Unmanned aerial vehicle asset automatic identification method and system based on flow fingerprint, and medium

Abstract

The invention provides an unmanned aerial vehicle asset automatic identification method and system based on a traffic fingerprint, and a storage medium, and relates to the technical field of network asset management. Comprising the steps of acquiring communication data between the unmanned aerial vehicle and a ground station, a flight control platform or a task management platform in real time; constructing a multi-dimensional asset fingerprint database, including constructing an ontology dimension fingerprint for uniquely identifying the identity of the unmanned aerial vehicle assets, and extracting at least one unique identification field; constructing an interaction dimension fingerprint which is used for describing network behavior characteristics of unmanned aerial vehicle assets and is obtained by aggregating communication behaviors, business behaviors and application interaction behaviors of the unmanned aerial vehicle; constructing a state dimension fingerprint used for sensing the operation state of the unmanned aerial vehicle assets in real time, and obtaining the state dimension fingerprint by analyzing a heartbeat packet, a state report or position information; and generating and updating an unmanned aerial vehicle asset ledger according to the multi-dimensional asset fingerprint database. Automatic and dynamic management of unmanned aerial vehicle assets is realized.

Description

Technical Field

[0001] This invention belongs to the field of network asset management technology, and in particular relates to a method, system and storage medium for automatic identification of drone assets based on traffic fingerprinting. Background Technology

[0002] Currently, the power industry mainly relies on traditional methods for the identification and management of drone assets, which can be divided into the following three categories: 1. Manual ledger management: During the drone storage process, maintenance personnel manually record core asset information (including model, serial number, department, etc.) and use this as the basis to form a paper ledger or electronic spreadsheet ledger. This manual maintenance method enables basic management of drone assets.

[0003] 2. Hardware identification and recognition: The drone is equipped with hardware identification items such as QR codes and RFID tags. When it is necessary to identify or inventory assets, a dedicated scanning device is used to scan the identification items at close range to read the relevant information of the drone and complete the asset identification and inventory operation.

[0004] 3. Simple network access identification: Using network technology, obtain the IP address or MAC address of the drone base station connected to the power system network. These two types of network layer addresses are used to perform preliminary identification and differentiation of drone assets to determine whether the assets are connected to the network.

[0005] Existing technologies have significant shortcomings in practical applications, making it difficult to meet the power industry's needs for efficient, precise, and dynamic management of drone assets. Specific deficiencies are as follows: 1. Deficiencies in manual ledger management Poor efficiency and timeliness: It relies on manual recording and updating, which is inefficient and the ledger information cannot be synchronized in real time, resulting in serious delays in updates.

[0006] Low information accuracy: Due to human negligence (such as recording errors or omissions), discrepancies can easily arise between the ledger information and the actual drones, leading to distorted asset information.

[0007] Unable to monitor dynamically: It can only record static basic information of the assets and cannot reflect the dynamic status of the drone in real time (such as online, offline, or under maintenance), and cannot achieve full life cycle status tracking of the assets.

[0008] 2. Hardware identification defects The operation is highly limited: maintenance personnel need to use specialized equipment to make close contact with the drone to complete the identification, which cannot achieve remote identification and automated inventory, thus increasing labor costs.

[0009] Insufficient reliability: Hardware identifiers such as QR codes and RFID tags are susceptible to environmental influences (such as wear and tear, detachment) or human tampering, which can cause the identifiers to become invalid and affect the stability of asset identification.

[0010] 3. Simple network access identification defects Poor identification stability: Drone IP addresses are usually dynamically assigned by DHCP servers, and the addresses are not fixed, so they cannot serve as unique and stable identifiers for assets; MAC addresses can be modified by software, which poses security vulnerabilities and results in low identification reliability.

[0011] Information dimension is missing: It can only obtain network layer address information such as IP and MAC, and cannot identify the key business attributes of drones (such as model, firmware version, business unit, and onboard mission payload), which cannot meet the power industry's needs for refined asset management. Summary of the Invention

[0012] Therefore, the technical problem to be solved by the present invention is to provide an automatic identification method, system and storage medium for drone assets based on traffic fingerprinting, which overcomes the problems of inaccurate information, unclear status and low management efficiency caused by the reliance on manual input and maintenance of drone asset ledgers in the prior art.

[0013] In a first aspect, the present invention provides a method for automatic identification of drone assets based on traffic fingerprinting, comprising: S1 obtains real-time communication data between the UAV and the ground station, flight control platform or mission management platform from network traffic through bypass mirroring. S2 constructs a multi-dimensional asset fingerprint database, including: Construct an ontology-dimensional fingerprint to uniquely identify the identity of the drone asset. Extract at least one unique identification field by parsing the payload content of the application layer protocol. The application layer protocol includes standard protocols or private protocols. Construct an interaction dimension fingerprint to describe the network behavior characteristics of drone assets, which is obtained by aggregating the drone's communication behavior, business behavior and application interaction behavior; Construct a state-dimensional fingerprint to perceive the operational status of drone assets in real time, obtained by parsing heartbeat packets, status reports, or location information; S3, Generate and update the drone asset ledger based on the multi-dimensional asset fingerprint database.

[0014] Furthermore, the construction of the ontology-dimensional fingerprint includes: For standard protocols, the fields specified in the protocol are parsed to extract unique identifiers, which include serial numbers, model numbers, or manufacturer information. For private protocols, a machine learning model is used for deep payload analysis to extract feature combinations to map the identity of UAV assets. The feature combinations include a fixed data packet header structure and sensor data blocks of a specific length.

[0015] Furthermore, the construction of the interaction dimension fingerprint includes: Extract communication behavior characteristics of drones, including long connections with specific servers, heartbeat frequency, transmission protocols, or port numbers; Extract the operational behavior characteristics of the drone, including video streaming protocols; Extract the application interaction behavior characteristics of the drone, including task-related API interfaces and interaction modes.

[0016] Furthermore, the application interaction behavior characteristics of the drone include: The communication objects of the UAV are constructed as a heterogeneous graph, where nodes are communication entities and edges are communication relationships. The embedded representation of the nodes is learned using a graph attention network. The communication objects of the UAV include ground stations, mission platforms, and video servers.

[0017] Furthermore, the construction of the state dimension fingerprint includes: The online status of the drone is determined by analyzing the arrival interval of the heartbeat packets, and it is marked as offline when the interval exceeds a preset threshold. Extract operational status parameters from the status report, including battery level, GPS coordinates, flight mode, or mission execution status; The status parameters are updated in real time to reflect the dynamic status of the drone assets.

[0018] Furthermore, the offline status is determined by the offline risk score (Riskoffline). when At that time, it was in an online state; when At that time, it was in an offline state; ; Heart rate deviation for: ; Communication jitter rate for:

[0019] Control signal silence for:

[0020] Business data activity for:

[0021] Flight mode risk factor for:

[0022] In the formula, The preset threshold; arrive These are the weighting coefficients; The actual time interval between two consecutive heartbeats. This is the known standard heartbeat interval for this type of drone; T 1 ,T 2 ,...,T N They are respectively N One heartbeat interval.

[0023] Furthermore, the construction of the multi-dimensional asset fingerprint database includes: Using a multi-head attention mechanism model and a query-key-value mechanism, the ontology dimension fingerprint, the interaction dimension fingerprint, and the state dimension fingerprint are fused. The attention weight expression in the multi-head attention mechanism model is as follows:

[0024] F =[ f 本体 ,f 交互 ,f 状态 ] ; in, T The number of feature sources; d k Represents the key vector K The dimension is a configurable hyperparameter; Q, K, V Each by F The output, obtained through linear transformation, is the weighted fusion feature. Q For query vector, K For key vectors, V It is a value vector.

[0025] Furthermore, the step of generating and updating the drone asset ledger based on the multi-dimensional asset fingerprint database includes: When a new drone first connects to the network, a new record is automatically created in the ledger by parsing the ontology-dimensional fingerprint. The new record includes the asset number, model, serial number, affiliated unit, or entry time. The ontology-dimensional fingerprint is dynamically associated with the interaction-dimensional fingerprint and the state-dimensional fingerprint, and the dynamic fields in the ledger are automatically updated, including the last online time, current status, real-time battery level, last location, or associated task ID.

[0026] Secondly, the present invention provides an automatic drone asset identification system based on traffic fingerprinting, comprising: The input module obtains real-time communication data between the UAV and the ground station, flight control platform, or mission management platform from network traffic via bypass mirroring. A multi-dimensional asset fingerprint database, including: Construct an ontology-dimensional fingerprint to uniquely identify the identity of the drone asset. Extract at least one unique identification field by parsing the payload content of the application layer protocol. The application layer protocol includes standard protocols or private protocols. Construct an interaction dimension fingerprint to describe the network behavior characteristics of drone assets, which is obtained by aggregating the drone's communication behavior, business behavior and application interaction behavior; Construct a state-dimensional fingerprint to perceive the operational status of drone assets in real time, obtained by parsing heartbeat packets, status reports, or location information; The output module generates and updates the drone asset ledger based on the multi-dimensional asset fingerprint database.

[0027] Thirdly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements any of the methods described above. Beneficial effects

[0028] This invention constructs a multi-dimensional asset fingerprint database for UAV communication: (1) Ontology-dimensional fingerprint solves the "who is it" problem: For standard protocols followed by UAVs and ground stations (GCS) or flight control platforms (such as MAVLink, DJI SDK, etc.), extract the unique identification fields (such as UAV_Serial_Number, MODEL_ID) embedded in the protocol as strong identity fingerprints.

[0029] For proprietary or non-standard protocols, the system deeply analyzes their business data payloads. Through feature matching, machine learning, and other methods, it extracts uniquely identifiable feature combinations (such as specific sensor data formats or unique heartbeat packet structures) from telemetry data, status reports, and other information, establishing a mapping relationship between <fingerprint features and asset identity>. This overcomes the limitations of relying solely on low-level network information, achieving accurate identification based on application-layer services.

[0030] (2) Interactive fingerprinting solves the problem of "what features are there": Extracting communication behavior features: This includes not only the standard five-tuple (source / destination IP, port, protocol), but also, more importantly, extracting UAV-specific interaction features, such as: long-term connection heartbeats with specific flight control servers / ports; specific ports and protocols used for transmitting video streams (e.g., RTP / RTSP); and protocols and API interfaces used when interacting with power-specific application systems (e.g., inspection task management systems). These features collectively constitute the network behavior profile of the UAV asset, enriching the identification dimensions and enabling assisted identification and association even when the intrinsic fingerprint is temporarily missing.

[0031] (3) State-dimensional fingerprints solve the problem of "what is the state": It connects to and analyzes the registration, heartbeat, and status reporting traffic of drone property management platforms or flight control systems. By continuously monitoring and analyzing the frequency and content of heartbeat packets, it determines the online / offline status of assets in real time. Information such as battery level, GPS coordinates, flight mode (e.g., hovering, cruising, return to home), and mission execution status are extracted from status reports to build a dynamically updated asset status profile, providing data support for the entire asset lifecycle management.

[0032] This invention features an automated ledger generation and dynamic update mechanism: Automatic discovery and entry: The system automatically discovers and identifies newly connected drone assets by analyzing network traffic in real time, and automatically creates new records in the asset ledger using the extracted multi-dimensional fingerprint information (mainly the ontology dimension) without manual intervention.

[0033] Dynamic association and updates: The system dynamically associates the identified asset identity with its real-time status (status dimension) and behavioral characteristics (interaction dimension), and automatically updates the asset ledger. For example, a record in the ledger not only includes the drone's model and serial number, but also automatically updates dynamic information such as its last online time, whether it is currently performing a task, and the location of its most recent task. Attached Figure Description

[0034] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0035] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0036] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. The principles and features of the present invention are described below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other. The embodiments given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0037] This invention aims to solve three core problems in existing drone asset management technologies: First, asset identity is "blind," meaning that it is impossible to achieve automatic and accurate identification beyond IP / MAC addresses, making it difficult to obtain specific business identity information such as device model, serial number, and affiliated unit; second, asset status is "blind," meaning that there is a lack of real-time automated perception capabilities for the online, offline, active, and idle operating status of drones, making it impossible to dynamically monitor the asset lifecycle; and third, asset ledgers are "static," meaning that reliance on manual maintenance leads to delayed ledger updates and static rigidity. It is necessary to achieve automatic discovery, updating, and dynamic maintenance of ledger information to ensure that the ledger is continuously consistent with the actual asset status.

[0038] Example 1 like Figure 1 As shown, this embodiment discloses an automatic identification method for drone assets based on traffic fingerprinting, including: S1, obtains real-time communication data between the UAV and the ground station, flight control platform or mission management platform from network traffic; S2 constructs a multi-dimensional asset fingerprint database, including: Construct an ontology-dimensional fingerprint to uniquely identify the identity of the drone asset. Extract at least one unique identification field by parsing the payload content of the application layer protocol. The application layer protocol includes standard protocols or private protocols. Construct an interaction dimension fingerprint to describe the network behavior characteristics of drone assets, which is obtained by aggregating the drone's communication behavior, business behavior and application interaction behavior; Construct a state-dimensional fingerprint to perceive the operational status of drone assets in real time, obtained by parsing heartbeat packets, status reports, or location information; S3, Generate and update the drone asset ledger based on the multi-dimensional asset fingerprint database.

[0039] Furthermore, the network traffic is collected via a bypass mirroring method.

[0040] Furthermore, the construction of the ontology-dimensional fingerprint includes: For standard protocols, the fields specified in the protocol are parsed to extract unique identifiers, which include serial numbers, model numbers, or manufacturer information. For private protocols, a machine learning model is used for deep payload analysis to extract feature combinations to map the identity of UAV assets. The feature combinations include a fixed data packet header structure and sensor data blocks of a specific length.

[0041] Furthermore, the construction of the interaction dimension fingerprint includes: Extract communication behavior characteristics of drones, including long connections with specific servers, heartbeat frequency, transmission protocols, or port numbers; Extract the operational behavior characteristics of the drone, including video streaming protocols; Extract the application interaction behavior characteristics of the drone, including task-related API interfaces and interaction modes.

[0042] Furthermore, the construction of the state dimension fingerprint includes: The online status of the drone is determined by analyzing the arrival interval of heartbeat packets, and it is marked as offline when the interval exceeds a preset threshold. Extract operational status parameters from the status report, including battery level, GPS coordinates, flight mode, or mission execution status; The status parameters are updated in real time to reflect the dynamic status of the drone assets.

[0043] Furthermore, the generation and updating of the drone asset ledger based on the multi-dimensional asset fingerprint database includes: When a new drone first connects to the network, a new record is automatically created in the ledger by parsing the ontology-dimensional fingerprint. The new record includes the asset number, model, serial number, affiliated unit, or entry time. The ontology-dimensional fingerprint is dynamically associated with the interaction-dimensional fingerprint and the state-dimensional fingerprint, and the dynamic fields in the ledger are automatically updated, including the last online time, current status, real-time battery level, last location, or associated task ID.

[0044] Furthermore, the drone asset ledger includes the drone's static attributes, dynamic status, and network behavior information.

[0045] To avoid repetition, the more detailed steps of the embodiments of the present invention are described in conjunction with the automatic identification system for drone assets in Embodiment 2. Example 2

[0046] This embodiment discloses an automatic identification system for drone assets based on traffic fingerprinting. It accesses the traffic of the core network node through a bypass mirroring method to achieve automated, refined, and dynamic management of drone assets across the entire network.

[0047] 1. Scenario Overview.

[0048] A provincial power grid company owns hundreds of drones of various models for power line inspection. These drones come from different manufacturers (such as DJI and XAG), use different communication protocols [MAVLink (Micro Air Vehicle Link) is a lightweight binary messaging protocol designed for communication between resource-constrained drone systems (such as small drones, ground stations, and airborne components), proprietary protocols, etc.], and communicate with multiple backend systems (such as flight control platforms, mission management platforms, and video analytics platforms). Traditionally, asset ledgers rely on manual entry and maintenance, resulting in inaccurate information, unclear status, and low management efficiency.

[0049] 2. System composition and implementation process.

[0050] Step 1: Data input. The system obtains raw data from the network traffic of the mirror.

[0051] Configure traffic mirroring on the power company's core network nodes (such as switches connecting the flight control platform and mission management system) to copy and send all network data packets related to UAV communication (including communication between the ground station and the UAV, and between the UAV and various servers) to this system.

[0052] Step 2: Constructing a multi-dimensional asset fingerprint database.

[0053] (1) Ontology-dimensional fingerprint collection and recognition (solving "who is it").

[0054] Power Standard Protocol Parsing (MQTT Protocol): After detecting MQTT protocol traffic, the system parses its data payload content, extracts the serial_number and type fields, and directly forms a strong identity fingerprint. For example, it identifies a drone as {SN: AB12345, Model: DJI Matrice 350}.

[0055] Non-standard / proprietary protocol parsing: For proprietary protocol traffic that cannot be directly parsed, the system uses a machine learning model for in-depth payload analysis. For example, by analyzing the unique heartbeat packet structure between a certain type of UAV and the ground station (such as a fixed data packet header of 0xA5F1 and sensor data blocks of a specific length), a set of feature combinations {Header: 0xA5F1,Payload_Length: 128, Sensor_Data_Offset: 0x10} is extracted and mapped to the asset identity {Vendor: Vendor A, Model: PowerInspector X3}.

[0056] (2) Interactive dimension fingerprint modeling (solving the question of "what features are there").

[0057] The system continuously monitors the network behavior of the identified drones and constructs their interaction fingerprints: Communication behavior: It was found that the drone maintained a long connection with port 14550 of IP address 10.10.1.100 and sent a heartbeat packet once per second.

[0058] Business behavior: It was discovered that when the drone was performing a task, it would initiate RTSP video stream transmission to port 554 of IP10.10.2.200.

[0059] Application Interaction: It was discovered that the drone communicates with the power inspection task management system (IP: 10.10.3.50) through a specific RESTful API (such as POST / api / task / start) at the start and end of the mission.

[0060] All these behavioral characteristics are aggregated to form the drone's "network behavior profile." Even if its communication is briefly encrypted, making its ontology fingerprint unreadable, its identity and business intent can be inferred from its interaction with specific servers.

[0061] The communication objects of the UAV (such as ground stations, mission platforms, and video servers) are constructed as heterogeneous graphs, with nodes representing communication entities and edges representing communication relationships. Graph Attention Network (GAT) is used to learn the embedded representations of nodes and identify abnormal interaction behaviors.

[0062] Graph construction and embedding learning process: Node set V = {UAV, Ground station, Mission platform, Video server} side e ij To represent communication relationships, edge characteristics include protocol type, communication frequency, and data volume. Using GAT for node embedding:

[0063] in is the attention weight, used to measure the importance of node j to i.

[0064] (3) State dimension fingerprint perception (solving the question of "how is the state").

[0065] The system continuously analyzes the heartbeat and status reports from the drone.

[0066] Online status: Determined in real time by the arrival interval of heartbeat packets. If no heartbeat is received for more than a threshold (e.g., 15 seconds), it is marked as "offline".

[0067] As a preferred implementation, this embodiment no longer relies solely on the heartbeat packet arrival interval, but comprehensively considers multiple dimensions of characteristics such as communication link quality, flight control status, and service data activity. It uses a weighted scoring system and a fuzzy logic-based decision function to jointly determine the final online status of the UAV.

[0068] The following feature factors are calculated in real time: Heart rate deviation It measures the degree of deviation between the current heart rate interval and the standard interval.

[0069]

[0070] in, It is the actual time interval between two consecutive heartbeats. This is the known standard heartbeat interval (e.g., 1 second) for this type of drone.

[0071] Communication jitter rate Assess the stability of recent communication links. Calculate past... The standard deviation of the heart rate interval.

[0072]

[0073] Control signal silence It detects whether no downlink control commands (such as MAVLink commands from ground stations) have been received for an extended period. This is a continuous representation of a Boolean characteristic.

[0074]

[0075] Business data activity This determines whether the drone is still generating valid operational data. For example, if GPS coordinates are not updated for an extended period or the video stream is interrupted during mission execution, its activity level is reduced.

[0076]

[0077] Flight mode risk factor The risk of "loss of contact" is assessed based on the current flight mode. For example, the perception of the risk of communication interruption differs between "automatic return to home" or "emergency landing" modes and "manual control" modes.

[0078]

[0079] The offline risk score calculation integrates the above features into a comprehensive offline risk score. :

[0080] in, arrive These are the weight coefficients of each feature, and These weights can be obtained through training on historical data, or set by domain experts based on experience (e.g., ...). ).

[0081] Fuzzy decision logic: The final offline status determination is not a simple hard threshold, but a fuzzy logic process: low-risk areas The status is determined to be "online".

[0082] medium-risk area The system is flagged as "suspected offline." It will then activate auxiliary verification mechanisms, such as attempting to send probe packets via an alternate channel or combining observations from other drones for assessment.

[0083] High-risk areas The system determines the asset to be "offline." The system immediately updates the asset ledger status and triggers an alarm.

[0084] ( and (For preset threshold) Operating status: Extract battery level (battery_remaining) from MAVLink's SYS_STATUS message, extract GPS coordinates from GLOBAL_POSITION_INT message, and extract flight mode (custom_mode, such as hover or return to home) from HEARTBEAT message.

[0085] For example, the system updates the asset status in real time as: {Status: Online, Power: 65%, Location: [Longitude, Latitude], Mode: Task Patrol, Task: 220kV Line A Phase Inspection}.

[0086] Step 3: Automated ledger generation and dynamic updates.

[0087] Automatic Discovery and Entry: When a new UAV first connects to the network and communicates with the ground station, the system immediately extracts its physical fingerprint (such as serial number) by analyzing its communication traffic. Subsequently, the system automatically creates a new record in the asset ledger, filling in [Asset Number: UAV-20240702-001, Model: DJI M350, Serial Number: AB12345, Affiliated Unit: Hangzhou Inspection Center, Entry Time: 2024-07-02 10:00:00].

[0088] Dynamic association and updates: The system dynamically associates the asset's ontological fingerprint with the real-time collected state dimension and interaction dimension fingerprints.

[0089] The record in the ledger will be automatically updated in real time, adding dynamic fields: [Last online time: 2024-07-02 14:30:01, Current status: Online / Task in progress, Real-time battery level: 45%, Last position: [XXX, YYY], Associated video stream: 10.10.2.200:554, Associated task ID: TASK-001].

[0090] In the process of fusion of three types of fingerprints, a multi-head attention mechanism is introduced to dynamically weight the contribution of each type of fingerprint and improve the recognition robustness.

[0091] Attention weights are calculated as follows: Let the three types of fingerprint features be: F =[ f 本体 ,f 交互 ,f 状态 Using a query-key-value mechanism:

[0092] in, T The number of feature sources can be set to [value]. T =3; d k Represents the key vector K The dimension is a configurable hyperparameter; Q, K, V Each by F The output, obtained through linear transformation, is the weighted fusion feature. Q For query vector, K For key vectors, V It is a value vector.

[0093] in the formula It is a crucial scaling factor.

[0094] when When the value of is very large, the result of the dot product QKT can become very large (because it is the sum of multiple numerical products).

[0095] This will lead to Softmax The gradient of the function becomes very small (entering the saturation region), which is the so-called "vanishing gradient" problem, making the model difficult to train.

[0096] pass We scale the result of the dot product back to a more stable range of variance to ensure the stability and effectiveness of the training process.

[0097] Create a unified asset view: Ultimately, administrators see a unified, visual view of their assets on the management interface. The view displays all drones in list or map format, with each drone's information card integrating static identity (model / SN), real-time status (online / battery level / location), and dynamic behavior (mission in progress / video transmission). This view is a "living" digital mirror, accurately reflecting the real-time status of drone assets in the physical world.

[0098] Compared with the prior art, the present invention has the following characteristics: 1. Multi-dimensional fingerprint extraction technology based on deep analysis of application layer protocols.

[0099] Beyond traditional IP / MAC address recognition, it delves into the payloads of application layer protocols such as MAVLink and proprietary protocols to extract strong identity identifiers and business characteristics. From the specified fields of standard protocols (such as serial numbers) and / or the payloads of non-standard protocols, it extracts feature information used to uniquely identify UAV assets through parsing and feature matching to form an "ontology fingerprint".

[0100] 2. A "three-in-one" asset fingerprint fusion and collaborative identification model.

[0101] Instead of using a single feature in isolation, this approach creatively links and merges "ontology fingerprints" (static identity), "interaction fingerprints" (network behavior), and "state fingerprints" (operational status) to form a three-dimensional, complementary digital profile of assets. This technical solution integrates and merges three types of feature information representing identity, behavior, and status to create a unified, multi-dimensional asset profile. Particularly noteworthy is the mechanism that utilizes interaction fingerprints for auxiliary identification when the ontology fingerprint is missing.

[0102] 3. A fingerprint-driven mechanism for the fully automated generation and dynamic updating of asset ledgers.

[0103] By using the identified multi-dimensional fingerprints as input, records are automatically created and updated in the ledger, transforming it from a "static manual" into a "dynamic mirror." Based on the automatic analysis results of network traffic (i.e., multi-dimensional fingerprints), a technical process and method are triggered for the automated creation, information association, and real-time updating of the asset ledger. This achieves a closed loop from "perception" to "management."

[0104] By deeply analyzing the application layer communication protocol of drones, extracting three types of fingerprints in parallel—identity, behavior, and status—and fusing these three types of fingerprints, the system can achieve automated and dynamic management of the entire lifecycle of asset ledgers, from discovery and identification to status monitoring.

[0105] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for automatic identification of UAV assets based on traffic fingerprints, the method comprising: Comprise: S1, real-time acquisition of communication data between the UAV and the ground station, flight control platform or task management platform from network traffic by bypass mirroring; S2, constructing a multi-dimensional asset fingerprint library, comprising: constructing an ontology dimension fingerprint for uniquely identifying the identity of the UAV asset by analyzing the payload content of the application layer protocol and extracting at least one unique identifier field, the application layer protocol including standard protocols or private protocols; constructing an interaction dimension fingerprint for describing the network behavior characteristics of the UAV asset by aggregating the communication behavior, business behavior and application interaction behavior of the UAV; constructing a state dimension fingerprint for real-time perception of the running state of the UAV asset by analyzing heartbeat packets, status reports or location information; S3, generating and updating the UAV asset ledger according to the multi-dimensional asset fingerprint library.

2. The method of claim 1, wherein, The construction of the ontology dimension fingerprint comprises: for standard protocols, parsing the fields specified in the protocol to extract unique identifiers, including serial numbers, model numbers or manufacturer information; for private protocols, using a machine learning model for deep payload analysis to extract feature combinations to map the identity of the UAV asset, the feature combinations including fixed packet header structures and specific length sensor data blocks.

3. The method of claim 2, wherein, The construction of the interaction dimension fingerprint comprises: extracting communication behavior characteristics of the UAV, including long connections with specific servers, heartbeat packet frequencies, transmission protocols or port numbers; extracting business behavior characteristics of the UAV, including video stream transmission protocols; extracting application interaction behavior characteristics of the UAV, including task-related API interfaces and interaction modes.

4. The method of claim 3, wherein, The application interaction behavior characteristics of the UAV comprise: constructing the communication objects of the UAV as a heterogeneous graph, with nodes as communication entities and edges as communication relationships, using a graph attention network to learn the embedded representation of the nodes, the communication objects of the UAV including ground stations, task platforms and video servers.

5. The method of claim 3, wherein, The construction of the state dimension fingerprint comprises: determining the online state of the UAV by analyzing the inter-arrival interval of heartbeat packets, and marking it as offline when the threshold is exceeded; extracting running state parameters from status reports, including battery level, GPS coordinates, flight mode or task execution status; updating the state parameters in real time to reflect the dynamic state of the UAV asset.

6. The method of claim 5, wherein, the offline state, by an offline risk score Risk offline determining the offline state: When is online; When is offline state; ； Heartbeat deviation is: ； Communication jitter rate Is: ； Control signal quietness Is: ； Business data activity For: ； Flight mode risk factor is: ； In the formula, is a preset threshold value; to is a weight coefficient; is the actual time interval of two adjacent heartbeats, is the standard heartbeat interval known for the model of the UAV; T 1 ,T 2 ,...,T N respectively, N heartbeats.

7. The method of claim 5, wherein, The construction of the multi-dimensional asset fingerprint library comprises: using a multi-head attention mechanism model to fuse the ontology dimension fingerprint, the interaction dimension fingerprint and the state dimension fingerprint using a query-key-value mechanism, the attention weight expression in the multi-head attention mechanism model being: ； F =[ f 本体 ,f 交互 ,f 状态 ] ； wherein, T is the number of feature sources; d k represent key vector K is a configurable hyper-parameter; Q, K, V are respectively obtained by F through linear transformation, and the output is the weighted fusion feature; Q is a query vector, K is a key vector, V is a value vector.

8. The method of claim 1, wherein, The generation and update of the UAV asset ledger according to the multi-dimensional asset fingerprint library comprises: when a new UAV first accesses the network, automatically creating a new record in the ledger by analyzing the ontology dimension fingerprint, the new record including asset number, model number, serial number, ownership unit or entry time; dynamically associating the ontology dimension fingerprint with the interaction dimension fingerprint and the state dimension fingerprint, and automatically updating the dynamic fields in the ledger, including last online time, current state, real-time power, last location or associated task ID.

9. A drone asset automatic identification system based on traffic fingerprint, characterized in that, Comprise: An input module, which acquires communication data between the UAV and the ground station, the flight control platform or the task management platform in real time from network traffic through a bypass mirroring mode; A multi-dimensional asset fingerprint library, comprising: constructing a ontology dimension fingerprint for uniquely identifying the identity of the UAV asset by analyzing the payload content of an application layer protocol, extracting at least one unique identification field, and the application layer protocol comprising a standard protocol or a private protocol; constructing an interaction dimension fingerprint for describing the network behavior characteristics of the UAV asset by aggregating the communication behavior, business behavior and application interaction behavior of the UAV; constructing a state dimension fingerprint for real-time sensing the running state of the UAV asset by analyzing heartbeat packets, state reports or location information; An output module for generating and updating a UAV asset ledger according to the multi-dimensional asset fingerprint library.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the method of any one of claims 1 to 7.

Images