Malicious interference detection device and method based on signal behavior analysis

Abstract

The invention discloses a malicious interference detection device and method based on signal behavior analysis, and belongs to the field of wireless communication and network security. The device comprises a signal monitoring module, a behavior analysis module, a prediction and classification module and a self-adaptive updating module. The system further comprises an automatic parameter selection module. The signal monitoring module is used for acquiring transmission state, frequency band and time interval parameters in real time; the behavior analysis module is used for extracting time sequence features and frequency domain features and detecting malicious behaviors in combination with behavior analysis; the signal monitoring module is linked with the behavior analysis module, analyzes the high-speed data packet and extracts frequency domain features, and the prediction and classification module performs malicious judgment in combination with a neural network; and the adaptive updating module dynamically adjusts model parameters. According to the method, signal monitoring and behavior analysis are realized, malicious judgment and dynamic adjustment of model parameters are carried out in combination with the neural network, active identification and accurate detection of dynamic change malicious signals are realized, and the method has the advantages of improving detection accuracy and adaptively coping with threats.

Description

Technical Field

[0001] This invention belongs to the field of wireless communication and network security, and relates to a malicious interference detection device and method based on signal behavior analysis. Background Technology

[0002] Current malicious interference detection technologies are mainly divided into two categories: static feature analysis and dynamic feature analysis. In the fields of wireless communication and network security, traditional detection methods rely excessively on static feature analysis, such as fixed threshold discrimination methods based on rule bases or spectral energy. Although these methods are widely used in practical scenarios, they have obvious limitations. Static feature analysis mainly targets known, relatively fixed features for detection, such as pattern matching based on predefined rule bases. However, malicious interference methods are becoming increasingly diversified, and attackers will constantly change their interference methods to evade rule-based detection. For example, in wireless communication, the frequency, power, and modulation method of interference signals may exhibit dynamic changes, making it difficult to accurately detect all types of malicious interference by relying solely on fixed threshold discrimination based on static spectral energy.

[0003] Dynamic feature analysis is crucial in practical detection scenarios. It captures the dynamic changes in interference signals by monitoring and analyzing them in real time. Compared to static feature analysis, dynamic analysis can more effectively identify unknown and novel malicious interference. Typical dynamic change characteristics include signal bursts, periodicity, and frequency drift, which are difficult to capture using static analysis methods. Especially in the field of network security, malicious interference detection relies more on behavioral and traffic analysis, such as detecting malicious interference by analyzing abnormal network traffic behavior. Common attack methods, such as distributed denial-of-service (DDoS) attacks and man-in-the-middle attacks, exhibit dynamic characteristics and must be effectively identified through dynamic detection.

[0004] The main problems with existing technologies include: strong passivity in detection, only able to respond to known interference patterns and unable to proactively identify new malicious signals; feature extraction limited to static parameters in the frequency domain, ignoring the dynamic changes in signal temporal behavior; insufficient model robustness, unable to adaptively update when environmental parameters change; and a lack of comprehensive behavioral discrimination criteria, making it difficult to cope with complex malicious strategies. These problems stem from the fact that existing methods have failed to effectively integrate temporal prediction and frequency domain feature classification, and that model training relies on fixed historical datasets, making it impossible to capture the evolution of signal intent in real time. Summary of the Invention

[0005] The purpose of this invention is to provide a malicious interference detection device and method based on signal behavior analysis, which has the advantages of actively identifying malicious signals, improving detection accuracy, and adaptive updating.

[0006] The objective of this invention is achieved through the following technical solution: As a first aspect of the present invention, a malicious interference detection device based on signal behavior analysis is proposed. Through signal monitoring and behavior analysis, the model parameters of the neural network are dynamically adjusted to determine maliciousness, thereby realizing the active identification and accurate detection of dynamically changing malicious signals. The device includes a signal monitoring module, a behavior analysis module, a prediction and classification module, an adaptive update module, and an automatic parameter selection module. The signal monitoring module is used to collect transmission status, frequency band, and time interval parameters in real time. The behavior analysis module is used to extract time-series features, frequency-domain features, and joint time-frequency features, and to identify the behavior type. The prediction and classification module combines neural networks to score anomalies and identify malicious behavior; the adaptive update module dynamically adjusts the parameters of the neural network model. The adaptive update module dynamically optimizes the neural network and updates the model parameters of the neural network by monitoring the input signal through gradient descent and gradient feedback. In practice, when the adaptive update module detects a new malicious behavior pattern or environmental disturbance, it triggers the fine-tuning or reconstruction of the neural network parameters. By using backpropagation combined with the loss function, the learning rate and weight decay factor are adjusted to ensure that the neural network can quickly adapt to new features without retraining the entire dataset, thereby improving the robustness of identifying dynamically evolving malicious signals.

[0007] The automatic parameter selection module searches for the optimal combination in a preset hyperparameter space, selects key parameters, and evaluates performance gains by combining cross-validation results, thereby balancing model structure and operating efficiency and improving the accuracy and real-time performance of malicious detection.

[0008] The parameter selection is dynamically chosen based on the statistical characteristics of the current data stream; the selected parameters include the convolution kernel size, pooling window, and number of hidden layer nodes; the statistical characteristics include the signal-to-noise ratio and behavior frequency distribution. The working process of the behavior analysis module includes: Step 1: Perform sliding window segmentation on the original behavior sequence; Step 2: Apply wavelet transform or short-time Fourier transform to the segmented data to map the time-domain signal to the frequency domain; Step 3: Extract frequency domain features and capture long-term dependencies to obtain time-series features; The frequency domain characteristics include frequency domain energy spectrum, main band power, and harmonic ratio; The capture of long-term dependencies is achieved by using an LSTM or Transformer architecture. The temporal characteristics include action intervals, periodic patterns, and temporal abrupt change points; Step 4: After fusing the frequency domain features and time series features, a high-dimensional behavioral fingerprint is formed; In practice, the search for the optimal combination is achieved using Bayesian optimization or a genetic algorithm. The behavior analysis module extracts temporal features, frequency domain features, and time-frequency joint features based on real-time acquired operation sequences and provides the behavior type; the operation sequence includes transmission status, frequency band, and time interval parameters; In practice, the behavior analysis module measures the uncertainty and randomness of the operation sequence by extracting time-series features, frequency-domain features, and time-frequency joint features. Based on the uncertainty and randomness, it determines the behavior type. Specifically, it calculates the behavior entropy, extracts the statistical features of the behavior entropy, and gives the behavior type. For example, the behavior entropy of normal behavior is usually low and stable, while the behavior entropy of malicious behavior rises sharply or fluctuates at a high level. The historical entropy distribution dynamically establishes a sliding threshold and combines it with Granger causality tests to determine the driving relationship between different behavioral events and predict behavior. The behavior analysis module selects behavior entropy through dynamic analysis and strategy adjustment, and sets a causal threshold for identifying malicious behavior; time-series features are extracted through a time-series prediction model; frequency domain features include static statistics and dynamic real-time features.

[0009] The signal monitoring module and the behavior analysis module work together. By parsing high-speed data packets and extracting frequency domain features, the signal monitoring module collects and outputs the transmission status, frequency band and time interval parameters in real time to the behavior analysis module. The behavior analysis module extracts time series and frequency domain features and feeds them to the prediction and classification module. The prediction and classification module trains a behavior feature matrix based on a neural network and performs anomaly scoring and malicious behavior identification through an anomaly scoring unit and a malicious behavior determination unit, respectively.

[0010] The signal monitoring module collects signal features, primarily frequency band and time sequence characteristics, in real time to provide basic data for subsequent behavior analysis. It then combines the collected signal features with an automatic parameter selection module to optimize feature encoding. The optimized feature encoding is input into the prediction and classification module. The prediction and classification module includes a prediction unit and a malicious detection unit, which performs anomaly scoring and malicious signal determination based on the extracted static and dynamic frequency domain features.

[0011] The adaptive update module and the automatic parameter selection module form a closed-loop feedback system, which periodically receives false positive / false negative samples and confidence information output by the behavior analysis module. The system uses this feedback data to generate adversarial samples or incremental training sets, drive the neural network to perform online fine-tuning, and update the parameter selection strategy simultaneously. The entire process supports the model to continuously accumulate attack pattern knowledge over time, realizing the evolution of proactive identification and defense capabilities against unknown variant malicious signals.

[0012] The anomaly scoring unit predicts behavior and calculates deviation using a time-series model to generate an anomaly score; the malice determination unit determines malicious signals based on the anomaly score and feature combination. The prediction and classification module classifies samples based on deep learning; the adaptive update module includes a parameter adjustment unit and a parameter update unit, which are used to dynamically optimize the classification threshold of the classification model and update the classification model parameters within the constraints, respectively. The parameter adjustment unit also includes a strategy generation subunit, which continuously optimizes the model through an online learning and update mechanism, adaptively generates strategies to adapt to new malicious interference, and dynamically adjusts model parameters according to the type of interference. The parameter update unit also includes a multimodal analysis subunit, which dynamically adjusts the model parameters by combining time-series and frequency-domain features and behavioral analysis with adaptive learning. When the multimodal analysis subunit detects an unknown interference mode, it receives time-series and frequency-domain features from the behavior analysis module in real time, generates a composite feature vector through feature fusion, and constructs a multidimensional feature matrix; it then inputs the updated classification model to complete the dynamic identification of the interference type.

[0013] The parameter update unit is used to update parameters, continuously receive real-time data streams from the signal monitoring module, and incrementally learn the characteristics of new interference signals using online learning algorithms. The parameter update unit retains the interference sample data within the most recent time window through a sliding window mechanism, and uses stochastic gradient descent to calculate the model parameter update amount, thereby gradually optimizing the classification boundary while updating the model parameters.

[0014] The parameter update unit also includes a cross-domain fusion subunit, which integrates frequency domain analysis, behavior analysis, and deep learning. This subunit simulates complex interference signals and elicits signal intent responses by generating controllable signals with specific interference patterns through a signal source. It also collects transmission status, frequency band, and time interval parameters in real time through a signal monitoring module. Furthermore, the behavior analysis module extracts temporal and frequency domain features of retry delay distribution anomalies or frequency band randomness thresholds based on signal behavior, forming a discrimination criterion for behavior analysis. The prediction and classification module includes a prediction unit, which includes prediction and malicious intent determination. The prediction unit uses a prediction model, combined with the temporal and frequency domain features extracted by the behavior analysis module, to make predictions, calculates the deviation, obtains the prediction result, and generates an anomaly score. The prediction result represents the predicted behavior; the anomaly score is generated based on the calculated deviation.

[0015] When the signal monitoring module detects an abnormal signal, the behavior analysis module extracts its time-series and frequency-domain features and inputs them into the prediction and classification module to extract interference features and make a preliminary judgment to identify the type of interference. The strategy generation subunit calls the corresponding parameter adjustment strategy library to generate parameter adjustment instructions suitable for this type of interference. For frequency hopping interference, the time window for frequency domain feature extraction is automatically reduced to the millisecond level, while the frequency band distribution entropy threshold in the classification model is reduced by a specific ratio; the parameter adjustment unit acts on the feature extraction and classification modules in real time. The strategy generation subunit uses the interference feature vector output by the prediction and classification module to identify the current interference type using a pre-trained interference type classification model; The parameter adjustment commands applicable to this type of interference are as follows: When encountering frequency hopping interference, the feature extraction window and classification threshold are automatically optimized, thereby improving the accuracy of frequency domain feature capture. When faced with intermittent interference, the observation window length of the time series prediction model is dynamically adjusted to enhance the detection sensitivity to sudden signals.

[0016] When the prediction model is an LSTM model, the LSTM model includes an input layer, a wide network layer, a linear layer, and an output layer; The input layer feeds the acquired multidimensional sequences into the linear sublayer and the LSTM sublayer, respectively. Wide network layers, including linear sublayers and LSTM sublayers; In a wide network layer, the linear sublayer is a linear model, and memory preprocessing is performed through the linear sublayer; The LSTM sublayer in the wide network layer is a bidirectional LSTM network. The bidirectional LSTM network fully fuses the multidimensional sequence data. When processing the multidimensional sequence at the current time, it fuses the information of the preceding and following data, that is, it performs serialization feature fusion on the multidimensional sequence data, which better represents the nonlinear interference relationship between the current multidimensional sequence and the preceding and following multidimensional sequences, improves the nonlinear equalization capability of the wide network layer for multidimensional sequences, and outputs the data fusion representation sequence. The memory sequence output from the linear sublayer and the data fusion representation sequence output from the LSTM sublayer are input into the linear layer. The linear layer transforms the memory sequence and the data fusion representation sequence into the label space dimension to obtain the probability vector of the label corresponding to the current multidimensional sequence. Based on the maximum probability value in the probability vector, the predicted label result corresponding to the current multidimensional sequence signal is obtained. The input layer feeds multidimensional sequences into the linear sublayers and LSTM sublayers of the wide network layer, respectively. The linear sublayer is a linear model that performs memory processing on the data in the multidimensional sequence, thereby improving the ability of the wide network layer to remember the data in the multidimensional sequence, preventing the wide network layer from overfitting, and outputting a multidimensional memory sequence.

[0017] The LSTM sublayer is a bidirectional LSTM network. The bidirectional LSTM network performs full feature serialization fusion processing on the data in the output multidimensional memory sequence, and performs serialization feature fusion on the preceding and following data information in the output memory sequence. This better represents the nonlinear interference relationship between the current output memory sequence and the preceding and following data information, improves the nonlinear equalization capability of the wide network layer on the output memory sequence, and outputs a data fusion representation sequence. The input data fusion representation sequence is fully fused using a bidirectional LSTM network. The bidirectional LSTM network contains two independent LSTM modules: one LSTM module processes each feature vector of the feature sequence forward from the front end, and the other LSTM module processes each feature vector of the feature sequence backward from the back end.

[0018] As a second aspect of the present invention, a malicious interference detection method based on signal behavior analysis is proposed, comprising the following steps: S1, Signal monitoring and parameter acquisition, to obtain the monitoring signal; The monitoring signal includes the signal transmission status, frequency band, and time interval parameters; S2, extract behavioral features including temporal features and frequency domain features; The timing characteristics are statistical characteristics of transmission intervals and delay distribution; the frequency domain characteristics are frequency domain static characteristics reflecting frequency band distribution and frequency domain dynamic characteristics mainly based on frequency band switching rate. S3, Behavior Prediction, is to predict the future behavior of a signal. It uses a trained time series model to predict the signal behavior in the next time window; compares the predicted behavior with the actual behavior and calculates the deviation as an anomaly score; Anomaly Score, calculates the deviation between the predicted behavior and the actual behavior and generates an anomaly score. S4, based on the combination of time-series features and frequency-domain features extracted by S2, and the anomaly discrimination criteria, and the anomaly score obtained by S3, is classified and determined by a classification model to determine whether the signal monitored by S1 is malicious, thereby realizing malicious interference detection based on signal behavior analysis.

[0019] Beneficial effects: The present invention discloses a malicious interference detection device and method based on signal behavior analysis, which has the following advantages compared with existing malicious interference detection devices and methods: 1. The device collects transmission status parameters in real time through a signal monitoring module, extracts time-series and frequency-domain features through a behavior analysis module, performs malicious judgment by combining a prediction and classification module with a neural network, and dynamically adjusts model parameters through an adaptive update module, thereby achieving proactive identification and accurate detection of dynamically changing malicious signals. It has the advantages of improving detection accuracy and adaptively responding to threats. 2. The parameter adjustment unit of the device dynamically optimizes the model parameters within the constraints to ensure that the classification model maintains a stable detection accuracy when the environmental noise changes; the parameter update unit continuously learns new interference samples, enabling the classification model to evolve to cope with unknown attack methods and reduce the risk of misjudgment caused by interference pattern variation; the reasonable setting of the adjustment range prevents the model from deviating from the initial optimization state due to excessive parameter adjustment and maintains the reliability of the classification decision boundary. 3. The malicious interference detection device achieves dynamic optimization of the classification threshold through the parameter adjustment unit, which solves the problem of the failure of fixed threshold in time-varying channels; through the online learning mechanism of the parameter update unit, the model parameters can be continuously optimized without interrupting the detection process, overcoming the model lag caused by traditional offline updates. 4. In the malicious interference detection device, when the signal monitoring module detects an abnormal signal, the behavior analysis module extracts its temporal and frequency domain features and inputs them into the prediction and classification module for preliminary judgment; the strategy generation subunit uses the interference feature vector output by the prediction and classification module to identify the current interference type using a pre-trained interference type classification model; for example, when the frequency band switching rate exceeds a preset threshold, it is determined to be a frequency hopping interference type; subsequently, the strategy generation subunit calls the corresponding parameter adjustment strategy library to generate parameter adjustment instructions suitable for this interference type; for frequency hopping interference types, the time window for frequency domain feature extraction can be automatically reduced to the millisecond level, while the frequency band distribution entropy threshold in the classification model is reduced by a specific proportion; these adjustments are applied to the feature extraction and classification modules in real time through the parameter adjustment unit, enabling the device to accurately capture rapidly changing interference features; 5. When encountering frequency hopping interference, the malicious interference detection device and method automatically optimize the feature extraction window and classification threshold, thereby improving the accuracy of frequency domain feature capture; when facing intermittent interference, the observation window length of the time series prediction model is dynamically adjusted to enhance the detection sensitivity to sudden signals; the parameter dynamic adjustment mechanism based on interference type significantly improves the detection accuracy and system robustness under complex interference environments. 6. The parameter update unit of the malicious interference detection device continuously receives real-time data streams from the signal monitoring module during the operation of the detection device, and incrementally learns the features of new interference signals using an online learning algorithm. This unit retains interference sample data within the most recent time window through a sliding window mechanism, and calculates the model parameter update amount using a stochastic gradient descent method, gradually optimizing the classification boundary while maintaining the original knowledge. When an unknown interference mode is detected, the multimodal analysis subunit simultaneously extracts the temporal and frequency domain features of the signal, generates a composite feature vector through feature fusion, and inputs it into the updated classification model to complete the dynamic identification of the interference type. This mechanism enables the model parameters to adaptively adjust as the behavior pattern of the interference signal evolves, effectively responding to new interference strategies such as frequency band switching and power modulation employed by attackers. 7. The multimodal analysis subunit of the malicious interference detection device receives temporal and frequency domain features from the behavior analysis module in real time and constructs a multidimensional feature matrix using a feature fusion algorithm. For example, after normalizing the transmission interval variance and frequency band switching rate, the data is input into the multilayer perceptron model to generate a joint feature vector. This subunit further combines the malicious behavior discrimination results output by the behavior analysis module and dynamically adjusts the decision boundary parameters of the classification model through an online learning mechanism. When a new type of interference signal is detected, the multimodal analysis subunit triggers the parameter update unit to dynamically correct the classification threshold in the model based on the abnormal correlation patterns of temporal and frequency domain features in the feature matrix, such as the contradictory phenomenon of a sudden increase in frequency band switching rate but an abnormal decrease in transmission interval variance. Simultaneously, the feature weight allocation coefficients are continuously optimized through an adaptive learning algorithm, enabling the model to prioritize cross-modal feature combinations with strong discriminative power. 8. The malicious interference detection method reduces the false judgment rate through comprehensive analysis of time-series and frequency-domain features; the dynamic behavior prediction mechanism effectively identifies the evolution of signal intent and reduces dependence on historical datasets; the online model update function enhances the system's robustness against unknown interference and avoids the detection accuracy from decreasing with environmental changes; the hybrid classification architecture improves the ability to distinguish complex interference strategies and achieves accurate differentiation between normal signals being interfered with and malicious active attacks. Attached Figure Description

[0020] Figure 1 This is a schematic diagram showing the composition and connection of a malicious interference detection device based on signal behavior analysis according to the present invention; Figure 2 This is a flowchart of a malicious interference detection process based on signal behavior analysis according to the present invention. Detailed Implementation

[0021] The technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The components of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following drawings indicate similar items; therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Furthermore, in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0022] like Figure 1 As shown in this embodiment, a malicious interference detection device based on signal behavior analysis is disclosed, including a signal monitoring module, a behavior analysis module, a prediction and classification module, and an adaptive update module. The signal monitoring module is used to collect transmission status, frequency band, and time interval parameters in real time. The behavior analysis module is used to extract temporal and frequency domain features, and combine these features to detect malicious behavior. Preferably, in the behavior analysis module, the behavior analysis identifies malicious behavior by dynamically analyzing and adjusting the behavior entropy and setting a causality threshold. The frequency domain features include static statistics and dynamic real-time features.

[0023] The time series features are extracted through a time series prediction model. This time series prediction model, in specific implementations, includes, but is not limited to, a moving average model, an autoregressive model, an autoregressive moving average model, and a synergistic moving average autoregressive model. Preferably, the malicious interference detection device further includes an automatic parameter selection module. In specific implementation, the signal monitoring module and the behavior analysis module work together. Through high-speed data packet parsing and frequency domain feature extraction, the signal monitoring module collects and outputs the transmission status, frequency band, and time interval parameters in real time to the behavior analysis module. The behavior analysis module extracts time-series and frequency domain features for the prediction and classification module. The prediction and classification module trains a behavior feature matrix based on a neural network and uses an anomaly scoring and malicious behavior determination unit to identify malicious signals and behaviors. An adaptive update module is used to dynamically adjust the model and update model parameters.

[0024] This invention discloses a malicious interference detection device based on signal behavior analysis. Through a signal monitoring module, a behavior analysis module, a prediction and classification module, an adaptive update module, and an automatic parameter selection module, it not only realizes signal monitoring and behavior analysis, but also combines neural networks to determine malice and dynamically adjust model parameters to achieve proactive identification and accurate detection of dynamically changing malicious signals. It has the advantages of improving detection accuracy and adaptively responding to threats.

[0025] Preferably, the signal monitoring module and the behavior analysis module work together. Through high-speed data packet parsing and frequency domain feature extraction, the signal monitoring module collects and outputs the transmission status, frequency band, and time interval parameters in real time to the behavior analysis module. The behavior analysis module extracts time-series and frequency domain features and feeds them to the prediction and classification module. The prediction and classification module trains a behavior feature matrix based on a neural network and uses an anomaly scoring and malice determination unit to determine malicious signals and identify malicious behaviors. An adaptive update module is used to dynamically adjust the model and update the model parameters.

[0026] Preferably, the signal monitoring module collects signal features, primarily frequency band and time-series characteristics, in real time, providing foundational data for the subsequent behavior analysis module and adaptive update module. Providing foundational data for subsequent behavior analysis specifically involves optimizing feature encoding by combining the collected signal features with an automatic parameter selection module. The optimized feature encoding is then input into the prediction and classification module. The prediction and classification module includes a prediction unit and a malicious detection unit. This module uses extracted static and dynamic frequency domain features to perform anomaly scoring and malicious signal determination.

[0027] The frequency domain features include the extraction of static frequency domain features and dynamic frequency domain features.

[0028] Furthermore, the anomaly scoring unit predicts behavior and calculates deviation to generate anomaly scores through a time-series model; the malice determination unit determines malicious signals based on the anomaly scores combined with feature combinations.

[0029] Furthermore, the prediction and classification module uses deep learning to classify samples; the adaptive update module includes a parameter adjustment unit and a parameter update unit, which are used to dynamically optimize the classification threshold of the classification model and update the classification model parameters within the constraints, respectively; the parameter adjustment is adjusted within a preset range.

[0030] The parameter adjustment unit dynamically optimizes the model parameters within the constraints, ensuring that the classification model maintains a stable detection accuracy when environmental noise changes. The adjustment range is set reasonably to prevent the model from deviating from the initial optimization state due to excessive parameter adjustment, thus maintaining the reliability of the classification decision boundary.

[0031] Furthermore, the parameter adjustment unit is used to dynamically adjust the model parameters; the parameter update unit is used to update the parameters. The parameter update unit is used to update parameters, specifically by continuously learning new interference samples, enabling the classification model to evolve to cope with unknown attack methods and reducing the risk of misjudgment caused by interference pattern variations.

[0032] Furthermore, the parameter adjustment unit also includes a strategy generation subunit, which continuously optimizes the model through an online learning and update mechanism, adaptively generates strategies to adapt to new malicious interference, and dynamically adjusts the model parameters according to the type of interference. The parameter adjustment unit enables dynamic optimization of the classification threshold, solving the problem of fixed threshold failure in time-varying channels; the online learning mechanism of the parameter update unit enables dynamic optimization of the classification threshold, achieving continuous optimization of model parameters without interrupting the detection process, overcoming the model lag caused by traditional offline updates.

[0033] Furthermore, the parameter update unit continuously optimizes the model through an online learning update mechanism to adapt to new types of malicious interference.

[0034] Preferably, the parameter update unit continuously receives real-time data streams from the signal monitoring module during the operation of the detection device, and uses an online learning algorithm to incrementally learn the characteristics of novel interference signals.

[0035] The parameter update unit retains the interference sample data within the most recent time window through a sliding window mechanism, and calculates the model parameter update amount using the stochastic gradient descent method, thereby gradually optimizing the classification boundary while updating the model parameters.

[0036] Furthermore, the parameter update unit also includes a multimodal analysis subunit, which combines time-series and frequency-domain features and behavioral analysis with adaptive learning to dynamically adjust model parameters in order to cope with new threats.

[0037] When the multimodal analysis subunit detects an unknown interference mode, it receives time-series and frequency-domain features from the behavior analysis module in real time, generates a composite feature vector through feature fusion, and constructs a multidimensional feature matrix; it inputs the updated classification model to complete the dynamic identification of the interference type; the multimodal analysis subunit enables the classification model parameters to be adaptively adjusted as the behavior mode of the interference signal evolves, in order to cope with the attacker's frequency band jumps and power modulation.

[0038] The classification model is a hybrid architecture. In specific implementation, the hybrid architecture includes, but is not limited to, GMM, and combinations of Transformer, CNN or RNN with time series models; the time series models include GRU, LSTM, and Bi-LSTM; the hybrid architecture can improve the ability to discriminate complex interference strategies and achieve accurate differentiation between normal signals being interfered with and malicious active attacks.

[0039] The dynamic identification of the interference type specifically involves: normalizing the transmission interval variance and frequency band switching rate in the constructed multidimensional feature matrix, and then inputting them into a multilayer perceptron model to generate a joint feature vector.

[0040] The composite feature vector, combined with the malicious behavior discrimination results output by the behavior analysis module, is used to dynamically adjust the decision boundary parameters of the classification model through online learning.

[0041] When the multimodal analysis subunit detects a new type of interference signal, based on the abnormal correlation pattern between the time-series and frequency-domain features in the feature matrix, if there is a contradiction between a sudden increase in the frequency band switching rate and an abnormal decrease in the variance of the transmission interval, the parameter update unit is triggered to dynamically correct the threshold of the classification model. At the same time, through adaptive learning, the feature weight allocation coefficients are continuously optimized so that the classification model can prioritize cross-modal feature combinations with strong discriminative power.

[0042] The dynamic identification of interference types involves normalizing the transmission interval variance and frequency band switching rate in the constructed multidimensional feature matrix and then inputting it into a multilayer perceptron model to generate a joint feature vector. The comprehensive analysis of temporal and frequency domain features reduces the false positive rate. A dynamic behavior prediction mechanism effectively identifies the evolution of signal intent, reducing reliance on historical datasets. The online update function of the classification model enhances the robustness of the device against unknown interference, preventing a decrease in detection accuracy due to environmental changes.

[0043] The working method of the malicious interference detection device is as follows: When the signal monitoring module detects an abnormal signal, the behavior analysis module extracts its time-series and frequency-domain features and inputs them into the prediction and classification module to extract interference features and make a preliminary judgment to identify the type of interference.

[0044] The strategy generation subunit calls the corresponding parameter adjustment strategy library to generate parameter adjustment instructions suitable for this type of interference.

[0045] For frequency hopping interference, the time window for frequency domain feature extraction is automatically reduced to the millisecond level, while the frequency band distribution entropy threshold in the classification model is reduced by a specific ratio. The parameter adjustment unit acts on the feature extraction and classification modules in real time, enabling the device to accurately capture rapidly changing interference features.

[0046] The strategy generation subunit identifies the current interference type by using the interference feature vector output by the prediction and classification module and a pre-trained interference type classification model.

[0047] The parameter update unit is used to update parameters, specifically: By continuously learning from new interference samples, the classification model can evolve to cope with unknown attack methods, reducing the risk of misjudgment caused by variations in interference patterns. During the operation of the detection device, the parameter update unit continuously receives real-time data streams from the signal monitoring module and uses online learning algorithms to incrementally learn the characteristics of new interference signals. The parameter update unit retains the interference sample data within the most recent time window through a sliding window mechanism, and uses stochastic gradient descent to calculate the model parameter update amount, thereby gradually optimizing the classification boundary while updating the model parameters.

[0048] The parameter update unit also includes a cross-domain fusion subunit, which integrates frequency domain analysis, behavioral analysis, and deep learning. This subunit simulates complex interference signals and elicits signal intent responses by generating controllable signals with specific interference patterns from a signal source. It also collects transmission status, frequency band, and time interval parameters in real time through a signal monitoring module. Furthermore, the behavioral analysis module extracts temporal and frequency domain features of retry delay distribution anomalies or frequency band randomness thresholds based on signal behavior, forming a discrimination criterion for behavioral analysis. The prediction and classification module includes a prediction unit, which performs prediction and malicious detection. The prediction unit uses a prediction model, combined with the temporal and frequency domain features extracted by the behavioral analysis module, to make predictions, calculates the deviation, obtains the prediction result, and generates an anomaly score. The prediction model is an LSTM, improved LSTM, improved GRU, or ARIMA model. The prediction result is the predicted behavior; the anomaly score is generated by calculating the deviation; the maliciousness determination is based on the combination of anomaly score and deviation determination features; temporal features include the mean and variance of the transmission interval; the maliciousness determination unit obtains the maliciousness determination result by performing a mixture detection of several classification models based on the prediction result obtained from the prediction model; the adaptive update module is used for dynamic adjustment and randomness assessment; the transmission interval statistical value window is dynamically adjusted to adapt to the density changes of complex interference signals and their excitation response signals; randomness assessment is based on the anomaly score by calculating the frequency band entropy value and relying on the Shannon entropy threshold to assess randomness; the signal monitoring module includes a transmission status acquisition unit and a frequency band acquisition unit. The system includes a time parameter acquisition unit and a transmission status acquisition unit, which are connected to the frequency band acquisition unit and the time parameter acquisition unit, respectively. The frequency band acquisition unit is used to acquire frequency band information. The transmission status acquisition unit is used to acquire transmission status in real time. The time parameter acquisition unit is used to acquire time interval parameters. The behavior analysis module includes a time-series feature extraction unit and a frequency domain feature extraction unit. The time-series feature extraction unit is used to extract time-series features. The frequency domain feature extraction unit is used to extract static frequency domain features and dynamic frequency domain features. Dynamic frequency domain features include frequency band switching rate and frequency band distribution entropy value. Static frequency domain features include average frequency, frequency standard deviation, frequency variance, and root mean square frequency.

[0049] The parameter adjustment command applicable to this type of interference is specifically as follows: When encountering frequency hopping interference, the feature extraction window and classification threshold are automatically optimized, thereby improving the accuracy of frequency domain feature capture.

[0050] When faced with intermittent interference, the observation window length of the time series prediction model is dynamically adjusted to enhance the detection sensitivity to sudden signals; the parameter dynamic adjustment mechanism based on interference type significantly improves the detection accuracy and system robustness under complex interference environments.

[0051] The types of interference include frequency hopping interference and intermittent interference.

[0052] The frequency hopping interference is determined by the following criteria: when the frequency band switching rate exceeds a preset threshold, it is determined to be a frequency hopping interference type.

[0053] The criteria for determining the intermittent interference include: 1) Time or frequency period judgment: Through wide bandwidth and long-term monitoring, abnormal spikes, interruptions or clutter at a specific frequency or time are recorded; the abnormal spikes, interruptions or clutter are intermittent and irregular. 2) Time-domain analysis and decision: Statistical analysis is performed on the time-domain data of the signal. If the parameters show significant differences in different time periods, it indicates the probability of intermittent interference. 3) Frequency domain analysis and decision-making: The signal is converted to the frequency domain using methods such as Fourier transform, and the distribution and changes of the spectrum are analyzed to identify the frequency characteristics of intermittent interference; 4) Spectrum comparison and judgment: The current spectrum is compared and observed with the recorded signal reference spectrum characteristics to confirm whether there are any new abnormal signal components or spectrum changes, and to identify intermittent interference. 5) Parameter comparison and judgment: Monitor signal parameters such as spectrum, waveform shape, pulse width, repetition period, intensity, bandwidth, peak value, mean, variance, kurtosis, RMS value and system to confirm whether there are any new abnormal signal parameters. If the parameters fluctuate significantly or are abnormal in a short period of time, it indicates that there is a probability of intermittent interference. 6) The device start-up and shutdown refers to monitoring the spectrum and signal parameters while starting or stopping the device to observe whether interference appears, weakens, or disappears; The signal parameters include, but are not limited to, waveform shape, pulse width, repetition period, intensity, bandwidth, peak value, mean, variance, kurtosis, RMS value, and system.

[0054] Furthermore, the parameter update unit also includes a cross-domain fusion subunit, which integrates frequency domain analysis, behavioral analysis, and deep learning to improve detection efficiency and accuracy. In specific implementation, a controllable signal with a specific interference pattern is generated by a signal source to simulate complex interference signals and the intended response of the excited signal. The malicious interference detection device of this application periodically detects unknown interference patterns based on the update trigger conditions of the included model, improving system flexibility. Specifically, the signal monitoring module of the detection device collects transmission status, frequency band, and time interval parameters in real time; the behavioral analysis module extracts time-series and frequency domain features of retry delay distribution anomalies or frequency band randomness thresholds based on signal behavior and forms a discrimination standard for behavioral analysis; the prediction unit in the prediction and classification module includes prediction and malicious determination. The prediction unit uses a prediction model, combined with the time-series and frequency domain features extracted by the behavioral analysis module, to make predictions, calculates the deviation, obtains the prediction result, and generates an anomaly score. The prediction model is an LSTM, improved LSTM, improved GRU, or ARIMA model.

[0055] The anomaly scoring unit predicts behavior using a time-series model and calculates deviation to generate anomaly scores. The malicious intent determination unit determines malicious signals based on the anomaly scores combined with feature combinations.

[0056] The prediction and classification module uses deep learning models, such as heterogeneous graphs, to classify samples. The adaptive update module includes a parameter tuning unit and a parameter update unit. Tuning is performed within a predetermined range.

[0057] The parameter adjustment unit is used to dynamically adjust model parameters. The parameter update unit is used to update parameters.

[0058] The parameter adjustment unit also includes a policy generation subunit, which is used to adaptively generate policies and dynamically adjust model parameters according to the type of interference.

[0059] The parameter update unit continuously optimizes the model through an online learning and update mechanism to adapt to new malicious interference.

[0060] The parameter update unit also includes a multimodal analysis subunit, which combines time-series and frequency-domain features and behavioral analysis with adaptive learning to dynamically adjust model parameters in order to address new threats.

[0061] The parameter update unit also includes a cross-domain fusion subunit, which integrates frequency domain analysis, behavioral analysis, and deep learning to improve detection efficiency and accuracy. In specific implementation, a controllable signal with a specific interference pattern is generated by a signal source to simulate complex interference signals and the intended response of the excited signal. The malicious interference detection device of this application periodically detects unknown interference patterns based on the update trigger conditions of the included model, improving system flexibility. Specifically, the signal monitoring module of the detection device collects transmission status, frequency band, and time interval parameters in real time. The behavioral analysis module extracts time-series and frequency domain features of retry delay distribution anomalies or frequency band randomness thresholds based on signal behavior and forms a discrimination criterion for behavioral analysis. The prediction unit in the prediction and classification module includes prediction and malicious determination. The prediction unit uses a prediction model, combined with the time-series and frequency domain features extracted by the behavioral analysis module, to make predictions, calculates the deviation, obtains the prediction result, and generates an anomaly score. The prediction model is an LSTM, improved LSTM, improved GRU, or ARIMA model.

[0062] When the prediction model is an LSTM model, the LSTM model includes an input layer, a wide network layer, a linear layer, and an output layer.

[0063] The input layer inputs the collected multidimensional sequences into the linear sublayer and the LSTM sublayer, respectively.

[0064] The wide network layer includes a linear sublayer and an LSTM sublayer.

[0065] The linear sublayer in a wide network layer is a linear model. Memory preprocessing is performed through the linear sublayer to improve the wide network layer's ability to remember multidimensional sequences and prevent overfitting.

[0066] The LSTM sublayer in the wide network layer is a bidirectional LSTM network. The bidirectional LSTM network fully fuses the multidimensional sequence data. When processing the multidimensional sequence at the current time, it fuses the information of the preceding and following data, that is, it performs serialization feature fusion on the multidimensional sequence data, which better represents the nonlinear interference relationship between the current multidimensional sequence and the preceding and following multidimensional sequences, improves the nonlinear equalization capability of the wide network layer for multidimensional sequences, and outputs a data fusion representation sequence.

[0067] The memory sequence output from the linear sublayer and the data fusion representation sequence output from the LSTM sublayer are input into the linear layer. The linear layer transforms the memory sequence and the data fusion representation sequence into the label space dimension to obtain the probability vector of the label corresponding to the current multidimensional sequence. Based on the maximum probability value in the probability vector, the predicted label result corresponding to the current multidimensional sequence signal is obtained.

[0068] The input layer feeds multidimensional sequences into the linear sublayer and LSTM sublayer in the wide network layer, respectively.

[0069] The linear sublayer is a linear model that performs memory processing on data in a multidimensional sequence, enhancing the memory capacity of the wide network layer and preventing overfitting. The output is a multidimensional memory sequence. The input multidimensional sequence to the linear sublayer is the memory sequence to be output. in, For input The weight parameter matrix, This is the bias parameter matrix.

[0070] The LSTM sublayer is a bidirectional LSTM network that performs full feature serialization and fusion processing on the data in the output multidimensional memory sequence. It performs serialization and feature fusion on the preceding and following data information in the output memory sequence, better representing the nonlinear interference relationship between the current output memory sequence and the preceding and following data information, improving the nonlinear equalization ability of the wide network layer on the output memory sequence, and output data fusion representation sequence.

[0071] The input data fusion representation sequence is fully fused using a bidirectional LSTM network. The bidirectional LSTM network consists of two independent LSTM modules. One LSTM module processes each feature vector of the feature sequence forward, starting from the beginning. Another LSTM module processes each feature vector of the feature sequence backward, starting from the end of the feature sequence, as shown in the following formula: ; for tAt any given time, the LSTM module processes the data as follows: in, , , , Enter the current time. The weight parameter matrix, , , , The hidden layer state at the previous moment The weight parameter matrix, for t Hidden layer state at time -1 , , , For the bias parameter matrix, For the Sigmoid function, Hadamard product; hidden layer states of an LSTM module The expression is: ;in, for t The hidden state at time t, for t At any given time, the output of the bidirectional LSTM network is formed by splicing the outputs of two serial LSTM modules.

[0072] For the constructed LSTM-based prediction model, configure the parameters required for training the prediction model, including: learning rate, batch size, initial hidden layer weights, optimization rules, and number of iterations, and train until a well-trained LSTM prediction model is obtained.

[0073] Preferably, when the prediction model is an improved LSTM model, the specific operation is as follows: the input multivariate time series is passed through a dimension shuffling layer, an LSTM block, and a fully convolutional block in sequence.

[0074] The input to the dimension-mixing layer varies depending on the dimension, with Q time steps to process M variables at each time step; the LSTM block processes Q variables at each time step with M time steps; the input to the fully convolutional block is a multivariate time series with Q time steps, each time step having M different variables.

[0075] When the prediction model is an improved GRU, the network model includes an update gate. z t and reset door r t : The improved GRU operation method is as follows: Step 1: Reset the door rt The expression used to determine whether the hidden state information from the previous time step should be preserved when computing a new hidden state is: ; in, Reset the gate input for the current moment The weight parameter matrix, for t The hidden layer state at time -1; rt Reset the gate's output for the current moment; Step 2: Update the door z t The expression used to determine how much hidden state information from the previous time step is retained in the current time step is: ; in, Update the gate input for the current moment The weight parameter matrix, for t The hidden layer state at time -1; zt Update the gate's output for the current moment; Step 3: Candidate Hidden State This indicates what the hidden state is at the current time step if the door is allowed to be reset to adjust the hidden state information of the previous time step. The expression is: ;in, Here is the weight parameter matrix of the hidden layer at the current time step, and tanh is the activation function; Step 4: Hide the current state ht The expression: ;in, This represents the current candidate hidden state; When the prediction model is an ARIMA model, the ARIMA model assumes that the trend of the time series is eliminated by two differencing operations, and that subsequent changes are determined only by random fluctuations; therefore, the ARIMA model predicts the output... y t The expression is: y t =c+s1 y t-1 +s2 y t-2 +ω t ; in, y t , y t-1 as well as y t-2 s1 and s2 are the predicted outputs at time t, t-1, and t-2, respectively; s1 and s2 are the first and second difference coefficients, respectively; ωt The value is a random fluctuation, and c is a fixed offset.

[0076] The prediction result is the predicted behavior; the anomaly score is generated by calculating the deviation; the malicious determination is based on the combination of anomaly score and deviation judgment features; temporal features include, but are not limited to, the mean and variance of the transmission interval; the malicious determination unit, in specific implementation, obtains the classification result by mixing several classification models based on the prediction result obtained from the prediction model; several classification models include, but are not limited to, SVM or decision trees and ensemble learning models; the adaptive update module, in specific implementation, includes two parts: one part is dynamic adjustment and randomness evaluation; dynamic adjustment specifically involves dynamically adjusting the transmission interval statistical value window to adapt to the density changes of complex interference signals and their excitation response signals; randomness evaluation is based on the anomaly score by calculating the frequency band entropy value and evaluating randomness using the Shannon entropy threshold. The signal monitoring module includes a transmission status acquisition unit, a frequency band acquisition unit, and a time parameter acquisition unit, with the transmission status acquisition unit connected to the frequency band acquisition unit and the time parameter acquisition unit respectively. The frequency band acquisition unit is used to acquire frequency band information; the transmission status acquisition unit is used to acquire the transmission status in real time; the time parameter acquisition unit is used to acquire time interval parameters. The behavior analysis module includes a time-series feature extraction unit and a frequency-domain feature extraction unit. The time-series feature extraction unit is used to extract time-series features; the frequency-domain feature extraction unit is used to extract static and dynamic frequency-domain features. Dynamic frequency-domain features include frequency band switching rate and frequency band distribution entropy value; static frequency-domain features include average frequency, frequency standard deviation, frequency variance, and root mean square frequency.

[0077] Furthermore, the present invention also discloses a malicious interference detection method based on signal behavior analysis, implemented based on the aforementioned malicious interference detection device based on signal behavior analysis, comprising the following steps: S1, Signal monitoring and parameter acquisition, specifically: real-time acquisition of signal transmission status, frequency band and time interval parameters; transmission status, including but not limited to silent or transmission status.

[0078] Preferably, the range of the surrounding signal frequency band is 800MHz–2GHz.

[0079] Preferably, the transmission state includes active and silent states.

[0080] S2, behavioral characteristics, forming discrimination criteria: obtained by statistically analyzing the mean and variance of the transmission interval of the signal within a time window and calculating the frequency of signal band switching and the entropy value of the band distribution; extracting statistics on the transmission interval and delay distribution based on signal behavior to form time-series characteristics; forming a time-series characteristic anomaly discrimination criterion based on the extracted time-series characteristics, specifically by statistically analyzing the abnormal parts of the transmission interval and delay distribution, forming abnormal intervals and merging them; extracting frequency domain characteristics, including but not limited to extracting frequency domain static characteristics mainly based on band distribution and frequency domain dynamic characteristics mainly based on band switching rate; forming a frequency domain characteristic anomaly discrimination criterion based on the extracted frequency domain characteristics, specifically by statistically analyzing the abnormal parts of the band distribution and band switching rate, forming abnormal intervals and merging the intervals.

[0081] S3, Behavior Prediction, is the prediction of future signal behavior. It uses a trained time-series model to predict the signal behavior in the next time window; compares the predicted behavior with the actual behavior, and calculates the deviation as an anomaly score; the anomaly score is generated by calculating the deviation between the predicted and actual behavior; prediction models include, but are not limited to, traditional models, machine learning models, and deep learning models; traditional models include ARIMA models; machine learning models include, but are not limited to, BP and LSTM; deep learning models include, but are not limited to, CNN and YOLO models. In the specific implementation of S3, the determination of behavior prediction is achieved through the collaboration of a prediction model and a classification model; the prediction model is a time-series prediction model, used to predict the future behavior of the signal and generate anomaly scores; the classification model includes, but is not limited to, traditional classification models, machine learning classification models, and deep learning classification models; traditional classification models include, but are not limited to, threshold classification, SVM, decision trees, Bayesian and ensemble learning models; machine learning classification models include, but are not limited to, GRU, LSTM and BP models; deep learning classification models include, but are not limited to, DCNN and YOLO models; S4, based on the combination of time-series features and frequency-domain features extracted by S2, and the anomaly discrimination criteria, and the anomaly score obtained by S3, is classified and determined by a classification model to determine whether the signal monitored by S1 is malicious, that is, to realize malicious interference detection based on signal behavior analysis.

[0082] When the prediction model is an LSTM model, the LSTM model includes an input layer, a wide network layer, a linear layer, and an output layer.

[0083] The input layer inputs the collected multidimensional sequences into the linear sublayer and the LSTM sublayer, respectively.

[0084] The wide network layer includes a linear sublayer and an LSTM sublayer.

[0085] The linear sublayer in a wide network layer is a linear model. Memory preprocessing is performed through the linear sublayer to improve the wide network layer's ability to remember multidimensional sequences and prevent overfitting.

[0086] The LSTM sublayer in the wide network layer is a bidirectional LSTM network. The bidirectional LSTM network fully fuses the multidimensional sequence data. When processing the multidimensional sequence at the current time, it fuses the information of the preceding and following data, that is, it performs serialization feature fusion on the multidimensional sequence data, which better represents the nonlinear interference relationship between the current multidimensional sequence and the preceding and following multidimensional sequences, improves the nonlinear equalization capability of the wide network layer for multidimensional sequences, and outputs a data fusion representation sequence.

[0087] The memory sequence output from the linear sublayer and the data fusion representation sequence output from the LSTM sublayer are input into the linear layer. The linear layer transforms the memory sequence and the data fusion representation sequence into the label space dimension, obtaining the probability vector of the label corresponding to the current multidimensional sequence. Based on the maximum probability value in the probability vector, the predicted label result corresponding to the current multidimensional sequence signal is obtained.

[0088] The input layer feeds multidimensional sequences into the linear sublayer and LSTM sublayer in the wide network layer, respectively.

[0089] The linear sublayer is a linear model that performs memory processing on data in a multidimensional sequence, enhancing the memory capacity of the wide network layer and preventing overfitting. The output is a multidimensional memory sequence. The input multidimensional sequence to the linear sublayer is the memory sequence to be output. (1) in, For input The weight parameter matrix, This is the bias parameter matrix.

[0090] The LSTM sublayer is a bidirectional LSTM network that performs full feature serialization and fusion processing on the data in the output multidimensional memory sequence. It performs serialization and feature fusion on the preceding and following data information in the output memory sequence, better representing the nonlinear interference relationship between the current output memory sequence and the preceding and following data information, improving the nonlinear equalization ability of the wide network layer on the output memory sequence, and output data fusion representation sequence.

[0091] The input data fusion representation sequence is fully fused using a bidirectional LSTM network. The bidirectional LSTM network contains two independent LSTM modules: one module processes each feature vector of the feature sequence forward from the beginning, as shown in equation (2), and the other module processes each feature vector of the feature sequence backward from the end, as shown in equation (3). t At any given time, the LSTM module processes the data as follows: (2) (3) (4) in, , , , Enter the current time. The weight parameter matrix, , , , The hidden layer state at the previous moment The weight parameter matrix, for t Hidden layer state at time -1 , , , For the bias parameter matrix, For the Sigmoid function, Hadamard product; hidden layer states of an LSTM module The expression is: ;in, for t The hidden state at time t, for t At any given time, the output of the bidirectional LSTM network is formed by splicing the outputs of two serial LSTM modules.

[0092] For the constructed LSTM-based prediction model, configure the parameters required for training the prediction model, including: learning rate, batch size, initial hidden layer weights, optimization rules, and number of iterations, and train until a well-trained LSTM prediction model is obtained.

[0093] When the prediction model is an improved LSTM model, the specific operation is as follows: the input multivariate time series is passed through a dimension shuffling layer, an LSTM block, and a fully convolutional block in sequence.

[0094] The input to the dimension-mixing layer varies depending on the dimension, with Q time steps to process M variables at each time step. The LSTM block processes Q variables at each time step over M time steps. The input to the fully convolutional block is a multivariate time series with Q time steps, each time step having M distinct variables.

[0095] When the prediction model is an improved GRU, the network model includes an update gate. z t and reset door r t .

[0096] The improved GRU operation method is as follows: Step 1: Reset the door r t The expression used to determine whether the hidden state information from the previous time step should be preserved when computing a new hidden state is: ; in, Reset the gate input for the current moment The weight parameter matrix, for t The hidden layer state at time -1; rt Reset the gate's output for the current moment; Step 2: Update the door z t The expression used to determine how much hidden state information from the previous time step is retained in the current time step is: ; in, Update the gate input for the current moment The weight parameter matrix, for t The hidden layer state at time -1; zt Update the gate's output for the current moment; Step 3: Candidate Hidden State This indicates what the hidden state is at the current time step if the door is allowed to be reset to adjust the hidden state information of the previous time step. The expression is: ; in, Here is the weight parameter matrix of the hidden layer at the current time step, and tanh is the activation function; Step 4: Hide the current state ht The expression: ;in, This represents the current candidate hidden state; When the prediction model is an ARIMA model, the ARIMA model assumes that the trend of the time series is eliminated by two differencing operations, and that subsequent changes are determined only by random fluctuations; therefore, the ARIMA model predicts the output... y t The expression is: y t =c+s1 y t-1 +s2 y t-2 +ω t ; in, y t , y t-1 as well as y t-2 s1 and s2 are the predicted outputs at time t, t-1, and t-2, respectively; s1 and s2 are the first and second difference coefficients, respectively; ω t The value is a random fluctuation, and c is a fixed offset.

[0097] The prediction result is a predicted behavior. Anomaly scores are generated by calculating the deviation. Malicious intent determination is based on a combination of anomaly scores and deviation determination features. Temporal features include, but are not limited to, the mean and variance of transmission intervals.

[0098] The malicious detection unit, in its specific implementation, obtains the classification result by performing a mixed detection of several classification models based on the prediction results obtained from the prediction model. The classification models include, but are not limited to, SVM, decision trees, and ensemble learning models. The adaptive update module, in its specific implementation, comprises two parts: dynamic adjustment and stochastic evaluation. Dynamic adjustment specifically involves dynamically adjusting the transmission interval statistical value window to adapt to the density changes of complex interference signals and their excitation response signals. Stochastic evaluation assesses stochasticity based on anomaly scoring, calculating frequency band entropy values, and relying on the Shannon entropy threshold. The signal monitoring module includes a transmission status acquisition unit, a frequency band acquisition unit, and a time parameter acquisition unit. The transmission status acquisition unit is connected to both the frequency band acquisition unit and the time parameter acquisition unit. The frequency band acquisition unit acquires frequency band information. The transmission status acquisition unit acquires transmission status in real time. The time parameter acquisition unit acquires time interval parameters. The behavior analysis module includes a temporal feature extraction unit and a frequency domain feature extraction unit. The temporal feature extraction unit extracts temporal features. The frequency domain feature extraction unit extracts static and dynamic frequency domain features. Dynamic frequency domain features include frequency band switching rate and frequency band distribution entropy values. Static frequency domain characteristics include average frequency, frequency standard deviation, frequency variance, and root mean square frequency.

[0099] like Figure 2As shown in this embodiment, a malicious interference detection method based on signal behavior analysis is disclosed, which includes the following steps: S1, Signal Monitoring and Parameter Acquisition, specifically: Real-time acquisition of signal transmission status, frequency band, and time interval parameters.

[0100] The S1 monitors signal behavior through signal monitoring and parameter acquisition.

[0101] In the specific implementation of the signal monitoring, the base station receiver continuously collects surrounding signal frequency bands, transmission status, and timestamps. The range of surrounding signal frequency bands is 800MHz–2GHz. The transmission status includes active and silent states.

[0102] S2. Extract behavioral features.

[0103] The behavioral characteristics described in S2 are obtained by statistically analyzing the mean and variance of the transmission interval of the signal within the time window and calculating the frequency of signal band switching and the entropy value of the band distribution.

[0104] The behavioral characteristics include temporal characteristics and frequency domain characteristics. The temporal characteristics are obtained based on signal behavior analysis, extracting transmission intervals and delay distribution statistics.

[0105] Frequency domain features include, but are not limited to, extracting frequency domain static features mainly based on frequency band distribution and frequency domain dynamic features mainly based on frequency band switching rate.

[0106] The time-series characteristics include the mean and standard deviation of the statistical signal silence interval.

[0107] S3. Based on the extracted behavioral features, predict behavior and establish decision criteria.

[0108] The discrimination criteria include time-series feature discrimination criteria and frequency domain feature discrimination criteria.

[0109] The timing feature discrimination criterion is specifically obtained by merging the abnormal parts of the statistical transmission interval and delay distribution to form abnormal intervals.

[0110] The time-series feature discrimination criterion is that if the signal silence interval is less than the mean minus x times the standard deviation, then it is judged as abnormal.

[0111] The value of x ranges from 2 to 8; in specific implementation, the value of x is 3.

[0112] The frequency domain feature discrimination criterion is specifically obtained by statistically analyzing the abnormal parts of frequency band distribution and frequency band switching rate, forming abnormal intervals, and merging the intervals.

[0113] The frequency domain feature discrimination criterion is as follows: if the frequency band switching rate is > y times / second and the frequency band entropy value is > K, it is classified as a malicious signal.

[0114] The value of y ranges from 2 to 8, and the value of K ranges from 3 to 6; in specific implementation, the value of y is 3, and the value of K is 2.

[0115] The behavior prediction refers to predicting the future behavior of a signal by using a trained time-series model to predict the signal behavior in the next time window. The predicted behavior is compared with the actual behavior, and the deviation is calculated as an anomaly score. The anomaly score is generated by calculating the deviation between the predicted and actual behavior. Prediction models include, but are not limited to, traditional models, machine learning models, and deep learning models. Traditional models include the ARIMA model. Machine learning models include, but are not limited to, BP and LSTM. Deep learning models include, but are not limited to, CNN and YOLO models.

[0116] S3 achieves behavior prediction through the collaboration of a prediction model and a classification model. The prediction model is a time-series prediction model used to predict future signal behavior and generate anomaly scores. The classification model includes, but is not limited to, traditional classification models, machine learning classification models, and deep learning classification models. Traditional classification models include, but are not limited to, threshold classification, SVM, decision trees, Bayesian methods, and ensemble learning models. Machine learning classification models include, but are not limited to, GRU, LSTM, and BP models. Deep learning classification models include, but are not limited to, DCNN and YOLO models.

[0117] The YOLO model includes, but is not limited to, YOLOv11 and YOLOX models; In practice, both YOLOv11 and YOLOX belong to the YOLO model, which performs object localization and recognition based on images; object localization involves boxing the object. The image includes, but is not limited to, the conversion of signals into time-frequency images based on time-window signal behavior, and the localization and identification of the "object to be identified," i.e., the target, derived from the converted time-frequency image; the steps of target localization and identification include: Step A: "Mesh out" the image and "assign tasks" to each grid cell. Specifically, the YOLO model divides the image into an S×S grid, and each grid cell detects objects whose "object center" falls within that grid cell. In practice, the center coordinates of the current cell are recorded as (cx, cy); Step B: Use the "bounding box formula" to enclose the object; In practice, each cell predicts multiple bounding boxes and encloses the object based on these bounding boxes; the position of the bounding box is determined by the following formula: bx = cx + acti(tx), by = cy + acti(ty), bw = pw × e tw bh = ph × e th ; The output (bx, by, bw, bh) represents the coordinates of the top-left corner and the width and height of the bounding box enclosing the object; pw and ph are the width and height of the prior bounding box. In practice, a 200×300 pixel prior bounding box is commonly used for detection. tw This adjusts the width and height; acti() is the activation function, ensuring that bx and by do not exceed the current cell or avoiding cross-cell borders; (tx, ty, tw, th) is the "offset" of the YOLO model, also known as the fine-tuning parameter; Step C: Use the "confidence formula" to determine whether the "box is accurate"; The confidence level indicates that there is an object in the current bounding box; the confidence expression for accurate bounding box is: Confidence score = probability of an object being present P × Intersection over Union (IoU); P is between 0 and 1, for example, P = 0.8 means there is an 80% probability that there is something in the current bounding box; the IoU represents the overlap area between the model-predicted bounding box and the actual object bounding box ÷ the total area. The closer the value is to 1, the more accurate the current bounding box is, such as 0.88, which means an overlap of 88%; if the confidence score of the current bounding box is lower than 0.5, the bounding box is considered inaccurate and is discarded directly; Step D: Identify objects using "category probability"; each cell also predicts which category the object belongs to; Step E: Remove duplicates and retain the best result; In specific implementation, YOLOv11 uses Non-Maximum Suppression (NMS) to remove multiple boxes that enclose the same object in an image. In practice, if the YOLOv11 model is used, it can also process consecutive frame images and predict objects; The YOLOv11 model includes feature fusion, the main body of the model, and the loss function; When RGB data enters the model, YOLOv11 extracts object features from it. Subsequently, the object features from multiple frames are fused. This feature fusion is used to combine features from multiple frames and perform self-supervision to improve the model's predictive ability. The loss function is used to reduce the difference between the prediction and the actual future state, integrate features from multiple frames, optimize, and ensure the accuracy of the model's prediction. The multi-frame features are obtained by converting the signal into a time-frequency image through the aforementioned time-window-based signal behavior, and then processing the multi-frame time-frequency image. Specifically, the steps include: Step a: Input the acquired time-frequency images from multiple frames and assemble them into an image frame sequence; Define the current frame in the image frame sequence Center the frame and combine the preceding and following frames and As a historical frame and the next frame; and the current frame Feature fusion is performed on the features; next frame Features are extracted using feature pyramids, dynamic convolutional kernels, and attention mechanisms. The feature extraction method involves extracting feature maps of different scales from the feature pyramid and then performing pooling to obtain multi-scale features. The attention mechanism calculates attention weights for feature maps extracted from different frames, dynamically adjusts them according to the importance of the feature maps, and performs a weighted summation of the feature maps to obtain fused features. Step b: Move to the next frame Extracted features, compared with historical frames Current frame The features are then fused to obtain the fused characteristics. The fusion includes: splicing, addition, multiplication, deconvolution, weighted averaging, and sparse representation; The stitching process combines features at different scales in chronological order, preserving information from all input features and obtaining richer feature representations. The addition process adds multiple feature maps element by element to obtain a new feature map, which is used to smooth the feature representation and reduce the impact of noise. The multiplication involves multiplying the feature values ​​at corresponding positions to generate a new feature map; In specific implementation, the deconvolution is used in scenarios with different sampling rates. For feature frames extracted at low sampling rates, a deconvolution operation is performed to upsample them to the target resolution and then concatenate them with the feature map of the previous frame. The weighted average is used to generate a fused image by weighting the gray values ​​of corresponding pixels in different frames. The determination of the weights is the key to this algorithm, and different weight allocation strategies will lead to different fusion results. The sparse representation uses a sliding window to segment the image into multiple overlapping segments, extracts features from these segments, and then stitches them together. In other words, learning on a complete feature set can better represent and extract the image, thereby improving robustness. Classification loss, regression loss, and target degree loss are the loss functions used for classification loss, regression loss, and target degree loss. Frame label supervised training: The classification loss is calculated based on the cross-entropy loss, and its expression is: ; For each bounding box, the loss measures the difference between the predicted class probability and the actual class label; where, The goal Category The actual label, The goal Predicted as category The probability, It represents the total number of categories; The regression loss is calculated using the mean squared error (MSE), specifically by calculating the difference between the predicted bounding box coordinates and the actual coordinates. Its expression is as follows: in, It is the number of positive sample bounding boxes. These are the predicted bounding box coordinates. These are the actual coordinates.

[0118] The target-oriented loss is used to distinguish between the target and the background. It is calculated using binary cross-entropy loss, and the expression for this loss is: in, It is the number of bounding boxes. It represents the bounding box. Whether to include the actual label of the target; 1 indicates the target is included, 0 indicates background. It is the predicted bounding box The probability of containing the target; S4. Weekly summary of unknown interference scenario data and detection data, combined with the prediction model, and fine-tuning of model parameters. Based on the combination of time-series and frequency-domain features extracted in S2, anomaly discrimination criteria, and anomaly scores obtained in S3, a classification model is used to classify and determine whether the signal monitored in S1 is malicious, thus achieving malicious interference detection based on signal behavior analysis.

[0119] The anomaly score is given based on the prediction and judgment of behavior using time-series features and frequency-domain dynamic features, and is based on the discrimination criteria.

[0120] The anomaly score is a dynamic threshold.

[0121] The classification of malicious signals involves classifying signals that exceed a dynamic threshold, i.e., 90% of signals based on historical data, as malicious signals.

[0122] The discrimination criterion is based on the number of switching times within a certain period of time. Specifically, it is calculated that the number of signal frequency band switching times within S seconds is calculated and it is determined whether the number of switching times per second is greater than T. If so, an early warning is triggered; otherwise, the number of signal frequency band switching times within S seconds is calculated again.

[0123] The value of S ranges from 2 to 20, and the value of T ranges from 4 to 20; in specific implementation, S is 16 and T is 12.

[0124] The classification is as follows: if the frequency band switching rate is >3 times / second and the frequency band entropy value is >2.0, it is classified as a malicious signal.

[0125] If the abnormal score exceeds the dynamic threshold (determined by the 90th percentile of historical data), it is classified as a malicious signal.

[0126] When the signal monitoring module detects an abnormal signal, the behavior analysis module extracts its time-series and frequency-domain features and inputs them into the prediction and classification module to extract interference features and make a preliminary judgment to identify the type of interference. The strategy generation subunit calls the corresponding parameter adjustment strategy library to generate parameter adjustment instructions suitable for this type of interference. For frequency hopping interference, the time window for frequency domain feature extraction is automatically reduced to the millisecond level, while the frequency band distribution entropy threshold in the classification model is reduced by a specific ratio; the parameter adjustment unit acts on the feature extraction and classification modules in real time. The strategy generation subunit uses the interference feature vector output by the prediction and classification module to identify the current interference type using a pre-trained interference type classification model; The parameter adjustment commands applicable to this type of interference are as follows: When encountering frequency hopping interference, the feature extraction window and classification threshold are automatically optimized, thereby improving the accuracy of frequency domain feature capture. When faced with intermittent interference, the observation window length of the time series prediction model is dynamically adjusted to enhance the detection sensitivity to sudden signals.

[0127] The above detailed description further illustrates the purpose, technical solution, and beneficial effects of the invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A malicious interference detection device based on signal behavior analysis, which dynamically adjusts the model parameters of a neural network through signal monitoring and behavior analysis to determine malicious intent, thereby achieving proactive identification and accurate detection of dynamically changing malicious signals, characterized in that: It includes a signal monitoring module, a behavior analysis module, a prediction and classification module, an adaptive update module, and an automatic parameter selection module; The signal monitoring module is used to collect transmission status, frequency band, and time interval parameters in real time. The behavior analysis module is used to extract time-series features, frequency-domain features, and joint time-frequency features, and to identify the behavior type. The prediction and classification module combines neural networks to score anomalies and identify malicious behavior; the adaptive update module dynamically adjusts the parameters of the neural network model. The adaptive update module dynamically optimizes the neural network and updates the model parameters of the neural network by monitoring the input signal through gradient descent and gradient feedback. The automatic parameter selection module searches for the optimal combination in a preset hyperparameter space, selects key parameters, and evaluates performance gains by combining cross-validation results, thereby balancing model structure and operating efficiency and improving the accuracy and real-time performance of malicious detection.

2. The malicious interference detection device based on signal behavior analysis as described in claim 1, characterized in that: The behavior analysis module selects behavior entropy through dynamic analysis and strategy adjustment, and sets causal thresholds to identify malicious behavior; Temporal features are extracted through a temporal prediction model; frequency domain features include static statistics and dynamic real-time features.

3. The malicious interference detection device based on signal behavior analysis as described in claim 2, characterized in that: The signal monitoring module and the behavior analysis module work together. By parsing high-speed data packets and extracting frequency domain features, the signal monitoring module collects and outputs the transmission status, frequency band and time interval parameters in real time to the behavior analysis module. The behavior analysis module extracts time series and frequency domain features and feeds them to the prediction and classification module. The prediction and classification module trains a behavior feature matrix based on a neural network and performs anomaly scoring and malicious behavior identification through an anomaly scoring unit and a malicious behavior determination unit, respectively.

4. The malicious interference detection device based on signal behavior analysis as described in claim 3, characterized in that: The anomaly scoring unit predicts behavior and calculates deviation using a time-series model to generate anomaly scores; the malice determination unit determines malicious signals based on the anomaly scores combined with feature combinations. The prediction and classification module classifies samples based on deep learning; the adaptive update module includes a parameter adjustment unit and a parameter update unit, which are used to dynamically optimize the classification threshold of the classification model and update the classification model parameters within the constraints, respectively.

5. The malicious interference detection device based on signal behavior analysis as described in claim 4, characterized in that: The parameter adjustment unit also includes a strategy generation subunit, which continuously optimizes the model through an online learning and update mechanism, adaptively generates strategies to adapt to new malicious interference, and dynamically adjusts model parameters according to the type of interference. The parameter update unit also includes a multimodal analysis subunit, which dynamically adjusts the model parameters by combining time-series and frequency-domain features and behavioral analysis with adaptive learning.

6. The malicious interference detection device based on signal behavior analysis as described in claim 5, characterized in that: The parameter update unit is used to update parameters, continuously receive real-time data streams from the signal monitoring module, and incrementally learn the features of novel interference signals using an online learning algorithm. Specifically, it retains interference sample data within the most recent time window through a sliding window mechanism, calculates the model parameter update amount using stochastic gradient descent, and gradually optimizes the classification boundary while updating the model parameters.

7. The malicious interference detection device based on signal behavior analysis as described in claim 6, characterized in that: The parameter update unit also includes a cross-domain fusion subunit, which integrates frequency domain analysis, behavior analysis and deep learning. The signal source generates a controllable signal with a specific interference pattern to simulate complex interference signals and the intended response of the excited signal; the signal monitoring module collects transmission status, frequency band and time interval parameters in real time.

8. The malicious interference detection device based on signal behavior analysis as described in claim 7, characterized in that: The behavior analysis module extracts time-series and frequency-domain features of retry delay distribution anomalies or frequency band randomness thresholds based on signal behavior and forms a discrimination criterion for behavior analysis. The prediction and classification module includes a prediction unit, which includes prediction and malicious judgment. The prediction unit uses a prediction model to combine the time-series and frequency-domain features extracted by the behavior analysis module to make predictions, calculates the deviation, obtains the prediction result, and generates an anomaly score. The prediction result is the predicted behavior. The anomaly score is generated by calculating the deviation.

9. A malicious interference detection method based on signal behavior analysis, characterized in that: Includes the following steps: S1, Signal monitoring and parameter acquisition, to obtain the monitoring signal; S2, extract behavioral features including temporal features and frequency domain features; S3, Behavior Prediction, is to predict the future behavior of a signal to obtain the predicted behavior. A trained time series model is used to predict the signal behavior in the next time window. The predicted behavior is compared with the actual behavior and the deviation between the predicted behavior and the actual behavior is calculated to generate an anomaly score. S4, based on the combination of time-series features and frequency-domain features extracted from S2, and the anomaly discrimination criteria, and the anomaly score obtained from S3, the monitoring signal of S1 is classified and determined by the classification model to determine whether it is malicious.

10. The malicious interference detection method based on signal behavior analysis as described in claim 9, characterized in that: The monitoring signal mentioned in S1 is the transmission status, frequency band, and time interval parameters of the real-time acquired signal; the timing characteristics mentioned in S2 are the statistical characteristics of the transmission interval and delay distribution; the frequency domain characteristics are the frequency domain static characteristics reflecting the frequency band distribution and the frequency domain dynamic characteristics reflecting the frequency band switching rate.

Images