial time-frequency spectrum diagram, and adaptively adjusting the time window length and overlap rate based on the target motion trajectory provided by the ultraviolet light pulse signal to extract preliminary spectrum features containing the target-related frequency band; Calculating the Doppler frequency shift of the electromagnetic radio frequency signal according to the velocity vector of the target in the ultraviolet light pulse signal, and dynamically correcting the frequency deviation of the preliminary spectrum characteristics according to the Doppler frequency shift to obtain enhanced spectrum characteristics aligned in the frequency domain; In the enhanced spectrum features, the continuous carrier component and the burst pulse component are separated through peak clustering and harmonic correlation analysis. Combined with the spatiotemporal marking of the ultraviolet signal, the candidate protocol feature segments synchronized with the target behavior are screened out to complete the extraction of the original time domain waveform and preliminary spectrum features.

3. The method for constructing a dynamic threat spectrum library of a gallium oxide solar-blind antenna detection module according to claim 1, wherein The S104 is specifically: The real-time position and speed information of the low-altitude target is calculated based on the ultraviolet light pulse signal, and the spatiotemporal motion feature vector is generated, and the timestamp is aligned with the original time domain waveform to mark the target effective signal interval; Using the velocity component in the spatiotemporal motion feature vector, Doppler phase compensation is performed on the target effective signal interval to eliminate the carrier frequency deviation caused by the target motion, thereby obtaining a motion compensated time domain signal; Constructing a spatial domain filtering weight according to the azimuth information in the spatiotemporal motion feature vector, performing beamforming processing on the motion compensated time domain signal, suppressing interference signals in non-target directions, and generating a spatial domain filtering signal; Adaptive adjustment of the window length according to the target speed magnitude, and perform variable-window short-time Fourier transform on the spatial domain filtered signal to generate a time-frequency spectrogram with speed adaptability; Extract the harmonic components synchronized with the target motion feature vector in the time-frequency spectrogram, strengthen the transient features through the Teager-Kaiser energy operator, and finally output an enhanced time-frequency feature matrix containing the target motion characteristics.

4. The method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module according to claim 1, wherein The S106 is specifically as follows: Perform multi-scale decomposition on the enhanced time-frequency feature matrix, extract the carrier fundamental frequency, modulation sideband, and synchronization header pulse features in the time-frequency domain to generate a set of protocol primitives; Perform sliding correlation operations on the set of protocol primitives and a preset typical UAV remote control protocol template library. When the correlation coefficient is greater than the preset coefficient threshold, it is determined as a valid protocol matching mode, and the candidate protocol type identifier is output; Based on the matched candidate protocol type, extract its transient modulation envelope features through Hilbert-Huang transform, combine with the frequency hopping pattern in the enhanced time-frequency feature matrix, calculate the protocol individual variation parameters, and generate a protocol fingerprint feature group; Perform principal component analysis on the protocol fingerprint feature group, screen out the feature components with variance contribution rate greater than the preset contribution rate threshold, and fuse them with the corresponding protocol type identifier to generate a unique key protocol feature vector containing protocol category and individual fingerprint; Compare the Euclidean distance between the key protocol feature vector and the records in the historical threat spectrum library. When the distance value is less than the dynamic adaptive threshold, it is determined as a verified threat feature, otherwise it is marked as a new protocol variant feature.

5. The method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module according to claim 1, characterized in that The S108 is specifically as follows: Cascade the key protocol feature vector with the real-time three-dimensional spatial coordinates and time stamp obtained by the gallium oxide solar-blind antenna detection module to generate a spatio-temporal-protocol joint feature vector; Perform hash coding operation on the spatio-temporal-protocol joint feature vector, and combine with the curvature feature of the target motion trajectory to generate a variable-length fingerprint identifier to form a dynamic threat fingerprint code; Calculate the Hamming distance between the current dynamic threat fingerprint code and the existing fingerprints in the threat spectrum library. When the Hamming distance value is less than the adaptive similarity threshold, it is determined as an associated target; Based on the principle of spatio-temporal continuity, perform Markov chain modeling on the motion trajectory and protocol feature change law of the associated target to construct a threat behavior transition probability matrix; According to the update result of the threat behavior transition probability matrix, perform time-weighted processing on the fingerprint features in the threat spectrum library to obtain the feature activity; When the feature activity exceeds the preset activity threshold, increase its retrieval priority to complete the establishment and maintenance of the low-altitude target threat behavior association chain.

6. The method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module according to claim 5, characterized in that Perform hash coding operation on the spatio-temporal-protocol joint feature vector, and combine with the curvature feature of the target motion trajectory to generate a variable-length fingerprint identifier to form a dynamic threat fingerprint code, specifically as follows: Perform normalization processing on the spatio-temporal-protocol joint feature vector to eliminate the dimension differences of each dimension feature and generate a normalized feature vector; Based on the continuous spatio-temporal coordinates of the target motion trajectory, calculate its curvature change feature to generate a trajectory curvature feature vector; Feature splicing is performed on the normalized feature vector and the trajectory curvature feature vector to generate a mixed feature vector; SHA-256 hash operation is performed on the mixed feature vector to generate a hash code with a fixed length of 256 bits; The final coding length is dynamically determined according to the information entropy value of the mixed feature vector. When the entropy value is higher than the set threshold, all 256-bit codes are retained. Otherwise, the first 128 bits are intercepted as the final code; An 8-bit check code is appended after the finally determined code to form a complete dynamic threat fingerprint code.

7. The method for constructing a dynamic threat spectrum library based on a gallium oxide solar-blind antenna detection module according to claim 1, wherein The S110 is specifically as follows: Based on the spatio-temporal coordinates in the threat behavior association chain, time synchronization calibration is performed on the ultraviolet light signal feature and the electromagnetic radio frequency signal feature corresponding to the dynamic threat fingerprint to generate a spatio-temporally aligned cross-modal feature pair; Joint sparse coding is performed on the cross-modal feature pair to extract the coupling mode of the ultraviolet pulse sequence and the radio frequency protocol feature. When the joint sparse coefficient of the two is greater than the preset threshold, it is determined as a valid cross-modal behavior pattern segment; According to the spatio-temporal distribution of the valid cross-modal behavior pattern segments, an initial threat behavior graph is constructed with the threat source as the node and the signal coupling strength as the edge weight; The edge weights of the initial threat behavior graph are dynamically adjusted using the transition probability matrix in the threat behavior association chain. When the behavior transfer frequency between nodes exceeds the adaptive threshold, the topological connection relationship of the corresponding edges is strengthened to generate an optimized dynamic threat behavior graph; The high-frequency coupling mode features in the dynamic threat behavior graph are extracted as new protocol templates and supplemented to the protocol feature vector set of the threat spectrum library to complete the closed-loop update.

8. The method for constructing a dynamic threat spectrum library of a gallium oxide solar-blind antenna detection module according to claim 1, wherein The gallium oxide solar-blind antenna detection module includes: An ultraviolet signal acquisition unit, composed of a β-phase gallium oxide solar-blind ultraviolet detector array, for receiving ultraviolet radiation signals in the 200-280nm band; An optical filtering unit, optically coupled to the ultraviolet signal acquisition unit, including a band-pass filter and an optical lens group, for suppressing interference optical signals in non-solar-blind bands; A signal conditioning unit, connected to the output end of the ultraviolet signal acquisition unit, including a transimpedance amplifier circuit and an adaptive gain control module, for converting the ultraviolet pulse signal into a processable electrical signal; A spatio-temporal marking unit, integrating a GPS module and an atomic clock, for attaching a nanosecond-level time stamp and three-dimensional spatial coordinates to the collected ultraviolet light signal; A data preprocessing unit, connected to the signal conditioning unit and the spatio-temporal marking unit, including a digital filter and a pulse shaping circuit, for eliminating signal baseline drift and extracting effective ultraviolet pulse features.

Images