Unmanned aerial vehicle communication flow threat detection method and system based on power business characteristics

Abstract

The invention discloses an unmanned aerial vehicle communication flow threat detection method and system based on power business characteristics, and belongs to the technical field of network security. The invention aims to solve the problems of low detection precision and poor adaptability caused by lack of service scene perception and dependence on static characteristics of an existing unmanned aerial vehicle threat detection scheme. The method comprises the following steps: collecting unmanned aerial vehicle communication traffic, performing protocol analysis, and mapping into a business semantic event based on a power business knowledge base; constructing a multi-dimensional dynamic behavior baseline comprising a space-time model, an instruction sequence model and a flow characteristic model based on historical data; and comparing the real-time business semantic event with the dynamic behavior baseline to detect an abnormal behavior, and triggering a self-adaptive response. According to the method, the dynamic and adaptive behavior model is constructed by deeply fusing the power business logic, known and unknown threats inconsistent with the business process can be accurately identified, and the detection accuracy and the adaptability to complex attack scenes are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for detecting drone communication traffic threats based on the characteristics of power business, which is especially suitable for drone inspection, operation and maintenance and other business scenarios in the power industry. Background Technology

[0002] With the rapid development of drone technology, its application in the power industry is becoming increasingly widespread, such as power transmission line inspection, substation monitoring, and emergency repairs. When drones perform these critical tasks, the security of their communication links is paramount. However, drone communication systems also face increasingly serious security threats, such as command injection, GPS spoofing, and data theft.

[0003] Currently, most threat detection solutions for drone communications draw inspiration from traditional Network Intrusion Detection Systems (NIDS), such as those based on core engines like Snort or Suricata. These solutions typically follow this workflow: first, the captured network traffic is decoded; then, a preprocessor performs stream reconstruction and other operations; finally, the data packets are matched against a predefined rule base, triggering an alert if a match is found. The rule base mainly consists of general network attack rules (such as port scanning and DDoS attacks) and simple customized rules for common drone protocols (such as MAVLink).

[0004] However, existing technical solutions have the following significant drawbacks: 1. Lack of Business Scenario Awareness: Traditional detection systems primarily focus on attack characteristics at the network and transport layers. Their rule bases are generic and cannot deeply analyze the specific communication protocols and business logic of power drones in specific business scenarios. For example, the system cannot distinguish whether a "fly to a certain coordinate" command is performing a legitimate inspection task or a malicious act of deviating from the flight path and intending to approach a sensitive area. This results in a low detection rate for industry-specific abnormal behaviors (such as unauthorized inspections and injection of abnormal command sequences), and is prone to generating a large number of false alarms due to the inability to understand normal business operations.

[0005] 2. Reliance on static signature databases, resulting in poor adaptability: Some solutions employ detection methods based on static fingerprints (such as drone MAC addresses and default communication ports) or fixed thresholds (such as traffic exceeding limits). However, drone communication is highly dynamic; its IP addresses and ports may be dynamically assigned, and attackers' methods are constantly evolving. Detection methods relying on static signatures are easily bypassed and cannot effectively address logical attacks launched using legitimate command combinations, unauthorized operations by internal personnel, and emerging unknown threats.

[0006] Therefore, how to deeply integrate the characteristics of power business and build a drone communication threat detection model that can dynamically adapt to business changes in order to accurately identify various security threats against power drones is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0007] This invention aims to address the problems in existing drone threat detection schemes, such as the lack of deep analysis capabilities for power business semantics and the over-reliance on static feature libraries leading to insufficient detection capabilities for business logic-related and unknown threats.

[0008] Specifically, the present invention mainly solves the following technical problems: How to deeply analyze the dedicated communication protocol of power drones and map it to specific power business semantics, so that the detection system can understand the legitimacy of communication commands in a specific business context.

[0009] How can we overcome the limitations of static feature detection, establish a dynamic and multi-dimensional baseline for the normal behavior of power drones in complex operations, and possess self-learning and adaptive capabilities to detect abnormal behaviors that deviate from normal business logic?

[0010] The first aspect of this invention discloses a method for detecting threats in unmanned aerial vehicle (UAV) communication traffic based on power service characteristics; the method includes: Collect real-time communication traffic between the UAV and the ground control system; The real-time communication traffic is parsed to extract protocol commands and parameters; Based on a pre-built power business knowledge base, the protocol instructions and parameters are mapped into business semantic events that include business actions and business objectives; Based on historical business semantic events, construct multi-dimensional dynamic behavior baselines for different power business scenarios, including time-series behavior patterns and communication characteristics; The real-time generated business semantic events are compared with the multi-dimensional dynamic behavior baseline to detect abnormal behaviors that deviate from the baseline. When abnormal behavior is detected, a threat alert is generated and a response action is executed according to the preset policy.

[0011] Preferably, the step of mapping protocol instructions and parameters to business semantic events includes: Extract key parameters such as flight coordinates and action type from the protocol instructions; In the power business knowledge base, information on associated power equipment is queried and matched based on the flight coordinates; By combining the action type and the matching power equipment information, the corresponding business action and business target are searched in the preset business action mapping rules to generate the business semantic event.

[0012] Preferably, the power business knowledge base includes: a power equipment spatial library storing the geographical location and safety range of power equipment, an inspection task plan library storing predetermined inspection plans, and a business action mapping rule library defining the mapping relationship between protocol instructions and business actions.

[0013] Preferably, the multi-dimensional dynamic behavior baseline includes at least one of the following: The spatiotemporal model is used to define the legal geographical range, altitude range, speed range, and operating time window for drones under specific power services. Instruction sequence model, used to learn and define legal instruction sequence patterns and their transition probabilities in normal power business processes; Traffic characteristic models are used to define the range of network traffic characteristics such as normal communication bandwidth, packet rate, and uplink / downlink traffic ratio under different service actions.

[0014] Preferably, the instruction sequence model is constructed based on a combination of an N-gram model and a probabilistic suffix tree (PST); high-frequency sequences are extracted using N-gram, and the probability of subsequent instructions is predicted using PST.

[0015] Preferably, the step of comparing the real-time generated business semantic events with a multi-dimensional dynamic behavior baseline includes: Extract real-time behavioral feature vectors covering spatiotemporal features, instruction sequence features, and traffic features from the real-time business semantic events and communication traffic; The Isolation Forest algorithm is used to perform unsupervised anomaly detection on the real-time behavioral feature vectors, and anomaly scores are output. When the abnormal score exceeds a preset threshold, it is determined to be abnormal behavior.

[0016] Preferably, the response action includes: calling the flight control platform through the application programming interface (API) to issue a safety command to the UAV, the safety command including emergency return to home, switching to a secure communication channel, or initiating link encryption.

[0017] A second aspect of this invention discloses a threat detection system for unmanned aerial vehicle (UAV) communication traffic based on power service characteristics; the system includes: The traffic acquisition module is used to collect real-time communication traffic between the UAV and the ground control system; The protocol parsing layer, connected to the traffic acquisition module, is configured to perform protocol parsing on the real-time communication traffic to extract protocol instructions and parameters, and map the protocol instructions and parameters into business semantic events based on a pre-set power business knowledge base; The behavior analysis layer, connected to the protocol parsing layer, is configured to build and maintain a multi-dimensional dynamic behavior baseline that includes temporal behavior patterns and communication characteristics based on historical business semantic events. An anomaly detection engine, connected to the protocol parsing layer and the behavior analysis layer, is configured to compare real-time generated business semantic events with the multi-dimensional dynamic behavior baseline to detect abnormal behaviors that deviate from the baseline. The response feedback layer is connected to the anomaly detection engine and is configured to generate a threat alarm and execute response actions according to a preset strategy when abnormal behavior is detected.

[0018] Preferably, the protocol parsing layer includes: A multi-protocol adapter for automatically identifying and parsing various drone communication protocols; The business semantic extractor is used to query the power business knowledge base and map the parsed protocol fields to specific power business actions.

[0019] Preferably, the behavior analysis layer includes: The power business behavior modeling module is used to learn from historical data and build spatiotemporal models, instruction sequence models, and flow characteristic models to jointly constitute the multi-dimensional dynamic behavior baseline. The machine learning module includes a built-in Isolation Forest algorithm for anomaly scoring of behavioral feature vectors generated based on real-time business semantic events.

[0020] Compared with the prior art, the present invention has the following beneficial effects: High detection accuracy and low false alarm rate: This invention achieves understanding from "syntax" to "semantics" by deeply analyzing communication protocols and combining them with a power business knowledge base. It can accurately identify malicious behaviors and violations that contradict business logic, effectively distinguish between normal business fluctuations and real security threats, thereby significantly improving detection accuracy and reducing false alarm rate.

[0021] Highly adaptable and capable of detecting unknown threats: This invention employs dynamic behavioral baseline modeling based on machine learning, enabling it to automatically learn and adapt to normal behavioral patterns under different inspection tasks and environments. Any behavior that does not conform to the learned "normal" patterns, even novel attacks without fixed characteristics, can be detected as anomalies, thus possessing the ability to detect unknown threats.

[0022] Automation and intelligence in response: This invention can not only detect threats, but also assess the actual business impact of threats through a business alarm correlation engine, and trigger adaptive, closed-loop response actions based on risk level (such as calling the flight control platform via API to make the drone return to home), realizing the transformation from passive monitoring to proactive defense, and improving the efficiency and intelligence level of security incident handling. Attached Figure Description

[0023] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of a drone communication traffic threat detection system based on power service characteristics provided in an embodiment of the present invention.

[0025] Figure 2 This is a flowchart of a method for detecting threats to unmanned aerial vehicle (UAV) communication traffic based on power service characteristics, provided by an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] Example 1: Please see Figure 1 This invention provides a drone communication traffic threat detection system 100 based on power business characteristics. The system 100 can be deployed in the network environment of a power company for real-time monitoring and protection of drones performing power tasks. The overall architecture of the system 100 includes: a traffic acquisition module 10, a protocol parsing layer 20, a behavior analysis layer 30, an anomaly detection engine 40, and a response feedback layer 50.

[0028] Traffic acquisition module 10 is used to acquire real-time communication traffic between the UAV and the ground control system; Protocol parsing layer 20, connected to the traffic acquisition module, is configured to perform protocol parsing on the real-time communication traffic to extract protocol instructions and parameters, and map the protocol instructions and parameters into business semantic events based on a pre-set power business knowledge base; The behavior analysis layer 30, connected to the protocol parsing layer, is configured to build and maintain a multi-dimensional dynamic behavior baseline that includes temporal behavior patterns and communication characteristics based on historical business semantic events. An anomaly detection engine 40, connected to the protocol parsing layer and the behavior analysis layer, is configured to compare real-time generated business semantic events with the multi-dimensional dynamic behavior baseline to detect abnormal behaviors that deviate from the baseline. The response feedback layer 50 is connected to the anomaly detection engine and is configured to generate a threat alarm and execute response actions according to a preset strategy when an abnormal behavior is detected.

[0029] The protocol parsing layer 20 includes: A multi-protocol adapter for automatically identifying and parsing various drone communication protocols; The business semantic extractor is used to query the power business knowledge base and map the parsed protocol fields to specific power business actions.

[0030] The behavior analysis layer 30 includes: The power business behavior modeling module is used to learn from historical data and build spatiotemporal models, instruction sequence models, and flow characteristic models to jointly constitute the multi-dimensional dynamic behavior baseline. The machine learning module includes a built-in Isolation Forest algorithm for anomaly scoring of behavioral feature vectors generated based on real-time business semantic events.

[0031] The functions of each module in this system are described in detail below: Traffic acquisition module 10: This module is deployed on the core switching node of the power company's network. Through port mirroring (SPAN) or network splitter (TAP) technology, it seamlessly replicates all network communication data packets related to the drone. These data packets include, but are not limited to, all uplink and downlink traffic between the drone and the ground control station, the drone and the mission management cloud platform, and the drone and the data processing server. The collected raw traffic is sent to the protocol resolution layer 20 in real time and completely.

[0032] Protocol parsing layer 20: This layer is the first step in achieving "business awareness," and its core task is to transform raw network data packets into structured events that are machine-understandable and have business meaning. This layer mainly consists of two core components: Multi-protocol Adapter: Responsible for identifying and parsing various drone communication protocols. Since the power industry may use drones from different manufacturers and models simultaneously, this adapter adopts a plug-in architecture, supporting mainstream and proprietary protocols such as MAVLink, DJI Lightbridge, and OcuSync. Its workflow is as follows: Fast port matching: First, the source / destination port number of the data packet is compared with the preset "port-protocol" mapping table (such as UDP14550->MAVLink) to quickly identify the protocol type.

[0033] Magic Byte Identification: If the port does not match or is not unique, the first few bytes of the application layer payload are read and precisely matched with the "magic byte" (MagicByte, such as 0xFD of MAVLinkv2) of each protocol.

[0034] Protocol feature verification: If the first two steps fail, extract structural features such as message length and checksum type, perform fuzzy matching with the protocol template, and select the parser with the highest matching degree. If it still cannot be identified, mark it as "unknown protocol" and issue an alarm.

[0035] Business semantic extractor: This function is responsible for associating the parsed purely technical protocol fields with the power business context, assigning them business meaning. This process heavily relies on a dynamically updated power business knowledge base.

[0036] The power business knowledge base is a key asset of this system, and it typically exists in the form of a database, containing: Power Equipment Space Library: Stores the precise geographical coordinates (latitude, longitude, and altitude), equipment ID, voltage level, and safety distance (such as the radius of no-fly zones) of all transmission towers, substations, insulators, and other equipment.

[0037] Inspection Task Plan Library: Stores planned inspection tasks, including task ID, planned date, target equipment, allowed drone ID and operator, and planned inspection actions (such as detailed photography and infrared temperature measurement).

[0038] Business Action Mapping Rule Base: Defines the mapping rules from "protocol instructions" to "business actions". For example, the rule definition is: when the target coordinates of MAVLink's MAV_CMD_NAV_WAYPOINT instruction fall within 50 meters of a certain tower, its business action is "execute tower inspection".

[0039] Workflow Example: Suppose the business semantic extractor parses a MAVLink instruction {command:MAV_CMD_NAV_WAYPOINT,param5:39.123,param6:116.123,param7:100.0}. It will perform the following operations: A spatial query was performed on the coordinates (39.123, 116.123) in the power equipment spatial database, and "220kV Shuangzi Line #38 Tower" was matched.

[0040] Searching the business action mapping rule base, we found that MAV_CMD_NAV_WAYPOINT + target "pole tower" -> business action "execute pole tower inspection".

[0041] Ultimately, a business semantic event is generated, such as {timestamp:...,drone_id:"UAV-01", original instruction:"MAV_CMD...", parsed business semantics: {business action:"execute tower inspection", business target:"220kV Shuangzi Line";} #38 Tower",...}}.

[0042] Behavioral analysis layer 30: This layer is the intelligent core of the system, responsible for "profiled" the normal behavior of the power drone, that is, establishing a dynamic behavioral baseline. It receives business semantic event streams from the protocol parsing layer 20 and models based on a large amount of historical normal data. It mainly constructs the following three models: Spatiotemporal model: This describes the legal spatial and temporal range of actions for a drone performing a specific power task (such as "transmission line inspection"). For example, the model defines a legal flight corridor for an inspection task (no more than 30 meters off the centerline), a legal altitude range (15-30 meters relative to the ground), a maximum speed, and permitted working hours (e.g., 08:00-17:00 on weekdays). Any behavior exceeding this spatiotemporal "electronic fence" will be considered a potential anomaly.

[0043] Command Sequence Model: Describes the normal command flow sequence during the completion of a specific power task. This embodiment uses a combination of N-gram and Probabilistic Suffix Tree (PST) method. By learning from historical data, the model determines that in the "refined tower inspection" task, after MAV_CMD_NAV_WAYPOINT (flying to the tower), the most likely command is CONDITION_CHANGE_ALT (adjusting height), followed by MAV_CMD_IMAGE_START_CAPTURE (starting to take a picture), while the extremely rarest command is ARM_DISARM (unlocking / locking). Any low-probability command jump will be marked as abnormal.

[0044] Traffic characteristic model: Describes normal network communication patterns under different service actions. For example, the model learns that the characteristics of the "real-time video transmission" action are: extremely high downlink bandwidth (e.g., 2Mbps±500kbps), extremely low uplink-to-downlink traffic ratio (e.g., 0.02-0.03), and large downlink packet size (e.g., 1400 bytes). During the "hovering to take a picture" action, however, the traffic is very stable and bandwidth usage is low. If the system detects large traffic similar to video transmission during "hovering to take a picture," it may indicate data theft.

[0045] Anomaly Detection Engine 40: The engine compares the drone's current behavior with the baseline established by the behavior analysis layer 30 in real time.

[0046] Feature Vector Generation: The engine first extracts a multi-dimensional feature vector from real-time business semantic events and network traffic. This vector integrates key metrics from the three models mentioned above, such as: current altitude, horizontal deviation from the planned flight path, confusion level of the current command sequence (calculated by the command sequence model), frequency of low-frequency commands, downlink bandwidth, uplink / downlink traffic ratio, and number of times sensitive areas are accessed.

[0047] Anomaly detection: This embodiment uses a combination of rule detection and machine learning.

[0048] The rule detection module has built-in explicit power safety rules, such as "It is strictly prohibited to execute a route change command when the distance to energized equipment is less than a safe distance".

[0049] The machine learning module employs the Isolation Forest algorithm. This algorithm is highly efficient at identifying outliers in multidimensional data. The engine inputs real-time generated feature vectors into a pre-trained Isolation Forest model, which outputs an anomaly score. The higher the score, the greater the deviation of the current behavior from the normal baseline.

[0050] Alarm generation: When a rule is triggered, or when the abnormal score output by the machine learning module exceeds the preset dynamic threshold, the engine will generate a detailed abnormal alarm and send it to the response feedback layer 50.

[0051] Response feedback layer 50: This layer is responsible for intelligent handling and response to alarms, forming a security closed loop.

[0052] Business Alarm Association Engine: Performs secondary analysis on received raw alarms to prevent alarm proliferation. It can associate multiple independent alarms into a high-level attack event based on time, space, and behavioral logic. For example, if the same drone triggers both a "GPS signal anomaly" alarm and an "illegal command injection" alarm within 10 seconds, the engine will associate them into a "GPS spoofing and command injection coordinated attack" event and increase its risk level.

[0053] Adaptive Response Controller: Automatically triggers tiered response measures based on the event risk level determined by correlation analysis.

[0054] Low risk: Record detailed logs and notify operations and maintenance personnel to pay attention.

[0055] Medium risk: Send pop-up alerts to operators via ground station software and provide handling suggestions.

[0056] High Risk / Emergency: Automatic proactive defense. The controller issues control commands by calling the API interface of the flight control platform or network device. For example, it constructs a JSON-formatted API request, calls the / command interface of the flight control platform, and issues the MAV_CMD_NAV_RETURN_TO_LAUNCH command, ordering the drone to return to base urgently. Alternatively, it calls the firewall API to block suspicious attack source IP addresses.

[0057] Example 2 This invention discloses a method for detecting threats in UAV communication traffic based on power service characteristics. Figure 2 This is a flowchart of a method for detecting drone communication traffic threats based on power service characteristics according to an embodiment of the present invention, as shown below. Figure 2 As shown, the method includes: Please see Figure 2 The process of the UAV communication traffic threat detection method based on power service characteristics provided in this embodiment of the invention is as follows: Step S201: Collect communication traffic; Specifically, it collects real-time communication traffic between the UAV and the ground control system; The system captures all network data packets entering and leaving the power drone-related systems in real time through network mirroring or traffic splitting.

[0058] Step S202: Perform protocol parsing and business semantic mapping; Specifically, the real-time communication traffic is parsed to extract protocol instructions and parameters; based on a pre-built power business knowledge base, the protocol instructions and parameters are mapped into business semantic events containing business actions and business objectives. The step of mapping protocol commands and parameters to business semantic events includes: Extract key parameters such as flight coordinates and action type from the protocol instructions; In the power business knowledge base, information on associated power equipment is queried and matched based on the flight coordinates; By combining the action type and the matching power equipment information, the corresponding business action and business target are searched in the preset business action mapping rules to generate the business semantic event.

[0059] The power business knowledge base includes: a power equipment spatial library that stores the geographical location and safety range of power equipment; an inspection task plan library that stores pre-arranged inspection plans; and a business action mapping rule library that defines the mapping relationship between protocol instructions and business actions.

[0060] Protocol parsing layer 20 processes the collected traffic. First, the multi-protocol adapter identifies and decrypts the data packets, extracting protocol layer information such as MAVLink commands. Then, the business semantic extractor uses a power business knowledge base to translate these technical commands into business language. For example, a command to fly to a certain coordinate, combined with the task plan and equipment location, is mapped to the business semantic event "UAV-01 is performing an inspection of tower #38".

[0061] Step S203: Construct a multi-dimensional dynamic behavior baseline; Specifically, based on historical business semantic events, a multi-dimensional dynamic behavior baseline, including temporal behavior patterns and communication characteristics, is constructed for different power business scenarios; The multi-dimensional dynamic behavior baseline includes at least one of the following: The spatiotemporal model is used to define the legal geographical range, altitude range, speed range, and operating time window for drones under specific power services. Instruction sequence model, used to learn and define legal instruction sequence patterns and their transition probabilities in normal power business processes; The instruction sequence model is constructed based on the combination of N-gram model and probabilistic suffix tree (PST). The method first uses N-gram model to identify high-frequency, legal short instruction sequences, and then uses PST model to predict the next most likely instruction based on the current instruction history, thereby probabilistically evaluating the legality of the entire instruction sequence.

[0062] Traffic characteristic models are used to define the range of network traffic characteristics such as normal communication bandwidth, packet rate, and uplink / downlink traffic ratio under different service actions.

[0063] The behavioral analysis layer 30 continuously learns from historical, confirmed normal business semantic events. Through statistical analysis and machine learning, it constructs and continuously optimizes spatiotemporal models, instruction sequence models, and traffic feature models, respectively. These models together constitute a white-box model of "normal behavior".

[0064] Step S204: Real-time detection of abnormal behavior; For each real-time generated business semantic event, the anomaly detection engine 40 will simultaneously extract its spatiotemporal, instruction, traffic and other multi-dimensional features to form a real-time behavioral feature vector.

[0065] Step S205: Compare the real-time behavior with the baseline to determine if it is abnormal.

[0066] Specifically, the real-time generated business semantic events are compared with the multi-dimensional dynamic behavior baseline to detect abnormal behaviors that deviate from the baseline; The step of comparing real-time generated business semantic events with a multi-dimensional dynamic behavior baseline includes: Extract real-time behavioral feature vectors covering spatiotemporal features, instruction sequence features, and traffic features from the real-time business semantic events and communication traffic; The Isolation Forest algorithm is used to perform unsupervised anomaly detection on the real-time behavior feature vector, and anomaly scores are output. When the abnormal score exceeds a preset threshold, it is determined to be abnormal behavior.

[0067] The anomaly detection engine 40 inputs the real-time behavior feature vector generated in step S204 into the baseline model of the behavior analysis layer 30 for evaluation. For example, the anomaly score of the vector is calculated using the Isolation Forest algorithm.

[0068] Perform unsupervised anomaly detection and output anomaly scores; When the abnormal score exceeds a preset threshold, it is determined to be abnormal behavior.

[0069] Step S206: If the abnormal score exceeds the threshold, an alarm is generated and a response is triggered.

[0070] When abnormal behavior is detected, a threat alert is generated and a response action is executed according to the preset policy.

[0071] The response actions include: calling the flight control platform through the application programming interface (API) to issue safety commands to the UAV, including emergency return to home, switching to a secure communication channel, or initiating link encryption.

[0072] If the anomaly score exceeds a preset threshold, the system determines that abnormal behavior has occurred. At this point, the response feedback layer 50 is activated. First, the business alarm correlation engine performs contextual analysis and correlation on the alarm to determine the authenticity and severity of the threat. Next, the adaptive response controller takes appropriate measures based on the determined risk level, such as alerting the operator or automatically commanding the drone to perform safety actions such as returning to base or landing via the API interface, forming a closed loop of detection and response. If the threshold is not exceeded, the process returns to step S201 to continue monitoring the next batch of traffic.

[0073] In summary, this invention fundamentally solves the pain point of traditional detection solutions being "unfamiliar with business" by constructing a dynamic behavior analysis framework that deeply integrates power business knowledge. It can accurately and adaptively detect various known and unknown security threats against power drones and achieve intelligent and automated closed-loop response, greatly improving the safety level of aerial operations on critical power infrastructure.

[0074] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for detecting threats of communication traffic of a UAV based on characteristics of power services, characterized in that, The method comprises the following steps: Collecting real-time communication traffic between the unmanned aerial vehicle and the ground control system; Protocol analysis is performed on the real-time communication traffic to extract protocol instructions and parameters; Based on the pre-set power business knowledge base, the protocol instructions and parameters are mapped into business semantic events containing business actions and business targets; Based on historical business semantic events, multi-dimensional dynamic behavior baselines including time sequence behavior patterns and communication characteristics are constructed for different power business scenarios; The real-time generated business semantic events are compared with the multi-dimensional dynamic behavior baselines to detect abnormal behaviors deviating from the baselines; When an abnormal behavior is detected, a threat alarm is generated and a response action is performed according to a pre-set strategy.

2. The method of claim 1, wherein, The step of mapping the protocol instructions and parameters into business semantic events comprises: Extracting flight coordinates, action types and other key parameters from the protocol instructions; In the power business knowledge base, the associated power equipment information is queried and matched according to the flight coordinates; In the pre-set business action mapping rules, the corresponding business actions and business targets are found in combination with the action types and the matched power equipment information, so as to generate the business semantic events.

3. The method of claim 2, wherein, The power business knowledge base comprises: a power equipment space library storing the geographic positions and safety ranges of power equipment, an inspection task plan library storing the pre-set inspection plans, and a business action mapping rule library defining the mapping relationship between protocol instructions and business actions.

4. The method of claim 1, wherein, The multi-dimensional dynamic behavior baseline comprises at least one of the following: A space-time model for defining the legal flight geographic range, height interval, speed range and working time window of the unmanned aerial vehicle under a specific power business; An instruction sequence model for learning and defining the legal instruction sequence pattern and its transition probability in the normal power business process; A traffic feature model for defining the normal communication bandwidth, packet rate and uplink / downlink traffic ratio under different business actions.

5. The method of claim 4, wherein, The instruction sequence model is constructed based on the combination of N-gram model and probability suffix tree.

6. The method of claim 1, wherein, The step of comparing the real-time generated business semantic events with the multi-dimensional dynamic behavior baseline comprises: From the real-time business semantic events and communication traffic, real-time behavior feature vectors covering space-time features, instruction sequence features and traffic features are extracted; An isolated forest algorithm is used for unsupervised anomaly detection on the real-time behavior feature vectors, and an anomaly score is outputted; When the anomaly score exceeds a pre-set threshold, it is determined as an abnormal behavior.

7. The method of claim 1, wherein, The response action comprises: calling a flight control platform through an application programming interface (API) to issue a safety instruction to the unmanned aerial vehicle, the safety instruction comprising an emergency return, switching to a safe communication channel or starting link encryption. 8.A system for detecting threats in UAV communication traffic based on power service characteristics, the system comprising: The method comprises: A traffic collection module for collecting real-time communication traffic between the unmanned aerial vehicle and the ground control system; A protocol analysis layer connected with the traffic collection module, configured to perform protocol analysis on the real-time communication traffic to extract protocol instructions and parameters, and map the protocol instructions and parameters into business semantic events based on a pre-set power business knowledge base; The behavior analysis layer, connected with the protocol analysis layer, is configured to build and maintain a multi-dimensional dynamic behavior baseline including time sequence behavior patterns and communication characteristics based on historical business semantic events; The anomaly detection engine, connected with the protocol analysis layer and the behavior analysis layer, is configured to compare real-time generated business semantic events with the multi-dimensional dynamic behavior baseline to detect abnormal behaviors deviating from the baseline; The response feedback layer, connected with the anomaly detection engine, is configured to generate threat alarms and perform response actions according to preset strategies when abnormal behaviors are detected.

9. The system of claim 8, wherein, The protocol analysis layer comprises: A multi-protocol adapter for automatically identifying and analyzing multiple unmanned aerial vehicle communication protocols; A business semantic extractor for querying the power business knowledge base and mapping the analyzed protocol fields to specific power business actions.

10. The system of claim 8, wherein, The behavior analysis layer comprises: A power business behavior modeling module for learning and building a space-time model, an instruction sequence model and a traffic feature model from historical data to jointly constitute the multi-dimensional dynamic behavior baseline; A machine learning module with an isolation forest algorithm for performing anomaly scoring on a behavior feature vector generated according to real-time business semantic events.

Images