Air-space-ground integrated network anomaly detection method based on sympathetic calculation fusion

Abstract

The invention relates to an air-space-ground integrated network anomaly detection method based on sympathetic calculation fusion, and belongs to the technical field of mobile communication. The method comprises the following steps: establishing a space-air-ground integrated network management framework which comprises a terminal device, an unmanned aerial vehicle and a high-altitude platform and is fused by a sensing algorithm, and carrying out network information perception, model training and resource allocation through a management and control agent; establishing an anomaly detection model based on the distributed generative adversarial network; the method comprises the following steps: deploying an anomaly detection model in all unmanned aerial vehicles, updating model parameters, periodically uploading the model parameters to a high-altitude platform for aggregation, issuing aggregated global parameters to each unmanned aerial vehicle by the high-altitude platform, and repeating a plurality of periods until the global model is converged; and establishing an anomaly detection standard, and judging whether the terminal equipment is in an abnormal working state to realize anomaly detection. According to the invention, while the data and model security is ensured, the network communication and calculation overhead can be reduced, and the anomaly detection accuracy is improved.

Description

Technical Field

[0001] The present invention belongs to the field of mobile communication technology, relates to network anomaly detection, and in particular to an air-space-ground integrated network anomaly detection method based on synaesthesia and computing fusion. Background Art

[0002] Low-cost, wide-coverage, and highly reliable integrated air-ground-space wireless communications are key technologies for effectively supporting the differentiated demands of new network services, such as high bandwidth, mobility, and ubiquitous communications. Fusion communication-perception-computing networks, which rapidly and collaboratively perceive and jointly optimize network service characteristics, communication, and computing resources, are crucial for providing deterministic network services for these differentiated services. However, the dynamic, random, and complex nature of integrated air-ground-space network environments presents a series of difficulties and challenges in modeling network behavior patterns and operational states, as well as in developing anomaly detection methods.

[0003] In an integrated air-space-ground network environment that integrates telepathy and computing, how to extract processable data and usable information from disorganized prior data and environmental information, and conduct knowledge mining and knowledge reasoning, how to ensure the secure transmission and sharing of multi-source network data, and how to establish an efficient anomaly detection model are key scientific issues faced in achieving real-time monitoring of multiple types of terminal devices.

[0004] Generative adversarial networks (GANs) are a commonly used foundational model for anomaly detection. Through adversarial training, the generator and discriminator compete with each other, pushing the probability distribution of generated data closer to the statistical characteristics of real data. Using the real data distribution as a benchmark, they establish anomaly determination criteria and identify abnormal operating conditions of terminal devices. Distributed learning technology, through local model training, avoids data security issues caused by the aggregation of multi-source data and is suitable for integrated air-space-ground network environments.

[0005] However, existing commonly used anomaly detection models are difficult to adapt to the diverse data characteristics and highly complex data structures in the integrated air-ground-space network, and the simulated data probability distribution accuracy is low; in addition, since drones and high-altitude platforms operate in the air and exchange information through wireless communication technology, sensitive information is more easily inferred and obtained. The model aggregation process in the current distributed training lacks security technology to ensure the security of model parameters. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to provide an air-space-ground integrated network anomaly detection method based on telepathy and computing fusion, which can utilize the perception capability of the air-space-ground integrated network with telepathy and computing fusion to collect real-time operation data of terminal devices, and at the same time utilize its distributed computing capability to analyze network behavior patterns and operation status, and establish an anomaly detection model based on a distributed generative adversarial network, while ensuring the security of data and models, reducing network communication and computing overhead and improving the accuracy of anomaly detection.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] A method for detecting anomalies in an air-ground integrated network based on synaesthesia and computing fusion, the method comprising:

[0009] S1. Establish an integrated air-ground-space network management framework that integrates sensory computing with terminal devices, drones, and high-altitude platforms, and use intelligent management and control agents to perform network information perception, model training, and resource allocation.

[0010] S2. Establish an anomaly detection model based on a distributed generative adversarial network. The anomaly detection model consists of a generator and a discriminator. The generator is responsible for sampling and generating false data from a prior distribution, and the discriminator is responsible for distinguishing the real operating data of the terminal device from the false data generated by the generator.

[0011] S3. Deploy the anomaly detection model in all drones. Each drone updates its local anomaly detection model based on the operating data of the associated ground terminal device. The local anomaly detection model parameters are periodically uploaded to the high-altitude platform for aggregation. The high-altitude platform then distributes the aggregated global anomaly detection model parameters to each drone. Repeat multiple cycles until the global anomaly detection model converges.

[0012] S4. Establish anomaly detection standards to determine whether the terminal equipment is in an abnormal working state and implement anomaly detection.

[0013] Furthermore, the network information perception performed by the management and control intelligent body includes collecting historical data, initial data, real-time data and user performance data during network operation through network perception equipment, and the perceived data is used for training the anomaly detection model.

[0014] Furthermore, the training process of the anomaly detection model includes:

[0015] 1) The high-altitude platform initializes the global generator and discriminator parameters and sends them to all drones to initialize the local generator and discriminator parameters of each drone;

[0016] 2) In drone n, determine whether the current cycle is a local training cycle. If so, use local data to update the local generator and discriminator; otherwise, reset the local anomaly detection model;

[0017] 3) In drone n, sample a batch of real data X from the local training dataset n , and sample a batch of random noise from the prior distribution, the noise generates a batch of false data X through the generator n , the discriminator is based on the real data X n and false data Perform K local trainings;

[0018] 4) Update the discriminator parameters through the local discriminator loss function, and update the generator parameters through the local generator loss function;

[0019] 5) After K times of local training, parameterized noise is added to the local anomaly detection model parameter gradient based on differential privacy technology, so that the local model parameters can be securely uploaded to the high-altitude platform;

[0020] 6) In the high-altitude platform, performing global aggregation of the local models with the goal of minimizing the global loss function;

[0021] 7) The control agent allocates the communication-sensing-computing resources required by the high-altitude platform and drones in the data perception and anomaly detection model training process in the next aggregation cycle;

[0022] 8) The high-altitude platform sends the aggregated global model parameters to each drone and repeats steps 2) to 7) until the global anomaly detection model converges.

[0023] Furthermore, in step 4), the local discriminator loss function LD n (w n ,θ n ) is expressed as:

[0024]

[0025] Where w n and θ n are the discriminator and generator parameters of the nth drone respectively; m represents the number of sampled data; D represents the discriminator; and denote the i-th real data and false data in drone n respectively; η is the coefficient of gradient penalty; is the gradient symbol; For data and The weighted sum of

[0026] The local generator loss function LGn (w n ,θ n ) is expressed as:

[0027] Furthermore, in step 5), parameterized noise is added to the local anomaly detection model parameter gradient based on differential privacy technology, as shown in the following formula:

[0028]

[0029] Where, represents the parameter gradient of the discriminator in the local model of drone n, Represents the discriminator loss function in drone n The gradient during the i-th iteration; N(·) represents the standard normal distribution, σ n represents the noise scale; c g represents the upper bound of the Wasserstein distance gradient; I represents the identity matrix.

[0030] Furthermore, in step 6), the global aggregation of the local model parameters is performed with the goal of minimizing the global loss function to obtain the optimal global generator parameters and discriminator parameters:

[0031]

[0032] Where w * and θ * denote the optimal global discriminator parameters and generator parameters respectively, LD(w,θ) and LG(w,θ) denote the global discriminator loss function and the global generator loss function respectively, N denotes the number of drones, w and θ denote the global discriminator parameters and the global generator parameters respectively.

[0033] Furthermore, in step S4, anomaly detection standards are established, and network anomaly detection is performed based on the trained global anomaly detection model, including: real-time sensing of the terminal device's operating data X, inputting it into the global anomaly detection model to obtain the generated error L G and the discrimination error L D ; Define the anomaly score S(X) as the generation error L G and the discrimination error L D Weighted combination of: S(X) = λL G (X)+(1-λ)L D (X), where λ is the weight coefficient; if S(X) is greater than the abnormality judgment threshold, it is considered that the terminal device is operating abnormally and an abnormal active warning is issued.

[0034] The beneficial effects of the present invention are: the present invention provides an air-space-ground-integrated network anomaly detection method based on telepathy and computing fusion. The method establishes an air-space-ground-integrated management framework based on telepathy and computing fusion of terminal devices, drones and high-altitude platforms equipped with communication modules, sensors and intelligent computing capabilities, utilizes their perception capabilities to collect real-time operation data of terminal devices, and at the same time establishes and trains a global anomaly detection model. Through the model, the status of terminal devices in the air-space-ground-integrated network is detected, and anomaly warnings are issued in a timely manner.

[0035] To address the problems of existing anomaly detection models' difficulty adapting to the diverse data characteristics and highly complex data structures in integrated air-space-ground networks, and the low accuracy of simulated data probability distributions, the present invention addresses this issue by establishing an anomaly detection model based on a distributed generative adversarial network. The generative adversarial network, through the interplay between the generator and the discriminator, continuously approximates the probability distribution of generated data to the statistical characteristics of real data. After convergence, the generative adversarial network can capture the distribution characteristics of normal data, effectively identifying abnormal operating states that deviate from this distribution and achieving accurate anomaly detection. Furthermore, the present invention proposes the use of differential privacy technology to add noise to the local model parameter gradients uploaded by drones, improving the security of data transmission, preventing the inference and acquisition of sensitive information, and ensuring data and model security.

[0036] Other advantages, objects, and features of the present invention will be described in part in the following description and, in part, will be apparent to those skilled in the art upon examination of the following description or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below with reference to the accompanying drawings, in which:

[0038] Figure 1 This is a schematic diagram of the integrated network management framework for space-ground-air communication and computing integration;

[0039] Figure 2 Schematic diagram of the training process of the anomaly detection model based on distributed generative adversarial networks. DETAILED DESCRIPTION

[0040] The following describes the embodiments of the present invention by means of specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0041] Among them, the accompanying drawings are only for illustrative purposes and represent only schematic diagrams rather than actual pictures, and should not be understood as limiting the present invention. In order to better illustrate the embodiments of the present invention, some parts of the accompanying drawings may be omitted, enlarged or reduced, and do not represent the dimensions of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions may be omitted in the accompanying drawings.

[0042] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if there are terms such as "upper", "lower", "left", "right", "front", "back", etc. indicating directions or positional relationships, they are based on the directions or positional relationships shown in the drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operate in a specific direction. Therefore, the terms describing the positional relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0043] An embodiment of the present invention provides a method for detecting anomalies in an integrated air-ground-space network based on synaesthesia and computation fusion, the method comprising the following steps:

[0044] S1: Based on terminal devices, drones and high-altitude platforms equipped with communication modules, sensors and intelligent computing capabilities, an integrated air-space-ground network management framework is established to complete the scheduling and supervision of training tasks and resource allocation through the management and control of intelligent agents.

[0045] Among them, the integrated network management framework of space, air and ground with synaesthesia and computing is as follows: Figure 1 As shown in the figure, in this framework, the control agent mainly completes functions such as network information perception, model training and resource allocation.

[0046] Network information perception involves aggregating sensory data from integrated network elements, extracting key sensory parameters, and eliminating irrelevant parameters to achieve global network situational awareness. Network operation generates a large amount of data, including historical data, initial data, and real-time network status and user performance data. Network perception devices (such as RFID tags and sensors) are responsible for sensing this data from terminal devices. High-performance sensors and distributed sensing technologies ensure accurate perception and acquisition of real-time operational data from terminal devices.

[0047] Model training is responsible for tuning model parameters based on sensory data to build high-quality network anomaly detection models. The control agent includes a variety of machine learning methods, including meta-learning, transfer learning, deep learning, and reinforcement learning, to complete data processing and anomaly detection model training tasks. The control agent supports distributed model training, multi-site joint training, and data sharing while protecting privacy, meeting data security requirements.

[0048] The resource allocation process uses deep reinforcement learning methods to intelligently schedule the network's energy efficiency, data rate, communication resources, computing resources, etc. through real-time interaction with sensory network information.

[0049] S2: Establish an anomaly detection model based on a distributed generative adversarial network. The anomaly detection model based on a distributed generative adversarial network consists of two parts: a generator and a discriminator. The generator is responsible for sampling and generating false data from the prior distribution, and the discriminator is responsible for distinguishing the real operating data of the terminal device from the generated false data. During the adversarial training process, the generator and the discriminator compete with each other, causing the probability distribution of the generated data to continuously approach the statistical characteristics of the real data. The converged generative adversarial network can capture the distribution characteristics of normal data, thereby effectively identifying abnormal operating states that deviate from the distribution and realizing anomaly detection.

[0050] S3: Anomaly detection models are deployed in all drones. Each drone updates its local anomaly detection model based on the operating data of its associated ground terminal equipment. The local anomaly detection model parameters are periodically uploaded to the high-altitude platform for aggregation. The high-altitude platform then sends the aggregated model to each drone. After the model converges, the global anomaly detection model is obtained, such as Figure 2 As shown in Figure 1. Differential privacy is used to achieve secure uploading of local model parameters. The process is as follows:

[0051] S31. The high-altitude platform initializes the global generator and discriminator parameters and sends them to all drones to initialize their local generator and discriminator parameters.

[0052] S32. In drone n, determine whether the current training cycle is local. If so, use local data to update the local generator and discriminator; where n∈N, N is the number of drones;

[0053] S33. In drone n, sample a batch of real data X from the local training dataset n , and sample a batch of random noise from the prior distribution, and the noise generates a batch of false data through the generator The discriminator is based on the real data X n and false data Perform K local trainings;

[0054] S34, based on the local discriminator loss function, update the discriminator parameters, the discriminator loss function LD n (w n ,θ n ) is expressed as:

[0055]

[0056] Where w n and θ n are the discriminator and generator parameters in the nth UAV respectively; m represents the number of sampled data; D represents the discriminator; and denote the i-th real data and false data in drone n respectively; η is the coefficient of gradient penalty; is the gradient symbol; For data and The weighted sum of The weight value ε∈U[0,1], U represents uniform distribution.

[0057] S35, based on the local generator loss function, update the generator parameters, the generator loss function LG n (w n ,θ n ) is expressed as:

[0058]

[0059] After S36 and K times of local training, parameterized noise is added to the local anomaly detection model parameter gradient based on differential privacy technology, so that the local model parameters can be securely uploaded to the high-altitude platform, as shown in the following formula:

[0060]

[0061] in, represents the parameter gradient of the discriminator in drone n, Represents the discriminator loss function in drone n The gradient during the i-th iteration; N(·) represents the standard normal distribution, σ n is the noise scale; c g represents the upper bound of the Wasserstein distance gradient; I represents the identity matrix.

[0062] S37. The goal of global aggregation is to minimize the global loss function, where the global loss functions LD(w,θ) and LG(w,θ) of the discriminator and generator are respectively expressed as:

[0063]

[0064] Where |N| represents the number of drones; w and θ are the global discriminator and global generator parameters respectively.

[0065] Then the global loss minimization is expressed as:

[0066]

[0067] Among them, w * and θ * represents the optimal global discriminator parameters and generator parameters.

[0068] S38. The control agent allocates the communication-sensing-computing resources required by the high-altitude platform and the UAV in the data perception and anomaly detection model training process in the next aggregation cycle;

[0069] S39: Send the aggregated global anomaly detection model to each drone, and repeat the above steps S32 to S38 until the global anomaly detection model converges.

[0070] S4. Establish abnormality detection standards to determine whether the terminal equipment is in an abnormal working state, and achieve accurate abnormality detection and active abnormality warning.

[0071] In order to determine whether the operating status of the terminal device is normal or not, its operating data X is perceived in real time, and the anomaly score S(X) is defined as the generated error L G and the discrimination error L D The weighted combination of is as follows:

[0072] S(X)=λL G (X)+(1-λ)L D (X)

[0073] Among them, λ is the weight coefficient; L G (X) represents the generated error; L D (X) represents the discrimination error.

[0074] For the real-time operation data X of the terminal device, the drone calculates its anomaly score S(X) based on the converged global generator and discriminator. If S(X) is greater than the anomaly judgment threshold, the terminal device is considered to be operating abnormally and an active anomaly warning is issued.

[0075] In summary, the present invention provides an air-space-ground-integrated network anomaly detection method based on the fusion of telepathy and computing. It can use the perception capability of the air-space-ground-integrated network with telepathy and computing to collect real-time operation data of terminal devices, establish and train an anomaly detection model based on a distributed generative adversarial network, and monitor the operation status of terminal devices in the network through the anomaly detection model. While ensuring the security of data and models, it can reduce network communication and computing overhead and improve the accuracy of anomaly detection.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not limiting. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solutions, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for detecting anomalies in an integrated space-ground network based on synaesthesia and computation fusion, characterized in that: The method includes: S1. Establish an integrated air-ground-space network management framework that integrates sensory computing with terminal devices, drones, and high-altitude platforms, and use intelligent management and control agents to perform network information perception, model training, and resource allocation. S2. Establish an anomaly detection model based on a distributed generative adversarial network. The anomaly detection model consists of a generator and a discriminator. The generator is responsible for sampling and generating false data from a prior distribution, and the discriminator is responsible for distinguishing the real operating data of the terminal device from the false data generated by the generator. S3. Deploy the anomaly detection model in all drones. Each drone updates its local anomaly detection model based on the operating data of the associated ground terminal device. The local anomaly detection model parameters are periodically uploaded to the high-altitude platform for aggregation. The high-altitude platform then distributes the aggregated global anomaly detection model parameters to each drone. Repeat multiple cycles until the global anomaly detection model converges. S4. Establish anomaly detection standards to determine whether the terminal equipment is in an abnormal working state and implement anomaly detection.

2. The method according to claim 1, characterized in that The network information perception performed by the management and control intelligent body includes collecting historical data, initial data, real-time data and user performance data during network operation through network perception equipment, and the perceived data is used for training the anomaly detection model.

3. The method according to claim 2, characterized in that The training process of the anomaly detection model includes: 1) The high-altitude platform initializes the global generator and discriminator parameters and sends them to all drones to initialize the local generator and discriminator parameters of each drone; 2) In drone n, determine whether the current cycle is a local training cycle. If so, use local data to update the local generator and discriminator; otherwise, reset the local anomaly detection model; 3) In drone n, sample a batch of real data X from the local training dataset n , and sample a batch of random noise from the prior distribution, and the noise generates a batch of false data through the generator The discriminator is based on the real data X n and false data Perform K local trainings; 4) Update the discriminator parameters through the local discriminator loss function, and update the generator parameters through the local generator loss function; 5) After K times of local training, parameterized noise is added to the local anomaly detection model parameter gradient based on differential privacy technology, so that the local model parameters can be securely uploaded to the high-altitude platform; 6) In the high-altitude platform, performing global aggregation of the local models with the goal of minimizing the global loss function; 7) The control agent allocates the communication-sensing-computing resources required by the high-altitude platform and drones in the data perception and anomaly detection model training process in the next aggregation cycle; 8) The high-altitude platform sends the aggregated global model parameters to each drone and repeats steps 2) to 7) until the global anomaly detection model converges.

4. The method according to claim 3, characterized in that The local discriminator loss function LD n (w n ,θ n ) is expressed as: Where w n and θ n are the discriminator and generator parameters of the nth drone respectively; m represents the number of sampled data; D represents the discriminator; and They represent the i-th real data and false data in drone n respectively; η is the coefficient of gradient penalty; is the gradient symbol; For data and The weighted sum of The local generator loss function LG n (w n ,θ n ) is expressed as:

5. The method according to claim 3, wherein: Based on differential privacy technology, parameterized noise is added to the local anomaly detection model parameter gradient, as shown in the following formula: Where, represents the parameter gradient of the discriminator in the local model of drone n, Represents the discriminator loss function in drone n The gradient during the i-th iteration; N(·) represents the standard normal distribution, σ n represents the noise scale; c g represents the upper bound of the Wasserstein distance gradient; I represents the identity matrix.

6. The method according to claim 5, characterized in that The global aggregation of local model parameters is performed with the goal of minimizing the global loss function to obtain the optimal global generator parameters and discriminator parameters: Where w * and θ * denote the optimal global discriminator parameters and generator parameters respectively, LD(w,θ) and LG(w,θ) denote the global discriminator loss function and the global generator loss function respectively, N denotes the number of drones, w and θ denote the global discriminator parameters and the global generator parameters respectively.

7. The method according to claim 6, characterized in that Establish anomaly detection standards and perform network anomaly detection based on the trained global anomaly detection model, including: real-time perception of terminal device operation data X, input into the global anomaly detection model to obtain the generated error L G and the discrimination error L D ; Define the anomaly score S(X) as the generation error L G and the discrimination error L D Weighted combination of: S(X) = λL G (X)+(1-λ)L D (X), where λ is the weight coefficient; if S(X) is greater than the abnormality judgment threshold, it is considered that the terminal device is operating abnormally and an abnormal active warning is issued.

Images