Dynamic identity authentication method for unmanned aerial vehicle group control communication system

Abstract

The invention discloses a dynamic identity authentication method for an unmanned aerial vehicle group control communication system, and relates to the technical field of unmanned aerial vehicle group control and information security, and the method comprises the steps: S1, collecting the flight path and communication mode data of an unmanned aerial vehicle through a sensor, processing multi-dimensional information through a timing sampling method, and integrating a noise filtering mechanism and real-time stream processing, obtaining a real-time behavior feature vector; s2, grouping the data points by adopting a clustering algorithm according to the real-time behavior feature vectors, applying isolation forest separation on the basis of grouping to preliminarily identify potential deviation, and determining current behavior pattern classification; s3, if the current behavior pattern classification is matched with the historical archive record within the preset threshold value, obtaining a matching degree score, and analyzing and calculating a difference vector through a deviation vector to obtain a behavior deviation index; according to the dynamic identity authentication method for the unmanned aerial vehicle group control communication system, the anti-counterfeiting, anti-tampering and intelligent management capabilities of the unmanned aerial vehicle group control communication system are remarkably enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of unmanned aerial vehicle group control and information security technology, and particularly relates to a dynamic identity authentication method for an unmanned aerial vehicle group control communication system. BACKGROUND

[0002] The wide application of unmanned aerial vehicle technology in fields such as logistics, agriculture, and emergency rescue makes identity management a key link to ensure safety and efficiency. The identity of an unmanned aerial vehicle not only involves the unique identification of the device itself, but also includes dynamic characteristics of its running behavior, such as flight trajectory, communication mode, etc. Ensuring the consistency of these identity information in complex environments and long-time operation is crucial to prevent illegal intrusion, tampering or disguise.

[0003] However, current research and practice still have significant deficiencies in continuously monitoring the identity performance of unmanned aerial vehicles, and there is an urgent need for more sophisticated technical means to cope with the identity verification challenges in dynamic scenarios. Existing methods usually rely on static identity identifiers such as device serial numbers or digital certificates, which are effective in fixed scenarios but seem inadequate in dynamic environments. Especially in multi-unmanned aerial vehicle cooperative operation or long-time operation across regions, environmental changes, device aging or external interference may cause behavior characteristics to deviate from expectations, and relying solely on static identifiers makes it difficult to accurately determine the authenticity of the identity. In addition, existing solutions often lack continuity analysis of behavior characteristics, which cannot effectively capture the dynamic changes of unmanned aerial vehicles in different times and scenarios, thus leading to potential identity disguise risks not being discovered in time. The core technical difficulty lies in how to realize real-time comparison of unmanned aerial vehicle behavior characteristics and dynamic matching with historical identity archives. Real-time comparison of behavior characteristics requires high-frequency collection and analysis of unmanned aerial vehicle flight trajectories, communication frequencies, sensor data, etc., but the complexity and multidimensionality of these data pose a huge challenge to real-time processing. Further, the dynamic changes of behavior characteristics are influenced by environmental factors, task types, etc., making the matching process with historical identity archives complex, and it is difficult to accurately determine whether the deviation is caused by legal factors or potential identity tampering. For example, when an unmanned aerial vehicle flies between city high-rise buildings, it may cause abnormal communication mode due to signal interference, which may be misjudged as identity disguise, or vice versa, the real disguise behavior is ignored as environmental interference. SUMMARY

[0004] The purpose of the present application is to provide a dynamic identity authentication method for an unmanned aerial vehicle group control communication system to solve the problems existing in the prior art.

[0005] To achieve the above object, the application provides the following technical scheme: a dynamic identity authentication method for a UAV group control communication system, comprising S1, collecting flight trajectory and communication mode data of the UAV through a sensor, processing multi-dimensional information by using a timing sampling method, simultaneously integrating a noise filtering mechanism and real-time stream processing to obtain a real-time behavior feature vector; S2, grouping data points by using a clustering algorithm according to the real-time behavior feature vector, and applying isolation forest separation on the basis of grouping to preliminarily identify potential deviations, and determining a current behavior mode classification; S3, if the current behavior mode classification matches a historical record within a preset threshold value, obtaining a matching score, and calculating a difference vector by bias vector analysis, and obtaining a behavior deviation index; S4, according to the behavior deviation index, using an anomaly detection algorithm to evaluate the influence of environmental changes in combination with a local anomaly factor and a change quantization index, and simultaneously judging a deviation source type; S5, if the deviation source type is classified as external interference, extracting similar scene data from the historical record, integrating threshold self-adaptive adjustment and abnormal score output, and obtaining an adjusted expected feature range; S6, performing secondary comparison between the adjusted expected feature range and the real-time behavior feature vector, applying information gain splitting and multi-factor branch processing to the comparison result, and determining a final consistency level; S7, according to the final consistency level, using a decision tree algorithm to integrate conditional probability calculation and tree depth limit processing of multi-factor conditions, simultaneously integrating leaf node decision and pruning optimization process, and obtaining an identity verification result; S8, according to the identity verification result, using path tracking to record backtracking of the deviation source type and association of the consistency level, and judging a final verification reliability level.

[0006] Preferably, S1 comprises obtaining flight trajectory and communication mode data from the UAV through a sensor, preliminarily fusing multi-dimensional information by using a timing sampling method to obtain an initial data sequence; integrating a noise filtering mechanism according to the initial data sequence, removing high-frequency interference by applying low-pass filtering to data points to obtain a filtered clean sequence, and determining real-time behavior preliminary features; continuously updating the filtered clean sequence by real-time stream processing, adjusting the sampling interval if the noise level exceeds a preset threshold value, and obtaining a dynamic behavior sequence; for the dynamic behavior sequence, combining path anomaly monitoring and signal strength evaluation, performing data fusion quantization, merging trajectory deviation and signal fluctuation value by weighted average, and judging an abnormal vector component; extracting trajectory optimization calculation elements from the abnormal vector component, correcting path points by linear interpolation, and obtaining a real-time behavior feature vector.

[0007] Preferably, the S2 comprises obtaining a behavior feature vector by real-time data acquisition, grouping the behavior feature vector by a clustering algorithm to obtain a data point grouping; applying isolation forest separation to the data point grouping, wherein the isolation forest separates the data point grouping randomly by constructing a plurality of isolation trees until a single point is isolated, calculates an isolation path length to identify potential bias to obtain a bias isolation result; determining a behavior pattern according to the bias isolation result, and determining an abnormal behavior pattern if the bias exceeds a preset threshold; obtaining pattern classification details from the abnormal behavior pattern to determine a current behavior pattern classification; obtaining a classification result output by the current behavior pattern classification, and forming a behavior pattern classification.

[0008] Preferably, the S3 comprises obtaining a current behavior pattern classification, retrieving a matching item from a historical record, evaluating a matching relationship by a preset threshold comparison, and obtaining a matching score; analyzing a bias vector by the matching score, extracting a vector component from a difference between the current pattern acquisition and the record retrieval, and calculating a difference vector; quantifying a bias index using the difference vector, determining a behavior bias degree by combining the bias index quantification and the matching relationship evaluation, and mapping a vector space for the behavior bias degree; obtaining a bias relationship evaluation by fusing the bias vector analysis result from the vector space mapping; generating a behavior bias index according to the bias relationship evaluation, and integrating details of the current pattern acquisition by the behavior bias index generation.

[0009] Preferably, the S4 comprises obtaining a behavior bias index from environmental changes by a data acquisition process, the data acquisition process comprising a sensor capturing behavior data in real time and calculating a difference between a bias value and a reference value to obtain a local anomaly factor; using an anomaly detection algorithm in combination with a change quantization index according to the local anomaly factor, the anomaly detection algorithm inputting the local anomaly factor and the quantization index and outputting an evaluation score, and determining an environmental impact evaluation by comparing the score with a preset threshold; analyzing a change trend according to the environmental impact evaluation, the change trend analysis comprising tracking a time series of the evaluation score and identifying an upward or downward pattern to determine a bias source type; obtaining the bias source type, fusing an index fusion method and a factor calculation logic, the index fusion method fusing the type and the factor by weighted average, and the factor calculation logic comprising multiplying a weight coefficient to obtain a source classification rule; determining an environmental change impact of the behavior bias index by the source classification rule in combination with a real-time monitoring mechanism, the real-time monitoring mechanism comprising continuously verifying the matching of the rule and new data.

[0010] Preferably, S5 comprises: if the bias source type is classified as external interference, extracting similar scene data from the historical archives, obtaining an initial threshold range by calculating the arithmetic mean of each bias term through the similar scene data; for the initial threshold range, fusing the abnormal score output by using a threshold self-adaptive adjustment method, determining a dynamic threshold boundary by summing the score and the range after applying a preset weight; according to the dynamic threshold boundary, obtaining the current behavior index data, judging whether the data exceeds the boundary, and obtaining a boundary deviation index; through the boundary deviation index, filtering the environmental noise, obtaining an adjusted expected feature range by subtracting a preset noise reference value from the current behavior index data.

[0011] Preferably, S6 comprises: obtaining a real-time behavior feature vector through the adjusted expected feature range, generating a preliminary deviation value by applying a secondary comparison, judging whether the preliminary deviation value exceeds a preset threshold, and obtaining a comparison result set; for the comparison result set, calculating the information gain value of each factor by using an information gain split method, determining a high-gain factor sequence by determining a split point through an entropy reduction calculation formula; according to the high-gain factor sequence, performing multi-factor branch processing, extracting at least one dominant factor from the sequence, constructing a branch tree structure, and obtaining a branch decision path; from the branch decision path, fusing the bias source type and external interference data, obtaining the bias source type from the historical archives extraction, obtaining the external interference data by calculating the similar scene data, calculating a path consistency score, determining an intermediate consistency index by judging whether the score meets the final consistency level requirement, and obtaining the path consistency score by summing the path factors after applying a weight; obtaining the intermediate consistency index, combining the similar scene data extracted from the historical archives, obtaining the boundary deviation index by adjusting the boundary deviation index, and obtaining the final consistency level.

[0012] Preferably, S7 comprises: according to the final consistency level, obtaining a multi-factor condition, extracting a conditional probability from the multi-factor condition, integrating the conditional probability by using a decision tree algorithm, inputting the conditional probability into the decision tree algorithm, outputting an integrated value from the decision tree algorithm, and obtaining a probability integration value by calculating the joint distribution of the conditional probability; for the probability integration value, fusing the tree depth limit, processing the multi-factor condition, and determining a depth control threshold value by limiting the maximum level of the tree depth limit; from the depth control threshold value, constructing a leaf node decision, fusing the leaf node decision, judging whether the fusion exceeds a preset threshold, and obtaining a node decision set; for the node decision set, performing a pruning optimization process, extracting an optimized pruning path, and determining a verification result basis by removing branches in the optimized pruning path that have a contribution lower than the preset threshold; obtaining the verification result basis, combining the consistency evaluation and the result, fusing the factor processing, judging whether the factor processing meets the consistency evaluation requirement, and obtaining an identity verification result.

[0013] Preferably, S8 comprises obtaining a deviation source type according to the identity verification result, extracting a consistency level association from the deviation source type, backtracking the consistency level association by layer-by-layer comparison using a path tracking record to obtain a backtracked deviation source; for the backtracked deviation source, integrating source type analysis to construct an associated deviation type, and determining a deviation type association set by matching and fusing the associated deviation type and the consistency level association item by item.

[0014] Preferably, S8 further comprises extracting a record tracking path from the deviation type association set, judging that the record tracking path meets a preset threshold to obtain a path tracking record; for the path tracking record, fusing a level association judgment, if the level association judgment exceeds the preset threshold, adjusting the deviation source type by source type correction to obtain an adjusted deviation source; and obtaining reliability determination from the adjusted deviation source, and judging a final verification reliability level in combination with the judgment.

[0015] From the above technical solution, the present application has the following beneficial effects: The dynamic identity authentication method for the unmanned aerial vehicle group control communication system can effectively overcome the defects of the prior art that relies on static identification and cannot cope with identity verification failure in dynamic scenarios. By real-time collection, modeling and comparison of multi-dimensional data of the unmanned aerial vehicle flight trajectory and communication mode, combined with deviation detection, environmental factor evaluation and adaptive feature adjustment, continuous tracking and dynamic verification of the unmanned aerial vehicle behavior characteristics are realized. This method not only maintains the consistency and reliability of identity recognition in complex environments and long-time tasks, but also distinguishes external interference and abnormal disguises, improves the safety and credibility of multi-unmanned aerial vehicle cooperative operation in the group control system, and significantly enhances the anti-counterfeiting, tamper-proofing and intelligent management capabilities of the unmanned aerial vehicle group control communication system. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 The flowchart of the dynamic identity authentication method for the unmanned aerial vehicle group control communication system of the present application. DETAILED DESCRIPTION

[0017] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0018] As Figure 1As shown, the present application provides a technical solution: a dynamic identity authentication method for a UAV group control communication system, comprising S1, collecting the flight trajectory and communication mode data of the UAV through a sensor, processing multi-dimensional information using a timed sampling method, simultaneously integrating a noise filtering mechanism and real-time stream processing to obtain a real-time behavior feature vector; S2, according to the real-time behavior feature vector, using a clustering algorithm to group the data points, and applying isolation forest separation on the basis of grouping to preliminarily identify potential deviations, and determining the current behavior mode classification; S3, if the current behavior mode classification matches the historical record within the preset threshold value, obtaining a matching score, and calculating a difference vector through deviation vector analysis, obtaining a behavior deviation index; S4, according to the behavior deviation index, using an anomaly detection algorithm to evaluate the influence of environmental changes in combination with a local anomaly factor and a change quantization index, and simultaneously judging the deviation source type; S5, if the deviation source type is classified as external interference, extracting similar scene data from the historical archives, integrating threshold value self-adaptive adjustment and abnormal score output, and obtaining the adjusted expected feature range; S6, through the secondary comparison of the adjusted expected feature range and the real-time behavior feature vector, applying information gain splitting and multi-factor branch processing to the comparison result, and determining the final consistency level; S7, according to the final consistency level, using a decision tree algorithm to integrate conditional probability calculation and tree depth limit processing of multi-factor conditions, simultaneously integrating leaf node decision and pruning optimization process, and obtaining the identity verification result; S8, according to the identity verification result, using path tracking to record the association between the deviation source type and the consistency level, and judging the final verification reliability level.

[0019] The method is based on the flight trajectory and communication mode characteristics of the UAV, and constructs a dynamic behavior feature model. First, through multi-sensor timed sampling and noise filtering, multi-dimensional feature information of the UAV in the flight process is extracted, such as speed change, attitude angle and communication frequency distribution, to form a real-time behavior feature vector. Then, the clustering algorithm is used to analyze the behavior characteristics of the UAV, and the isolation forest algorithm is used to detect potential anomalies, so as to identify individuals with abnormal or deviated group behavior. Next, the system matches the current behavior mode with the historical record data, determines the behavior deviation index by calculating the deviation vector, to evaluate the rationality of the individual state change. Further, the local anomaly factor and the change quantization index are combined to analyze the deviation source, such as environmental interference or communication anomaly. When external interference is detected, the system automatically extracts historical similar scene data, adjusts the threshold value adaptively, and dynamically updates the expected feature range. Subsequently, the system performs secondary comparison on the real-time data through the information gain splitting strategy, judges the consistency level, and optimizes the classification result and verification decision through the decision tree model by integrating the conditional probability and multi-factor conditions. Finally, combined with the path tracking mechanism, the system traces back and analyzes the deviation source and the consistency result to determine the reliability level of the UAV identity verification.

[0020] The method can verify the identity of the UAV with high precision in a dynamic environment, realize real-time identity recognition through behavior feature modeling, and improve the security and robustness of the group control system. The detection mechanism combining clustering and isolation forest can effectively identify malicious interference or disguised attacks. The introduction of an adaptive threshold adjustment mechanism enables the system to maintain high recognition accuracy under different external conditions. The fusion of decision tree algorithm and pruning optimization strategy improves the operation efficiency and reduces the probability of misjudgment. The path tracking and backtracking analysis mechanism further enhances the system's ability to explain abnormal events, making the entire authentication process traceable and verifiable.

[0021] S1 includes obtaining flight trajectory and communication mode data from the UAV through sensors, using a timed sampling method to preliminarily fuse multi-dimensional information to obtain an initial data sequence; based on the initial data sequence, a noise filtering mechanism is introduced, low-pass filtering is applied to the data points to remove high-frequency interference, a filtered clean sequence is obtained, and real-time behavior preliminary features are determined; the filtered clean sequence is continuously updated through real-time stream processing, if the noise level exceeds the preset threshold, the sampling interval is adjusted, a dynamic behavior sequence is obtained; for the dynamic behavior sequence, combined with path anomaly monitoring and signal strength evaluation, data fusion quantization is performed, the trajectory deviation and signal fluctuation value are merged through weighted average, and the abnormal vector component is judged; from the abnormal vector component, trajectory optimization calculation elements are extracted, path points are corrected through linear interpolation, and real-time behavior feature vectors are obtained.

[0022] In the embodiment, firstly, a baseline collection phase lasting 10 seconds is entered, the sensor synchronously acquires flight trajectory data and signal strength data in the communication mode at fixed intervals of 50 milliseconds, each acquisition forms a record, the record content includes a time mark, a three-dimensional spatial position, a straight-line distance between the current position and the previous position, an instantaneous speed calculated based on the two adjacent positions, a heading angle calculated based on the three adjacent positions, and a current signal strength, all records are sequentially arranged to form an initial data sequence; subsequently, a noise filtering mechanism is performed on the initial data sequence, a moving average with a coverage time of 250 milliseconds is used as a low-pass filter, specifically, at any time, a sliding window with a time coverage not less than 250 milliseconds is formed by taking the time and a plurality of records before the time, when the sampling interval is 50 milliseconds, the window contains 5 records, when the sampling interval is adjusted to 25 milliseconds, the window contains 10 records, the arithmetic mean of the three coordinates of the spatial position, the straight-line distance between the adjacent positions, the instantaneous speed, the heading angle and the signal strength are taken in the respective windows, and the average value is used to replace the original value at the time at the end of the window, so that a filtered clean sequence is obtained, and real-time behavior preliminary features are determined accordingly; in the baseline collection phase, a noise level is calculated in a statistical window of 1 second, the noise level is defined as the median of the absolute difference values of the data points in the statistical window relative to the average value in the window, the straight-line distance between the adjacent positions, the instantaneous speed, the heading angle and the signal strength are calculated, the maximum value in the four is taken as the comprehensive noise level of the statistical window, the system sorts the comprehensive noise levels of all baseline statistical windows from small to large, takes the median and multiplies by 3 to determine the noise threshold, once the threshold is determined, it is written into the running configuration; after entering the formal collection, a real-time stream processing is enabled to continuously update the filtered clean sequence, the system calculates the comprehensive noise level of the recent 1-second window every 100 milliseconds and compares it with the noise threshold, when the comprehensive noise level is continuously checked for 10 times and is higher than the noise threshold, the sampling interval is shortened from 50 milliseconds to 25 milliseconds to improve the suppression ability of high-frequency disturbances, when the comprehensive noise level is continuously checked for 50 times and is lower than the noise threshold, the sampling interval is restored to 50 milliseconds, the above checks and adjustments are cyclically executed during the running period, so that a dynamic behavior sequence is obtained; path anomaly monitoring and signal strength evaluation are performed on the dynamic behavior sequence, and data fusion quantization is completed, the path anomaly monitoring takes each time point and its adjacent time points before and after it to form a minimum segment, the steering change amount and the speed change amount of the segment are calculated, the steering change amount is the absolute value of the heading angle at the time point, the speed change amount is the absolute value of the difference between the instantaneous speed at the time point and the average speed of the recent 1-second window, when the steering change amount is not less than 30 degrees and the speed change amount is not less than twice the average speed obtained by dividing the average value of the straight-line distance between the adjacent positions in the recent 1-second window by the sampling interval, the time point is marked as a trajectory anomaly point.The signal strength evaluation calculates the difference between the maximum value and the minimum value of the signal strength in the nearest 1-second window of each time point as the signal fluctuation value, and records the average value of the signal strength in the window as the current signal level; the trajectory anomaly and the signal fluctuation are weighted and averaged to be fused, specifically, the turning change amount and the speed change amount are averaged by equal weight to obtain a trajectory deviation amount, then the trajectory deviation amount and the signal fluctuation value are summed by weight and divided by the sum of the weights to obtain a fusion value, the weight of the trajectory deviation amount is set to 60, and the weight of the signal fluctuation value is set to 40, the above two weights are determined by a fixed outdoor calibration flight before online, the calibration process is to first collect normal data by stable and uniform flight in a straight line for 5 minutes and hovering at a fixed point for 5 minutes, then collect disturbance data by hovering near a strong interference source on the ground for 3 minutes and flying around with clear turning and acceleration / deceleration for 3 minutes, calculate the fusion value distribution of different weight combinations on normal data and the fusion value distribution on disturbance data respectively, select the weight combination with the smallest 95th percentile on normal data and the largest difference between the 50th percentile on disturbance data as the optimal weight and write it into the device configuration; the determination of the fusion threshold is based on the data in the baseline collection stage and the set of time points that are judged as non-trajectory abnormal points and have signal fluctuation values less than the median in the first 60 seconds after the formal collection starts, sort the fusion values of the set from small to large and take the 95th percentile as the fusion threshold which is fixed and unchanged during this task; the system calculates the fusion value at each time point and compares it with the fusion threshold, when the fusion value is greater than or equal to the fusion threshold, the time point is added to the abnormal vector component, the abnormal vector component records the time mark, the filtered spatial position, the adjacent position straight line distance, the instantaneous speed, the heading angle, the signal strength, the signal fluctuation value, the trajectory anomaly mark and the fusion value in chronological order; when the fusion value is less than the fusion threshold, the time point is marked as a normal point; when extracting trajectory optimization calculation elements from the abnormal vector component, the continuously abnormal time points in time are divided into an abnormal segment, the normal time point before the abnormal segment is determined as the starting anchor point and the normal time point after the abnormal segment is determined as the ending anchor point, the time marks and spatial positions of the two anchor points are recorded, and the number of abnormal time points in the abnormal segment is counted; when performing linear interpolation to correct the path points, the same number of intermediate instants as the number of abnormal time points is equally divided between the starting anchor point and the ending anchor point, the positions of the intermediate instants are taken as the equally proportional positions allocated by the connecting line of the two anchor points according to the time proportion, these positions are used to replace the spatial positions of the corresponding time points in the abnormal segment in turn, the adjacent position straight line distance and the instantaneous speed are updated using the replaced adjacent two positions, the signal strength of each 1-second window in which the abnormal segment is located is taken as the signal strength of the time point and the original signal fluctuation value remains unchanged, after completion, all time points are output as real-time behavior feature vectors in chronological order;All parameters and threshold determination rules in the above process are fixed and unique, specifically including that the initial value of the sampling interval is 50 milliseconds, the shortening value is 25 milliseconds, the shortening trigger condition is that the integrated noise level is higher than the threshold for 10 consecutive checks, the recovery condition is that the integrated noise level is lower than the threshold for 50 consecutive checks, the coverage time of the low-pass filter is 250 milliseconds, the noise threshold is equal to 3 times the median of the integrated noise level in the baseline stage, the turning threshold of the path anomaly is 30 degrees, the speed change threshold is 2 times the average speed in the recent 1 second window, the fusion weight for the trajectory deviation amount is 60, the signal fluctuation value is 40, the fusion threshold is the 95th percentile of the normal set fusion value, and the number of interpolation points of linear interpolation is equal to the number of abnormal time points in the abnormal segment, and the interpolation position is uniquely determined by the time proportion of the start and end anchor points and each intermediate time.

[0023] The noise threshold is determined by calculating the integrated noise level with a 1-second statistical window in the baseline acquisition stage, sorting all window integrated noise levels from small to large, and taking the median multiplied by 3. This value ensures that it is higher than the baseline fluctuation and lower than the abnormal jitter. The sampling interval shortening trigger condition is that the integrated noise level is higher than the noise threshold for 10 consecutive checks, and the recovery condition is that the integrated noise level is lower than the noise threshold for 50 consecutive checks. The above check period is fixed at 100 milliseconds, and the trigger and recovery counts are determined based on the false alarm rate and the false alarm rate balance in ground testing and written into the configuration. The path anomaly turning threshold is fixed at 30 degrees, which is selected as the smallest angle that can stably separate normal fine tuning and sudden turning in straight stable flight and circular turning flight comparison tests. The speed change threshold is fixed at 2 times the average speed in the recent 1 second window, which is selected as the smallest multiple that can reliably remove small amplitude speed fluctuations and retain abnormal acceleration events in uniform speed and mixed acceleration and deceleration flight tests. The fusion threshold is determined by taking the 95th percentile of the fusion value of the normal set sorted from small to large. The normal set is composed of time points within 60 seconds after the baseline stage and the start of formal acquisition without trajectory anomalies and signal fluctuation values not higher than the median of that stage. This threshold makes the pass rate of normal samples reach 95 and maintains sufficient separation degree for abnormal samples.

[0024] S2 includes obtaining a behavior feature vector through real-time data acquisition, grouping the behavior feature vector using a clustering algorithm to obtain a data point grouping; applying isolation forest separation to the data point grouping, wherein the isolation forest separates the data point grouping by constructing multiple isolation trees to randomly divide the data point grouping until a single point is isolated, calculates an isolation path length to identify potential deviations, and obtains a deviation isolation result; determining an abnormal behavior pattern according to the deviation isolation result; obtaining pattern classification details from the abnormal behavior pattern to determine a current behavior pattern classification; and outputting a classification result through the current behavior pattern classification to form a behavior pattern classification.

[0025] In the embodiment, the behavior feature vectors output by step S1 are continuously received, written in time sequence into an analysis window with a length of 2 seconds and rolled over every 1 second, and the grouping and separation processing is performed in the window immediately after the window is filled; the grouping processing adopts a center-based clustering algorithm, and the number of groups is fixed at 4, which is selected from the historical archives before going online by comparing the sum of the false positive rate and the false negative rate after the number of groups is 3 to 8 and the subsequent separation step is linked one by one, and the value with the smallest sum is selected and fixed at 4; the initial centers of each analysis window are selected as seed centers in time sequence from the 4 vectors in the window at equal intervals, and then at most 10 iterations are performed, and each iteration is completed by the following process without skipping: the distance of each vector in the window to the 4 centers is calculated and assigned to the group where the center with the smallest distance is located, the distance value is obtained by summing the squares of the component differences and then taking the square root, and no approximation is performed; after completing the full assignment, the arithmetic mean of each component of all vectors in each group is taken as the new center, and if the sum of the absolute differences of all centers in all components after this iteration is less than 1, the iteration is terminated in advance, otherwise the next iteration is continued until 10 times or the above convergence condition is met, so that the data point grouping and the corresponding center are obtained; the isolation forest separation is independently performed within each data point group, the isolation forest contains 100 isolation trees, the maximum number of split layers of the tree is 8, and the sample capacity of each tree is 256, when the data points in the group are less than 256, all data points in the group are used, when more than 256, 256 samples are extracted from the group without replacement, the tree is constructed by layers, and each split is fixed to perform the following steps and record the split count as the path length count: one component is randomly selected from all components of the feature vector as the current split component, then a threshold value is randomly selected from the minimum value and the maximum value of the component in the current sample set, the samples less than the threshold value are divided into the left subset, and the samples greater than or equal to the threshold value are divided into the right subset, and the above process is repeated for each subset until there is only one sample left in the subset or the current split layer reaches 8, at which time the isolation path length of the sample in the tree is equal to the split count from the root to the current leaf; when all isolation trees are constructed, the arithmetic mean of the isolation path lengths of the same data point on the 100 trees is taken to obtain the average isolation path length of the data point, and the arithmetic mean of the average isolation path lengths of all data points in the same group is taken to obtain the standard path length of the group, then the deviation score of each data point in the group is calculated, the deviation score is defined as the difference between the standard path length and the average isolation path length of the data point, when the difference is negative, it is processed as 0, when the difference is non-negative, the difference is retained as the final deviation score and as the core measurement of the deviation isolation result;The behavior mode judgment is strictly based on the deviation isolation result, the preset threshold in the group is calculated by the normal samples in the historical archives before going online and is unchanged during the task, the calculation method is to calculate the deviation score of each point of the normal samples in the group in the offline state, sort them from small to large, and take the 95th percentile as the preset threshold, in the running period, when the deviation score of a data point is greater than or equal to the threshold, it is judged as abnormal behavior mode, otherwise it is judged as normal behavior mode; The process of obtaining mode classification details from abnormal behavior mode does not introduce new algorithm, only extracts deterministic indicators from the calculated results, the indicators include the group number to which the data point belongs, the distance from the data point to the center of the group, the average isolation path length of the data point, the deviation score of the data point, whether the path continuity marker of the deviation score of the data point at the two adjacent time points in time is greater than the threshold, the above indicators are written into the mode classification detail record in a fixed order; The current behavior mode classification is determined by two deterministic conditions in the mode classification details and the rule is unique without ambiguity, when the path continuity marker is yes and the distance from the data point to the center of the group is greater than the 90th percentile of the distance from all data points in the group to the center in the same window, it is classified as continuous anomaly, when the path continuity marker is no and the deviation score of the data point is between the threshold and twice the threshold, it is classified as instantaneous anomaly, when the deviation score of the data point is greater than twice the threshold, it is classified as strong anomaly, if none of the above conditions is met, it is classified as normal; The classification result is output as a record with fixed structure, the fields are time marker, group number, standard path length, average isolation path length, deviation score, preset threshold, current behavior mode classification and mode classification detail summary, the record is immediately written into the behavior mode classification queue and called by the subsequent steps. The analysis window length is 2 seconds, the rolling step is 1 second, the number of groups is 4, the upper limit of iteration times is 10, the number of isolation trees is 100, the sample capacity of each tree is 256, the maximum number of segmentation layers is 8, the preset threshold is the 95th percentile of the deviation score of the normal samples, the path continuity judgment range is 2 time points forward and backward, the distance boundary of continuous anomaly is the 90th percentile of the distance distribution of the group, and the strong anomaly boundary is twice the preset threshold.

[0026] The preset threshold of deviation is determined according to the deviation score of the normal sample in groups, specifically, before going online, the behavior feature vectors labeled as normal in the historical archives are used to construct and run the grouping and isolation forest process consistent with the running period, the deviation score is obtained point by point and sorted from small to large, and the 95th percentile is taken as the fixed preset threshold of the group, which is fixed after being determined and unchanged during the task; the strong abnormal boundary is set as 2 times of the preset threshold, and the multiple is selected as 2 by evaluating the sum of false positive rate and false negative rate on the offline validation set, and the result is fixed as 2; the path continuity threshold of continuous abnormality is set as more than the preset threshold at 2 time points in front and back, and the value is selected as 2 by testing one by one in the candidate 1, 2, 3, and selecting 2 as the criterion of optimal classification stability; the spatial distance boundary of continuous abnormality is set as the 90th percentile of the distance to the center in the normal sample, and the distance to the center is calculated and sorted in the offline grouping unit to directly take the 90th percentile as the fixed boundary; the grouping convergence termination threshold is set as the sum of the absolute difference of the center in all components is less than 1, and the value is selected as 1 by testing one by one in the candidate 1 to 5, and selecting 1 as the criterion of not more than 10 iterations and the lowest change rate of running again to ensure the stability of grouping; the maximum number of isolation forest splitting layers is set to 8, which is the upper limit threshold of the isolation path length, and the value is selected as 8 by evaluating the sum of false positive rate and false negative rate in the candidate range of 6 to 10 to balance accuracy and time delay; the split position used for each split in the isolation tree is determined between the minimum and maximum values of the current sample set in an even manner, and the split position is only used as a random split point for tree construction and does not participate in the setting of abnormality judgment threshold.

[0027] S3 includes obtaining a current behavior mode classification, retrieving a matching item from historical archive records, evaluating a matching relationship through a preset threshold comparison, and obtaining a matching degree score; through the matching degree score, analyzing a deviation vector, extracting vector components from the difference between the current mode collection and the archive record retrieval, and calculating a difference vector; using the difference vector, quantifying a deviation index, and determining the degree of behavior deviation through the combination of deviation index quantification and matching relationship evaluation; for the degree of behavior deviation, mapping a vector space, integrating the results of deviation vector analysis from the vector space mapping, and obtaining a deviation relationship evaluation; according to the deviation relationship evaluation, generating a behavior deviation index, and integrating the details of the current mode collection through the behavior deviation index generation.

[0028] In a possible implementation, the processing is performed in a time-consistent analysis window with a fixed length of 2 seconds and a fixed rolling step of 1 second, and the values are fixed after offline evaluation of the compromise between delay and stability based on historical records before going online; the system first receives the current behavior pattern classification, retrieves a candidate set of samples consistent with the classification from the historical record, and then calculates the distance between the real-time behavior feature vector at the current time and each record vector in the candidate set, where the distance is calculated by squaring the difference of each corresponding dimension, adding them up, and then taking the square root, without approximation and truncation; the system sorts the obtained distances from small to large and generates a matching degree score based on the distance-to-matching degree score calibration table established before going online, where the calibration table is separately fixed as a linear mapping interval offline according to the classification, the lower limit of the interval is equal to the minimum distance of the normal sample pair and corresponds to a matching degree score of 100, the upper limit of the interval is equal to the 90th percentile distance of the normal sample pair distance distribution and corresponds to a matching degree score of 10, the matching degree score is fixed at 1 when the distance is greater than the upper limit of the interval, the matching degree score is fixed at 100 when the distance is less than the lower limit of the interval, and the percentage score is obtained by linear proportion within the interval; the system sorts the candidate samples in descending order of matching degree score and selects the top 5 as effective matching items, and the number is fixed at 5 after offline comparison of the sum of false positive rate and false negative rate in the range of 3 to 7; in order to obtain a robust control vector, the system performs weighted averaging on the archive vectors corresponding to the effective matching items with the matching degree scores as weights to obtain a reference archive vector, and takes the archive vector corresponding to the highest score as a reference archive vector, and then performs consistency checking, where the checking method is to calculate the median of the absolute difference between the reference archive vector and the reference archive vector in each dimension, and compare it with the median of the absolute value of each dimension of the reference archive vector, and when the ratio is not greater than 5%, the reference archive vector is used as the final archive control, otherwise the reference archive vector is used as the final archive control; the system sets a preset threshold for the matching relationship to determine strong and weak matching, and the preset threshold is fixed at the 10th percentile score of the matching degree scores of the same type of normal sample pairs in the historical records before going online, and when the highest matching degree score in the effective matching items is not less than the preset threshold, it is determined as strong matching, otherwise it is determined as weak matching.The deviation vector analysis is to subtract the final archive value in the corresponding dimension from the current real-time behavior feature vector to obtain a difference sequence, and record the sign and absolute difference of each dimension. The system calculates the arithmetic mean of the absolute difference of the dimensions related to flight trajectory and the dimensions related to communication mode to obtain trajectory sub-deviation and communication sub-deviation, respectively. Then, the two types of sub-deviation are combined into a single deviation index according to fixed weights. The weight of the trajectory sub-deviation is set to 60, and the weight of the communication sub-deviation is set to 40. This weight is based on the labeled samples in the historical archive before going online. The weight combination is traversed, and the sum of the correct recognition rate and false alarm rate is minimized as the criterion to select and fix 60 and 40. The scale of the deviation index quantization is determined by the historical distribution of the same type of normal sample. The system sorts the deviation index of the normal sample from small to large and records the 90th percentile and the 99th percentile as the mapping reference points. The position of the running period deviation index in this interval is linearly mapped to a deviation score of 0 to 100. If it is lower than the 90th percentile, it is mapped to a score less than 10. If it is higher than the 99th percentile, it is mapped to a score close to 100. If it is within the interval, it is converted by linear proportion. The two reference points are calculated and fixed at one time before going online. The system determines the behavior deviation degree by combining the deviation score and the matching degree score. When the matching relationship is strong matching, the deviation score is given priority, and the matching degree score is increased by one-to-one proportion when it is less than 90 to increase the deviation degree. When the matching relationship is weak matching, the deviation score and one hundred minus the matching degree score are synthesized by one-to-one proportion to obtain the behavior deviation degree, and the result is limited to the range of 0 to 100. The vector space mapping is used to give an interpretable expression of the deviation source. The system constructs a two-dimensional mapping with the trajectory-related coordinates and the communication-related coordinates. The trajectory sub-deviation and the communication sub-deviation are linearly mapped to the coordinate values of 0 to 100 according to the 90th percentile and the 99th percentile reference interval of the same type of normal sample, and the coordinate pair is output. The proportion of the two coordinate values in the sum is calculated, and the one with a proportion not less than 60 is marked as the dominant deviation source.The bias relationship evaluation consists of three parts, namely the behavior bias degree value, the two-dimensional mapping coordinates and the dominant bias source label. The system generates a behavior bias indicator based on the above and outputs it together with the details collected in the current mode. The behavior bias indicator is a structured record with fixed fields, including time label, current behavior mode classification, highest matching score, preset threshold, strong and weak matching label, behavior bias degree, trajectory-related coordinates, communication-related coordinates, dominant bias source label, and identification and corresponding score list of the top 5 matching objects. The analysis window length is 2 seconds, the rolling step is 1 second, the number of valid matching items is 5, the lower limit of the matching degree scale is the minimum distance of the same normal sample pair with a corresponding score of 100, the upper limit is the 90th percentile distance of the same normal sample pair with a corresponding score of 10, the score exceeding the upper limit is fixed at 1, the preset threshold is the 10th percentile of the matching degree score of the same normal sample pair, the ratio threshold for reference and benchmark consistency check is 5%, the fusion weight of trajectory and communication is 60 and 40, the reference point of bias score is the 90th and 99th percentiles of the same normal sample, the penalty trigger point for strong matching is 90, and the proportion threshold of the dominant bias source is 60.

[0029] The preset threshold of the matching relationship is determined by taking the 10th percentile score of the matching degree score of the same normal sample pair in the historical archive, sorted from small to large, for each classification, to distinguish between strong and weak matching and remain fixed during the task; The lower limit and upper limit of the matching degree scale interval are respectively taken as the minimum distance and the 90th percentile distance of the same normal sample pair and linearly mapped to score 100 and score 10, and the score exceeding the upper limit is fixed at 1. The interval is used to unify the distance to the percentage system to ensure consistency of data caliber in different batches; The consistency check ratio threshold of reference and benchmark is 5%, which is determined after offline comparison of false selection rate and score stability, and is used to determine whether to use the top 5 weighted results as the final archive reference; The fusion weight of the two types of bias indicators of the bias indicator is fixed at 60 and 40, and the weight is determined by traversing the candidate weight on the historical labeled samples and taking the sum of the recognition accuracy and the false alarm rate as the criterion, to ensure the interpretability and stability of the contribution of trajectory and communication; The 90th and 99th percentiles of the bias indicator of the same normal sample are taken as the interval endpoints for the bias score scale, which is used to linearly map the running period bias indicator to 0 to 100 and stretch the tail sensitivity; In the strong matching scenario, the part with a matching degree lower than 90 is added with a penalty in a one-to-one ratio, and the value of 90 is determined according to the stable boundary of the historical samples in the high similarity area, which is used to avoid underestimation of high score but slight mismatch; The proportion threshold of the dominant bias source is 60, which is used to determine which party is dominant in the two-dimensional mapping, and the value is selected from the candidates 50, 60 and 70 according to the criteria of optimal stability and interpretability.

[0030] S4 includes obtaining the behavior deviation indicator from the environmental change through a data collection process, the data collection process including real-time capture of behavior data by a sensor and calculation of a difference between a deviation value and a baseline value to obtain a local anomaly factor; According to the local anomaly factor, an anomaly detection algorithm is used in combination with a change quantification indicator, the anomaly detection algorithm input being the local anomaly factor and the quantification indicator, and the output being an evaluation score, and through comparison of the score with a preset threshold, environmental impact evaluation is determined; Through environmental impact evaluation, change trend analysis is performed, the change trend analysis including tracking a time series of the evaluation score and identifying an upward or downward pattern to determine a deviation source type; The deviation source type is obtained, a fusion method and a factor calculation logic are fused, the fusion method fusing the type and the factor through weighted averaging, and the factor calculation logic including multiplication by a weight coefficient to obtain a source classification rule; Through the source classification rule, in combination with a real-time monitoring mechanism, the real-time monitoring mechanism including continuous verification of matching of the rule and new data, environmental change impact on the behavior deviation indicator is determined.

[0031] In a possible implementation, the data is processed in an analysis window with a length of 2 seconds and a rolling step of 1 second, and the window and the step are fixedly written into the configuration according to the compromise evaluation of the detection time delay and stability based on the historical archives before going online; at each time point, the real-time behavior data output by the sensor and the reference value obtained in step S3 are synchronously acquired by the data acquisition process, the difference between the real-time behavior data and the reference value is calculated dimension by dimension and the absolute value is taken, then the arithmetic mean of the absolute differences belonging to the dimensions of the flight trajectory is obtained to obtain the trajectory difference average, and the arithmetic mean of the absolute differences belonging to the dimensions of the communication mode is obtained to obtain the communication difference average; the trajectory difference absolute median and the communication difference absolute median of the same type of normal samples in the historical archives are taken as the scaling quantities, the trajectory difference average is divided by the corresponding median to obtain the trajectory local anomaly factor, the communication difference average is divided by the corresponding median to obtain the communication local anomaly factor, and the arithmetic mean of the two is taken as the comprehensive local anomaly factor, and the trajectory local anomaly factor, the communication local anomaly factor and the comprehensive local anomaly factor are saved for each time point in the current window; subsequently, two change quantization indexes are calculated for the input of the anomaly detection algorithm, the first one is a short-time change rate defined as the change amount obtained by dividing the comprehensive local anomaly factor at the current time point by 1 second minus the comprehensive local anomaly factor at the same position one second ago, and the second one is a short-time fluctuation amplitude defined as the amplitude obtained by subtracting the minimum value from the maximum value of the comprehensive local anomaly factor in the last 2 seconds; the anomaly detection algorithm obtains a percentage evaluation score after linear scaling through weighted summation, the comprehensive local anomaly factor weight is 60, the short-time change rate weight is 25, and the short-time fluctuation amplitude weight is 15, and the three weight values are determined and fixed before going online based on the labeled normal and environmental interference samples as the criterion by traversing the candidate weights and taking the sum of the false alarm rate and the missed alarm rate as the criterion; in order to obtain a stable percentage scale, the system takes the first percentile and the 99th percentile of the weighted sum and the original value of the normal and environmental interference samples in the historical archives as the linear scaling interval endpoints, maps the weighted sum to the evaluation score of 0 to 100, maps the value below the first percentile to 0, maps the value above the 99th percentile to 100, and converts the value within the interval according to the linear proportion; the environmental impact evaluation is determined according to a preset threshold, the preset threshold is determined according to the 95th percentile of the evaluation scores of the same type of normal samples in ascending order, and when the evaluation score is not lower than the threshold during running, it is recorded as being affected by the environment, and when the evaluation score is lower than the threshold, it is recorded as not being affected by the environment.After completing the environmental impact assessment, the change trend analysis is performed, the system continuously tracks the time series of the assessment score and calculates the score difference with the previous second every second within the last 3 seconds, and takes the median of the 3 differences as the trend measure, and compares it with the rising threshold and the falling threshold fixed before going online, the rising threshold takes the 90th percentile of the score difference distribution of the same normal sample, and the falling threshold takes the absolute value of the 10th percentile of the score difference distribution of the same normal sample and takes the negative direction when comparing, when the median is not lower than the rising threshold, it is determined as an upward mode, when the median is not higher than the negative falling threshold, it is determined as a downward mode, and the rest is a stable mode; the system judges the deviation source type accordingly, if the upward mode is established and the average value of the trajectory local anomaly factor within the last 2 seconds is not less than 1.5 times of the communication local anomaly factor, it is classified as a trajectory-related source, if the upward mode is established and the average value of the communication local anomaly factor within the last 2 seconds is not less than 1.5 times of the trajectory local anomaly factor, it is classified as a communication-related source, if neither of the two is established and the assessment score is continuously not less than the preset threshold within the last 3 seconds, it is classified as a composite source; after obtaining the deviation source type, the system performs the index fusion method and the factor calculation logic to output the source classification rule, the index fusion method performs weighted average on the three factors corresponding to the source type, the three factors are fixed as the comprehensive local anomaly factor, the short-time change rate and the short-time fluctuation amplitude, the factor calculation logic is to multiply each factor by the weight coefficient corresponding to the source type and then sum up to linearly map to the percentage source score, wherein the three coefficients of the trajectory-related source are 60, 25 and 15 respectively, the three coefficients of the communication-related source are 60, 25 and 15 respectively, and the three coefficients of the composite source are 33, 33 and 33 respectively, the above coefficients and the anomaly detection weight use the same offline evaluation process and take the sum of the false alarm rate and the missed alarm rate as the criterion to be fixed once; the output of the source classification rule includes the source score and the source label, the source label is one of the trajectory-related, communication-related and composite three categories and is consistent with the aforementioned source type;Finally, the system determines the environmental change impact on the behavioral deviation indicator with the source classification rule combined with a real-time monitoring mechanism. The real-time monitoring mechanism includes two parts: continuous verification rule and new data matching. The continuous verification rule is that when the source score is not lower than the preset threshold for three consecutive times, it is confirmed that there is an environmental change impact. When any two subsequent source scores are lower than the preset threshold, the confirmation is revoked and turned into an observation state. The new data matching is to count the number of consistent times of the source label within the last 5 seconds and calculate the consistency rate. When the consistency rate is not less than 70, the conclusion is maintained. When the consistency rate is lower than 70, review is triggered and the whole calculation process is repeated. The analysis window length is 2 seconds, the rolling step is 1 second, the three weights are 60, 25 and 15, the linear scaling interval endpoints are the first and 99th percentiles of the historical archive weighted sum, the environmental impact preset threshold is the 95th percentile of the normal sample evaluation score, the rising threshold is the 90th percentile of the normal sample score difference, the falling threshold is the absolute value of the 10th percentile of the normal sample score difference and takes the negative direction, the source type ratio boundary is 1.5, the equal weight coefficient of the composite source is 33, 33 and 33, the continuous verification confirmation times is 3, the revocation times is 2, the new data matching consistency rate threshold is 70, and the matching statistical duration is 5 seconds.

[0032] The preset thresholds for evaluation scores are determined by sorting the evaluation scores of similar normal samples in historical archives from smallest to largest and taking the 95th percentile. This is used to determine if the evaluation score during operation is not lower than this value, indicating environmental influence. The rising threshold for trend analysis is taken as the 90th percentile of the distribution of the difference in evaluation scores per second among similar normal samples, and the falling threshold is taken as the absolute value of the 10th percentile of the distribution of the difference in evaluation scores per second among similar normal samples, with a negative boundary used for comparison. These two thresholds are used to determine if the median difference in the most recent 3 seconds is not lower than the rising threshold as an rising pattern, and not higher than the negative falling threshold as a falling pattern. The ratio boundary for deviation source types is fixed at 1.5. When the average value of the local anomaly factor in the trajectory in the most recent 2 seconds is not lower than 1.5 times the average value of the local anomaly factor in communication, it is classified as a trajectory-related source; conversely, when the average value of the local anomaly factor in communication is not lower than 1.5 times the average value of the local anomaly factor in trajectory, it is classified as a communication-related source. The ratio boundary is determined by historical... The system uses a grid search to select integer and half-integer candidates from the labeled normal and environmental interference samples in the archives, and determines the candidates based on the minimum sum of false positive and false negative rates. The continuous verification threshold in the real-time monitoring mechanism is set to confirm the presence of environmental changes if the source score is not lower than the preset threshold for three consecutive times. The cancellation threshold is set to cancel the confirmation if any two subsequent source scores are lower than the preset threshold. The number of such confirmations is selected after offline evaluation of the response latency and false positive rate of candidate values ​​2, 3, and 4. The consistency rate threshold for new data matching is fixed at 70%, with the most recent 5 seconds as the statistical duration. If the consistency rate between the source label and the previous confirmation conclusion is not lower than 70% within this duration, the conclusion is maintained; otherwise, a review is triggered. This value is determined by comparing the stability and recovery speed among the candidates 60, 70, and 80. The linear calibration endpoint threshold for the evaluation score is taken from the 1st and 99th percentiles of the weighted sum of similar normal and environmental interference samples, used to map the weighted sum to a percentage system from 0 to 100 and suppress the influence of extreme tail values.

[0033] S5 includes extracting similar scenario data from historical archives if the source of the deviation is classified as external interference, and obtaining the arithmetic mean of each deviation item through the similar scenario data to obtain the initial threshold range. For the initial threshold range, an adaptive threshold adjustment method is used to fuse abnormal score outputs. The adaptive threshold adjustment method determines the dynamic threshold boundary by summing the scores and ranges after applying preset weights. Based on the dynamic threshold boundary, obtain the current behavior indicator data, determine whether the data exceeds the boundary, and obtain the boundary deviation indicator; By incorporating the boundary deviation index into environmental noise filtering, the environmental noise filtering subtracts the preset noise benchmark value from the current behavioral index data to obtain the adjusted expected characteristic range.

[0034] In a possible implementation, similar scenario data extraction and initial threshold range construction are first performed: the system takes the current behavior pattern classification as the retrieval key in the historical archive and limits the same platform and the same task type and not more than 7 days in time, if the number of records meeting the conditions is not less than 300, this part of records is used as the similar scenario data set, if not enough, all available records are used and a data insufficient mark is issued when the number of records is less than 100, but still calculated according to the same steps; the system respectively takes the value of each track sub-deviation and communication sub-deviation in the similar scenario data set and calculates the arithmetic mean to obtain the scenario mean of the two items, and then constructs the initial threshold range with a fixed proportion, the initial lower limit of the track sub-deviation and the communication sub-deviation is equal to the corresponding scenario mean multiplied by 0.8, and the initial upper limit is equal to the corresponding scenario mean multiplied by 1.2, the above two proportions are fixed after the off-line evaluation of the historical archive before going online, wherein the candidate lower limit proportion is stepped from 0.7 to 0.9 by 0.05, and the candidate upper limit proportion is stepped from 1.1 to 1.3 by 0.05, the combination with the minimum sum of false positive rate and false negative rate of recovery speed and stability of normal samples is selected and solidified as 0.8 and 1.2; then threshold self-adaptive adjustment and abnormal score output fusion are performed to determine the dynamic threshold boundary, the abnormal score is the evaluation score output in step S4 and the range is fixed as 0 to 100, the system first calculates the initial range width of each item equal to the initial upper limit minus the initial lower limit, then divides the abnormal score by 100 to obtain the expansion ratio and performs weighted operation on the initial range and the expansion ratio according to the preset weight, the range weight is fixed as 0.7 and the expansion weight is fixed as 0.3, the two weights are outside the boundary of the adaptive stability of the external interference sample and the response time delay as the objective function is searched by grid search and the sum of the false alarm rate and the false alarm rate is fixed; the calculation process of the dynamic lower bound is to expand downward based on the initial lower bound, the expansion amount is equal to the initial range width multiplied by the expansion weight and then multiplied by the expansion proportion, the calculation process of the dynamic upper bound is to expand upward based on the initial upper bound, the expansion amount is consistent with the dynamic lower bound, so as to obtain the dynamic threshold boundary which is symmetrically expanded at both ends and monotonically changes with the abnormal score; then the system obtains the behavior index data at the current time and calculates the boundary deviation index, the behavior index data is fixed as the trajectory sub deviation and the communication sub deviation at the same time, the determination rule is that when a certain data is not lower than the dynamic lower bound and not higher than the dynamic upper bound, the boundary deviation index of the certain data is set to 0, when a certain data is higher than the dynamic upper bound, the boundary deviation index of the certain data is set to the excess of the certain data minus the dynamic upper bound, the ratio of the initial range width is multiplied by 100 and truncated to 100 when the result is greater than 100, when a certain data is lower than the dynamic lower bound, the boundary deviation index of the certain data is set to the dynamic lower bound minus the deficiency of the certain data, the ratio of the initial range width is multiplied by 100 and truncated to 100 when the result is greater than 100, the above ratio and multiplication are executed in full precision without using approximation and truncation; subsequently, the system filters the boundary deviation index into environmental noise to generate the adjusted expected feature range, the environmental noise reference value is calculated once for each category based on the absolute median of the behavior index data of the same normal sample and is fixed before going online, during operation, the system first subtracts the corresponding environmental noise reference value from the current behavior index data to obtain the noise correction value, then takes the arithmetic mean of the noise correction value in the analysis window of the last 2 seconds as the correction center, while keeping the width of the dynamic threshold boundary unchanged and reconstructing the range with the correction center as the symmetric center, that is, the adjusted lower bound is obtained by offsetting the correction center downward by half the width and is limited to not less than 0, the adjusted upper bound is obtained by offsetting the correction center upward by half the width, so as to form the adjusted expected feature range which eliminates the fixed noise offset but retains the boundary sensitivity; in the above process, the time of similar scene data is not more than 7 days, the minimum sample size is 300, the initial range lower bound proportion is 0.8, the initial range upper bound proportion is 1.2, the range weight is 0.7, the expansion weight is 0.3, the abnormal score range is 0 to 100, the boundary deviation index percentage system upper limit is 100, and the analysis window length is 2 seconds.

[0035] The time adjacent threshold of similar scenario data is set to 7 days and the minimum sample size threshold is set to 300 to ensure the timeliness and statistical stability of the sample; the above two values are fixed through comprehensive comparison of the false positive rate and the false negative rate of different time windows and sample sizes on historical records; the initial threshold range is formed by taking the arithmetic mean of the similar scenario data for each deviation term to form a scenario mean and is proportionally extended, the lower proportion threshold is fixed at 0.8, and the upper proportion threshold is fixed at 1.2, the proportion is offline grid searched in the range of 0.7 to 0.9 and 1.1 to 1.3, and the sum of the false positive rate and the false negative rate under the trade-off between recovery speed and stability is taken as the criterion for selection; the threshold adaptive adjustment adopts range weight threshold 0.7 and expansion weight threshold 0.3 to fuse the evaluation score and the initial range into a dynamic threshold boundary, the two weights are fixed after being selected by jointly minimizing the boundary jitter amplitude and response time delay on historical external interference samples; the boundary determination threshold is directly from the dynamic lower bound and the dynamic upper bound, any current behavior index data below the dynamic lower bound or above the dynamic upper bound is determined to be out of bounds, the out-of-bound amount is further converted into a percentage boundary deviation index and set to an upper limit threshold of 100 to limit the influence of extreme values on subsequent decisions, the upper limit value is fixed through offline comparison of the percentage interpretability and the stability of the tail of the abnormal distribution; the noise reference threshold of environmental noise filtering is the absolute median of this data of the same normal sample, to enhance the robustness to abnormal points and eliminate fixed bias, the threshold is calculated once before going online and remains unchanged; when reconstructing the range, a constraint threshold not less than 0 is set for the lower bound to avoid negative values and keep the width of the dynamic threshold boundary constant, this constraint is established by evaluating the minimum reachable range of historical data.

[0036] S6 includes obtaining a real-time behavior feature vector through an adjusted expected feature range, generating a preliminary deviation value by applying a secondary comparison, determining whether the preliminary deviation value exceeds a preset threshold, and obtaining a comparison result set; For the comparison result set, an information gain splitting method is used to calculate the information gain value of each factor, the information gain splitting method determines the splitting point through an entropy reduction calculation formula, and determines a high-gain factor sequence; According to the high-gain factor sequence, multi-factor branch processing is performed, at least one dominant factor is extracted from the sequence, a branch tree structure is constructed, and a branch decision path is obtained; From the branch decision path, the deviation source type and the external interference data are fused, the deviation source type is obtained from historical records extraction, the external interference data is obtained by similar scenario data, a path consistency score is calculated, the path consistency score is obtained by summing the weights of the path factors, it is determined whether the score meets the final consistency level requirement, and an intermediate consistency index is determined; An intermediate consistency index is obtained, combined with similar scene data extracted from historical archives, and the similar scene data is obtained by threshold adaptive adjustment and fusion of the abnormal score output. The boundary deviation index is adjusted to obtain the final consistency level.

[0037] In a possible implementation, the step takes the adjusted expected feature range output in step S5 as input, first performs secondary comparison, the system reads the current value of the real-time behavior feature vector and the lower bound and upper bound of the corresponding dimension, calculates half of the difference between the upper bound and the lower bound as the half-width and only uses it for scale normalization of the dimension; if the current value is between the lower bound and the upper bound, the preliminary deviation value of the dimension is set to 0, if the current value is higher than the upper bound, the preliminary deviation value of the dimension is obtained by dividing the excess amount by the half-width and multiplying by 100, and if the result is greater than 100, it is truncated to 100, if the current value is lower than the lower bound, the preliminary deviation value of the dimension is obtained by dividing the insufficient amount by the half-width and multiplying by 100, and if the result is greater than 100, it is truncated to 100; the system takes the preliminary deviation values of the trajectory-related dimensions to obtain the preliminary trajectory sub-deviation value, and takes the preliminary deviation values of the communication-related dimensions to obtain the preliminary communication sub-deviation value, and reads the trajectory boundary deviation index and the communication boundary deviation index generated in step S5 to form a comparison result set; to form the out-of-bound label, the system takes the 95th percentile of the dimension deviation values of the same normal sample before going online as the secondary comparison preset threshold, and marks the current time point as out-of-bound when any dimension preliminary deviation value is not less than the threshold or any boundary deviation index is not less than the threshold, otherwise marks it as not out-of-bound, which is used for subsequent gain calculation; then the information gain splitting method is performed on the comparison result set, the candidate factors are fixed as the preliminary trajectory sub-deviation value, the preliminary communication sub-deviation value, the trajectory boundary deviation index, the communication boundary deviation index and the deviation source type, of which the first four are continuous factors and the last one is a three-category discrete factor; the candidate split points of the continuous factors are selected at 9 positions equidistant between the minimum value and the maximum value in the current analysis window, and the candidate split mode of the discrete factor is to combine each category with the remaining categories to form a binary set; for each candidate, the system first calculates the overall uncertainty with out-of-bound and not out-of-bound as binary labels, then calculates the uncertainty of the two sides after splitting and weights them according to the proportion of the number of samples, and takes the difference between the two as the information gain value of the candidate, and takes the candidate with the maximum gain in the same factor as the optimal split of the factor and the optimal gain value of the factor; the system sorts the optimal gain values of the five factors from large to small to obtain a high-gain factor sequence, if the gains are equal, select according to the fixed priority order of the preliminary trajectory sub-deviation value, the preliminary communication sub-deviation value, the trajectory boundary deviation index, the communication boundary deviation index and the deviation source type, then enter the multi-factor branch processing, extract at most 3 dominant factors from the sequence in turn to construct a branch tree structure, the root node uses the optimal split of the first factor to form two branches, the second and third factors repeat the same split in their respective parent nodes, the upper limit of the branch depth is 3 and the number of samples of any node is less than 30, stop splitting, and the above depth and sample number thresholds are fixed before going online.The system generates a branch decision path according to the current time point in the branch tree, and calculates the path consistency score, specifically, the first node, the second node, and the third node on the path are assigned weights of 50, 30, and 20 respectively, and the node consistency determination rule is to compare the splitting direction of the node with the deviation source type given in step S4 and whether the factor direction is consistent with the similar scene data of external interference consistent with the current behavior mode classification in the historical archives, if the node direction is consistent with both, the full weight is recorded, if only one of them is consistent, half of the node weight is recorded, if both are inconsistent, 0 is recorded, the path consistency score is obtained by adding the scores of the three nodes and is limited in the range of 0 to 100; the path consistency threshold is fixed at 70 and is determined by grid evaluation before going online with the goal of distinguishing normal samples from external interference samples in the historical archives, when the path consistency score is not less than 70, the intermediate consistency index is marked as passed and the value is recorded as the path consistency score, otherwise it is marked as failed and the value is recorded as the path consistency score; the system adjusts the boundary deviation index after obtaining the intermediate consistency index in combination with the similar scene data extracted from the historical archives, the similar scene data outputs the dynamic threshold boundary and noise correction center according to the threshold adaptive adjustment process of step S5, the system calculates the trajectory and communication instant deviation values around the noise correction center at the current time point according to the same rules as the second comparison, and obtains the new boundary deviation value by weighting the original boundary deviation index and the instant deviation value according to the fixed fusion weight, wherein the original boundary deviation weight is 60, the instant deviation weight is 40, the value is fixed before going online with the criterion of minimizing the sum of false alarm rate and missed alarm rate and remains unchanged during operation; the final consistency level is determined by the path consistency score and the reverse score of the new boundary deviation value of the trajectory and communication, the reverse score is obtained by subtracting the corresponding new boundary deviation value from 100 and limiting it in the range of 0 to 100, the system weights and sums the path consistency score, trajectory reverse score, and communication reverse score according to the fixed proportion of 50, 25, and 25, and linearly maps it to the final consistency level of 0 to 100, the above proportion is calibrated before going online by jointly minimizing decision jitter and error rate; in order to output a directly usable level result, the system sets the level boundaries of the final consistency level as high consistency not less than 80, medium consistency between 50 and 80, and low consistency less than 50, the three boundary points are determined on the historical archives by the curve inflection point method and written into the read-only configuration; in this step, the second comparison preset threshold is the 95th percentile of the same type of normal sample dimension deviation, the number of continuous factor candidate splitting points is 9, the upper limit of branch depth is 3, the minimum sample size is 30, the path node weight is 50, 30, and 20, the path consistency threshold is 70, the boundary deviation fusion weight is 60 and 40, the final consistency weighting proportion is 50, 25, and 25, and the level boundary is 80 and 50.

[0038] The out-of-bound preset threshold of the secondary comparison is the 95th percentile of the preliminary deviation values of the same type of normal samples obtained by the consistent secondary comparison process before going online, and is fixed for determining whether any dimension or any boundary deviation index is out of bound; the preliminary deviation upper limit is fixed at 100 for limiting the deviation value converted by the half-width ratio within the percentage range, and the upper limit is determined and fixed by stability evaluation of the extreme values at the end of the historical archives; the stop threshold of information gain splitting includes the upper limit of branch depth 3 and the minimum number of nodes 30, which are determined and fixed by grid evaluation of candidate depth 2 to 5 and candidate sample number 20 to 50 before going online to minimize delay and stability, for preventing overfitting and amplifying small sample noise; the number threshold of high gain factors is fixed at 3, that is, only the top 3 factors with the highest gain value are selected as the input of branch construction, and if there are less than 3 positive gain factors, all are selected, and the threshold is determined by comparing the comprehensive indicators of different selection numbers in classification stability and calculation delay; the path consistency threshold is fixed at 70, and the candidate threshold 60 to 80 is evaluated and distinguished by the comprehensive indicators of the best point to determine whether the intermediate consistency passes or not, with normal samples and external interference samples as controls before going online, for determining whether the intermediate consistency passes or not; the final consistency level boundary is fixed at 80 and 50, where less than 80 is judged as high consistency, between 50 and 80 is judged as medium consistency, and less than 50 is judged as low consistency, and the two boundaries are determined and fixed by calculating the receiver operating characteristic curve on the historical archives and taking the inflection point and risk balance point.

[0039] S7 includes obtaining a multi-factor condition according to the final consistency level, extracting a conditional probability from the multi-factor condition, integrating the conditional probability using a decision tree algorithm, the decision tree algorithm input being the conditional probability, the decision tree algorithm output being the integrated value, and obtaining a probability integration value by calculating the joint distribution of the conditional probability; for the probability integration value, the multi-factor condition is processed by limiting the tree depth limit to determine a depth control threshold value; from the depth control threshold value, a leaf node decision is constructed, the leaf node decision is fused, it is judged whether the fusion exceeds a preset threshold, and a node decision set is obtained; for the node decision set, a pruning optimization process is performed, an optimized pruning path is extracted, and a verification result basis is determined by removing branches with a contribution below the preset threshold in the optimized pruning path; the verification result basis is obtained, combined with the consistency evaluation and the result, the factor processing is fused, the factor processing is obtained from the multi-factor condition, it is judged whether the factor processing meets the consistency evaluation requirement, and an identity verification result is obtained.

[0040] In a possible implementation, the step takes the final consistency level output in step S6 as input, first acquires the multi-factor conditions including the final consistency level, path consistency score, trajectory reverse score, communication reverse score, and bias source type, and extracts the conditional probability from the historical archives, wherein the value range of the four scores is 0 to 100, and the bias source type takes three values of trajectory correlation, communication correlation, or composite; to ensure the stability of the conditional probability estimation, the system discretizes the four scores before going online and fixes the segmentation boundaries at one time, the final consistency level is not less than 80, which is classified into the high zone, between 50 and 80, which is classified into the medium zone, and less than 50, which is classified into the low zone, the path consistency score is not less than 70, which is classified into the high zone, between 50 and 70, which is classified into the medium zone, and less than 50, which is classified into the low zone, the trajectory reverse score and the communication reverse score are not less than 80, which are classified into the high zone, between 60 and 80, which are classified into the medium zone, and less than 60, which are classified into the low zone, the above boundaries inherit the levels and thresholds of step S6 and complete one-time calibration using the same historical archives; then the system statistically counts the passing sample number and the total sample number in the historical archives according to the discrete combination of the five conditions one by one and calculates the passing probability, and for the sparse sample combination, the passing sample number and the non-passing sample number are each increased by 1 for smoothing counting to avoid zero probability, the smoothing counting value is 1 and is fixed before going online; then the decision tree algorithm is used to integrate the conditional probability, the reduction amount of uncertainty is used as the splitting criterion of each node during tree construction, the candidate splitting comes from the value set after discretization, the system selects the splitting that brings the maximum reduction of uncertainty to generate two child nodes at each node and continues to grow until the depth control threshold is reached, the depth control threshold is fixed at 3 and is determined in candidate 2 to 5 before going online according to the criterion of joint minimization of delay and stability; after the tree growth is completed, the system integrates the conditional probability along the root-to-leaf order for the condition combination corresponding to the current time point, the integration rule is to multiply the passing probability of each node corresponding combination in the path order, then normalize the probability integration value to the percentage system and limit it in the range of 0 to 100; to process the influence of multi-factor conditions on reliability at different depths, the system integrates the tree depth limit information into the probability integration value and reduces the credibility by level, the root layer is not reduced, the second layer is reduced by 10, and the third layer is reduced by another 10, the reduction amplitude of each layer is fixed before going online by comparing the candidate 0, 10, and 20 in the receiver operating characteristic curve;The leaf node decision is then constructed under the constraint of the depth control threshold and fused, the leaf node decision fused probability of leaf node coverage combination and the probability integrated value after depth correction, the fusion weight fixed as leaf node probability of passing 60 and integrated value weight 40, the above weight determined and fixed through minimizing the sum of false alarm rate and false alarm rate of historical archives, the fusion result compared with the preset threshold to generate leaf node output, the preset threshold fixed as 70 and determined in the interval of 60 to 80 through discrimination and stability compromise, when the fusion result is not less than 70, the leaf node output passes, and less than 70, the output fails, the output set of all leaf nodes constitutes the node decision set; the system then performs pruning optimization on the node decision set to remove branches with insufficient contribution, the pruning contribution jointly measured by the passing rate improvement amount brought by the relative parent node on the validation set and the coverage sample proportion, the improvement amount threshold fixed as 2, the coverage rate threshold fixed as 5, indicating that only when the improvement is not less than 2 percentage points and the coverage sample is not less than 5 of the validation set, the branch is retained, the above two thresholds are solidified after grid evaluation in the candidate 1 to 3 and the candidate 3 to 10 before going online, the pruning is completed to obtain the validation result basis and record the retained leaf node set; after obtaining the validation result basis, the system gives the final determination jointly with the consistency evaluation and integrates the factor processing, the factor processing selects three most important factors from the multi-factor conditions according to the information contribution ranking and outputs the percentage result after calculating the factor processing score according to the weight 50 and 30 and 20, the three weights are directly mapped and solidified by the gain ranking of historical archives before going online; the consistency evaluation requires that the final consistency level is not less than 50 and the path consistency score is not less than 50, the two boundaries inherit the level boundaries of step S6 and are calibrated on the same data set; the generation of the final identity verification result follows the unique decision rule, that is, when the validation result basis is pass, the two boundaries of the consistency evaluation are satisfied, and the factor processing score is not less than 60, the identity verification result is output as pass, otherwise, it is output as fail; in this step, the score discretization boundaries 80 and 50 and 70 and 60, the smoothing count 1, the tree depth control threshold 3, the level reduction amplitude 10 per layer, the leaf node fusion weight 60 and 40, the leaf node preset threshold 70, the pruning improvement threshold 2, the pruning coverage rate threshold 5, the factor processing weight 50 and 30 and 20, the factor processing passing score 60, the consistency evaluation boundary 50.

[0041] The discretization boundaries of the four scores are calibrated once based on historical records and consistent with the criteria of step S6, and the final consistency level is not less than 80, classified into the high zone, between 50 and 80, classified into the middle zone, and less than 50, classified into the low zone, the path consistency score is not less than 70, classified into the high zone, between 50 and 70, classified into the middle zone, and less than 50, classified into the low zone, the trajectory reverse score and the communication reverse score are not less than 80, classified into the high zone, between 60 and 80, classified into the middle zone, and less than 60, classified into the low zone, the above boundaries are determined by jointly minimizing the pass rate and false alarm rate of similar task samples and fixed; the smoothing count of the conditional probability estimate is 1, which is used to eliminate the zero frequency problem, and the value is determined in the candidate 0, 1 and 2 based on the best stability of extreme combinations on the validation set; the depth control threshold of the decision tree is 3, which is determined in the range of candidate 2 to 5 based on the joint minimization of delay and stability; the level reduction amplitude of depth correction is 10 per layer, which is determined in the candidate 0, 10 and 20 based on the optimal discrimination of the receiver operating characteristic curve; the fusion weight of leaf node decision is the leaf node pass probability weight 60 and the integrated value weight 40, which is determined based on the minimum sum of false alarm rate and missed alarm rate on historical records; the leaf node preset threshold is 70, which is determined in the range of candidate 60 to 80 based on the compromise between discrimination and stability; the pass rate improvement threshold of relative parent node in pruning optimization is 2, and the coverage threshold is 5, which are fixed after grid evaluation in the range of candidate 1 to 3 and candidate 3 to 10 respectively, to ensure that the branches with insufficient contribution to the overall judgment are deleted; the three weights of factor processing are 50, 30 and 20, which are directly mapped according to the information gain ranking and fixed on the historical records, and the factor processing pass score is 60, which is determined based on the minimum overall error rate; the two boundaries of consistency evaluation are that the final consistency level is not less than 50 and the path consistency score is not less than 50, which follow the statistical inflection point of step S6 and are calibrated on the same data set.

[0042] S8 includes obtaining a bias source type according to the identity verification result, extracting a consistency level association from the bias source type, backtracking the consistency level association by layer-by-layer comparison to obtain a backtracking bias source; for the backtracking bias source, the source type analysis is integrated to construct an associated bias type, the associated bias type and the consistency level association are fused by item-by-item matching to determine a bias type association set; from the bias type association set, the record tracking path is extracted, it is judged that the record tracking path meets the preset threshold, and the path tracking record is obtained; for the path tracking record, the level association judgment is fused, if the level association judgment exceeds the preset threshold, the bias source type is adjusted by source type correction to obtain the adjusted bias source; from the adjusted bias source, the reliability determination is obtained, and the final verification reliability level is determined in combination with the judgment.

[0043] In a possible implementation, the step takes the identity verification result output in step S7 and the final consistency level as inputs, and completes all calculations in a unique order at each time point, and all parameters and threshold values are fixed and explicit: the system first reads the identity verification result and the bias source type, and extracts the consistency level association from the branch decision path and path consistency score retained in step 6, specifically, the final consistency level is divided into a high zone not lower than 80, a medium zone between 50 and 80, and a low zone lower than 50, and is marked as a consistency level association label; then the path tracking backtracking of layer-by-layer comparison is performed, the branch decision path is divided into three nodes of the first layer, the second layer, and the third layer, and is respectively assigned a weight of 50, 30, and 20, the system compares whether the path direction of each layer is consistent with the bias source type and the direction of the consistency level association label, if both are consistent, the full weight of the layer is counted, if only one is consistent, the half weight of the layer is counted, if both are inconsistent, the weight of 0 is counted, the 3-layer weight score is added and limited in the range of 0 to 100 to obtain a backtracking path score; the system determines the backtracking bias source according to the rule that the backtracking path score is not lower than 70 and the bias source type is consistent with the direction of the consistency level association label, and enters the source type analysis, the source type analysis only uses the current bias source type and the backtracking bias source to match item by item, completely consistent is marked as strong consistency, the direction is opposite and is marked as strong inconsistency, and the rest is marked as weak consistency; the system backtracks the same type of records at each time point for a statistical time length of 5 seconds and generates a consistency label for each record to form a bias type association set, extracts the record tracking path from the set and calculates the path consistency rate, that is, the percentage of the number of strong consistent items in the total number of items in the last 5 seconds, when the path consistency rate is not lower than 60 and the backtracking path score is not lower than 70, it is considered that the record tracking path meets the preset threshold and a path tracking record is generated, otherwise it is marked as an observation state and does not enter the subsequent correction; for the generated path tracking record, the system fuses the level association judgment to determine whether to correct the bias source type, specifically, the backtracking path score is added or subtracted according to the interval label of the consistency level, when the consistency level is in the high zone, 10 is added to the backtracking path score, when it is in the medium zone, it is not added or subtracted, and when it is in the low zone, 10 is subtracted from the backtracking path score, the modified result is limited in the range of 0 to 100 and compared with the level association threshold, the level association threshold is fixed at 75 and is determined before going online through historical archives in the candidate 70, 75, and 80 with the minimum joint minimization of the interval and the false positive rate, when the modified level association score is not lower than 75 and the current bias source type and the backtracking bias source are marked as strong inconsistency, the source type correction is performed, the backtracking bias source replaces the current bias source type, otherwise no change is made.After the source type correction is completed, the system determines the reliability and outputs the final verification reliability level. The reliability score is composed of three parts weighted by a fixed proportion, which are the percentage value of the final consistency level, the backtracking path score of the path tracking record, and the source consistency degree score. The source consistency degree score is given according to a three-grade value rule, with strong consistency taking 100, weak consistency taking 70, and strong inconsistency taking 40. The weights of the three parts are 40, 40, and 20, respectively. The above weights are determined by historical grid search before going online and are written into a read-only configuration according to the criterion of minimizing the overall error rate and fluctuation. The reliability score obtained by the weighted sum of the three parts is between 0 and 100. The system gives the final verification reliability level according to the level boundary of the reliability score. The boundary is fixed as follows: no less than 80 is judged as high reliability, between 50 and 80 is judged as medium reliability, and less than 50 is judged as low reliability. The three boundary points are determined based on the same historical archives through the inflection point and risk balance point of the receiver operating characteristic curve before going online and are fixed. The setting and determination method of all the above parameters and thresholds are unique and remain unchanged during the task. Specifically, they include the consistency level discrete boundaries 80 and 50, the path node weights 50, 30, and 20, the path consistency rate threshold 60, the backtracking path score threshold 70, the horizontal correlation threshold 75, the near neighbor statistical time length 5 seconds, the source consistency degree scores 100, 70, and 40, the reliability weighting proportions 40, 40, and 20, and the reliability level boundaries 80 and 50.

[0044] The consistency level discrete boundary takes 80 and 50, the two boundary points are determined by the inflection point and risk balance point of the subject work characteristic curve on the historical record, used to divide the final consistency level into high, medium and low three grades and fixed during the task; The node weight of path tracking layer-by-layer comparison takes 50, 30 and 20, which comes from the joint evaluation of discrimination and decision delay, and is determined according to the principle of first layer influence the most, second layer second, and third layer third; The backtracking path score threshold takes 70, which is determined by grid search in the range of 60 to 80 with the criteria of maximum discrimination and minimum sum of false positive rate and false negative rate, and is used as a hard boundary to confirm the source of backtracking deviation; The path consistency rate threshold takes 60, and the statistical window is fixed at 5 seconds, and the above binary is determined after joint evaluation on the candidate window length and the candidate threshold set to ensure the balance between stability and response speed under short-term fluctuations; The horizontal correlation threshold takes 75, which is determined as the compromise point of minimum misjudgment cost and best judgment stability in the candidate 70, 75 and 80, and is used to determine whether to trigger source type correction; The trigger condition of source type correction is that the horizontal correlation score is not less than 75 and the current deviation source type is strongly inconsistent with the backtracking deviation source, both conditions are met to replace; The source consistency degree score adopts three grades of 100, 70 and 40, which is calibrated according to the separability of artificial annotation samples for strong consistency, weak consistency and strong inconsistency, to ensure that the score and the consistency strength correspond monotonously; The weighting proportion of reliability score takes 40, 40 and 20, which is respectively given to the final consistency level, the backtracking path score and the source consistency degree score, and the weight is fixed after minimizing the overall error rate and result jitter on the validation set through grid search; The final verification reliability level boundary takes 80 and 50, which follows the statistical inflection point of consistency grading and is reviewed on the same data set to ensure that the grade interpretation is consistent.

[0045] The input of the method at the beginning is the real-time acquisition of the unmanned aerial vehicle flight trajectory original data stream by the sensor, the historical record for comparison and learning and the similar scene data retrievable therein; After the processing of steps S1 to S7 is completed and the path tracking and reliability synthesis of step S8 are completed, the final output is the identity verification result (pass or fail) and the final verification reliability level (high or medium or low), and a structured record for tracing and reviewing is generated, including the final consistency level, the path consistency score, the backtracking deviation source, the path tracking record and the behavior deviation index, to ensure that the judgment is traceable and reproducible.

[0046] Although the embodiments of the present application have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A dynamic identity authentication method for a drone swarm control communication system, characterized in that, include: S1. Collect flight trajectory and communication mode data of the UAV through sensors, process multi-dimensional information using a timed sampling method, and incorporate noise filtering mechanism and real-time stream processing to obtain real-time behavior feature vectors; S2. Based on the real-time behavior feature vector, a clustering algorithm is used to group the data points, and an isolation forest is applied to separate the groups to initially identify potential biases and determine the current behavior pattern classification. S3. If the current behavior pattern classification matches the historical records within the preset threshold, obtain the matching score, and calculate the difference vector through deviation vector analysis to obtain the behavior deviation index. S4. Based on the behavioral deviation index, use an anomaly detection algorithm combined with local anomaly factors and change quantification indicators to assess the impact of environmental changes and determine the type of deviation source. S5. If the source of the deviation is classified as external interference, similar scenario data is extracted from historical archives, and threshold adaptive adjustment and abnormal score output are incorporated to obtain the adjusted expected feature range. S6. By comparing the adjusted expected feature range with the real-time behavioral feature vector, the information gain split and multi-factor branching processing of the comparison results are applied to determine the final consistency level. S7. Based on the final consistency level, the decision tree algorithm is used to integrate conditional probability calculation and tree depth constraint to handle multiple factors, while incorporating leaf node decision and pruning optimization processes to obtain the identity verification result. S8. Based on the authentication results, use path tracing to record the source type of backtracking deviation and associate it with the consistency level to determine the final authentication reliability level.

2. The dynamic identity authentication method for a drone swarm communication system according to claim 1, characterized in that: S1 includes: By acquiring flight trajectory and communication mode data from the UAV through sensors, and using a timed sampling method to initially fuse the multidimensional information, an initial data sequence is obtained. Based on the initial data sequence, a noise filtering mechanism is incorporated. By applying low-pass filtering to the data points to remove high-frequency interference, a clean filtered sequence is obtained, and preliminary characteristics of real-time behavior are determined. The filtered clean sequence is continuously updated through real-time stream processing. If the noise level exceeds a preset threshold, the sampling interval is adjusted to obtain a dynamic behavior sequence. For dynamic behavior sequences, combined with path anomaly monitoring and signal strength assessment, data fusion and quantification are performed. By merging trajectory deviation and signal fluctuation values ​​through weighted averaging, anomaly vector components are identified. Trajectory optimization calculation elements are extracted from the anomaly vector component, and path points are corrected through linear interpolation to obtain real-time behavior feature vectors.

3. The dynamic identity authentication method for a drone swarm communication system according to claim 1, characterized in that: S2 includes: Behavioral feature vectors are acquired through real-time data collection, and clustering algorithms are used to group the behavioral feature vectors to obtain data point groups. Isolation forest separation is applied to grouped data points. Isolation forest randomly divides grouped data points by constructing multiple isolation trees until a single point is isolated. The isolation path length is calculated to identify potential biases and obtain the bias isolation result. The behavior pattern is determined based on the deviation isolation results. If the deviation exceeds the preset threshold, the abnormal behavior pattern is identified. Obtain pattern classification details from abnormal behavior patterns to determine the current behavior pattern classification; The classification results are obtained by classifying the current behavior pattern, thus forming a behavior pattern classification.

4. The dynamic identity authentication method for a drone swarm communication system according to claim 1, characterized in that: S3 includes: The system obtains the current behavior pattern category, retrieves matching items from historical records, evaluates the matching relationship by comparing with a preset threshold, and obtains a matching score. By analyzing the deviation vector through the matching score, vector components are extracted from the differences between the current pattern collection and the archive record retrieval, and the difference vector is calculated. By employing a difference vector to quantify deviation indicators, and combining the quantification of deviation indicators with the assessment of matching relationships, the degree of behavioral deviation can be determined. To determine the degree of behavioral deviation, a vector space is mapped, and the results of deviation vector analysis are fused from the vector space mapping to obtain an assessment of the deviation relationship. Based on the deviation relationship assessment, behavioral deviation indicators are generated, and details collected from the current pattern are generated by integrating the behavioral deviation indicators.

5. The dynamic identity authentication method for a drone swarm communication system according to claim 1, characterized in that: S4 includes: Through the data acquisition process, behavioral deviation indicators are obtained from environmental changes. The data acquisition process includes real-time capture of behavioral data by sensors and calculation of the difference between the deviation value and the benchmark value to obtain local anomaly factors. Based on local anomaly factors, an anomaly detection algorithm is used in combination with change quantification indicators. The anomaly detection algorithm takes local anomaly factors and quantification indicators as input and outputs an evaluation score. The environmental impact assessment is determined by comparing the calculated score with a preset threshold. Through environmental impact assessment, trend analysis is conducted, which includes tracking the time series of assessment scores and identifying rising or falling patterns to determine the type of source of deviation. The source type of deviation is obtained, and the index fusion method and factor calculation logic are integrated. The index fusion method uses a weighted average of the types and factors, and the factor calculation logic includes multiplying by weight coefficients to obtain the source classification rules. By using source classification rules and combining them with a real-time monitoring mechanism, which includes continuously verifying the matching of rules with new data, the environmental impact of behavioral deviation indicators can be determined.

6. The dynamic identity authentication method for a drone swarm communication system according to claim 1, characterized in that: S5 includes: If the source of the deviation is classified as external interference, similar scenario data is extracted from historical archives, and the arithmetic mean of each deviation item is calculated using the similar scenario data to obtain the initial threshold range. For the initial threshold range, an adaptive threshold adjustment method is used to fuse abnormal score outputs. The adaptive threshold adjustment method determines the dynamic threshold boundary by summing the scores and ranges after applying preset weights. Based on the dynamic threshold boundary, obtain the current behavior indicator data, determine whether the data exceeds the boundary, and obtain the boundary deviation indicator. By incorporating the boundary deviation index into environmental noise filtering, the environmental noise filtering subtracts the preset noise benchmark value from the current behavioral index data to obtain the adjusted expected characteristic range.

7. The dynamic identity authentication method for a drone swarm communication system according to claim 1, characterized in that: S6 includes: By adjusting the expected feature range, the real-time behavioral feature vector is obtained, a secondary comparison is applied to generate a preliminary deviation value, and it is determined that the preliminary deviation value exceeds the preset threshold to obtain the comparison result set. For the comparison result set, the information gain value of each factor is calculated using the information gain splitting method. The information gain splitting method determines the splitting point and the high-gain factor sequence through the entropy reduction calculation formula. Based on the high-gain factor sequence, multi-factor branching is performed. Multi-factor branching extracts at least one dominant factor from the sequence, constructs a branch tree structure, and obtains the branch decision path. From the branch decision path, deviation source type and external interference data are incorporated. Deviation source type is obtained from historical archives, and external interference data is obtained from similar scenario data. The path consistency score is calculated by summing the path factors after applying weights. It is then determined whether the score meets the final consistency level requirements and intermediate consistency indicators are determined. Intermediate consistency metrics are obtained, combined with similar scenario data extracted from historical archives. The similar scenario data is obtained by adaptively adjusting the threshold and fusing the anomaly score output. The boundary deviation metrics are then adjusted to obtain the final consistency level.

8. The dynamic identity authentication method for a drone swarm communication system according to claim 1, characterized in that: S7 includes: Based on the final consistency level, multi-factor conditions are obtained, conditional probabilities are extracted from the multi-factor conditions, and the conditional probabilities are integrated using a decision tree algorithm. The input of the decision tree algorithm is the conditional probability, and the output of the decision tree algorithm is the integrated value. The integrated probability value is obtained by calculating the joint distribution of the conditional probabilities. For probability integration values, tree depth constraints are incorporated to handle multi-factor conditions. The depth control threshold is determined by limiting the maximum level of the tree depth constraint. From the depth control threshold, construct leaf node decisions, fuse leaf node decisions, determine whether the fusion exceeds the preset threshold, and obtain the node decision set; For the node decision set, a pruning optimization process is performed to extract the optimized pruning path. The basis for the verification results is determined by removing branches with contributions below a preset threshold from the optimized pruning path. Based on the obtained verification results, combined with the consistency assessment and results, factor processing is incorporated. Factor processing is derived from multiple factors and conditions. It is determined that the factor processing meets the consistency assessment requirements, and the identity verification results are obtained.

9. A dynamic identity authentication method for a drone swarm communication system according to claim 1, characterized in that: S8 includes: Based on the authentication results, obtain the deviation source type, extract the consistency level association from the deviation source type, and use path tracing records to backtrack the consistency level association through layer-by-layer comparison to obtain the backtracked deviation source; To identify the sources of deviations, source type analysis is incorporated to construct associated deviation types. By matching each type with the consistency level, the association set of deviation types is determined.

10. A dynamic identity authentication method for a drone swarm communication system according to claim 9, characterized in that: S8 further includes: Extract the record tracking path from the deviation type association set, determine whether the record tracking path meets the preset threshold, and obtain the path tracking record; For path tracking records, horizontal correlation judgment is integrated. If the horizontal correlation judgment exceeds the preset threshold, the source type of the deviation is adjusted by source type correction to obtain the adjusted source of deviation. The reliability determination is obtained from the adjusted sources of deviation, and the final verification reliability level is determined by combining the final level assessment.

Images