Abnormal signal detection and signal transmission protocol identification method and device

Abstract

The invention discloses an abnormal signal detection and signal transmission protocol identification method and device, relates to the field of cognitive radio, and is used for improving the practicability and robustness of signal identification in an open set environment. According to the method, the generative adversarial network is utilized to train the first classifier model to classify the time-frequency characteristics of the air interface signals, and the rejection threshold value determined based on the extreme value theory is utilized to perform abnormal signal discrimination. On the basis, a deep convolutional neural network fused with a multi-head self-attention mechanism is used for identifying the transmission protocol type of a normal transmission signal. According to the method, generalization ability and robustness of unknown signal identification in an open environment are effectively achieved.

Description

Technical Field

[0001] This invention relates to the field of cognitive radio, and in particular to an abnormal signal detection method, a signal transmission protocol identification method and apparatus. Background Technology

[0002] With the surge in the number of wireless access devices, the complexity of the electromagnetic environment continues to rise. Communication signals frequently encounter interference from unknown protocols, malicious attack signals, and dynamic noise, seriously threatening the stability and reliability of wireless communication networks. Therefore, ensuring the security of wireless communication systems urgently requires the development of efficient abnormal wireless signal detection technologies. Among these, the technology path based on transmission protocol identification is the core approach to achieving this goal. Normally, communication between legitimate devices strictly adheres to established protocol specifications regarding frequency range and modulation methods. Once a signal with a protocol inconsistency appears, such as a sudden change in center frequency or modulation method, it is highly suspected of being an abnormal activity such as unauthorized access, malicious attack, or interference.

[0003] Chinese patent document CN118646687A proposes an IoT communication protocol identification method based on time-frequency domain combination. It analyzes protocol data such as Bluetooth, WIFI, and LTE through the time-frequency characteristics of protocol signals and realizes the identification of some communication protocol signals. However, the method only uses simulation data for testing and does not consider unknown abnormal interference signals that exist in real scenarios, so the practicality of the algorithm is not good.

[0004] Chinese patent document CN114492537A proposes a method for detecting abnormal signals in an electromyography (EMG) control system under malicious attack. This method calculates the Chebyshev distance between each channel of a standard sample and an interference sample after applying a perturbation signal, and then uses an SVM classifier based on the channel features to achieve anomaly detection. However, this method constructs feature vectors based on only a single parameter, which easily leads to error accumulation. Furthermore, it does not fundamentally consider completely unknown interference types, resulting in poor robustness.

[0005] Chinese patent document CN119074015A proposes a method for detecting abnormal EEG signals based on convolutional neural networks. This method designs a neural network to perform multi-scale feature analysis on abnormal signals and determines the category of the abnormal signal based on the extracted feature vectors. However, this method only studies known abnormal signals and does not consider unknown open-set scenarios, resulting in less than ideal recognition performance.

[0006] In summary, known signal protocol identification methods have the following shortcomings: (1) Poor practicality: Existing algorithms mostly rely on simulation data or simulated signals transmitted by software radio, ignoring various unknown protocols, complex noise and dynamic interference in the real air interface environment, collectively referred to as open sets. When the receiver captures protocol signals outside the training set, it will misjudge them as the closest known type, resulting in a sharp drop in recognition accuracy and missing key malicious attacks and interference signals.

[0007] (2) Poor robustness: Existing algorithms have weak robustness and generalization ability, and often rely on single parameters such as modulation mode to construct feature vectors or directly use the original I / Q sequence for identification. In complex and ever-changing real channel environments, various interferences can easily cause error accumulation, and some protocol signals may have the same parameters or modulation mode, which leads to a sharp deterioration in model recognition performance and a serious lack of generalization ability. Summary of the Invention

[0008] The purpose of this invention is to provide an abnormal signal detection and signal transmission protocol identification method and apparatus to address all or part of the problems mentioned above, thereby solving the problem of insufficient practicality and robustness of existing technologies in open set environments.

[0009] The technical solution adopted in this invention is as follows: An abnormal signal detection method, comprising: S1. Perform power normalization processing on the received air interface signal to obtain a unit power signal; S2. Extract the time-frequency features of the unit power signal; identify the confidence level of the air interface signal as an abnormal signal based on the time-frequency features; S3. Compare the confidence level with the dynamic rejection threshold, and determine whether the air interface signal is an abnormal signal based on the comparison result; the dynamic rejection threshold is determined by the tail model of the confidence distribution of the true non-abnormal signal sample based on the extreme value theory EVT.

[0010] In addition, this application also provides a method for identifying signal transmission protocols, which includes: S4. Receive air interface signals; S5. Use an abnormal signal detection method to determine whether the air interface signal is an abnormal signal; if the air interface signal is not an abnormal signal, then execute: S6. Extract the multimodal features of the unit power signal; S7. Using the trained second classifier model with the multimodal features as input features, classify and identify the transmission protocol of the air interface signal.

[0011] Based on the concept of this application, this application also provides a signal transmission protocol identification device, which includes a processor and a storage medium, wherein the storage medium stores a computer program, and the processor runs the computer program to execute the above-described signal transmission protocol identification method.

[0012] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: The abnormal signal detection method provided in this application innovatively introduces extreme value theory to probabilistically fit the confidence distribution of boundary samples of closed sets (i.e., signals with known transmission protocol types), adaptively calculating the optimal rejection threshold. By dynamically adjusting this threshold, the generalization ability for identifying unknown abnormal signals is effectively solved, thereby improving the practicality of abnormal signal identification in open set environments. Furthermore, the abnormal signal detection method uses real open set samples for training, while simultaneously using generator-fitted samples to supplement open set samples, achieving effective identification of open set samples while ensuring accuracy in identifying closed set samples. The signal transmission protocol identification method provided in this application integrates multimodal features to identify closed set samples, avoiding the cumulative error caused by identification based on a single parameter, and improving the generalization and robustness of the algorithm. In addition, the method employs a lightweight convolutional neural network architecture combining multi-head self-attention mechanism and multimodal fusion, significantly reducing computational overhead. Attached Figure Description

[0013] The present invention will be described by way of example and with reference to the accompanying drawings, wherein: Figure 1 This is a flowchart of one embodiment of the signal transmission protocol identification method in this application; Figure 2 This is a diagram of the generative network architecture used to train the first classifier model in this application; Figure 3 This is a diagram of the architecture of the second classifier model in this application; Figure 4 This is a schematic diagram of the training process of the first classifier module in this application; Figure 5 This is a graph showing the change in AUC classification accuracy of the discriminator trained in this application; Figure 6 These are time-frequency characteristic diagrams of nine known categories of transmission protocol signals in this application; Figure 7 This application contains feature maps of eight unknown signal types, including unknown protocols, dynamic noise, and single-frequency interference. Figure 8 These are the 12 open set sample feature maps fitted by the generator in this application; Figure 9 This is a histogram of the distribution of the mapping features between closed set samples and open set samples in this application; Figure 10 This is a confusion matrix diagram of the abnormal signal detection method in this application; Figure 11 This is a confusion matrix diagram of the signal transmission protocol identification method in this application. Detailed Implementation

[0014] All features disclosed in this specification, or all steps in all disclosed methods or processes, may be combined in any way, except for mutually exclusive features and / or steps.

[0015] Any feature disclosed in this specification (including any appended claims and abstract) may be replaced by other equivalent or similar features, unless specifically stated otherwise. That is, unless specifically stated otherwise, each feature is merely one example of a series of equivalent or similar features.

[0016] To address the shortcomings of known signal recognition methods in terms of practicality and robustness, this application provides an abnormal signal detection and signal transmission protocol identification method and apparatus, aiming to improve the practicality and robustness of signal transmission protocol identification in an open set environment.

[0017] See appendix Figure 1 The abnormal signal detection method provided in this application includes: S1. Perform power normalization processing on the received air interface signal to obtain a unity power signal.

[0018] by This indicates the received air interface signal. Power normalization is performed to unify the power of the received signal, resulting in a unity-power signal. .

[0019] Specifically, step S1 includes: S1.1 Receiving air interface signals . The signals obtained from the constructed test platform are real air interface signals, which may originate from normal transmission protocols (closed set), unknown interference protocols, malicious attack signals, and dynamic noise (open set). The normal transmission protocols include frequency division multiplexing 5G-NR (transmission protocol is FDNR) and 4G-LTE (transmission protocol is FDLTE), time division multiplexing 5G-NR (transmission protocol is TDNR) and 4G-LTE (transmission protocol is TDLTE), 3G (transmission protocol is CDMA), 2G-GSM uplink (transmission protocol is GSM_UP) and downlink (transmission protocol is GSM_DW), 802.11-WiFi protocol cluster signals collected in the 5GHz band (transmission protocol is 802.11_5GHz), and signals collected in the 2.4GHz-ISM band, including Bluetooth, 802.11 and other protocol clusters with time and frequency domain aliasing (transmission protocol is ISM_2.4GHz).

[0020] S1.2, to Power normalization is performed.

[0021] The power normalization method is as follows: ; In the formula, L is The signal length.

[0022] S2. Extract the time-frequency characteristics of the unit power signal; identify the confidence level of the air interface signal as an abnormal signal based on the time-frequency characteristics.

[0023] Time-frequency characteristics can be obtained through short-time Fourier transform. As an optional implementation, step S2 includes: S2.1 Extract the time-frequency characteristics of the unit power signal.

[0024] Time-frequency characteristics The calculation method is as follows: ; In the formula, Let m be the window function, R be the time frame number of the sampling time frame, R be the time sliding step size between adjacent time frames, and f be the signal frequency.

[0025] S2.2 Confidence level of identifying air interface signals as anomalous signals based on time-frequency characteristics.

[0026] Abnormal signals refer to signals that do not belong to all known potential transmission protocol types, including unknown protocols, complex noise, and dynamic interference. For ease of description, these abnormal signals are collectively referred to as open sets in this application. Correspondingly, signals of known transmission protocol types (such as the various normal transmission protocols introduced above) are referred to as closed sets. Abnormal signal detection then refers to determining whether the received air interface signal covers all potential transmission protocol categories in the closed set, given the presence of multiple protocol types, low signal-to-noise ratio, high sampling rate, and complex interference. This requires the detection method to maintain the accuracy of identifying known protocol types (i.e., closed sets) while also possessing the ability to discriminate against unknown samples (i.e., open sets).

[0027] As an optional implementation, a trained first classifier model is used with time-frequency features. Estimating air interface signals based on input features The binary classification confidence score for whether it is an anomalous signal. The first classifier model aims to minimize the classification error in both the known transport protocol category space (i.e., the closed set space) and the unknown anomalous protocol category space (i.e., the open set space). It is trained using real binary samples (i.e., real closed set samples and open set samples) and fake generated samples (i.e., open set samples generated by fitting closed set samples).

[0028] Specifically, the objective function of the first classifier model Represented as: ; In the formula, Indicates the test sample. Indicates training samples, This represents the classification error in the unknown anomaly protocol category space. This represents the classification error within the known transport protocol category space. This represents the weight of the closed set samples during training. The objective function aims to distinguish unknown signal types while maintaining the accuracy of known protocol type recognition.

[0029] In one alternative implementation, the first classifier model is a generative adversarial network architecture, in which a generator G (Generator) fits and generates samples, and a discriminator D (Discriminator) identifies the authenticity of the input samples.

[0030] The generator consists of a 2D transposed convolutional layer a, a batch normalization layer, an activation function ReLU, a 2D transposed convolutional layer b, a batch normalization layer, an activation function ReLU, a 2D transposed convolutional layer c, a batch normalization layer, an activation function ReLU, a 2D transposed convolutional layer d, a batch normalization layer, an activation function ReLU, a 2D transposed convolutional layer e, and an activation function Tanh.

[0031] The discriminator consists of a two-dimensional convolutional layer a, a LeakyReLU activation function, a two-dimensional convolutional layer b, a batch normalization layer, a LeakyReLU activation function c, a batch normalization layer, a LeakyReLU activation function d, a batch normalization layer, a LeakyReLU activation function e, and a Sigmoid activation function.

[0032] Generative Adversarial Networks (GANs) require training with samples to meet the requirements for anomaly signal detection. The goal of GAN training is to obtain a high-performance discriminator as the first classifier model. This discriminator uses the input data to determine whether the corresponding air signal belongs to a closed set or an open set; open set signals are considered anomaly signals.

[0033] The training process of a Generative Adversarial Network (GAN) corresponds to the training process of the first classifier model, except that the first classifier model only uses the trained discriminator. During training, the generator and discriminator are trained alternately until a stopping condition is met. The stopping condition is usually the convergence of the loss function or the reaching of the maximum number of iterations.

[0034] The core idea of ​​traditional Generative Adversarial Networks (GANs) is to enable generator G to fit the distribution of real data and generate sufficiently approximate samples through adversarial training between a generator G and a discriminator D. Generator G maps random noise to outputs similar to real samples, aiming to minimize the difference between its output and the real samples to deceive discriminator D. Discriminator D, on the other hand, aims to maximize its ability to distinguish between real and generated samples. The two continue to compete until, after several rounds of training, discriminator D can no longer distinguish between real closed-set samples and generated samples, reaching Nash equilibrium, at which point the network can be considered converged. The optimization function (i.e., the loss function) of a traditional GAN ​​is: ; In the formula, G represents the generator, D represents the discriminator, and V(D,G) represents the objective function. This represents a sample from real data (whether it is an open set sample or a closed set sample). Indicates origin from a random distribution The generated sample z; This represents the probability estimated by the discriminator that the input sample belongs to a real, non-abnormal signal; Let represent the probability that the discriminator estimates a generated sample as a true, non-abnormal signal; E represents the expectation function. The optimization objective of the discriminator D is... Approaching 1, Approaching 0; the optimization objective of generator G is... Approaching 1. The respective optimization objectives for both are: ; .

[0035] Traditional methods for anomaly signal detection using generative adversarial networks mainly include two approaches: (1) introducing some real outlier samples as open set samples to participate in training, and constructing a binary classifier to distinguish between closed set and open set samples. (2) conducting unsupervised training on the generative adversarial network, and using its ability to learn the distribution of closed set samples to construct a discriminator.

[0036] However, the generalization performance of method (1) is highly dependent on whether the open set samples can fully represent the diversity of the open environment; otherwise, the performance of the discriminator D will significantly decrease when faced with new and unknown samples. Method (2) is limited by the adversarial training nature of generative adversarial networks based on game theory, and its stability depends on the dynamic balance between the generator G and the discriminator D. If the adversarial balance is unbalanced or the adversarial disappearance phenomenon occurs, it will lead to unstable model training and difficulty in convergence.

[0037] To address the shortcomings of traditional generative adversarial networks, this application, in an optional implementation, designs the following optimization function to calculate the training loss, in order to train by combining real open set samples, closed set samples, and fake generated samples.

[0038] ; In the formula, Indicates origin from a real closed set samples x , Indicates that it comes from the real opening set. samples x , These represent the weights of the real open set samples and the spurious generated samples during training. When real open set samples are lacking... The value is 0, but the model still has the performance of open set recognition.

[0039] Part One This indicates that the discriminator D is trained using closed-set samples, with the goal of correctly identifying closed-set samples; Part Two The discriminator D is trained using real open set samples, with the goal of correctly identifying open set samples; Part Three This means that the discriminator D is trained using generated samples fitted by the generator G, with the goal of correctly identifying generated samples as pseudo-open set samples and improving the performance of the discriminator D when facing an open world.

[0040] Furthermore, since real open-set samples are incorporated into the training, the training method for the generative adversarial network in this embodiment differs from traditional methods. Specifically, the discriminator D and the generator G are trained alternately using the following method: Training the discriminator: (1) Label the samples according to their type and source.

[0041] In this embodiment, the training samples include real binary classification samples and fake generated samples. First, real closed-set samples are labeled as true, real open-set samples are labeled as false, and generated samples fitted by generator G are labeled as false.

[0042] (2) Input the sample into the discriminator, calculate the first total loss based on the discrimination result, and update the discriminator parameters based on the first total loss.

[0043] The labeled samples are fed into the discriminator, and the loss of the three parts is calculated according to the optimization function. The first total loss is calculated by weighted summation according to the weights. The first loss is used as the loss function of the discriminator D to update the network parameters of the discriminator D.

[0044] Training generator: (1) Update the sample labels according to the sample type and source.

[0045] Based on the above labeled samples, the generated samples fitted by generator G are labeled as true, and the rest remain unchanged.

[0046] (2) Input the sample into the discriminator, calculate the second total loss based on the discrimination result, and update the generator parameters based on the second total loss.

[0047] The updated samples are fed into the discriminator, and the losses of the three parts are calculated according to the optimization function. The second total loss is calculated by weighted summation according to the weights. The resulting second loss is used as the loss function of the generator G to update the network parameters of the generator G.

[0048] This process is repeated iteratively until the stopping condition is met, thus completing the training of the first classifier model.

[0049] Furthermore, as a preferred implementation, this application does not select the discriminator D at the point of training stop as the first classifier model, because the ultimate goal is to obtain a high-performance open-closed set discriminator D, rather than an excellent generator G. It does not expect the generated samples to be highly realistic. Therefore, it is necessary to rely on the one with the minimum loss or the largest number of rounds to select the best model. Instead, the discriminator D with the highest AUC classification accuracy in multiple rounds of training that have reached the stopping condition is selected as the first classifier model.

[0050] Specifically, this application proposes a discriminator optimization method based on abnormal wireless signal detection. By constructing a validation dataset containing closed-set samples and true open-set samples, the discriminator models saved in each round are evaluated, and the discriminator D with the highest AUC classification accuracy is used as the final first classifier model. Discriminator D exhibits stable performance during processing and validation. The AUC is directly related to the area under the ROC curve, with the horizontal and vertical axes representing the false closed-set sample rate (FPR) and the true closed-set sample rate (TPR), respectively. The calculation method is as follows: ; Where FP is the number of samples in the false closed set, FN is the number of samples in the false open set, TN is the number of samples in the true open set, and TP is the number of samples in the true closed set.

[0051] S3. Compare the confidence level with the dynamic rejection threshold, and determine whether the air interface signal is an abnormal signal based on the comparison result.

[0052] The so-called rejection threshold is the threshold for refusing further identification of the transmission protocol type, used to define whether a signal is abnormal or a normal transmission signal; the term "dynamic" means that the rejection threshold is not fixed but changes dynamically. Specifically, the dynamic rejection threshold is determined by a tail model based on the extreme value theory EVT to reconstruct the confidence distribution of true non-abnormal signal samples (i.e., closed set samples).

[0053] Traditional normal distributions struggle to accurately characterize the characteristics of sample confidence in extreme regions, i.e., the boundary regions near 0 or 1. In this embodiment, 0 is set as an unknown protocol type, and 1 as a known protocol type. Although the discriminator D already possesses distinguishing capabilities, in open protocol environments, there are always unknown samples whose features are highly similar to those of closed-set protocols. Therefore, an optimal rejection threshold needs to be set for binary classification decisions, and the threshold selection directly affects recognition performance, false alarm rate, and false negative rate. To this end, in an optional implementation, this application provides a method for determining a dynamic rejection threshold based on extreme value theory (EVT), including: (1) The Weibull distribution is used to fit the maximum distribution region of the confidence scores of the real closed set samples. By tail modeling, the optimal decision threshold region is located at the feature values ​​of the closed set samples (i.e., the output values ​​of the first classifier model). or its logarithm () Concentrated overlapping areas.

[0054] (2) Calculate the probability of the maximum confidence value of the sample based on the Weibull cumulative distribution function to obtain the dynamic rejection threshold.

[0055] The Weibull cumulative distribution function refers to the occurrence of sample feature values ​​when... The probability is expressed as: ; In the formula, For shape parameters, For position parameters; is the scaling parameter. x is the confidence distribution characteristic value. After fitting the Weibull distribution model to the closed set samples, the probability of the maximum value is calculated, and the optimal rejection threshold is determined based on the probability. The size of the threshold avoids the process of manually calculating the threshold, and the threshold is dynamically related only to the feature values ​​of the closed set samples, which improves the reliability of distinguishing abnormal signals from normal transmission signals.

[0056] The rejection threshold is determined by the above method. Based on the confidence level calculated for the air interface signal, if the confidence level does not reach the rejection threshold, the air interface signal is judged as an abnormal signal. Conversely, if the confidence level reaches the rejection threshold, the air interface signal is judged as a non-abnormal signal, i.e., a normal transmission signal.

[0057] Based on the detection of abnormal signals, if the air interface signal is a normal transmission signal, this application can also identify its transmission protocol.

[0058] Specifically, this application also provides a signal transmission protocol identification method. This method first distinguishes whether an air interface signal is an abnormal signal. If it is an abnormal signal, its transmission protocol type is rejected. If it is a normal transmission signal, its transmission protocol type is further identified. The method includes the following steps: S4, Receive air interface signal .

[0059] S5. Determine air interface signal Is this an abnormal signal?

[0060] The abnormal signal detection method described in the previous embodiments can be used to determine this; however, other methods can also be employed. If an abnormal signal is detected, the process will exit; otherwise, the subsequent transmission protocol identification steps will continue.

[0061] S6. Extract unity power signal Multimodal features. To The unity power signal obtained by power normalization.

[0062] As an optional implementation, the extracted multimodal features include: (1) To Spectral characteristics obtained by performing Fast Fourier Transform : ; k is the index of the sampling point.

[0063] (2) To High-order spectral features obtained by performing high-order Fast Fourier Transform; for example, quadratic spectral features extracted by performing quadratic Fast Fourier Transform: .

[0064] (3) To Time-frequency features obtained by performing short-time Fourier transform .

[0065] S7. Using the trained second classifier model with multimodal features as input features, classify and identify the transmission protocols of air interface signals.

[0066] For example, the output dimensions of the second classifier model correspond to the classification probabilities of {FDNR}, {TDNR}, {FDLTE}, {TDLTE}, {CDMA}, {GSM_DW}, {GSM_UP}, {802.11_5GHz}, and {ISM_2.4GHz}, respectively. The transmission protocol type corresponding to the highest classification probability is used as the identification result of the air interface signal transmission protocol.

[0067] The second classifier model is trained using closed-set samples. Multimodal features extracted from the closed-set samples are input into the second classifier model, with the corresponding transmission protocol type used as the ground truth label, and the model is trained until convergence.

[0068] In one alternative implementation, the second classifier model includes a deep convolution module, a multi-head self-attention feature fusion module, and a classification module.

[0069] (1) The protocol feature extraction module performs depth convolution processing on each modality feature to obtain the corresponding feature vector.

[0070] In one optional implementation, the protocol feature extraction module sequentially includes a two-dimensional convolutional layer a, a two-dimensional convolutional layer b, a two-dimensional convolutional layer c, a two-dimensional max pooling layer, and an activation function ReLU, to construct a lightweight convolutional neural network.

[0071] (2) The protocol feature fusion module includes a linear transformation unit, a subspace computation unit, a cross-subspace fusion unit, and a feature fusion unit, which are used to perform multi-head self-attention fusion on each modal feature and fuse the attention weights of each modal feature to improve adaptability to the changing environment and reduce environmental interference.

[0072] In one optional implementation, the linear transformation unit performs a linear transformation on the feature vectors of the depthwise convolution to obtain a query matrix Q, a key matrix K, and a value matrix V. The subspace computation unit splits the query matrix Q, key matrix K, and value matrix V into multiple submatrices according to the set number of attention heads, and maps each submatrix to a different subspace (in the high-dimensional space). Attention weights are calculated independently in each subspace. The method for calculating attention weights is defined as follows: ; in, It is the number of columns in matrices Q and K.

[0073] Each subspace corresponds to one attention head. Within each of the multiple subspaces, the dot product similarity is calculated to obtain the attention weight for that subspace, expressed as: ; In the formula, This represents the attention weight of the i-th attention head. These represent the weight matrices for the query matrix Q, the key matrix K, and the value matrix V, respectively.

[0074] The cross-subspace fusion unit concatenates the attention weights of each subspace to obtain a multi-head self-attention weight vector. : ; In the formula, This indicates a matrix concatenation operation.

[0075] Based on the multi-head self-attention weight vector extracted for each modality feature, the feature fusion unit concatenates the multi-head self-attention weight vectors of each modality feature to obtain the fused feature.

[0076] This mechanism can effectively capture the intrinsic correlation between cross-domain features of protocol signals, and significantly improve the neural network's ability to comprehensively extract and represent multi-domain features.

[0077] (3) The transmission protocol classification module calculates the probability of the transmission protocol belonging to a category based on the fusion characteristics. The classification module calculates the probability that the fused features belong to each potential transport protocol type.

[0078] As an optional implementation, the classification module includes, in sequence, a linear layer a, an activation function ReLU, a linear layer b, an activation function ReLU, and a linear layer c.

[0079] By using the above method, abnormal signal detection is first performed on the air interface signal in the open space. Only after it is determined that it is not an abnormal signal is the transmission protocol type identified. This can reduce the workload of identifying open set samples and the possibility of misidentification, and improve the accuracy and reliability of signal identification.

[0080] In an experiment on a signal transmission protocol identification method, a test platform was built using a Siyi 3943B spectrum monitoring receiver. The transmitted signals involved nine common transmission protocol types, including 2G (GSM_UP, GSM_DW), 3G (CDMA), 4G (FDLTE, TDLTE), 5G (FDNR, TDNR) mobile communication standards, WiFi protocol cluster (802.11_5GHz), and public frequency band (ISM_2.4GHz). Unknown signal types included unknown protocols and dynamic noise in the 500MHz-6GHz frequency band. The frequency range of the signal acquisition is shown in Table 1.

[0081] Table 1 Frequency Band Parameters for Receiving Over-the-Air Protocol Signals

[0082] According to the specific implementation of this application, for the first classifier model, the discriminator D inputs an image with a dimension of 64×64×3, and the generator G inputs a vector with a dimension of 1×1×100. Its network parameter table is shown in Table 2. The final output confidence score s is compared with the rejection threshold to detect abnormal signals. For the second classifier model, the input image has a dimension of 64×64×3, and its network parameter table is shown in Table 3. The output dimension of the final classification module represents the recognition result for the nine transmission protocols.

[0083] Table 2. Network Parameters of the First Classifier Model

[0084] Table 3. Network Parameters of the Second Classifier Model

[0085] The experimental content and results conducted under the above experimental conditions are as follows: Experimental content and results: Experiment 1: From Figure 2As can be seen from the diagram of the generative network model construction for training the first classifier model, this network learns the distribution of closed set samples through discriminator D, while introducing some real open set samples to form binary classification training. At the same time, it uses generator G to fit generated samples similar to closed set samples as a supplement to open set samples, avoiding overfitting of real open set samples by discriminator D and expanding the generalization of open environment.

[0086] Experiment 2: From Figure 3 As can be seen from the diagram of the second classifier model, the signal to be identified is processed by the convolution module to extract high-dimensional features, multi-domain feature fusion is achieved through the multi-head self-attention mechanism, and finally the fused features are sent to the classification module to complete the recognition task.

[0087] Experiment 3: From Figure 4 As can be seen, the training method of the first classifier model proposed in this application processes random noise, closed set samples and open set samples simultaneously. After calculating the loss based on the label, joint optimization is achieved through adversarial training of the discriminator D and the generator G.

[0088] Experiment 4: From Figure 5 As can be seen from the AUC classification accuracy change curve of the discriminator trained in this application, even after 300 rounds, there is still an oscillation of AUC. This shows that the first classifier model cannot be selected simply based on the lowest loss or the longest training round, which verifies the correctness of the discriminator D selection method proposed in this application.

[0089] Experiment 5: From Figure 6 As can be seen, the time-frequency characteristic diagrams of the nine known types of transmission protocol signals listed in this application include 5G-NR, 4G-LTE, 3G-CDMA2000, 2G-GSM, 802.11-WiFi, Bluetooth, etc.

[0090] Experiment 6: From Figure 7 As can be seen, this is a time-frequency characteristic diagram of an unknown protocol signal, which may include unknown transmission protocols, single-frequency interference, dynamic noise, etc.

[0091] Experiment 7: From Figure 8 As can be seen, the open set of samples that the generator G finally fits in this application is very close to the features of known class samples, which shows the correctness of the training.

[0092] Experiment 8: From Figure 9 As can be seen, the red and blue histograms represent the feature value distribution of the discriminator mapping known and unknown class samples, respectively. The overlapping area reflects the similarity of features caused by complex interference in the air interface environment, and the optimal rejection threshold appears in this area. It can be seen that the discriminator now has powerful detection performance.

[0093] Experiment 9: From Figure 10 As can be seen, for the binary open set identification confusion matrix after discrimination according to the optimal threshold, it can be seen that on the test platform built in this application, the accuracy rate of the abnormal signal detection method for the known class is 97.24%, the accuracy rate for the unknown class is 98.28%, the false alarm rate is 2.76%, and the missed alarm rate is 1.72%.

[0094] Experiment 10: From Figure 11 As can be seen from the confusion matrix of the signal transmission protocol identification method, the overall identification accuracy exceeds 97%. Although there are a small number of misjudgments caused by interference from the complex air interface environment, their proportion is extremely low, which fully verifies the superiority and robustness of the signal transmission protocol identification method of this application.

[0095] The signal dataset used in this application is entirely from the test platform built with the Siyi 3943B monitoring receiver. It fully considers the complex environment of the air interface signal and completes the real-time test of the algorithm based on the test platform, which fully verifies the practicality of this application.

[0096] In summary, compared with known algorithms, this application has the following innovative effects: The first classifier model designed in this application, based on the traditional generative adversarial network architecture, introduces some real open-set samples for binary classification training, and uses fitted samples generated by the generator G to supplement the open-set data. The discriminator D finally gives the likelihood that a sample belongs to the closed-set data. At the same time, it innovatively introduces extreme value theory to perform probability fitting on the likelihood of closed-set boundary samples and adaptively calculates the optimal rejection threshold, effectively solving the problem of insufficient generalization ability of traditional generative adversarial networks when used for open-set recognition.

[0097] The lightweight convolutional neural network architecture proposed in this application combines multi-head self-attention mechanism with multimodal feature fusion. It fully mines the potential features of protocol signals by combining deep learning algorithms and comprehensively utilizes time domain, frequency domain, time-frequency domain and autocorrelation domain features to significantly reduce computational overhead. It achieves high-precision identification of the nine standard transmission protocols defined by 3GPP and solves the problems of insufficient attention to wireless protocols and poor generalization and robustness of existing research.

[0098] Based on the ideas of this application, this application also proposes a signal transmission protocol identification device, which includes a processor and a storage medium. The storage medium stores a computer program, and the processor runs the computer program to execute the signal transmission protocol identification method of the above embodiments.

[0099] This invention is not limited to the specific embodiments described above. The invention extends to any new feature or combination disclosed in this specification, as well as any new method or process step or combination disclosed herein.

Claims

1. An abnormal signal detection method, characterized in that, include: S1. Perform power normalization processing on the received air interface signal to obtain a unit power signal; S2. Extract the time-frequency characteristics of the unit power signal; The confidence level for identifying the air interface signal as an abnormal signal based on the time-frequency characteristics; S3. Compare the confidence level with the dynamic rejection threshold, and determine whether the air interface signal is an abnormal signal based on the comparison result; the dynamic rejection threshold is determined by the tail model of the confidence distribution of the true non-abnormal signal sample based on the extreme value theory EVT.

2. The abnormal signal detection method as described in claim 1, characterized in that, The confidence level for identifying the air interface signal as an anomalous signal based on the time-frequency characteristics includes: Using the trained first classifier model with the time-frequency features as input features, estimate the binary classification confidence level of whether the air interface signal is an abnormal signal; The first classifier model aims to minimize the classification error in both the known transport protocol category space and the unknown abnormal protocol category space, and is trained using real binary classification samples and fake generated samples.

3. The abnormal signal detection method as described in claim 2, characterized in that, The first classifier model is a generative adversarial network architecture, in which a generator fits and generates samples, and a discriminator identifies the authenticity of the input samples; During training, the first classifier model alternately trains the generator and discriminator until a stopping condition is met; wherein: Training the discriminator: Label the samples according to their type and origin; Input the sample into the discriminator, calculate the first total loss based on the discrimination result, and update the discriminator parameters based on the first total loss; Training generator: Update sample labels based on sample type and source; The sample is input into the discriminator, the second total loss is calculated based on the discrimination result, and the generator parameters are updated based on the second total loss.

4. The abnormal signal detection method as described in claim 3, characterized in that, The first classifier is the discriminator with the highest AUC classification accuracy during multiple rounds of training that reach the stopping condition.

5. The abnormal signal detection method as described in claim 3 or 4, characterized in that, The generator sequentially includes a two-dimensional transposed convolutional layer a, a batch normalization layer, an activation function ReLU, a two-dimensional transposed convolutional layer b, a batch normalization layer, an activation function ReLU, a two-dimensional transposed convolutional layer c, a batch normalization layer, an activation function ReLU, a two-dimensional transposed convolutional layer d, a batch normalization layer, an activation function ReLU, a two-dimensional transposed convolutional layer e, and an activation function Tanh; The discriminator sequentially includes a two-dimensional convolutional layer a, an activation function LeakyReLU, a two-dimensional convolutional layer b, a batch normalization layer, an activation function LeakyReLU, a two-dimensional convolutional layer c, a batch normalization layer, an activation function LeakyReLU, a two-dimensional convolutional layer d, a batch normalization layer, an activation function LeakyReLU, a two-dimensional convolutional layer e, and an activation function Sigmoid.

6. The abnormal signal detection method as described in claim 3 or 4, characterized in that, The loss functions for calculating the first total loss and the second total loss are as follows: ； In the formula, G represents the generator, D represents the discriminator, and V(D,G) represents the objective function. Indicates that it comes from a set of real, non-abnormal samples. samples x , Indicates that it comes from a real set of abnormal samples. samples x , Indicates origin from a random distribution The generated sample z; This represents the probability estimated by the discriminator that the input sample belongs to a real, non-abnormal signal; E represents the probability estimated by the discriminator that the generated sample belongs to a real, non-abnormal signal; E represents the expectation function. These represent the weights of the real abnormal signal samples and the generated samples during training, respectively.

7. The abnormal signal detection method as described in claim 2, characterized in that, The method for determining the dynamic rejection threshold includes: The distribution region of the maximum confidence level of real non-abnormal signal samples is fitted using the Weibull distribution; The probability of the sample confidence maxima occurring is calculated based on the Weibull cumulative distribution function, and the dynamic rejection threshold is obtained.

8. A method for identifying signal transmission protocols, characterized in that, include: S4, Receive air interface signals; S5. Determine whether the air interface signal is an abnormal signal using the abnormal signal detection method described in any one of claims 1-7; if the air interface signal is not an abnormal signal, then execute: S6. Extract the multimodal features of the unit power signal; S7. Using the trained second classifier model with the multimodal features as input features, classify and identify the transmission protocol of the air interface signal.

9. The transmission protocol identification method as described in claim 8, characterized in that, The second classifier model includes a protocol feature extraction module, a protocol feature fusion module, and a transport protocol classification module; The protocol feature extraction module performs depth convolution processing on each modality feature to obtain the corresponding feature vector; The protocol feature fusion module includes a linear transformation unit, a subspace calculation unit, a cross-subspace fusion unit, and a feature fusion unit; the linear transformation unit performs a linear transformation on the feature vector to obtain a query matrix Q, a key matrix K, and a value matrix V; the subspace calculation unit splits the query matrix Q, the key matrix K, and the value matrix V according to the set number of attention heads and maps them to different subspaces respectively, and each subspace independently calculates attention weights; The cross-subspace fusion unit concatenates the attention weights of each subspace to obtain a multi-head self-attention weight vector; The feature fusion unit concatenates the multi-head self-attention weight vectors of each modality feature to obtain the fused feature; The transmission protocol classification module calculates the probability of a transmission protocol belonging to a specific category based on the fusion features.

10. A signal transmission protocol identification device, characterized in that, It includes a processor and a storage medium, the storage medium storing a computer program, the processor running the computer program to perform the signal transmission protocol identification method as claimed in claim 8 or 9.

Images