A method and device for detecting an attack on a UAV, an electronic device, and a storage medium

Abstract

The application relates to the technical field of aircraft safety, in particular to a UAV attack detection method and device, an electronic device and a storage medium, which comprise the following steps: preprocessing network flow data and sensor data of a UAV, extracting key network flow features and key sensor features in the pretreated network flow data and the pretreated sensor data based on key feature types; processing the key network flow features and the key sensor features based on a first network layer and a second network layer of an attack detection model, and outputting an attack detection result; processing the attack detection result based on a comprehensive response mechanism, and determining a defense strategy corresponding to the attack detection result. The optimized key feature types are used for feature screening, the identification precision of important features and the accuracy of the model are improved, the layered network of the model is used for comprehensive detection of double attacks, and the detection precision of the UAV in a complex attack scene is improved.

Description

Technical Field

[0001] This application relates to the field of aircraft security technology, and in particular to a method, apparatus, electronic device and storage medium for detecting unmanned aerial vehicle (UAV) attacks. Background Technology

[0002] With the widespread application of drones in civilian, logistics, and surveying fields, their security issues in communication, navigation, and sensing are receiving increasing attention. In actual operation, drones may be subjected to dual attacks from network communication and sensor systems. For example, attackers may inject forged data packets into communication links to cause network congestion (such as DDoS attacks), while simultaneously tampering with GPS, barometer, and other sensor data to mislead the flight control system. Such dual attacks are characterized by high concealment, high coordination, and high harm, posing a serious threat to drone flight safety. Currently, some research has proposed drone intrusion detection schemes based on machine learning; however, existing technologies still have the following shortcomings: most existing schemes only model and identify single types of attacks (such as network attacks or sensor attacks). When facing complex scenarios involving coordinated network and sensor attacks, the detection accuracy drops significantly, resulting in false negatives and false negatives. Therefore, improving the accuracy of drone attack detection has become a significant technical problem. Summary of the Invention

[0003] In view of this, the purpose of this application is to provide a method, device, electronic device and storage medium for detecting drone attacks, which uses optimized key feature types for feature screening, improves the recognition accuracy of important features and the accuracy of the model, and uses the hierarchical network of the model to perform comprehensive detection of dual attacks, thereby improving the detection accuracy of drones in complex attack scenarios.

[0004] This application provides a method for detecting drone attacks, the method comprising:

[0005] The network traffic data and sensor data of the UAV are preprocessed, and key network traffic features and key sensor features are extracted from the preprocessed network traffic data and preprocessed sensor data based on key feature types; wherein, the key feature types are determined in advance through the chi-square test algorithm and the heuristic search algorithm.

[0006] The attack detection model is based on a first network layer and a second network layer to process the key network traffic features and the key sensor features, and outputs the attack detection results of the UAV; wherein, the attack detection model is obtained by training a gradient boosting decision tree model;

[0007] The attack detection results are processed based on a comprehensive response mechanism to determine the corresponding defense strategy.

[0008] In one possible implementation, the key feature type is determined through the following steps:

[0009] Based on the chi-square test algorithm, a preliminary screening process is performed on multiple sample network traffic features and multiple sample sensor features to determine multiple first sample network traffic features and multiple first sample sensor features.

[0010] Based on the heuristic search algorithm, a second screening process is performed on each of the first sample network traffic features and each of the first sample sensor features to determine multiple key network traffic features and multiple key sample sensor features.

[0011] Based on the feature types corresponding to the network traffic characteristics of multiple key samples and the sensor characteristics of multiple key samples, the key feature types are determined.

[0012] In one possible implementation, regarding the sample network traffic characteristics, the preliminary screening process based on the chi-square test algorithm for multiple sample network traffic characteristics and multiple sample sensor characteristics to determine multiple first sample network traffic characteristics and multiple first sample sensor characteristics includes:

[0013] Each of the sample network traffic features is discretized to determine multiple sample network traffic features under each discretization interval;

[0014] Contingency tables of network traffic characteristics for each sample are constructed based on each discretized interval and attack type label;

[0015] Based on the contingency table, the chi-square statistic of each sample network traffic feature is calculated, and the network traffic feature whose chi-square statistic is greater than the critical value of the contingency table is taken as the first sample network traffic feature.

[0016] In one possible implementation, the second screening process based on the heuristic search algorithm for each first sample network traffic feature and each first sample sensor feature determines multiple key network traffic features and multiple key sample sensor features, including:

[0017] Based on the heuristic search algorithm, each first sample network traffic feature and each first sample sensor feature are processed to determine the minimum conditional entropy of each first sample network traffic feature and the minimum conditional entropy of each first sample sensor feature.

[0018] Based on the minimum conditional entropy and the corresponding overall entropy of the network traffic characteristics of the first sample, the information gain value of the network traffic characteristics of the first sample is determined.

[0019] Based on the minimum conditional entropy of the first sample sensor features and the corresponding overall entropy, the information gain value of the first sample sensor features is determined.

[0020] The key network traffic features and key sample sensor features are determined based on the first sample network traffic features and the first sample sensor features corresponding to information gain values ​​greater than a preset threshold.

[0021] In one possible implementation, for each of the first sample network traffic features and each of the first sample sensor features, based on the heuristic search algorithm, the minimum conditional entropy of each of the first sample network traffic features and the minimum conditional entropy of each of the first sample sensor features are determined, including:

[0022] Determine the conditional entropy of each of the first sample network traffic features in the initial state;

[0023] A segmentation point corresponding to a discretized interval is randomly determined, and neighboring segmentation points are constructed based on the segmentation point and the increment value;

[0024] The conditional entropy of the neighboring segment points is determined. The minimum conditional entropy is selected from the conditional entropy of the neighboring segment points and the conditional entropy of the initial state. The segment point corresponding to the minimum conditional entropy is used as the initial state of the next loop. The loop stops when the conditional entropy of all neighboring segment points is greater than the conditional entropy under the current condition. The conditional entropy under the current condition is used as the minimum conditional entropy of the network traffic feature of the first sample.

[0025] In one possible implementation, the first and second network layers based on the attack detection model process the key network traffic features and the key sensor features to output the attack detection results of the UAV, including:

[0026] Based on the key network traffic characteristics analyzed by the first network layer, network attack detection processing is performed, and the attack detection results are output.

[0027] Based on the second network layer, sensor attack detection processing is performed on the key sensor features, and the attack detection results of sensor attacks are output.

[0028] Based on the attack detection results of the network attack and the attack detection results of the sensor attack, it is determined whether it is a dual attack.

[0029] In one possible implementation, the step of processing the attack detection result based on a comprehensive response mechanism to determine the defense strategy corresponding to the attack detection result includes:

[0030] Based on a preset rule tree structure, the attack detection results of a single attack type and the attack detection results of a dual attack type are mapped to determine the corresponding attack level; wherein, the attack level of the attack detection results of the dual attack type is the sum of the single attack levels.

[0031] The defense strategy corresponding to the attack detection result is determined based on the attack level.

[0032] This application embodiment also provides a drone attack detection device, the drone attack detection device comprising:

[0033] The key feature extraction module is used to preprocess the network traffic data and sensor data of the UAV, and extract key network traffic features and key sensor features from the preprocessed network traffic data and sensor data based on key feature types; wherein, the key feature types are determined in advance through the chi-square test algorithm and the heuristic search algorithm.

[0034] The determination module is used to process the key network traffic features and key sensor features based on the first and second network layers of the attack detection model, and output the attack detection results of the UAV; wherein, the attack detection model is obtained by training a gradient boosting decision tree model;

[0035] The response module is used to process the attack detection results based on the comprehensive response mechanism and determine the defense strategy corresponding to the attack detection results.

[0036] This application also provides an electronic device, including: a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. When the machine-readable instructions are executed by the processor, the steps of the drone attack detection method described above are performed.

[0037] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of the drone attack detection method described above.

[0038] This application provides a method, apparatus, electronic device, and storage medium for detecting drone attacks. The drone attack detection method includes: preprocessing network traffic data and sensor data of the drone; extracting key network traffic features and key sensor features from the preprocessed network traffic data and preprocessed sensor data based on key feature types; wherein the key feature types are pre-determined using a chi-square test algorithm and a heuristic search algorithm; processing the key network traffic features and key sensor features based on a first network layer and a second network layer of an attack detection model, and outputting the attack detection result of the drone; wherein the attack detection model is obtained by training a gradient boosting decision tree model; and processing the attack detection result based on a comprehensive response mechanism to determine the defense strategy corresponding to the attack detection result. Using optimized key feature types for feature filtering improves the recognition accuracy of important features and the accuracy of the model. Utilizing the hierarchical network of the model for comprehensive detection of dual attacks improves the detection accuracy of drones in complex attack scenarios.

[0039] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0040] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A flowchart illustrating a drone attack detection method provided in this application embodiment;

[0042] Figure 2 This is one of the structural schematic diagrams of a drone attack detection device provided in the embodiments of this application;

[0043] Figure 3 This is a second schematic diagram of the structure of a drone attack detection device provided in an embodiment of this application;

[0044] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. Based on the embodiments of this application, every other embodiment obtained by those skilled in the art without inventive effort falls within the scope of protection of this application.

[0046] First, the applicable scenarios for this application will be introduced. This application can be applied to the field of aircraft safety technology.

[0047] Research has revealed that with the widespread application of drones in civilian, logistics, and surveying fields, their security in communication, navigation, and sensing is receiving increasing attention. In actual operation, drones may be vulnerable to dual attacks from network communication and sensor systems. For example, attackers can inject forged data packets into communication links to cause network congestion (such as DDoS attacks), while simultaneously tampering with GPS, barometer, and other sensor data to mislead the flight control system. Such dual attacks are characterized by high concealment, high coordination, and high destructiveness, posing a serious threat to drone flight safety. Currently, some research has proposed drone intrusion detection schemes based on machine learning; however, existing technologies still have the following shortcomings: most existing schemes only model and identify single types of attacks (such as network attacks or sensor attacks). When facing complex scenarios involving coordinated network and sensor attacks, detection accuracy drops significantly, resulting in false negatives and false negatives. Therefore, improving the accuracy of drone attack detection has become a significant technical challenge.

[0048] Based on this, embodiments of this application provide a method, apparatus, electronic device, and storage medium for detecting drone attacks. Optimized key feature types are used for feature filtering, improving the recognition accuracy of important features and the accuracy of the model. The hierarchical network of the model is used to perform comprehensive detection of dual attacks, improving the detection accuracy of drones in complex attack scenarios.

[0049] Please see Figure 1 , Figure 1 This is a flowchart illustrating a drone attack detection method provided in an embodiment of this application. Figure 1 As shown in the figure, the drone attack detection method provided in this application includes:

[0050] S101: Preprocess the network traffic data and sensor data of the UAV, and extract key network traffic features and key sensor features from the preprocessed network traffic data and sensor data based on key feature types.

[0051] In this step, the network traffic data and sensor data of the UAV are preprocessed, and key network traffic features and key sensor features are extracted from the preprocessed network traffic data and preprocessed sensor data according to the key feature type.

[0052] Here, the preprocessing of network traffic data and sensor data of UAVs includes filling missing values ​​with interpolation or specific default values, deleting infinite values ​​and irrelevant fields (such as timestamps and sensor names), performing one-hot encoding on non-numerical data to ensure model compatibility, and scaling the data to the [0,1] interval for feature normalization to unify the units.

[0053] The key feature types are pre-determined using a chi-square test algorithm and a heuristic search algorithm.

[0054] In one possible implementation, the key feature type is determined through the following steps:

[0055] A: Based on the chi-square test algorithm, multiple sample network traffic features and multiple sample sensor features are initially screened to determine multiple first sample network traffic features and multiple first sample sensor features.

[0056] Here, the chi-square test algorithm is used to perform preliminary screening of multiple sample network traffic features and multiple sample sensor features to determine multiple first sample network traffic features and multiple first sample sensor features.

[0057] The chi-square test algorithm is used to evaluate the independence of features from target classification, retaining features with p < 0.05, where p represents the probability of observed data or more extreme data occurring when the null hypothesis is true, and p < 0.05 means that there is sufficient evidence to reject the null hypothesis, that is, to prove that features and target classification are not independent.

[0058] In one possible implementation, regarding the sample network traffic characteristics, the preliminary screening process based on the chi-square test algorithm for multiple sample network traffic characteristics and multiple sample sensor characteristics to determine multiple first sample network traffic characteristics and multiple first sample sensor characteristics includes:

[0059] a: Perform feature discretization processing on each of the sample network traffic features to determine multiple sample network traffic features under each discretization interval.

[0060] Here, each sample network traffic feature is discretized according to (-∞,0), [0,0.25), [0.25,0.5), [0.5,0.75), [0.75,1], (1,+∞) to determine multiple sample network traffic features under each discretization interval.

[0061] b: Construct a contingency table of network traffic characteristics for each sample based on each discretized interval and attack type label.

[0062] Here, a contingency table is constructed for each feature, with the feature value or discretization range as the row and the attack type label as the column.

[0063] The attack type tags include normal attacks, network attacks, and sensor attacks. Sensor attacks include GPS interference and GPS spoofing, while network attacks include denial-of-service attacks, network interference, and network replay attacks.

[0064] It should be noted that a dual attack consists of multiple attack type tags.

[0065] c: Calculate the chi-square statistic for each sample network traffic feature based on the contingency table, and take the network traffic feature with the chi-square statistic greater than the critical value of the contingency table as the first sample network traffic feature.

[0066] Here, the chi-square statistic of each sample network traffic feature is calculated based on the contingency table, and the network traffic feature with a chi-square statistic greater than the critical value of the contingency table is taken as the first sample network traffic feature.

[0067] The chi-square contribution value of each cell is calculated according to the formula, and then the chi-square statistic of the feature is obtained by summing them.

[0068] It should be noted that the critical value for each contingency table is obtained by calculating the degrees of freedom of each contingency table and combining them with a significance level of 0.05.

[0069] It should be noted that the processing method for sample sensor features is consistent with the processing method for sample network traffic features, and this part will not be elaborated further.

[0070] B: Based on the heuristic search algorithm, a second screening process is performed on each of the first sample network traffic features and each of the first sample sensor features to determine multiple key network traffic features and multiple key sample sensor features.

[0071] Here, a second screening process is performed on each first sample network traffic feature and each first sample sensor feature based on a heuristic search algorithm to identify multiple key network traffic features and multiple key sample sensor features.

[0072] The purpose of using heuristic search algorithms is to select high-contribution features through heuristic information gain search and optimize the classification effect of features.

[0073] In one possible implementation, the second screening process based on the heuristic search algorithm for each first sample network traffic feature and each first sample sensor feature determines multiple key network traffic features and multiple key sample sensor features, including:

[0074] (1): Based on the heuristic search algorithm, each first sample network traffic feature and each first sample sensor feature are processed to determine the minimum conditional entropy of each first sample network traffic feature and the minimum conditional entropy of each first sample sensor feature.

[0075] Here, a heuristic search algorithm is used to process each first sample network traffic feature and each first sample sensor feature to determine the minimum conditional entropy of each first sample network traffic feature and each first sample sensor feature.

[0076] Conditional entropy is used to evaluate the predictive ability of a feature for attack type labels. Specifically: After feature binning: Each feature is discretized into several intervals (bins), such as [0, 0.25), [0.25, 0.5). Contingency table construction: For each combination of feature and attack type label, a contingency table is constructed. Calculation of conditional entropy: Based on this contingency table, the conditional entropy for that feature is calculated, reflecting the uncertainty of the attack type label given the value of that feature. The smaller the conditional entropy, the lower the uncertainty of the attack type label given the feature, meaning the greater the contribution of that feature to the attack type.

[0077] In one possible implementation, for each of the first sample network traffic features and each of the first sample sensor features, based on the heuristic search algorithm, the minimum conditional entropy of each of the first sample network traffic features and the minimum conditional entropy of each of the first sample sensor features are determined, including:

[0078] I: Determine the conditional entropy of each of the first sample network traffic features in the initial state.

[0079] Here, the formula for calculating conditional entropy is:

[0080]

[0081] in, For the first i The first sample sensor features, x for The corresponding normalized values, for The conditional entropy, where Y is the attack type label. P ( x )for Values x The probability, Features Values x The conditional entropy of Y at time Y.

[0082] II: Randomly determine a segmentation point corresponding to a discretized interval, and construct neighboring segmentation points based on the segmentation point and the increment value.

[0083] Here, the contingency table and discretization interval in the chi-square test are set to the initial state, with the three split points having values ​​of 0.25, 0.5, and 0.75, and an increment of 0.05. Entering the loop, a split point is randomly selected, and this split point plus or minus the increment constitutes two neighboring split points.

[0084] III: Determine the conditional entropy of the neighboring segmentation points, select the minimum conditional entropy from the conditional entropy of the neighboring segmentation points and the conditional entropy of the initial state, and take the segmentation point corresponding to the minimum conditional entropy as the initial state of the next cycle, until the conditional entropy of all neighboring segmentation points is greater than the conditional entropy under the current condition, and stop the cycle, and take the conditional entropy under the current condition as the minimum conditional entropy of the network traffic feature of the first sample.

[0085] Here, the conditional entropy of the neighboring split points is determined. The minimum conditional entropy is selected from the conditional entropy of the neighboring split points and the conditional entropy of the initial state. The split point corresponding to the minimum conditional entropy is used as the initial state of the next loop. The loop stops when the conditional entropy of all neighboring split points is greater than the conditional entropy under the current condition. The conditional entropy under the current condition is used as the minimum conditional entropy of the network traffic feature of the first sample.

[0086] It should be noted that the conditional entropy of the initial state and the neighboring binning strategies is compared, and the binning strategy with the smallest conditional entropy is selected as the initial state for the next loop. This loop is repeated until the conditional entropy of all neighboring binning strategies is greater than the conditional entropy of the current state, at which point the search for a binning strategy stops.

[0087] In this specific implementation, in each iteration, a split point (e.g., 0.25, 0.5, 0.75) is randomly selected, forming the binning boundaries for the current feature. Based on the selected split point, an increment (e.g., 0.05) is added or subtracted. For example, if the original split point is 0.5 and the increment is 0.05, the new split points are 0.45 and 0.55 respectively. These two new split points constitute two new binning strategies (i.e., new discretization methods). For each new binning strategy, a contingency table (feature value range × classification label) is reconstructed. Based on this contingency table, the conditional entropy, i.e., the uncertainty of the target class under this binning strategy, is calculated. The conditional entropy of the current binning strategy (initial state) is compared with that of the two new strategies (neighboring strategies). The binning strategy with the smallest conditional entropy is selected as the initial state for the next iteration. If the conditional entropy of one of the two neighboring strategies is smaller than that of the current strategy, the current binning strategy is updated to the optimal strategy. Otherwise, the loop ends when the conditional entropy of all neighboring policies (i.e., the policies after ± increments) of the current policy is greater than that of the current policy, indicating that a local optimum has been reached. At this point, the search stops, and the current binning policy is retained as the final discretization method for this feature.

[0088] (2): Based on the minimum conditional entropy and the corresponding overall entropy of the network traffic features of the first sample, the information gain value of the network traffic features of the first sample is determined. Based on the minimum conditional entropy and the corresponding overall entropy of the sensor features of the first sample, the information gain value of the sensor features of the first sample is determined.

[0089] Here, the information gain value is the difference between the overall entropy of the feature and the minimum conditional entropy of the feature.

[0090] The formula for calculating the overall entropy is:

[0091]

[0092] Here, Y represents the attack type label. H ( Y Let y be the overall entropy, and y be a specific value of the attack type label Y. P ( y ) where Y takes the value y The probability of.

[0093] (4): Based on the information gain value greater than the preset threshold, the key network traffic characteristics and key sample sensor characteristics are determined.

[0094] Here, the first sample network traffic feature corresponding to the information gain value greater than the preset threshold is taken as the key network traffic feature, and the first sample sensor feature corresponding to the information gain value greater than the preset threshold is taken as the key sample sensor feature.

[0095] C: Based on the feature types corresponding to the network traffic features of multiple key samples and the sensor features of multiple key samples, the key feature types are determined.

[0096] Here, the key feature types are determined by identifying the key network traffic characteristics and the feature types corresponding to multiple key sample sensor characteristics.

[0097] S102: The first and second network layers based on the attack detection model process the key network traffic features and the key sensor features, and output the attack detection results of the UAV; wherein, the attack detection model is obtained by training a gradient boosting decision tree model.

[0098] In this step, the first and second network layers of the attack detection model are used to process key network traffic features and key sensor features, and output the attack detection results of the UAV.

[0099] Here, the attack detection results include network attacks, sensor attacks, and dual attacks, where dual attacks include at least two attack methods.

[0100] In one possible implementation, the first and second network layers based on the attack detection model process the key network traffic features and the key sensor features to output the attack detection results of the UAV, including:

[0101] Based on the first network layer, network attack detection processing is performed on the key network traffic characteristics, and the network attack detection result is output; based on the second network layer, sensor attack detection processing is performed on the key sensor characteristics, and the sensor attack detection result is output; based on the network attack detection result and the sensor attack detection result, it is determined whether it is a dual attack.

[0102] Here, the first network layer is used to perform network attack detection processing on key network traffic features and output the network attack detection result; the second network layer is used to perform sensor attack detection processing on key sensor features and output the sensor attack detection result; if both the network attack detection result and the sensor attack detection result exist, it is a double attack.

[0103] The training process for the gradient boosting decision tree model is as follows: Data processing: Stratified sampling balances data from different attack categories; one-hot encoding is performed on non-numerical data; the training and test sets are divided in an 8:2 ratio. Initialization: Initial values ​​for the model's hyperparameters are set. Training preparation: The search space for the model's hyperparameters is set, and the objective function is designed with accuracy, F1 score, and runtime as metrics. Model training: Two XGBoost models are trained separately, and Bayesian optimization is used for iterative training of each model to automatically search for the optimal hyperparameter combination for each model. Results: A model with high accuracy and F1 score and short runtime is obtained. The model learns attack patterns through training data, enabling the detection of new threats. Bayesian optimization automatically adjusts hyperparameters, resulting in a model with high detection accuracy and efficiency.

[0104] S103: Process the attack detection results based on the comprehensive response mechanism to determine the defense strategy corresponding to the attack detection results.

[0105] In this step, the attack detection results are processed using a pre-set comprehensive response mechanism to determine the corresponding defense strategy.

[0106] Here, compared with existing solutions that only detect single-type network attacks or sensor attacks on drones, this application constructs a hierarchical model to comprehensively detect dual attacks, improving the detection accuracy in complex attack scenarios; the optimized feature selection algorithm is applied to feature screening, improving the recognition accuracy of important features and the accuracy of the model.

[0107] In one possible implementation, the step of processing the attack detection result based on a comprehensive response mechanism to determine the defense strategy corresponding to the attack detection result includes:

[0108] Based on a preset rule tree structure, the attack detection results of a single attack type and the attack detection results of a dual attack type are mapped to determine the corresponding attack level; wherein, the attack level of the attack detection results of the dual attack type is the sum of the single attack levels; and the defense strategy corresponding to the attack detection results is determined based on the attack level.

[0109] Here, a preset rule tree structure is used to map the attack detection results of a single attack type and the attack detection results of a dual attack type to determine the corresponding attack level, and the defense strategy corresponding to the attack detection result is determined based on the attack level.

[0110] Single attack: assessed at levels 1-5 based on the likelihood of occurrence and potential impact, according to NIST SP 800-30, ISO / IEC 27005, and RTCA DO-326A standards. Dual attack: based on the sum of the single attack levels, adding 1-2 levels to consider synergistic effects to form the final level. Defense strategies are automatically selected based on the attack level, filtering attack data to maintain system integrity.

[0111] This application achieves: (1) Comprehensive dual-attack detection: A hierarchical model is adopted, combining two specialized XGBoost models to detect both network and sensor attacks simultaneously, significantly improving detection accuracy in complex attack scenarios compared to traditional single-attack detection methods. (2) Optimized feature selection: The chi-square test and heuristic information gain feature selection algorithm (HIS) are integrated to reduce computational complexity while retaining key features, enabling efficient operation of UAVs in resource-constrained environments. (3) Resource-efficient model deployment: Feature selection and model training are completed in an offline environment, and lightweight pre-trained models are deployed on UAVs to ensure that limited airborne computing resources are adapted without sacrificing detection performance. (4) Automated and adaptive response mechanism: Based on the threat level assessment of standards (NIST SP 800-30, ISO / IEC 27005, RTCA DO-326A), the detection results are integrated, the synergistic effect of dual attacks is considered, and automated defense measures are triggered through the flight controller to ensure timely and effective threat mitigation.

[0112] This application provides a method for detecting drone attacks, comprising: preprocessing network traffic data and sensor data of the drone; extracting key network traffic features and key sensor features from the preprocessed network traffic data and preprocessed sensor data based on key feature types; wherein the key feature types are pre-determined using a chi-square test algorithm and a heuristic search algorithm; processing the key network traffic features and key sensor features based on a first network layer and a second network layer of an attack detection model, and outputting the attack detection result of the drone; wherein the attack detection model is obtained by training a gradient boosting decision tree model; and processing the attack detection result based on a comprehensive response mechanism to determine the defense strategy corresponding to the attack detection result. Using optimized key feature types for feature selection improves the recognition accuracy of important features and the accuracy of the model. Utilizing the hierarchical network of the model for comprehensive detection of dual attacks improves the detection accuracy of drones in complex attack scenarios.

[0113] Please see Figure 2 , Figure 3 , Figure 2This is one of the structural schematic diagrams of a drone attack detection device provided in the embodiments of this application; Figure 3 This is a second schematic diagram of the structure of a drone attack detection device provided in an embodiment of this application; as shown Figure 2 As shown, the drone attack detection device 200 includes:

[0114] The key feature extraction module 210 is used to preprocess the network traffic data and sensor data of the UAV, and extract key network traffic features and key sensor features from the preprocessed network traffic data and preprocessed sensor data based on key feature types; wherein, the key feature types are determined in advance through the chi-square test algorithm and the heuristic search algorithm.

[0115] The determination module 220 is used to process the key network traffic features and the key sensor features based on the first network layer and the second network layer of the attack detection model, and output the attack detection results of the UAV; wherein, the attack detection model is obtained by training a gradient boosting decision tree model;

[0116] The response module 230 is used to process the attack detection results based on the comprehensive response mechanism and determine the defense strategy corresponding to the attack detection results.

[0117] Furthermore, such as Figure 3 As shown, the drone attack detection device 200 also includes a type determination module 240, which determines the key feature type through the following steps:

[0118] Based on the chi-square test algorithm, a preliminary screening process is performed on multiple sample network traffic features and multiple sample sensor features to determine multiple first sample network traffic features and multiple first sample sensor features.

[0119] Based on the heuristic search algorithm, a second screening process is performed on each of the first sample network traffic features and each of the first sample sensor features to determine multiple key sample network traffic features and multiple key sample sensor features.

[0120] Based on the feature types corresponding to the network traffic characteristics of multiple key samples and the sensor characteristics of multiple key samples, the key feature types are determined.

[0121] Furthermore, the type determination module 240 is used to perform preliminary screening of multiple sample network traffic features and multiple sample sensor features based on the chi-square test algorithm, thereby determining multiple first sample network traffic features and multiple first sample sensor features:

[0122] Each of the sample network traffic features is discretized to determine multiple sample network traffic features under each discretization interval;

[0123] Contingency tables of network traffic characteristics for each sample are constructed based on each discretized interval and attack type label;

[0124] Based on the contingency table, the chi-square statistic of each sample network traffic feature is calculated, and the network traffic feature whose chi-square statistic is greater than the critical value of the contingency table is taken as the first sample network traffic feature.

[0125] Furthermore, the type determination module 240 performs a second screening process on each first sample network traffic feature and each first sample sensor feature based on the heuristic search algorithm, determining multiple key network traffic features and multiple key sample sensor features for:

[0126] Based on the heuristic search algorithm, each first sample network traffic feature and each first sample sensor feature are processed to determine the minimum conditional entropy of each first sample network traffic feature and the minimum conditional entropy of each first sample sensor feature.

[0127] Based on the minimum conditional entropy and the corresponding overall entropy of the network traffic characteristics of the first sample, the information gain value of the network traffic characteristics of the first sample is determined.

[0128] Based on the minimum conditional entropy of the first sample sensor features and the corresponding overall entropy, the information gain value of the first sample sensor features is determined.

[0129] The key network traffic features and key sample sensor features are determined based on the first sample network traffic features and the first sample sensor features corresponding to information gain values ​​greater than a preset threshold.

[0130] Furthermore, the type determination module 240 is used to process each first sample network traffic feature and each first sample sensor feature based on the heuristic search algorithm, for the first sample network traffic features, to determine the minimum conditional entropy of each first sample network traffic feature and the minimum conditional entropy of each first sample sensor feature:

[0131] Determine the conditional entropy of each of the first sample network traffic features in the initial state;

[0132] A segmentation point corresponding to a discretized interval is randomly determined, and neighboring segmentation points are constructed based on the segmentation point and the increment value;

[0133] The conditional entropy of the neighboring segment points is determined. The minimum conditional entropy is selected from the conditional entropy of the neighboring segment points and the conditional entropy of the initial state. The segment point corresponding to the minimum conditional entropy is used as the initial state of the next loop. The loop stops when the conditional entropy of all neighboring segment points is greater than the conditional entropy under the current condition. The conditional entropy under the current condition is used as the minimum conditional entropy of the network traffic feature of the first sample.

[0134] Furthermore, the determination module 220 is used by the first network layer and the second network layer based on the attack detection model to process the key network traffic features and the key sensor features, and output the attack detection results of the UAV.

[0135] Based on the first network layer, network attack detection processing is performed on the key network traffic characteristics, and the attack detection results of the network attack are output.

[0136] Based on the second network layer, sensor attack detection processing is performed on the key sensor features, and the attack detection results of sensor attacks are output.

[0137] Based on the attack detection results of the network attack and the attack detection results of the sensor attack, it is determined whether it is a dual attack.

[0138] Furthermore, when the response module 230 processes the attack detection result based on the comprehensive response mechanism to determine the defense strategy corresponding to the attack detection result, the response module 230 is specifically used for:

[0139] Based on a preset rule tree structure, the attack detection results of a single attack type and the attack detection results of a dual attack type are mapped to determine the corresponding attack level; wherein, the attack level of the attack detection results of the dual attack type is the sum of the single attack levels.

[0140] The defense strategy corresponding to the attack detection result is determined based on the attack level.

[0141] This application provides a drone attack detection device, comprising: a key feature extraction module, used to preprocess network traffic data and sensor data of the drone, and extract key network traffic features and key sensor features from the preprocessed network traffic data and preprocessed sensor data based on key feature types; wherein the key feature types are pre-determined using a chi-square test algorithm and a heuristic search algorithm; a determination module, used to process the key network traffic features and key sensor features based on the first and second network layers of an attack detection model, and output the attack detection result of the drone; wherein the attack detection model is obtained by training a gradient boosting decision tree model; and a response module, used to process the attack detection result based on a comprehensive response mechanism, and determine the defense strategy corresponding to the attack detection result. By using optimized key feature types for feature filtering, the recognition accuracy of important features and the accuracy of the model are improved. The hierarchical network of the model is used for comprehensive detection of dual attacks, improving the detection accuracy of drones in complex attack scenarios.

[0142] Please see Figure 4 , Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 400 includes a processor 410, a memory 420, and a bus 430.

[0143] The memory 420 stores machine-readable instructions executable by the processor 410. When the electronic device 400 is running, the processor 410 communicates with the memory 420 via the bus 430. When the machine-readable instructions are executed by the processor 410, they can perform the operations described above. Figure 1 The steps of the drone attack detection method in the illustrated method embodiment can be found in the method embodiment for specific implementation methods, which will not be repeated here.

[0144] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, can perform the above-described actions. Figure 1 The steps of the drone attack detection method in the illustrated method embodiment can be found in the method embodiment for specific implementation methods, which will not be repeated here.

[0145] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0146] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the shown or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0147] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0148] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0149] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a processor-executable, non-volatile, computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0150] Finally, it should be noted that the above-described embodiments are merely specific implementations of this application, used to illustrate the technical solutions of this application, and not to limit them. The scope of protection of this application is not limited thereto. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments, or make equivalent substitutions for some of the technical features, within the scope of the technology disclosed in this application. Such modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting drone attacks, characterized in that, The drone attack detection method includes: The network traffic data and sensor data of the UAV are preprocessed, and key network traffic features and key sensor features are extracted from the preprocessed network traffic data and preprocessed sensor data based on key feature types; wherein, the key feature types are determined in advance through the chi-square test algorithm and the heuristic search algorithm. The attack detection model is based on a first network layer and a second network layer to process the key network traffic features and the key sensor features, and outputs the attack detection results of the UAV; wherein, the attack detection model is obtained by training a gradient boosting decision tree model; The attack detection results are processed based on a comprehensive response mechanism to determine the corresponding defense strategy. The key feature type is determined through the following steps: Based on the chi-square test algorithm, a preliminary screening process is performed on multiple sample network traffic features and multiple sample sensor features to determine multiple first sample network traffic features and multiple first sample sensor features. Based on the heuristic search algorithm, a second screening process is performed on each of the first sample network traffic features and each of the first sample sensor features to determine multiple key sample network traffic features and multiple key sample sensor features. Based on the feature types corresponding to the network traffic features of multiple key samples and the sensor features of multiple key samples, the key feature types are determined.

2. The drone attack detection method according to claim 1, characterized in that, Regarding the sample network traffic characteristics, the preliminary screening process based on the chi-square test algorithm is performed on multiple sample network traffic characteristics and multiple sample sensor characteristics to determine multiple first sample network traffic characteristics and multiple first sample sensor characteristics, including: Each of the sample network traffic features is discretized to determine multiple sample network traffic features under each discretization interval; Contingency tables of network traffic characteristics for each sample are constructed based on each discretized interval and attack type label; Based on the contingency table, the chi-square statistic of each sample network traffic feature is calculated, and the network traffic feature whose chi-square statistic is greater than the critical value of the contingency table is taken as the first sample network traffic feature.

3. The UAV attack detection method according to claim 2, characterized in that, The second filtering process, based on the heuristic search algorithm, is performed on each of the first sample network traffic features and each of the first sample sensor features to determine multiple key network traffic features and multiple key sample sensor features, including: Based on the heuristic search algorithm, each first sample network traffic feature and each first sample sensor feature are processed to determine the minimum conditional entropy of each first sample network traffic feature and the minimum conditional entropy of each first sample sensor feature. Based on the minimum conditional entropy and the corresponding overall entropy of the network traffic characteristics of the first sample, the information gain value of the network traffic characteristics of the first sample is determined. Based on the minimum conditional entropy of the first sample sensor features and the corresponding overall entropy, the information gain value of the first sample sensor features is determined. Key network traffic features and key sample sensor features are determined based on the first sample network traffic features and the first sample sensor features corresponding to information gain values ​​greater than a preset threshold.

4. The drone attack detection method according to claim 3, characterized in that, For the network traffic features of the first sample, the heuristic search algorithm is used to process each network traffic feature and each sensor feature of the first sample to determine the minimum conditional entropy of each network traffic feature and each sensor feature of the first sample, including: Determine the conditional entropy of each of the first sample network traffic features in the initial state; A segmentation point corresponding to a discretized interval is randomly determined, and neighboring segmentation points are constructed based on the segmentation point and the increment value; The conditional entropy of the neighboring segment points is determined. The minimum conditional entropy is selected from the conditional entropy of the neighboring segment points and the conditional entropy of the initial state. The segment point corresponding to the minimum conditional entropy is used as the initial state of the next loop. The loop stops when the conditional entropy of all neighboring segment points is greater than the conditional entropy under the current condition. The conditional entropy under the current condition is used as the minimum conditional entropy of the network traffic feature of the first sample.

5. The drone attack detection method according to claim 1, characterized in that, The first and second network layers based on the attack detection model process the key network traffic features and the key sensor features to output the attack detection results of the UAV, including: Based on the first network layer, network attack detection processing is performed on the key network traffic characteristics, and the attack detection results of the network attack are output. Based on the second network layer, sensor attack detection processing is performed on the key sensor features, and the attack detection results of the sensor attack are output. Based on the attack detection results of the network attack and the attack detection results of the sensor attack, it is determined whether it is a dual attack.

6. The drone attack detection method according to claim 1, characterized in that, The process of processing the attack detection results based on the comprehensive response mechanism to determine the corresponding defense strategy includes: Based on a preset rule tree structure, the attack detection results of a single attack type and the attack detection results of a dual attack type are mapped to determine the corresponding attack level; wherein, the attack level of the attack detection results of the dual attack type is the sum of the single attack levels. The defense strategy corresponding to the attack detection result is determined based on the attack level.

7. A drone attack detection device, characterized in that, The drone attack detection device includes: The key feature extraction module is used to preprocess the network traffic data and sensor data of the UAV, and extract key network traffic features and key sensor features from the preprocessed network traffic data and sensor data based on key feature types; wherein, the key feature types are determined in advance through the chi-square test algorithm and the heuristic search algorithm. The determination module is used to process the key network traffic features and key sensor features based on the first and second network layers of the attack detection model, and output the attack detection results of the UAV; wherein, the attack detection model is obtained by training a gradient boosting decision tree model; The response module is used to process the attack detection results based on the comprehensive response mechanism and determine the defense strategy corresponding to the attack detection results. The key feature extraction module determines the key feature type through the following steps: Based on the chi-square test algorithm, a preliminary screening process is performed on multiple sample network traffic features and multiple sample sensor features to determine multiple first sample network traffic features and multiple first sample sensor features. Based on the heuristic search algorithm, a second screening process is performed on each of the first sample network traffic features and each of the first sample sensor features to determine multiple key sample network traffic features and multiple key sample sensor features. Based on the feature types corresponding to the network traffic features of multiple key samples and the sensor features of multiple key samples, the key feature types are determined.

8. An electronic device, characterized in that, include: The device includes a processor, a memory, and a bus. The memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory via the bus. The machine-readable instructions are executed by the processor to perform the steps of the drone attack detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the steps of the drone attack detection method as described in any one of claims 1 to 6.

Images