A method and system for trapping a control instruction of a drone based on a base station probing technology

Abstract

The application provides a UAV control instruction trapping method and system based on a probe base station technology. First, the application collects signal parameters of a real base station and environmental electromagnetic noise characteristics, generates and transmits a dynamic base station simulation signal, so that a UAV initiates a probe signal actively. When the probe signal transmitted by the UAV is received, the instruction code characteristics in the probe signal are analyzed to reconstruct a trapping control signal with protocol deception. Finally, the protocol field parameters and the transmission power parameters of the trapping control signal are adjusted adaptively, so that the UAV keeps the communication connection with the probe base station device and continuously transmits control instruction data. The technical solution provided by the application not only completely eliminates the UAV anti-reconnaissance alarm caused by abnormal signal characteristics, but also improves the concealment and reliability of the instruction trapping process.

Description

Technical Field

[0001] This application relates to the field of wireless communication network security technology, and in particular to a method and system for trapping unmanned aerial vehicle (UAV) control commands based on base station detection technology. Background Technology

[0002] In civilian scenarios such as no-fly zones for logistics and warehousing, airspace control for commercial activities, and perimeter protection for data centers, unauthorized flights of small drones may lead to equipment collisions or data leaks. It is essential to accurately distinguish between controlled delivery drones and unauthorized intrusions to avoid disrupting normal business operations.

[0003] The current mainstream solution adopts spectrum feature comparison-based interference interception technology, which collects radio frequency signals of surrounding drones by deploying a group of monitoring base stations on the top floor of buildings, extracts the frequency hopping mode and modulation characteristics of the signals to generate a temporary fingerprint database; when an unregistered aircraft signal is detected, a protocol reset command group is transmitted to the target using a directional antenna to forcibly trigger the drone's emergency hovering response.

[0004] However, the solution still has three key flaws: First, the temporary fingerprint database needs to be continuously updated with matching rules, which creates blind spots for new logistics drones that use dynamic protocols; second, the explicit broadcast of the forced hovering command is easily recognized by the pilot's control terminal, causing the target to immediately switch communication frequency bands and escape; and finally, it is impossible to obtain complete control command data, making it difficult to distinguish between equipment operation errors and malicious intrusion. Summary of the Invention

[0005] This application provides a method and system for capturing UAV control commands based on base station detection technology, which solves the problems in the prior art such as fingerprint database matching lag leading to missed detection of new UAVs, explicit interference commands triggering target escape, and physical layer blocking failing to continuously capture the complete control command stream.

[0006] Firstly, this application provides a method for trapping unmanned aerial vehicles (UAVs) using control commands based on base station detection technology, including:

[0007] The signal parameters and environmental electromagnetic noise characteristics of real base stations are collected using detection base station devices deployed in a predetermined geographical area.

[0008] Based on the collected signal parameters and environmental electromagnetic noise characteristics, a dynamic base station simulation signal is generated, and the dynamic base station simulation signal is transmitted by the detection base station device so that the UAV entering the communication coverage area can respond to the dynamic base station simulation signal and actively initiate detection signals.

[0009] When the detection base station device receives the detection signal sent by the UAV, it analyzes the instruction encoding features in the detection signal;

[0010] The decoy control signal with protocol deception is reconstructed based on the instruction encoding features obtained from the analysis, wherein the decoy control signal is synchronously transmitted by incorporating the electromagnetic noise features of the current environment;

[0011] By adaptively adjusting the protocol field parameters and transmission power parameters of the trapping control signal, the UAV maintains a communication connection with the detection base station device and continuously transmits control command data.

[0012] Optionally, detection base station devices deployed in a predetermined geographical area are used to collect signal parameters and environmental electromagnetic noise characteristics of real base stations, including:

[0013] The signal acquisition device of the detection base station device performs a full-band wireless signal scan of the predetermined geographical area, and locates the signal transmission source of the real base station based on the scan results;

[0014] For the located signal transmission source, continuously capture communication signal samples transmitted by real base stations within a set time window, identify base station identification features and spectrum features in the communication signal samples, and generate signal parameters;

[0015] Simultaneously, based on the scanning results, the electromagnetic radiation of non-base station signal sources in the predetermined geographical area is monitored, and the intensity fluctuation characteristics and frequency band distribution characteristics of the electromagnetic radiation are extracted to generate environmental electromagnetic noise characteristics.

[0016] Optionally, a dynamic base station simulation signal is generated based on the collected signal parameters and environmental electromagnetic noise characteristics, and the dynamic base station simulation signal is transmitted by a base station detection device, so that the UAV entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates a detection signal, including:

[0017] Map the base station identification features contained in the signal parameters to base station identity recognition fields;

[0018] The carrier parameters and modulation parameters of the dynamic base station analog signal are determined based on the spectral characteristics, and a pre-set handshake protocol unit is embedded in the signal framework formed by the carrier parameters and modulation parameters.

[0019] The characteristics of environmental electromagnetic noise are converted into background noise waveforms covering the target frequency band;

[0020] The base station identification field and the handshake protocol unit are integrated into the signal framework, and the background noise waveform is synchronously superimposed to generate a composite analog signal as the dynamic base station analog signal;

[0021] The detection base station device continuously transmits the dynamic base station simulation signal within the communication coverage area of ​​the predetermined geographical region;

[0022] When the protocol field parameters of the simulated signal from the dynamic base station are within the authentication range of the target UAV control protocol, the target UAV is triggered to send a detection signal to the detection base station device.

[0023] Optionally, when the detection base station device receives a detection signal from the UAV, it parses the command encoding features in the detection signal, including:

[0024] The detection signal is demodulated at the physical layer to separate the data signaling unit in the communication protocol format; the protocol control field and data payload field in the data signaling unit are identified, and the core data segment containing the control identifier is extracted from the data payload field;

[0025] Based on the pre-established UAV control protocol structure mapping table, locate the storage location of specific parameters in the core data segment;

[0026] Read the bit sequence structure at the storage location of the specific parameter and confirm that it conforms to the bit distribution characteristics and check characteristics of the instruction encoding;

[0027] The data segment content that satisfies the bit distribution characteristics and check characteristics is determined as the instruction encoding characteristics.

[0028] Optionally, the decoy control signal with protocol deception capability is reconstructed based on the instruction encoding features obtained from the parsing, including:

[0029] Based on the control protocol type identifier in the instruction encoding features, a corresponding protocol control header structure is generated;

[0030] The operation instruction bit sequence in the instruction encoding feature is copied as the basic template of the trap instruction, and pseudo response content is inserted at the preset parameter position of the basic template of the trap instruction to form a pseudo instruction payload;

[0031] The protocol control header structure and the pseudo-instruction payload are assembled into a data unit in the target communication protocol format;

[0032] The coverage frequency band of the transmission carrier is determined based on the frequency band distribution characteristics of the environmental electromagnetic noise; the power modulation mode of the synchronization carrier is configured based on the intensity fluctuation characteristics.

[0033] The data unit is loaded within the defined coverage frequency band to form an initial trap signal;

[0034] The initial trapping signal is subjected to intensity mode adaptation processing through the power modulation mode to generate the trapping control signal.

[0035] Optionally, the initial trapping signal is subjected to intensity mode adaptation processing through the power modulation mode to generate the trapping control signal, including:

[0036] Analyze the intensity change period and fluctuation range recorded in the power modulation mode;

[0037] The intensity change period is divided into multiple continuous adjustment windows, and each continuous adjustment window corresponds to a specific amplitude adjustment ratio coefficient.

[0038] The basic intensity adjustment threshold range is determined based on the fluctuation range.

[0039] Read the instantaneous intensity waveform envelope structure of the initial trapping signal;

[0040] The instantaneous intensity waveform envelope structure is subjected to waveform compression processing according to the amplitude adjustment ratio coefficient to form envelope adjustment parameters, and the envelope adjustment parameters are limited to the range of the basic intensity adjustment threshold to generate a standard envelope structure;

[0041] The standard envelope structure is loaded onto the carrying frequency band of the initial trap signal to form a time-varying trajectory. Based on the mapping relationship between the time-varying trajectory and the intensity change period, the signal intensity sequence of the initial trap signal is reconstructed to output the trap control signal.

[0042] Optionally, by adaptively adjusting the protocol field parameters and transmit power parameters of the trapping control signal, the UAV maintains a communication connection with the detection base station device and continuously transmits control command data, including:

[0043] Monitor the communication maintenance characteristics in the response signals returned by the UAV, and identify the response interval characteristics and data integrity characteristics included in the communication maintenance characteristics;

[0044] When the response interval feature exceeds the preset maintenance interval, the number of transmission frequencies of the handshake command in the protocol field parameter is increased; when there is a continuous packet loss flag in the data integrity feature, the carrier strength value in the transmit power parameter is increased by gradient magnitude.

[0045] Calculate the deviation between the current response interval characteristic and the preset maintenance interval, synchronously correct the transmission frequency of the handshake command, and obtain the adjusted transmission power parameters;

[0046] The carrier strength value is updated in reverse order based on the packet loss marker distribution location of the pre-set periodic detection data integrity characteristics;

[0047] Cross-validate the adjusted protocol field parameters and the adjusted transmit power parameters, and output the target adjustment parameters when the preset communication maintenance conditions are met;

[0048] The target adjustment parameters are used to control the continuous transmission of the trapping control signal so that the UAV maintains a communication connection with the detection base station device and continuously transmits control command data.

[0049] Secondly, this application provides a drone control command trapping system based on base station detection technology, comprising:

[0050] The acquisition module is used to collect signal parameters and environmental electromagnetic noise characteristics of real base stations using detection base station devices deployed in a predetermined geographical area.

[0051] The transmitting module is used to generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and to transmit the dynamic base station simulation signal through the detection base station device, so that the UAV entering the communication coverage area can respond to the dynamic base station simulation signal and actively initiate the detection signal.

[0052] The parsing module is used to parse the instruction encoding features in the detection signal when the detection base station device receives the detection signal emitted by the UAV;

[0053] The reconstruction module is used to reconstruct a decoy control signal with protocol deception based on the instruction encoding features obtained from parsing, wherein the decoy control signal is synchronously transmitted by incorporating the electromagnetic noise features of the current environment;

[0054] The adjustment module is used to adaptively adjust the protocol field parameters and transmission power parameters of the trapping control signal so that the UAV maintains a communication connection with the detection base station device and continuously transmits control command data.

[0055] Thirdly, this application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement a drone control command trapping method based on base station detection technology as described in the first aspect above.

[0056] Fourthly, this application provides a computer storage medium storing a computer program, which, when executed by a computer, implements a drone control command trapping method based on base station detection technology as described in the first aspect.

[0057] This application utilizes an active induction mechanism based on simulated signals from dynamic base stations to enable target drones to autonomously initiate communication connections without coercion, effectively avoiding the risk of equipment escape caused by traditional physical interference. Simultaneously, by leveraging the dynamic fusion of protocol-deceptive capture control signals and environmental characteristics, it continuously captures complete control command streams while maintaining communication connections. This avoids indiscriminate impact on legitimate communication devices and enables precise tracing of unauthorized operations.

[0058] Furthermore, by precisely replicating the protocol control header structure and covertly implanting the pseudo-command payload, a deceptive signal framework fully compatible with the real control protocol is constructed, fundamentally penetrating the technical barrier of the encrypted frequency hopping mechanism. Further, by combining dynamic adaptation technology of environmental noise waveforms and carrier coverage frequency bands, the decoy control signal exhibits wave characteristics completely consistent with the real electromagnetic environment at the physical layer, completely eliminating UAV counter-reconnaissance alarms caused by abnormal signal characteristics, and significantly improving the concealment and reliability of the command decoy process.

[0059] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 A flowchart of a drone control command trapping method based on base station detection technology provided in this application is shown;

[0062] Figure 2 This paper presents a schematic diagram of a drone control command trapping system based on base station detection technology provided in this application.

[0063] Figure 3 A schematic diagram of the structure of a computing device provided in this application is shown. Detailed Implementation

[0064] To enable those skilled in the art to better understand the present application, the technical solution of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0065] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0066] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0067] Figure 1 This application provides a flowchart of a method for trapping unmanned aerial vehicle (UAV) control commands based on base station detection technology, as shown in the flowchart. Figure 1 As shown, the method includes:

[0068] Step 101: Use a detection base station device deployed in a predetermined geographical area to collect signal parameters and environmental electromagnetic noise characteristics of real base stations.

[0069] In this step, the "base station detection device" refers to equipment deployed at the boundary of the no-fly zone that has signal transmission and processing functions; the "real base station" refers to a legal communication base station authorized by the operator; the signal parameters include base station identification features (such as the cell global identification code) and spectrum features (such as carrier frequency); the environmental electromagnetic noise features refer to the electromagnetic radiation intensity fluctuation characteristics and frequency band distribution characteristics generated by non-base station signal sources (such as industrial equipment and WiFi routers).

[0070] In this embodiment, the base station detection device first initiates a full-band wireless signal scan, capturing all radio frequency signals within a predetermined geographical area using a broadband receiver. Based on the signal energy peak, it locates the signal source of the actual base station. After locking onto the target base station, it collects its communication signal samples within a continuous time window. Signal demodulation and protocol parsing techniques are used to separate base station identification features (such as parsing the PLMN identifier in the broadcast channel) and spectrum features (such as measuring the frequency offset characteristics of the pilot signal). Simultaneously, a spectrum analyzer is activated to monitor environmental electromagnetic radiation. Through time-frequency analysis, intensity fluctuation features (such as periodic fluctuations in signal amplitude) and frequency band distribution features (such as the noise density of the 2.4GHz band) are extracted. Finally, the base station-related features are classified as signal parameters, and environmental interference features are integrated into environmental electromagnetic noise features.

[0071] For example, in the deployment of a no-fly zone in a logistics hub, the detection base station device scanned the entire frequency band around the park, identifying the transmitter of the China Mobile base station with PCI code 42. It continuously collected the SIB1 broadcast signal of sector 1 of the base station, extracting the MCC / MNC identifier as a base station identification feature, and simultaneously measuring the carrier frequency offset in the 1800MHz band as a spectral feature. Simultaneously, it monitored the pulse noise generated by electric forklift motors within the park, recording its intensity fluctuation period of 3 times per second and its frequency band distribution of 2.4-2.4835GHz, forming an environmental electromagnetic noise feature library. These features will be used to subsequently generate dynamic base station simulation signals that match the real environment.

[0072] Step 102: Generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and transmit the dynamic base station simulation signal through the detection base station device so that the UAV entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates the detection signal.

[0073] In this step, the dynamic base station simulation signal refers to a composite radio frequency signal that mimics the characteristics of a real base station signal and incorporates environmental noise; the communication coverage range refers to the three-dimensional airspace range that the detection base station device's signal transmission can effectively reach; and the detection signal refers to the initialization request message containing identification and control protocol characteristics sent by the UAV to the base station to establish a communication link.

[0074] In this embodiment, the base station detection device first maps the base station identification features (such as PLMN encoding) in the signal parameters to the identity recognition field of the protocol specification, and simultaneously determines the carrier center frequency and QPSK modulation mode based on the spectrum characteristics; the environmental electromagnetic noise features are reconstructed into a time-domain background noise waveform through inverse Fourier transform; then, a handshake protocol unit (such as an RRC connection request response template) is embedded in the generated protocol framework, and the identity recognition field and the handshake unit are integrated into the physical layer signal structure, and the background noise waveform is superimposed to form a composite signal; this signal is continuously broadcast within a preset airspace radius through a power amplifier; when the UAV receiver detects a protocol field that conforms to its control protocol authentication range (such as the LTE random access preamble threshold), it actively initiates a detection signal containing IMSI code and flight status data.

[0075] In a logistics hub case study, the detection base station converted the collected China Mobile MCC / MNC identifiers into 46000 protocol fields and constructed a signal framework using an 1800MHz carrier and π / 4-DQPSK modulation. The noise characteristics of the electric forklift in the 2.4GHz band were converted into impulse noise waveforms using IFFT. The RC handshake response unit of the DJI drone was embedded in the protocol framework, and noise was superimposed to generate a dynamic base station simulation signal. The device continuously transmitted over the airspace of the loading and unloading area of ​​the park with a power of 3dBm. When the JD Logistics drone entered the airspace, its onboard communication module identification protocol field fell into the DJI OcuSync authentication range, and it actively sent a detection signal containing the aircraft serial number and GPS coordinates to the detection base station, triggering the subsequent command trapping process.

[0076] Step 103: When the detection base station device receives the detection signal sent by the UAV, it parses the instruction encoding features in the detection signal.

[0077] In this step, the instruction encoding feature refers to the specific bit distribution pattern of the UAV flight control instruction in the communication protocol, including operation type identifiers (such as direction control bits), parameter storage locations (such as altitude value offset addresses), and verification rules (such as parity bit distribution), which are used to restore the original control intent.

[0078] In this embodiment, the detection base station device first performs physical layer demodulation on the detection signal and uses orthogonal frequency division multiplexing (OFDM) technology to separate the protocol data units. It then uses a protocol parsing engine to identify control fields (such as the PDCP header) and data payload fields, locating the core data segment containing flight commands. Based on a pre-set UAV protocol structure mapping table (such as the DJI OcuSync frame format table), it determines the storage offset and length of the command parameters. It reads the bit sequence of this region and verifies its structural integrity (such as checksum bit position matching) by combining the parity bit distribution. Finally, it extracts the bit distribution features that conform to the target UAV control specifications as valid command encoding features, providing a data foundation for subsequent protocol deception.

[0079] In a logistics case study, the investigation revealed that after receiving a detection signal containing the aircraft's serial number, the base station used OFDM demodulation to separate the protocol data unit. The core segment identified as "flight control command" in the payload field was identified, and bits 24-32 were located as the heading angle parameter storage area based on DJI's protocol mapping table. The bit sequence "10011010" was read and its parity bit (bit 33 being "1") was verified to conform to the specifications, confirming that the sequence contained the encoded feature of a 15° leftward deflection command. This feature will be used to reconstruct the deceptive signal that induces a continuous rightward turn.

[0080] Step 104: Reconstruct the decoy control signal with protocol deception based on the instruction encoding features obtained from the analysis, wherein the decoy control signal is synchronously transmitted by incorporating the electromagnetic noise features of the current environment.

[0081] In this step, reconstruction refers to reconstructing a communication signal with a logically compatible structure but altered content based on the instruction encoding characteristics; protocol deception refers to the trap control signal maintaining the same representational attributes as legitimate instructions in the protocol control header and data payload layers; trap control signal refers to a composite radio frequency signal that carries both forged control instructions and environmental noise characteristics, inducing the UAV to respond continuously through dual camouflage at the physical layer and protocol layer.

[0082] In this embodiment, the detection base station device first generates a corresponding protocol control header structure based on the protocol type identifier (such as DJIOcuSync 2.0 identifier) ​​in the instruction encoding characteristics, and uses a protocol reverse engine to copy the original operation instruction bit sequence as a basic template. Pseudo-response content (such as the reverse deflection direction instruction value) is then implanted into the preset tampering bits (such as the heading angle parameter area) of this template to form a pseudo-instruction payload with logical integrity. The protocol control header and pseudo-instruction payload are assembled into a data unit conforming to the target protocol format. Simultaneously, carrier frequency points are configured based on the frequency band distribution characteristics of environmental electromagnetic noise (such as the proportion of the 2.4GHz band), and dynamic power modulation parameters are generated based on intensity fluctuation characteristics (such as periodic pulse patterns). Finally, data units are loaded within the target frequency band to form a baseband signal. Electromagnetic environment characteristics are fused using noise waveform time-domain superposition technology to output a decoy control signal whose physical characteristics are indistinguishable from the real environment.

[0083] Following the aforementioned logistics case, this study investigated the encoding characteristics of the base station based on the "deflection command." First, a DJI OcuSync protocol control header (containing the same frame number and checksum) was generated. "10011010" was copied as the basic bit sequence, and bits 25-27 were inverted to "001" to generate a pseudo-command payload for "deflect left." After assembling this into a complete protocol unit, based on the noise characteristics of electric forklifts collected from the SF Express logistics hub (70% in the 2.4GHz band), the carrier center frequency was set to 2412MHz. Combining this with the intensity fluctuation of the noise (3 pulses per second), a power modulator was configured to operate in a synchronous fluctuation mode. Finally, the forged protocol data was loaded onto the carrier, superimposed with the forklift noise waveform, and transmitted to the target drone. This signal was mistakenly identified by the drone as a legitimate "deflect 15° to the left" command. Simultaneously, the physical layer noise perfectly matched the park environment, and no anti-reconnaissance alarm was triggered.

[0084] Step 105: Adaptively adjust the protocol field parameters and transmission power parameters of the trapping control signal to ensure that the UAV maintains a communication connection with the detection base station device and continuously transmits control command data.

[0085] In this step, the protocol field parameters refer to the set of protocol layer variables that control the communication connection state, including the number of handshake command transmissions (such as the interval between ACK confirmation packets) and command sequence number characteristics (such as the incremental sequence number of data packets); the transmit power parameters refer to the set of physical layer signal strength dynamic adjustment rules, covering the carrier strength variation range (such as the power fluctuation interval threshold) and modulation mode parameters (such as the pulse width modulation duty cycle). The two work together to ensure that the decoy signal can be continuously parsed by the target UAV.

[0086] In this embodiment, the detection base station device first monitors the response signals returned by the UAV in real time, and uses a protocol parser to identify its response interval characteristics (such as the arrival delay of uplink ACK packets) and data integrity characteristics (such as the distribution of CRC check failure markers). When the response interval is detected to exceed the preset maintenance interval (such as a 150ms threshold), the frequency of handshake command transmission is increased through a dynamic protocol scheduling algorithm (such as shortening the RRC retransmission interval). Simultaneously, when consecutive packet loss markers are detected, the carrier strength value is gradually increased according to the gradient amplitude calculation model (such as increasing by 0.5dB each time). Then, the deviation between the current response interval and the preset value is calculated, and the frequency of handshake commands is fine-tuned with a closed-loop feedback mechanism. At the same time, the distribution position of packet loss markers is periodically scanned (such as packets that appear consecutively in odd-numbered sequences), and the carrier strength enhancement gradient is adjusted in reverse (such as decreasing from 0.5dB to 0.3dB). Finally, the adjusted protocol field parameters and transmit power parameters are cross-validated (such as checking whether the carrier enhancement affects the protocol timing). When the communication continuity condition is met, the target parameters are output, and the signal transmitter is controlled to stably output the decoy signal.

[0087] Following the aforementioned logistics case, the detection base station detected that the response interval had increased from 120ms to 210ms (exceeding the 180ms maintenance interval), and immediately shortened the RRC handshake command transmission interval from 20ms to 10ms. Simultaneously, it discovered the consecutive loss of the 7th and 9th sequence data packets, and activated the gradient carrier enhancement mechanism to gradually increase the transmission power from 20dBm to 23dBm. After calculating the 30ms deviation between the current 210ms latency and 180ms, it added handshake commands to send 12 times per second. Subsequently, it detected that packet loss was concentrated in odd-numbered packet sequences, and reversed the power reduction and gradient increase to 0.3dB steps. After cross-validation confirmed that the adjusted communication met the requirements (latency reduced to 170ms, packet loss disappeared), and finally maintained the optimized parameters to enable the drone to continuously transmit control command streams containing battery status and cargo weight back to the detection base station, completing the sensitive data collection.

[0088] In summary, this application generates dynamic simulated signals by real-time acquisition and fusion of base station signals and environmental noise characteristics, accurately inducing the target UAV to actively initiate a communication connection; it extracts key command encoding features based on deep analysis of the protocol layer of the detection signal, reconstructing a trap control signal with dual deception at both the physical and protocol layers; finally, it maintains a stable communication connection through a parameter adaptive adjustment mechanism, continuously capturing the complete control command stream without the UAV's awareness throughout the process, thus completely solving the four major technical defects of traditional solutions: lagging signal feature recognition, physical interference triggering target escape, encryption protocol blocking failure, and fragmented control command capture.

[0089] As one feasible embodiment, according to step 101, the signal parameters and environmental electromagnetic noise characteristics of real base stations are collected using a detection base station device deployed in a predetermined geographical area, including:

[0090] Step 201: The signal acquisition device of the detection base station device performs a full-band wireless signal scan of the predetermined geographical area, and locates the signal transmission source of the real base station based on the scan results.

[0091] In this step, full-band wireless signal scanning refers to indiscriminate signal energy detection of all available frequency bands within the target airspace; signal transmission source refers to the physical location of radio frequency transmitting equipment whose radiated energy exceeds a preset threshold, which is achieved through cross-location of signal arrival angle and energy peak value.

[0092] In this embodiment, the base station detection device activates a broadband radio frequency receiver to scan the 400MHz-6GHz frequency band in a stepped-frequency manner, and records the signal energy intensity at each frequency point in real time; it analyzes the signal phase difference through multi-channel beamforming technology and calculates the target signal angle of arrival; it combines the energy peak distribution map and the angle of arrival data, and uses a triangulation algorithm to determine the three-dimensional coordinates of the signal source; when a continuous energy distribution that conforms to the characteristics of a base station is detected (such as periodic broadcasting at a fixed frequency), it is marked as a real base station signal transmission source, and the set of location coordinates is output.

[0093] Step 202: For the located signal transmission source, continuously capture communication signal samples transmitted by the real base station within a set time window, identify the base station identification features and spectrum features in the communication signal samples, and generate signal parameters.

[0094] In this step, the communication signal sample refers to the raw signal data stream continuously sampled from the target transmitter; the base station identification feature refers to the operator's network unique identification parameters (such as PLMN code); and the spectrum feature refers to the modulation method and frequency stability parameters of the carrier signal.

[0095] In this embodiment, the coordinates of the base station targeted by the directional receiving antenna are determined, and broadcast channel signals are collected within a continuous time window. The baseband signal is separated by an IQ demodulator, and the network identifier (such as MCC 460 / MNC 01) in the System Information Block (SIB) is parsed using a protocol analysis engine. Simultaneously, a spectrum analyzer is used to measure the carrier center frequency offset and modulation error rate, and the modulation type (such as 64QAM) is recorded. The identification features and spectrum features are encapsulated into signal parameters.

[0096] Step 203: Simultaneously, based on the scanning results, monitor the electromagnetic radiation of non-base station signal sources in the predetermined geographical area, and extract the intensity fluctuation characteristics and frequency band distribution characteristics of the electromagnetic radiation to generate environmental electromagnetic noise characteristics.

[0097] In this step, non-base station signal sources refer to electromagnetic radiation sources generated by non-operator-authorized devices (such as WiFi routers); intensity fluctuation characteristics refer to the regular pattern of signal amplitude changes over time; frequency band distribution characteristics refer to the proportion of noise energy in different frequency bands.

[0098] In this embodiment, the device calls full-band scanning data, filters base station signals, and separates environmental noise; it extracts the amplitude envelope variation pattern (such as periodic pulse intervals) through time-domain analysis; it performs fast Fourier transform to calculate the energy integral value of each frequency band and determines the main interference frequency band (such as the proportion of the 2.4GHz frequency band); and it encodes the intensity fluctuation pattern and frequency band energy distribution into an environmental noise feature vector.

[0099] As another embodiment, according to step 102, a dynamic base station simulation signal is generated based on the collected signal parameters and environmental electromagnetic noise characteristics, and the dynamic base station simulation signal is transmitted by a base station detection device, so that the UAV entering the communication coverage area responds to the dynamic base station simulation signal and actively initiates a detection signal, including:

[0100] Step 301: Map the base station identification features contained in the signal parameters to a base station identity recognition field.

[0101] In this step, the base station identification field refers to the network identity identification data unit encoded according to the mobile communication protocol specification, which contains a combination of bit sequences of the Public Land Mobile Network Code (PLMN) and the Cell Global Identifier (CGI), and is used to simulate the identity of a legitimate base station at the protocol layer.

[0102] In this embodiment, the base station identification features in the base station device call signal parameters are investigated, and the base station identification features are split into country code (MCC) and network code (MNC) bit segments through the protocol conversion engine. According to the 3GPP protocol specifications, the MCC / MNC fields and the cell ID (CI) obtained by positioning are recombined into binary, and after adding CRC check bits, they are encapsulated into a complete identity recognition field that conforms to the air interface transmission specifications, generating an identity authentication unit that can be directly embedded in the communication protocol.

[0103] Step 302: Determine the carrier parameters and modulation parameters of the dynamic base station analog signal based on the spectral characteristics, and embed a pre-set handshake protocol unit into the signal framework formed by the carrier parameters and modulation parameters.

[0104] In this step, carrier parameters refer to the set of physical transmission characteristics of radio frequency signals (center frequency / bandwidth); modulation parameters refer to the baseband signal coding rules (such as QAM order); and signal frame refers to the physical layer transmission template that includes carrier frequency, modulation method, and time slot structure.

[0105] In this embodiment, the probe base station selects the center frequency and signal bandwidth based on the carrier frequency offset and modulation error data in the spectrum characteristics; matches the corresponding modulator parameters according to the modulation type; after constructing a signal framework that includes physical resource block allocation and time slot format, it extracts the target UAV manufacturer's specific handshake unit (such as the DJI OcuSync connection response template) from the protocol library and writes its binary stream into the preset data area of ​​the signal framework according to the control channel mapping rules.

[0106] Step 303: Convert the environmental electromagnetic noise characteristics into a background noise waveform covering the target frequency band.

[0107] In this step, the background noise waveform refers to the electrical signal function curve that exhibits continuous fluctuation characteristics in the time domain, and its spectral characteristics are consistent with those of real environmental noise.

[0108] In this embodiment, the device extracts frequency band distribution data from the environmental electromagnetic noise characteristics and generates a baseband noise spectrum through inverse discrete Fourier transform. Combining the intensity fluctuation characteristics (such as periodic pulse parameters), a signal generator is used to reconstruct a simulated waveform with the same amplitude fluctuation pattern in the time domain. Finally, the baseband noise is upconverted to the target frequency band through radio frequency modulation, and the output noise waveform with three-dimensional time and frequency characteristics matching the real environment is obtained.

[0109] Step 304: Integrate the base station identification field and the handshake protocol unit into the signal frame, and synchronously superimpose the background noise waveform to generate a composite analog signal as the dynamic base station analog signal.

[0110] In this embodiment, the base station identification field generated in step 301 is written into the synchronization channel (PSS / SSS resource block) of the signal frame; the handshake protocol unit implanted in step 302 has been stored in the data channel; the IQ data stream of the signal frame and the background noise waveform are added in the time domain by the composite signal generator; the noise signal amplitude is adjusted so that it does not exceed 30% of the protocol data power, and a composite baseband signal that retains the complete protocol structure and wraps the real noise characteristics is output.

[0111] Step 305: The detection base station device continuously transmits the dynamic base station analog signal within the communication coverage area of ​​the predetermined geographical region.

[0112] In this embodiment, the composite baseband signal is converted into an analog signal by a DAC and amplified to a set power through an RF power amplifier link; the coverage radius of the predetermined geographical area (such as the airspace 500 meters around the venue) is calculated by combining a three-dimensional propagation model; an omnidirectional antenna is used to continuously broadcast in the target airspace, and the transmission power is dynamically adjusted according to environmental characteristics (such as increasing it by 5% during the day to compensate for equipment interference) to ensure that the UAV can receive the compliant guidance signal at any location in the no-fly zone.

[0113] Step 306: When the protocol field parameters of the dynamic base station analog signal are within the authentication range of the target UAV control protocol, the target UAV is triggered to send a detection signal to the detection base station device.

[0114] In this step, the authentication range refers to the range of communication connection legitimacy verification set by the target drone manufacturer (such as the valid value range of RC command codes required by DJI drones); the triggering mechanism refers to the activation of the drone's preset response program when the signal parameters meet the authentication range.

[0115] In this embodiment, after receiving the simulated signal from the dynamic base station, the communication module of the target UAV first extracts its protocol control field (such as the RRC connection request code) and reverse maps the value of the field through the internally stored protocol database. If the value is within the authentication threshold predefined by the manufacturer, it is determined to be a legitimate base station connection request. Then, the detection signal transmission process is activated, packaging the device physical identifier (such as the fuselage serial number), real-time status data (GPS coordinates and flight mode), and control protocol version number, and sending wireless detection data packets to the signal source direction with a preset response power to complete the active connection request to the detection base station.

[0116] As another embodiment, according to step 103, when the detection base station device receives the detection signal emitted by the UAV, it parses the command encoding features in the detection signal, including:

[0117] Step 401: Perform physical layer demodulation processing on the probe signal to separate the data signaling unit in the communication protocol format; identify the protocol control field and data payload field in the data signaling unit, and extract the core data segment containing the control identifier from the data payload field.

[0118] In this step, the data signaling unit refers to a standardized data transmission block that conforms to the mobile communication protocol stack structure; the protocol control field refers to the header data area that carries communication connection status identifiers (such as frame type code and sequence number); the data payload field refers to the valid data area containing actual application layer information; and the control identifier refers to the key positioning tag in the payload that marks the instruction type.

[0119] In this embodiment, the detection base station device first uses orthogonal frequency division multiplexing demodulation technology to process the radio frequency carrier of the detection signal, filters out environmental noise components, and separates the baseband protocol data stream; it identifies the transport block structure through a protocol parsing engine, matches the control field according to the pre-stored protocol template, and strips the control information; then it scans the binary sequence of the payload field, locates the manufacturer's preset control identifier, and determines the offset and length of the core data segment according to the protocol mapping table; finally, it extracts the continuous bit segment starting from the identifier as the core data area containing flight command parameters.

[0120] Step 402: Locate the storage location of specific parameters in the core data segment according to the pre-established UAV control protocol structure mapping table.

[0121] In this step, the UAV control protocol structure mapping table refers to a relational database that records the command data structure of UAVs from different manufacturers, including the mapping rules between command type identifiers and parameter storage offsets; the specific parameter storage location refers to the precise bit range of key operation values ​​(such as pitch angle and flight speed) in the control command within the data segment.

[0122] In this embodiment, the probe base station device calls a preset protocol structure database and matches the corresponding protocol template according to the control identifier extracted in step 401; based on the instruction type index recorded in the template, it looks up the table to obtain the parameter offset rule of the instruction; combined with the core data segment length, it dynamically calibrates the parameter storage boundary; and finally, based on the parity check characteristics of the timestamp field in the instruction sequence, it locks the precise storage range of the target parameter in the bit stream.

[0123] Step 403: Read the bit sequence structure at the storage location of the specific parameter and confirm that it conforms to the bit distribution characteristics and check characteristics of the instruction encoding.

[0124] In this step, bit distribution characteristics refer to the standardized bit allocation rules for parameter values ​​in the target UAV control commands; verification characteristics refer to the manufacturer's pre-configured data integrity verification mechanism, used to ensure that no bit errors occur during transmission.

[0125] In this embodiment, the detection base station device first reads the specific parameter storage location located in step 402, and extracts the complete bit sequence of the segment through a binary stream parser; compares the sequence with the standardized bit distribution pattern stored in the protocol mapping library; synchronously scans adjacent verification regions to verify whether their values ​​meet the preset verification algorithm; if the bit distribution conforms to the manufacturer's template rules and the verification bit verification passes, the instruction encoding feature is determined to be valid; if the verification fails, the UAV is requested to retransmit the detection signal until a legal instruction data that meets the dual feature constraints is obtained.

[0126] Step 404: The data segment content that satisfies the bit distribution characteristics and check characteristics is determined as the instruction encoding characteristics.

[0127] In this step, the instruction encoding feature refers to the effective control of the structured expression of instruction data through dual verification (bit distribution + check), which includes the original parameter bit sequence, storage location metadata (such as the start bit), and associated verification rules (such as the parity check bit index), providing a tamperable instruction unit carrier for protocol spoofing.

[0128] In this embodiment, the detection base station device adds a location marker and a check bit index to the bit sequence that has passed the verification in step 403; simultaneously extracts the verification rules (such as even parity requirements) of the check bit; encapsulates the bit sequence, location metadata, and verification rules into a structured data object; writes it into the instruction feature database through a memory registration operation, tags it with "verified and tamper-proof" and associates it with the target UAV model, generating a complete instruction encoding feature that can be directly used for reconstructing the trap signal.

[0129] As another embodiment, according to step 104, reconstructing the decoy control signal with protocol deception based on the instruction encoding features obtained through parsing includes:

[0130] Step 501: Generate a corresponding protocol control header structure based on the control protocol type identifier in the instruction encoding features.

[0131] Step 501: Generate the corresponding protocol control header structure based on the control protocol type identifier in the instruction encoding features.

[0132] In this step, the protocol control header structure refers to the data packet header template used to establish a connection in the UAV communication protocol. It contains a logical combination of control fields such as frame synchronization code, source device address, sequence number, and protocol version number. Its format is defined by the communication standard of the target device manufacturer and is used to forge the identity of a legitimate command source at the protocol layer.

[0133] In this embodiment, the probe base station device extracts the protocol type identifier from the instruction encoding features registered in step 404, queries the preset protocol template library to match the header structure specifications of the corresponding manufacturer, calls the protocol generation engine to construct a standard header template, and fills in key fields according to the specifications: inserting the virtual device address of the current session, incrementing the sequence number (to prevent replay attack detection), and copying the frame synchronization code of the target UAV; finally, adding the protocol feature identifier field to generate a protocol control header structure that is fully compatible with the original control instructions.

[0134] Step 502: Copy the operation instruction bit sequence in the instruction encoding feature as the decoy instruction base template and insert pseudo response content at the preset parameter position of the decoy instruction base template to form a pseudo instruction payload.

[0135] In this step, the trapping instruction base template refers to a binary sequence framework (including instruction type identifier and parameter placeholders) that completely replicates the original instruction structure of the target UAV, used to maintain protocol integrity; the preset parameter location refers to the bit address of the changeable value storage area specified by the manufacturer's protocol; and the pseudo response content refers to the operation parameter value that has been tampered with while maintaining protocol logic compliance.

[0136] In this embodiment, the detection base station device first completely copies the original bit sequence in the instruction encoding features determined in step 404 to generate a baseband template with a consistent protocol data structure; it locates the preset tampering bit of the instruction type according to the protocol mapping table; it writes the pseudo response content into the target location according to the bit length adaptation rule; and finally, it performs check code recalculation on the modified bit sequence (such as regenerating the parity check bit) to ensure that the payload passes the protocol layer verification rules, forming a complete instruction payload unit with a legal structure but deceptive content.

[0137] Step 503: Assemble the protocol control header structure and the pseudo-instruction payload into a data unit in the target communication protocol format.

[0138] In this step, the data unit of the target communication protocol format refers to a complete frame structure entity that conforms to the target UAV communication specifications. It consists of a three-part binary combination of protocol control header (source address / serial number), payload data (flight commands), and tail check field. Its encapsulation rules strictly follow the layering standards of the vendor's protocol stack.

[0139] In this embodiment, the detection base station device first calls the protocol control header structure (such as a 20-byte packet header) generated in step 501, and copies its fixed field area (synchronization code + address) to the start position of the data unit; it then concatenates the pseudo-instruction payload (such as a tampered heading angle instruction body) output in step 502 to the packet header according to the offset specified in the protocol; it calculates the cyclic redundancy check (CRC) value of the combined data and writes it to the tail check field; it fills the data unit according to the length rules of the target protocol (adding null bytes when the length is less than the minimum), and finally generates a three-segment complete protocol data unit that conforms to the specification, ensuring that the target UAV communication module can seamlessly parse the forged instruction.

[0140] Step 504: Determine the coverage frequency band of the transmission carrier based on the frequency band distribution characteristics of the environmental electromagnetic noise characteristics; configure the power modulation mode of the synchronization carrier based on the intensity fluctuation characteristics.

[0141] In this step, the coverage frequency band refers to the range of the main carrier frequency selected by the probe base station, which needs to coincide with the frequency band dominated by environmental noise to avoid interference; the power modulation mode refers to the set of rules for the dynamic adjustment of carrier strength over time, and its fluctuation pattern needs to be synchronized with the intensity fluctuation characteristics of environmental noise.

[0142] In this embodiment, the base station detection device first analyzes the frequency band distribution data of the environmental electromagnetic noise characteristics and selects the continuous frequency band with the largest energy proportion as the main carrier coverage frequency band; calculates the optimal center frequency based on the frequency band width (avoiding other system protection frequency bands); simultaneously analyzes the periodic patterns in the intensity fluctuation characteristics (such as two intensity pulses per second), configures the power modulator to increase the carrier intensity by a preset ratio within the interval between adjacent pulses, and attenuates it to the basic power during the pulse peak period (such as maintaining the noise masking effect); finally, it establishes the mapping rules between the coverage frequency band and the power fluctuation, forming a carrier parameter configuration that matches both the time-varying spectrum and the intensity.

[0143] Step 505: Load the data unit within the determined coverage frequency band to form an initial trap signal.

[0144] In this step, the initial decoy signal refers to the baseband protocol data radio frequency carrier entity without superimposed power modulation, whose physical layer structure already includes protocol data units and fixed carrier parameters.

[0145] In this embodiment, the probe base station sends the protocol data unit generated in step 503 into the digital upconverter and configures the local oscillator parameters according to the center frequency of the coverage band determined in step 504; it uses quadrature modulation technology to shift the baseband IQ signal to the target radio frequency band; it sets the passband range of the filter according to the signal bandwidth requirements; and finally, it outputs the original carrier signal without dynamic power modulation through the radio frequency front end to form an initial physical layer decoy signal containing a complete spoofing protocol but with constant strength.

[0146] Step 506: Perform intensity mode adaptation processing on the initial trapping signal through the power modulation mode to generate the trapping control signal.

[0147] In this step, intensity mode adaptation processing refers to dynamically adjusting the power of the initial signal with a fixed intensity according to a preset fluctuation rule, so that the final signal exhibits intensity fluctuation characteristics consistent with the environmental noise.

[0148] In this embodiment, the power modulation rule established in step 504 is invoked; the initial trapping signal in step 505 is input to the digitally controlled attenuator; the attenuation ratio is adjusted in real time according to the modulation rule; the output signal envelope is monitored synchronously to ensure that it fluctuates synchronously with the noise intensity waveform; and finally, a trapping control signal whose physical layer time domain characteristics are completely disguised as environmental noise is generated.

[0149] As another embodiment, according to step 506, the initial trapping signal is subjected to intensity mode adaptation processing through the power modulation mode to generate the trapping control signal, including:

[0150] Step 601: Analyze the intensity change period and fluctuation range recorded in the power modulation mode.

[0151] In this step, the intensity change period refers to the complete time length from the initial value to the peak value and then back down in terms of environmental noise intensity; the fluctuation range refers to the effective range between the minimum reference value and the maximum peak value of the noise intensity within this period.

[0152] In this embodiment, the power modulation mode data stream configured in step 504 is invoked, and the periodic parameters are separated using a time-domain feature extraction engine: the position of continuous peaks / troughs is locked by peak detection, and the interval between adjacent peaks is calculated to determine the change period; the peak intensity sequence is extracted synchronously to calculate the average value as a reference peak value, and the upper and lower boundaries of the fluctuation range are determined by combining the trough intensity; finally, the discretized period value and amplitude range value are output as the reference parameters for dynamic power adjustment.

[0153] Step 602: Divide the intensity change period into multiple continuous adjustment windows, each corresponding to a specific amplitude adjustment ratio coefficient.

[0154] In this step, the continuous adjustment window refers to the time-series operation interval (such as the rise period / peak maintenance period / attenuation period) that divides a single noise fluctuation period according to the signal strength change pattern. Its duration is determined by the characteristics of the environmental noise waveform. The amplitude adjustment ratio coefficient refers to the dynamic scaling factor of the carrier power relative to the base value within each window (such as the rise window coefficient >1 indicating power enhancement), which is used to accurately fit the noise envelope shape.

[0155] In this embodiment, the periodic characteristics of noise intensity analyzed in step 601 are first extracted, and the waveform inflection point is located by envelope analysis: four key positions are identified: the starting point, the rising inflection point (slope change), the peak inflection point (maximum value), and the decay inflection point (fall start); based on the inflection point, three continuous windows (rising window / maintenance window / decay window) are divided, and the proportional coefficient change rule is configured according to the waveform slope of each time period. The rising window adopts a linearly increasing coefficient, the maintenance window adopts a fixed coefficient, and the decay window adopts a linearly decreasing coefficient; finally, a coefficient mapping table with timestamp is output for real-time calling by the CNC power amplifier.

[0156] Step 603: Determine the basic intensity adjustment threshold range based on the fluctuation range.

[0157] In this step, the basic strength adjustment threshold range refers to the physical boundary constraint of the dynamic change of carrier power. Its lower limit is the minimum intensity reference value of environmental noise, and its upper limit is the peak intensity of environmental noise. This range is generated by calculating the mapping relationship between the basic reference power and the scaling factor, and is used to prevent abnormal signal characteristics caused by amplitude exceeding the limit during signal modulation.

[0158] In this embodiment, the fluctuation amplitude range parameters (lower limit L / upper limit H) parsed in step 601 are called to calculate the basic reference power P=(L+H) / 2 as the modulation reference point; a mapping function between the proportional coefficient K and the physical power is established: when K=1, the corresponding power is P, and the range of K values ​​is determined by formula conversion as [L / P, H / P]; this mathematical constraint is converted into the dynamic limiting rule of the power controller: the power value K·P is calculated in real time, and when the result is less than L, L is forcibly output, and when it is greater than H, H is forcibly output; finally, a threshold range object containing the basic power value, the proportional coefficient boundary and the forced truncation rule is generated and written to the signal generator configuration register.

[0159] Step 604: Read the instantaneous intensity waveform envelope structure of the initial trapping signal.

[0160] In this step, the instantaneous intensity waveform envelope structure refers to the amplitude change profile curve formed in the time domain after the initial trap signal is output through the radio frequency link. This curve is shaped by the inherent characteristics of the signal transmission system and the environmental coupling effect, and its morphological characteristics reflect the intensity fluctuation law of the signal in the real physical transmission process.

[0161] In this embodiment, a small portion of the initial trap signal is shunted from the RF output link via a directional coupler and fed into a high-speed analog-to-digital converter for time-domain sampling. An envelope detector circuit is used to extract the amplitude component of the sampled signal to generate the original voltage-time sequence. A digital filter bank is invoked to filter out the high-frequency components of the carrier wave, retaining the low-frequency envelope waveform that matches the power modulation period. Finally, a time-domain discretized envelope point sequence is output, where each sampling point corresponds to the normalized intensity value of the signal at a specific moment, forming a reference waveform structure for subsequent adjustment processing.

[0162] Step 605: Perform waveform compression processing on the instantaneous intensity waveform envelope structure according to the amplitude adjustment ratio to form envelope adjustment parameters, and limit the envelope adjustment parameters within the range of the basic intensity adjustment threshold to generate a standard envelope structure.

[0163] In this step, the envelope adjustment parameter refers to the set of signal strength scaling factors required at each time point; the standard envelope structure refers to the time-domain amplitude sequence that is generated after dynamic adjustment and threshold constraints and accurately fits the target waveform within the physical strength boundary.

[0164] In this embodiment, the original discrete envelope sequence is first imported into the processing engine; then, the amplitude adjustment scaling factor mapping table is called to perform temporal synchronous scaling on each sampling point of the original envelope. The amplitude value is linearly amplified by an increasing factor in the rising window interval, scaled proportionally by a fixed factor in the maintenance window, and reduced by a decreasing factor in the attenuation window. After generating the initial adjustment parameter sequence, the intensity boundary is checked according to the threshold range rule: when the scaled amplitude value is lower than the lower limit, it is forcibly increased to the lower limit value; when it is higher than the upper limit, it is suppressed to the upper limit value. Finally, a standard envelope structure is output where the intensity values ​​of the discrete points are all within the effective physical boundary and the shape matches the environmental noise.

[0165] Step 606: Load the standard envelope structure onto the carrying frequency band of the initial trapping signal to form a time-varying trajectory. Based on the mapping relationship between the time-varying trajectory and the intensity change period, reconstruct the signal intensity sequence of the initial trapping signal to output the trapping control signal.

[0166] In this embodiment, the standard envelope structure generated in step 605 is first input into the radio frequency control unit; the carrier frequency band of the initial trap signal is locked by the digital frequency synthesizer; a time-varying trajectory mapping mechanism is established: the timestamp and intensity value of each standard envelope point are bound to the radio frequency carrier; a clock synchronization signal is generated based on the intensity change period, triggering the signal generator to cyclically reset the output power value at each time node; the output signal strength is monitored in real time by the power amplifier closed-loop control circuit to ensure that it strictly follows the fluctuation of the standard envelope point sequence; finally, a trap control signal with continuously changing power value and perfectly fitting the characteristics of environmental noise is generated.

[0167] As another embodiment, according to step 105, by adaptively adjusting the protocol field parameters and transmission power parameters of the trapping control signal, the UAV maintains its communication connection with the detection base station device and continuously transmits control command data, including:

[0168] Step 701: Monitor the communication maintenance characteristics in the response signal returned by the UAV, and identify the response interval characteristics and data integrity characteristics included in the communication maintenance characteristics.

[0169] In this step, the communication maintenance feature refers to the status feedback signal actively sent by the UAV to maintain the communication connection; the response interval feature refers to the time difference between two consecutive status feedback signals; and the data integrity feature refers to the set of verification identifiers in the response signal that mark the integrity of data transmission.

[0170] In this embodiment, the UAV response signal is first captured, and the time difference between adjacent signals is calculated by extracting the timestamp field through the protocol parsing engine to generate response interval features. Simultaneously, the check flag bit at the end of the data frame is scanned to detect the number of consecutive check failure flags and generate data integrity features. Finally, the two types of features are encapsulated into a communication state evaluation vector.

[0171] Step 702: When the response interval feature exceeds the preset maintenance interval, increase the number of handshake command transmissions in the protocol field parameters; when there are continuous packet loss markers in the data integrity feature, increase the carrier strength value in the transmit power parameter by gradient magnitude.

[0172] In this step, the preset maintenance interval refers to the maximum allowable response interval to ensure stable communication; the gradient amplitude increase refers to the adjustment rule of gradually increasing the signal strength according to a fixed ratio (such as increasing the base value by 5% each time).

[0173] In this embodiment, the response interval feature of step 701 is first compared with the preset maintenance interval: if the current interval is greater than the threshold, the handshake instruction sending frequency in the protocol field parameter is increased; the data integrity feature of synchronization detection is: if there are N consecutive verification failures (such as 3 times), the carrier strength value in the transmit power parameter is increased according to the gradient magnitude.

[0174] Step 703: Calculate the deviation between the current response interval feature and the preset maintenance interval, and simultaneously correct the transmission frequency of the handshake command to obtain the adjusted transmission power parameters.

[0175] In this step, the deviation refers to the absolute time difference between the actual response interval of the UAV and the preset maintenance interval.

[0176] In this embodiment, the absolute time difference between the response interval feature value and the preset maintenance interval is first calculated; based on the preset deviation frequency mapping relationship, the handshake command frequency correction value is generated; the initial frequency adjustment result of step 702 is superimposed to output the final frequency parameter; the carrier strength value after gradient boosting in step 702 is synchronously inherited and encapsulated into a complete transmit power parameter set containing protocol layer frequency parameters and physical layer strength parameters.

[0177] Step 704: According to the preset periodic detection data integrity feature packet loss marker distribution position, the increase of the carrier strength value is updated in reverse.

[0178] In this step, the packet loss marker distribution position refers to the index pattern of the verification failure identifier in the data frame sequence (such as appearing consecutively in odd-order frames); reverse update refers to the optimization process of deriving the carrier strength adjustment strategy in reverse based on the packet loss distribution pattern; and boost magnitude refers to the amount of change in carrier strength each time it is adjusted (such as the basic boost step value).

[0179] In this embodiment, the packet loss marker sequence in the data integrity features is first scanned at fixed time periods; the concentrated packet loss interval is located by binary sequence analysis; the environmental interference mode is inferred from the distribution pattern; the amplitude adjustment attenuation coefficient is calculated based on the interference mode matching degree; and finally, the updated gradient boost amplitude value is output and written to the transmit power parameter register.

[0180] Step 705: Cross-validate the adjusted protocol field parameters and the adjusted transmit power parameters. When the preset communication maintenance conditions are met, output the target adjustment parameters.

[0181] In this step, cross-validation refers to the synchronous verification of the compatibility between protocol layer parameters (handshake command frequency) and physical layer parameters (carrier strength); communication maintenance conditions refer to the constraint rules that the two parameters must satisfy.

[0182] In this embodiment, a two-parameter joint verification matrix is ​​first established: it checks whether the protocol field parameters exceed the channel capacity threshold; it verifies whether the transmit power parameters exceed the environmental noise masking limit; when both parameters meet the preset threshold and the mutual exclusivity is met, they are encapsulated as a {frequency, intensity} tuple and the target adjustment parameters are output; if the verification fails, the process returns to step 702 to readjust.

[0183] Step 706: The target adjustment parameters are used to control the continuous transmission of the trapping control signal so that the UAV maintains a communication connection with the detection base station device and continuously transmits control command data.

[0184] In this embodiment, the target adjustment parameters are first loaded into the signal generator control unit: the protocol field parameters are written into the protocol scheduler; the transmit power parameters are input into the RF power amplifier circuit; the closed-loop power monitoring circuit is started to calibrate the signal strength in real time; and the target UAV is continuously transmitted according to the parameter configuration to maintain the communication connection and command feedback of the target UAV.

[0185] Figure 2 This application provides a schematic diagram of the structure of a drone control command trapping system based on base station detection technology, as shown below. Figure 2 As shown, the system includes:

[0186] The acquisition module 21 is used to acquire signal parameters and environmental electromagnetic noise characteristics of real base stations using a detection base station device deployed in a predetermined geographical area.

[0187] Transmission module 22 is used to generate dynamic base station simulation signals based on the collected signal parameters and environmental electromagnetic noise characteristics, and transmit dynamic base station simulation signals through the detection base station device so that the UAV entering the communication coverage area responds to the dynamic base station simulation signals and actively initiates detection signals;

[0188] The parsing module 23 is used to parse the command encoding features in the detection signal when the detection base station device receives the detection signal sent by the UAV;

[0189] Reconstruction module 24 is used to reconstruct a decoy control signal with protocol deception based on the instruction encoding features obtained from parsing, wherein the decoy control signal is synchronously transmitted by incorporating the electromagnetic noise features of the current environment;

[0190] The adjustment module 25 is used to adaptively adjust the protocol field parameters and transmission power parameters of the trapping control signal so that the UAV maintains a communication connection with the detection base station device and continuously transmits control command data.

[0191] Figure 2 The aforementioned drone control command trapping system based on detection base station technology can execute... Figure 1 The implementation principle and technical effects of the drone control command trapping method based on base station detection technology described in the illustrated embodiment will not be repeated here. The specific methods by which each module and unit of the drone control command trapping system based on base station detection technology in the above embodiments have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0192] In one possible design, Figure 2 The drone control command trapping system based on base station detection technology shown in the embodiment can be implemented as a computing device, such as... Figure 3As shown, the computing device may include a storage component 31 and a processing component 32;

[0193] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are invoked and executed by the processing component 32.

[0194] The processing component 32 is used for the above Figure 1 The embodiment describes a method for capturing unmanned aerial vehicles (UAVs) using control commands based on base station detection technology.

[0195] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for trapping unmanned aerial vehicles (UAVs) using control commands based on base station detection technology, applied to a predetermined geographical area, characterized in that: include: The signal parameters and environmental electromagnetic noise characteristics of real base stations are collected by using a detection base station device deployed in a predetermined geographical area to simulate real base station signals. The predetermined geographical area includes no-fly zones for logistics and warehousing, airspace control zones for commercial activities, and perimeter protection zones for data centers. Based on the collected signal parameters and environmental electromagnetic noise characteristics, a dynamic base station simulation signal is generated, and the dynamic base station simulation signal is transmitted by the detection base station device so that the UAV entering the communication coverage area can respond to the dynamic base station simulation signal and actively initiate detection signals. When the detection base station device receives the detection signal sent by the UAV, it analyzes the instruction encoding features in the detection signal; The decoy control signal with protocol deception is reconstructed based on the instruction encoding features obtained from the analysis, wherein the decoy control signal is synchronously transmitted by incorporating the electromagnetic noise features of the current environment; By adaptively adjusting the protocol field parameters and transmission power parameters of the trapping control signal, the UAV maintains a communication connection with the detection base station device and continuously transmits control command data. The reconstructing of the decoy control signal with protocol deception based on the instruction encoding features obtained from parsing includes: Based on the control protocol type identifier in the instruction encoding features, a corresponding protocol control header structure is generated; The operation instruction bit sequence in the instruction encoding feature is copied as the basic template of the trap instruction, and pseudo response content is inserted at the preset parameter position of the basic template of the trap instruction to form a pseudo instruction payload; The protocol control header structure and the pseudo-instruction payload are assembled into a data unit in the target communication protocol format; The coverage frequency band of the transmission carrier is determined based on the frequency band distribution characteristics of the environmental electromagnetic noise; the power modulation mode of the synchronization carrier is configured based on the intensity fluctuation characteristics. The data unit is loaded within the defined coverage frequency band to form an initial trap signal; The initial trapping signal is subjected to intensity mode adaptation processing through the power modulation mode to generate the trapping control signal.

2. The method according to claim 1, characterized in that, Using base station detection devices deployed in a predetermined geographical area to simulate real base station signals, signal parameters and environmental electromagnetic noise characteristics of real base stations are collected, including: The signal acquisition device of the detection base station device performs a full-band wireless signal scan of the predetermined geographical area, and locates the signal transmission source of the real base station based on the scan results; For the located signal transmission source, continuously capture communication signal samples transmitted by real base stations within a set time window, identify base station identification features and spectrum features in the communication signal samples, and generate signal parameters; Simultaneously, based on the scanning results, the electromagnetic radiation of non-base station signal sources in the predetermined geographical area is monitored, and the intensity fluctuation characteristics and frequency band distribution characteristics of the electromagnetic radiation are extracted to generate environmental electromagnetic noise characteristics.

3. The method according to claim 1, characterized in that, Based on the collected signal parameters and environmental electromagnetic noise characteristics, a dynamic base station simulation signal is generated. This signal is then transmitted via a base station detection device, causing drones entering the communication coverage area to respond to the dynamic base station simulation signal and actively initiate detection signals, including: Map the base station identification features contained in the signal parameters to base station identity recognition fields; The carrier parameters and modulation parameters of the dynamic base station analog signal are determined based on the spectral characteristics, and a pre-set handshake protocol unit is embedded in the signal framework formed by the carrier parameters and modulation parameters. The characteristics of environmental electromagnetic noise are converted into background noise waveforms covering the target frequency band; The base station identification field and the handshake protocol unit are integrated into the signal framework, and the background noise waveform is synchronously superimposed to generate a composite analog signal as the dynamic base station analog signal; The detection base station device continuously transmits the dynamic base station simulation signal within the communication coverage area of ​​the predetermined geographical region; When the protocol field parameters of the simulated signal from the dynamic base station are within the authentication range of the target UAV control protocol, the target UAV is triggered to send a detection signal to the detection base station device.

4. The method according to claim 1, characterized in that, When the detection base station device receives a detection signal from the UAV, it analyzes the command encoding features in the detection signal, including: The detection signal is demodulated at the physical layer to separate the data signaling unit in the communication protocol format; the protocol control field and data payload field in the data signaling unit are identified, and the core data segment containing the control identifier is extracted from the data payload field; Based on the pre-established UAV control protocol structure mapping table, locate the storage location of specific parameters in the core data segment; Read the bit sequence structure at the storage location of the specific parameter and confirm that it conforms to the bit distribution characteristics and check characteristics of the instruction encoding; The data segment content that satisfies the bit distribution characteristics and check characteristics is determined as the instruction encoding characteristics.

5. The method according to claim 1, characterized in that, The initial trapping signal is subjected to intensity mode adaptation processing through the power modulation mode to generate the trapping control signal, including: Analyze the intensity change period and fluctuation range recorded in the power modulation mode; The intensity change period is divided into multiple continuous adjustment windows, and each continuous adjustment window corresponds to a specific amplitude adjustment ratio coefficient. The basic intensity adjustment threshold range is determined based on the fluctuation range. Read the instantaneous intensity waveform envelope structure of the initial trapping signal; The instantaneous intensity waveform envelope structure is subjected to waveform compression processing according to the amplitude adjustment ratio coefficient to form envelope adjustment parameters, and the envelope adjustment parameters are limited to the range of the basic intensity adjustment threshold to generate a standard envelope structure; The standard envelope structure is loaded onto the carrying frequency band of the initial trap signal to form a time-varying trajectory. Based on the mapping relationship between the time-varying trajectory and the intensity change period, the signal intensity sequence of the initial trap signal is reconstructed to output the trap control signal.

6. The method according to claim 1, characterized in that, By adaptively adjusting the protocol field parameters and transmission power parameters of the trapping control signal, the UAV maintains its communication connection with the detection base station device and continuously transmits control command data, including: Monitor the communication maintenance characteristics in the response signals returned by the UAV, and identify the response interval characteristics and data integrity characteristics included in the communication maintenance characteristics; When the response interval feature exceeds the preset maintenance interval, the number of transmission frequencies of the handshake command in the protocol field parameter is increased; when there is a continuous packet loss mark in the data integrity feature, the carrier strength value in the transmit power parameter is increased by gradient magnitude. Calculate the deviation between the current response interval characteristic and the preset maintenance interval, synchronously correct the transmission frequency of the handshake command, and obtain the adjusted transmission power parameters; The carrier strength value is updated in reverse order based on the packet loss marker distribution location of the pre-set periodic detection data integrity characteristics; Cross-validate the adjusted protocol field parameters and the adjusted transmit power parameters, and output the target adjustment parameters when the preset communication maintenance conditions are met; The target adjustment parameters are used to control the continuous transmission of the trapping control signal so that the UAV maintains a communication connection with the detection base station device and continuously transmits control command data.

7. A drone control command trapping system based on base station detection technology, applied to any one of the drone control command trapping methods based on base station detection technology described in claims 1-6, characterized in that, include: The acquisition module is used to acquire signal parameters and environmental electromagnetic noise characteristics of real base stations using a base station detection device deployed in a predetermined geographical area to simulate real base station signals. The transmitting module is used to generate a dynamic base station simulation signal based on the collected signal parameters and environmental electromagnetic noise characteristics, and to transmit the dynamic base station simulation signal through the detection base station device, so that the UAV entering the communication coverage area can respond to the dynamic base station simulation signal and actively initiate the detection signal. The parsing module is used to parse the instruction encoding features in the detection signal when the detection base station device receives the detection signal emitted by the UAV; The reconstruction module is used to reconstruct a decoy control signal with protocol deception based on the instruction encoding features obtained from parsing, wherein the decoy control signal is synchronously transmitted by incorporating the electromagnetic noise features of the current environment; The adjustment module is used to adaptively adjust the protocol field parameters and transmission power parameters of the trapping control signal so that the UAV maintains a communication connection with the detection base station device and continuously transmits control command data.

8. A computing device, characterized in that, It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement the UAV control command trapping method based on the detection base station technology as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that, The device contains a computer program, which, when executed by a computer, implements a method for trapping unmanned aerial vehicles (UAVs) based on base station detection technology as described in any one of claims 1 to 6.

Images