An unmanned aerial vehicle anomaly detection method and system
By constructing a fusion encoding of static and dynamic graphs, combining TCN and causal Transformer, and utilizing adaptive and global thresholds for UAV anomaly detection, the problems of false positives and false negatives in existing technologies are solved, and a more stable anomaly detection effect is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NANCHANG HANGKONG UNIVERSITY
- Filing Date
- 2026-03-23
- Publication Date
- 2026-05-29
AI Technical Summary
Existing UAV anomaly detection methods are prone to false alarms and missed alarms on various flight records, resulting in low stability and reliability of alarms. They are also difficult to adapt to the timing bias problems caused by multi-stage mode switching and multi-rate sampling.
A static graph is constructed using a sliding window, and temporal and spatial encoding is performed by combining TCN and causal Transformer. Anomaly scores are obtained through attention-induced dynamic graph fusion, and adaptive and global thresholds are used for decision-making to achieve stable anomaly detection.
It improves the stability and reliability of anomaly detection, reduces the risk of false alarms, can adapt to instantaneous changes in relationships under different voyages and operating conditions, and enhances the continuity of anomaly identification and the reliability of alarm results under cross-voyage conditions.
Smart Images
Figure CN121884204B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of unmanned aerial vehicle (UAV) data processing technology, and in particular to a method and system for detecting UAV anomalies. Background Technology
[0002] Accurate perception of the drone's own status is the foundation for reliable and safe flight. With the routine application of drones in tasks such as inspection, agriculture, and emergency response, the multi-source sensor time-series data in the flight logs has become an important basis for fault diagnosis and risk assessment.
[0003] Existing technologies for anomaly detection in UAV flight data typically employ prediction-based methods, relying on the accuracy of the prediction model to support the prediction results.
[0004] However, actual flight missions present the following challenges: anomaly samples are scarce and diverse in form, making it difficult to construct sufficiently comprehensive supervisory samples; different sensor channels exhibit significant differences in dimensions, noise intensity, and drift characteristics, and cross-sensor channel coupling involves both linear and nonlinear relationships, causing detection boundaries to fluctuate with flight duration and operating conditions; actual flights involve multi-stage mode switching, and multi-rate sampling and asynchronous alignment further amplify timing biases, leading to discontinuous or false alarm responses in anomaly detection. Due to these factors, existing anomaly detection methods exhibit inconsistent false alarms and false negatives across different flight records, increasing manual review costs and resulting in low stability and reliability of anomaly alarm conclusions. Summary of the Invention
[0005] To address the shortcomings of existing technologies, the present invention aims to provide a method and system for detecting anomalies in unmanned aerial vehicles (UAVs). This invention seeks to solve the technical problems of existing UAV anomaly detection technologies, which are prone to false alarms and missed alarms across various flight records, resulting in low stability and reliability of alarms.
[0006] To achieve the above objectives, the present invention is implemented through the following technical solution:
[0007] A method for detecting anomalies in unmanned aerial vehicles (UAVs) includes the following steps:
[0008] Acquire sensor data sequences, obtain data to be detected from the sensor data sequences through a sliding window, and construct a static graph based on the data to be detected using the MIC correlation coefficient to obtain a subset of nodes;
[0009] The node subset is encoded using TCN and causal Transformer to obtain temporal encoding;
[0010] Based on the node subset and the static graph, an attention-induced dynamic graph is constructed, the static graph and the dynamic graph are fused, and graph propagation is performed to obtain spatial encoding;
[0011] Synchronize the end semantics of the temporal encoding and the spatial encoding to obtain an aligned representation, and decode the aligned representation to obtain prediction data;
[0012] Obtain an updated sensor data sequence, extract real data from the updated sensor data sequence, obtain aggregated residuals based on the predicted data and the real data, and perform smooth scoring on the aggregated residuals to obtain anomaly scores.
[0013] Obtain training data sequences and test data sequences, perform smooth scoring based on the training data sequences and test data sequences to obtain training score sequences, and obtain a global threshold based on the training score sequences;
[0014] Obtain an adaptive magnification, extract a cruise data sequence from the sensor data sequence, obtain an adaptive threshold based on the adaptive magnification and the cruise data sequence, and obtain a decision threshold based on the adaptive threshold and the global threshold;
[0015] The anomaly score and the decision threshold are compared to obtain the anomaly detection result for the real data.
[0016] Furthermore, the step of encoding the node subset using TCN and causal Transformer to obtain temporal encoding includes:
[0017] The node subset is flattened and linearly projected, and multi-layer TCN is used to capture multi-scale dependencies;
[0018] Based on the multi-scale dependency, long-range dependencies are captured by a causal Transformer and time-encoded data is output.
[0019] Furthermore, the node subset includes several nodes, and the steps of constructing an attention-induced dynamic graph based on the node subset and the static graph, fusing the static graph and the dynamic graph, and performing graph propagation to obtain spatial encoding include:
[0020] A short window is used to extract the mean summary of several nodes and project it onto the hidden feature dimension to obtain the node short window summary representation. The structure mask matrix is obtained through the MIC correlation coefficient.
[0021] The integration coefficient is obtained, and the static graph is subjected to a logit transformation to form a bias term. Based on the node short window summary representation, the structure mask matrix, the bias term, and the integration coefficient, a dynamic graph is obtained.
[0022] The dynamic graph and the static graph are fused based on the structure mask matrix to obtain a spatiotemporal fusion code. The spatiotemporal fusion code and the node short window summary representation are then subjected to graph propagation to obtain a spatial code.
[0023] Furthermore, the formula for the dynamic graph is:
[0024]
[0025] in, This represents a dynamic image. This represents the softmax function. This represents a query obtained by a linear mapping of the node short window summary representation. This represents the transpose of the key matrix obtained by the linear mapping of the node short window summary representation. Indicates the hidden feature dimension. Indicates the integration coefficient. Represents the logit transformation. This represents a static image.
[0026] Furthermore, the step of synchronizing the end semantics of the temporal encoding and the spatial encoding to obtain an aligned representation, and decoding the aligned representation to obtain the prediction data includes:
[0027] Based on the spatial encoding, an end spatial representation is obtained, and based on the end spatial representation, a temporal context is injected into the temporal encoding to obtain an updated temporal encoding;
[0028] Based on the terminal spatial representation and the update time encoding, a multi-head attention alignment operator and prefix causal masking are used to obtain the aligned representation.
[0029] The end node representation is extracted from the end time step index of the aligned representation, and the end node representation is decoded using the Dec decoder to generate prediction data.
[0030] Furthermore, the steps of extracting real data from the updated sensor data sequence, obtaining aggregated residuals based on the predicted data and the real data, and smoothing and scoring the aggregated residuals to obtain anomaly scores include:
[0031] Based on the time step of the predicted data, real data is obtained from the updated sensor data sequence. Based on the predicted data and the real data, residuals in all dimensions are obtained, and the residuals in all dimensions are aggregated by mean to obtain aggregated residuals.
[0032] Obtain the EMA coefficient, and smooth the aggregation residual based on the EMA coefficient to obtain the anomaly score.
[0033] Furthermore, the formula for the abnormal score is:
[0034]
[0035] in, express Abnormal scores at time steps Represents the EMA coefficient. express Abnormal scores at time steps express Aggregation residuals at time steps.
[0036] Furthermore, the formula for the global threshold is:
[0037]
[0038] in, Indicates the global threshold. This indicates taking the median. Represents the training score sequence. Represents the consistency coefficient. Indicates the absolute deviation of the median;
[0039]
[0040] The formula for the adaptive threshold is:
[0041]
[0042] in, Indicates an adaptive threshold. Represents the cruise data sequence. This indicates an adaptive scaling factor.
[0043] Furthermore, the step of obtaining the decision threshold based on the adaptive threshold and the global threshold includes:
[0044] If the adaptive threshold is greater than the global threshold, then the adaptive threshold is selected as the decision threshold.
[0045] If the global threshold is greater than the adaptive threshold, then the global threshold is selected as the decision threshold.
[0046] A drone anomaly detection system, employing the drone anomaly detection system method as described in the above technical solution, the system comprising:
[0047] The static graph module is used to acquire sensor data sequences, obtain the data to be detected from the sensor data sequences through a sliding window, and construct a static graph based on the data to be detected using the MIC correlation coefficient to obtain a subset of nodes.
[0048] The time module is used to encode the subset of nodes using TCN and causal Transformer to obtain time codes;
[0049] A spatial module is used to construct an attention-induced dynamic graph based on the node subset and the static graph, fuse the static graph and the dynamic graph, and perform graph propagation to obtain spatial encoding;
[0050] An alignment module is used to synchronize the end semantics of the temporal encoding and the spatial encoding to obtain an aligned representation, and to decode the aligned representation to obtain prediction data.
[0051] The scoring module is used to acquire the updated sensor data sequence, extract real data from the updated sensor data sequence, obtain aggregated residuals based on the predicted data and the real data, and perform smooth scoring on the aggregated residuals to obtain anomaly scores.
[0052] The global module is used to acquire training data sequences and test data sequences, perform smooth scoring based on the training data sequences and test data sequences to obtain training score sequences, and obtain a global threshold based on the training score sequences.
[0053] An adaptive module is used to obtain an adaptive magnification, extract a cruise data sequence from the sensor data sequence, obtain an adaptive threshold based on the adaptive magnification and the cruise data sequence, and obtain a decision threshold based on the adaptive threshold and the global threshold.
[0054] The results module is used to compare the anomaly score with the decision threshold to obtain anomaly detection results for the real data.
[0055] Compared with existing technologies, the beneficial effects of this invention are as follows: A generalizable static graph is constructed using the MIC correlation coefficient, and a bias term is formed based on the static graph. Attention scores are then incorporated using the fusion coefficient to construct a dynamic graph with prior constraints. Furthermore, the static graph and the dynamic graph, which have stable prior consistency, are fused. This not only adapts to instantaneous relationship changes under different voyages and operating conditions based on the dynamic graph, but also balances stable prior constraints with dynamic adaptive adjustment, which helps reduce the propagation and false alarm risks caused by weakly correlated noise coupling. Local dependency extraction is performed using TCN, and then combined with a Transformer with causal masking, simultaneously covering local multi-scale dependencies and long-term trends. This allows for the simultaneous characterization of short-term dynamics and long-term trends under a unified causal reference. Multidimensional residual aggregation, causal smoothing, and anomaly scoring suppress non-continuous fluctuations caused by instantaneous noise. By calculating the global threshold and the adaptive threshold within the detected voyage, a more stringent threshold is used as the alarm boundary, which helps improve the stability of false alarm control and the continuity of anomaly interval identification under cross-voyage conditions, resulting in higher reliability of anomaly detection alarm results. Attached Figure Description
[0056] Figure 1 This is a flowchart of the UAV anomaly detection method in the first embodiment of the present invention;
[0057] Figure 2 This is a structural block diagram of the UAV anomaly detection system in the second embodiment of the present invention;
[0058] The following detailed description, in conjunction with the accompanying drawings, will further illustrate the present invention. Detailed Implementation
[0059] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Several embodiments of the invention are illustrated in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete.
[0060] It should be noted that when a component is said to be "fixed to" another component, it can be directly on the other component or there may be an intervening component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there may be an intervening component. The terms "vertical," "horizontal," "left," "right," and similar expressions used in this document are for illustrative purposes only.
[0061] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.
[0062] Please see Figure 1 The UAV anomaly detection method in the first embodiment of the present invention includes the following steps:
[0063] Step S10: Obtain sensor data sequence, obtain the data to be detected from the sensor data sequence through a sliding window, and construct a static graph based on the data to be detected using the MIC correlation coefficient to obtain a subset of nodes;
[0064] Preferably, the sensor data sequence is acquired by a UAV multidimensional sensor. The sliding window is a multivariable sliding window with a fixed time length. Multidimensional data at all time steps within a fixed time length are extracted from the data sequence through the sliding window to form a multidimensional observation data matrix, which is the data to be detected. Anomaly detection of the sensor data sequence is based on a prediction method to obtain the prediction residual, calculate the score, and identify the time points with abnormal conditions according to the score.
[0065] The static graph is constructed based on the multidimensional observation data matrix, using sensor variables as nodes and the correlation strength between variables as edge weights. Specifically, the static graph is an undirected weighted static graph. The MIC correlation coefficient is used to measure the dependence strength on feature pairs, constructing undirected weighted adjacency. Specifically, for any node pair, edge weights are defined on the sampled finite-value observations. The MIC correlation coefficient simultaneously characterizes linear and generalized nonlinear dependencies. The node pairs are processed and normalized to obtain edge weights, which are then assembled into a symmetric adjacency matrix. A quantile threshold is applied to the upper triangular off-diagonal set to achieve distribution-adaptive strong correlation truncation, i.e., retaining the most strongly correlated pairs. Furthermore, a density upper limit is introduced to cap the density of the graph. Combined with its symmetric adjacency matrix, the static graph is finally formed. The off-diagonal of the static graph only retains strong dependencies, while the main diagonal remains 1. The MIC correlation coefficient is beneficial for cross-flight record comparisons.
[0066] Step S20: Encode the node subset using TCN and causal Transformer to obtain temporal encoding;
[0067] Preferably, the TCN is a multi-layer TCN, and the causal Transformer uses a causal mask to ensure the causal consistency of time information. When performing flight logs in complex task scenarios, traditional convolutional neural networks and recurrent neural networks have defects in high-dimensional and strongly nonlinear scenarios. Under conditions containing noise or distribution drift, bias accumulation is more likely to occur on the time side, which weakens the ability of time series representation to characterize effective dynamic changes. Understandably, this embodiment uses a multi-layer TCN on the time side to capture multi-scale local dependencies, and combines the causal Transformer to model long-range dependencies. Under a unified causal reference, it can simultaneously characterize short-term dynamics and long-term trends, which is beneficial to enhancing the characterization ability of time series representation.
[0068] Step S20 includes:
[0069] S210: Flatten and linearly project the node subset, and use a multi-layer TCN to capture multi-scale dependencies;
[0070] Preferably, the expansion coefficient of the multilayer TCN is 2. i .
[0071] S220: Based on the multi-scale dependency, long-range dependencies are captured by a causal Transformer and time-coded data is output.
[0072] Preferably, the multi-scale dependency is captured by a 4-layer TCN layer, and its output passes through an LN layer, a Casual Mask layer, a Transformer Encoder layer and an LN layer in sequence to finally output the temporal code. The Casual Mask layer uses an upper triangular causal mask, which can be understood to introduce causal constraints on the temporal side, which is beneficial to avoid phase shift or inconsistent training and inference paths.
[0073] Step S30: Based on the node subset and the static graph, construct an attention-induced dynamic graph, fuse the static graph and the dynamic graph, and perform graph propagation to obtain spatial encoding;
[0074] Traditional convolutional neural networks and recurrent neural networks suffer from drawbacks in high-dimensional, highly nonlinear scenarios. Spatial-side propagation often relies on fixed graph priors, making it difficult to adaptively align with changes in operating conditions and cross-sensor heterogeneity. Specifically, they struggle to maintain stable alignment during UAV operating condition switching and cross-flight drift, thus amplifying the error between the temporal and spatial channels. Understandably, on the spatial side, constructing a generalizable static graph based on MIC correlation and constraining its sparsity, followed by weighted fusion with attention-induced dynamic graph information, can help form a cross-channel relationship mechanism that combines stable prior constraints with dynamic adaptive adjustment.
[0075] In step S30, the node subset includes several nodes, and step S30 includes:
[0076] S310: Extract the mean summary of several nodes using a short window and project it onto the hidden feature dimension to obtain the node short window summary representation, and obtain the structure mask matrix through the MIC correlation coefficient;
[0077] Preferably, the node refers to sensor dimension data. For example, a drone sensor has three dimensions of acceleration data, with each dimension representing a direction. The acceleration in each direction is considered as a node. If there is a strong correlation between multiple accelerations, then the multiple nodes are considered to be connected. The length of the short window is less than the sliding window. The mean summary is extracted for each node and projected onto the hidden feature dimension, specifically using linear projection. This maps nodes from different sources to a shared comparison space, which helps reduce the computational cost and instability of dynamic graph learning. The structure mask matrix is a matrix that allows edges connecting pairs of variables, derived from the MIC correlation. It is obtained based on the structure of the static graph and the MIC correlation coefficient. The structure mask matrix is used to restrict unreasonable or physically meaningless node connections, ensuring the interpretability and sparsity of spatial modeling, and forming a constraint on sparsity.
[0078] S320: Obtain the integration coefficient, perform a logit transformation on the static graph to form a bias term, and obtain a dynamic graph based on the node short window summary representation, the structure mask matrix, the bias term, and the integration coefficient;
[0079] Preferably, the static graph constructed from the MIC correlation coefficient is processed using the logit operator to form the bias term, and the attention score is incorporated in combination with the integration coefficient to construct the dynamic graph, thereby improving prior consistency. Specifically, the integration coefficient is set to 0.5.
[0080] Furthermore, the structure mask matrix is a matrix that allows edges to be connected in any two dimensions. Only edges with high correlation are allowed to be connected, and the value is represented as 1. In the process of obtaining the dynamic graph, the edges in the graph structure that correspond to the values of 0 in the structure mask matrix are set to negative infinity. Understandably, this can effectively prevent illegal edges from being included in the similarity calculation and ensure that only legal connection edges participate in information transmission.
[0081] S330: Based on the structure mask matrix, the dynamic graph and the static graph are fused to obtain a spatiotemporal fusion code. The spatiotemporal fusion code and the node short window summary representation are then subjected to graph propagation to obtain a spatial code.
[0082] Preferably, the fusion weight of the dynamic graph is set to 0.5. The dynamic graph and the static graph are fused according to the fusion weight, and multiplied with the structure mask matrix during the fusion stage to maintain sparsity consistency.
[0083] The formula for the dynamic graph is:
[0084]
[0085] in, This represents a dynamic image. This represents the softmax function. This represents a query obtained by a linear mapping of the node short window summary representation. This represents the transpose of the key matrix obtained by the linear mapping of the node short window summary representation. Indicates the hidden feature dimension. Indicates the integration coefficient. Represents the logit transformation. This represents a static image.
[0086] Step S40: Synchronize the end semantics of the temporal encoding and the spatial encoding to obtain an aligned representation; decode the aligned representation to obtain the prediction data.
[0087] Preferably, a multi-head attention alignment operator is used for synchronous alignment, which can achieve cross-branch alignment, alleviate spatiotemporal representation misalignment, and improve the continuity of response before and after anomaly occurrence.
[0088] Step S40 includes:
[0089] S410: Obtain the end spatial representation based on the spatial encoding, and inject time context into the time encoding based on the end spatial representation to obtain the updated time encoding;
[0090] Preferably, the end space representation is used as a query template to align with the time context.
[0091] S420: Based on the end-space representation and the update time encoding, a multi-head attention alignment operator and prefix causal masking are used to obtain an aligned representation;
[0092] Preferably, a cross-head attention alignment operator is used, and a prefix causal mask is applied on both the K-axis and V-axis of the cross-attention to maintain consistent information boundaries. After processing with the multi-head attention alignment operator and the prefix causal mask, residual connections and layer normalization are applied to obtain the alignment representation. The prefix causal mask is specifically an upper triangular causal mask.
[0093] S430: Extract the end node representation from the end time step index of the aligned representation, and decode the end node representation using the Dec decoder to generate prediction data.
[0094] Preferably, a lightweight two-layer perceptron decoder Dec is used to generate node-by-node single-step prediction values to obtain its tensor shape. The sensor data sequence is a historical data sequence in the flight log, corresponding to multiple historical time steps, and the prediction data corresponds to the next time step after the historical time step.
[0095] Step S50: Obtain the updated sensor data sequence, extract real data from the updated sensor data sequence, obtain aggregated residuals based on the predicted data and the real data, and perform smooth scoring on the aggregated residuals to obtain anomaly scores;
[0096] Preferably, residual aggregation and causal smoothing are used to improve scoring consistency, which is beneficial for handling alarm tasks in cross-voyage drift scenarios.
[0097] Step S50 includes:
[0098] S510: Based on the time step of the predicted data, obtain real data from the updated sensor data sequence, obtain residuals in all dimensions based on the predicted data and the real data, and perform mean aggregation on the residuals in all dimensions to obtain aggregated residuals.
[0099] Preferably, the time step of the predicted data is the first predictable moment after the historical sliding window. Understandably, the UAV sensor continuously collects data, and performs residual calculation based on the actual value collected during the current continuous collection process and the predicted value obtained based on historical data, in order to analyze the difference between the predicted value and the actual value, and form an assessment of whether there is an anomaly in the current actual flight situation.
[0100] S520: Obtain the EMA coefficient, and smooth the aggregation residual based on the EMA coefficient to obtain the anomaly score.
[0101] Preferably, the EMA coefficient is greater than 0 and less than or equal to 1.
[0102] The formula for the anomaly score is:
[0103]
[0104] in, express Abnormal scores at time steps Represents the EMA coefficient. express Abnormal scores at time steps express Aggregation residuals at time steps.
[0105] Step S60: Obtain the training data sequence and the test data sequence, perform smooth scoring based on the training data sequence and the test data sequence to obtain the training score sequence, and obtain the global threshold based on the training score sequence;
[0106] Preferably, the threshold is constructed based on MAD (Median Absolute Deviation), which has a 50% violation point and is less sensitive to anomalies than the mean and standard deviation. In the calculation of the global threshold, a consistency coefficient is introduced, which is set to 1.4826.
[0107] Step S70: Obtain the adaptive magnification, extract the cruise data sequence from the sensor data sequence, obtain the adaptive threshold based on the adaptive magnification and the cruise data sequence, and obtain the decision threshold based on the adaptive threshold and the global threshold;
[0108] Preferably, in UAV missions, the early stage of flight recording has a clear mission flow and UAV control rules. After the aircraft completes takeoff, establishes attitude and altitude, and enters cruise mode, the system usually maintains a relatively fixed control mode and small maneuver amplitude for a period of time, before entering high-maneuver phases such as target approach, avoidance, or execution of actions. This cruise phase shows a stable center and scale level in the sensor data sequence, so it can be used as the normal noise baseline in this mission for adaptive threshold calibration. Specifically, the adaptive threshold is calculated using L time points of the flight record prefix of this mission to match the noise and scale of the current mission and avoid mismatch of the global threshold fixed in the previous step.
[0109] The formula for the global threshold is:
[0110]
[0111] in, Indicates the global threshold. This indicates taking the median. Represents the training score sequence. Represents the consistency coefficient. Indicates the absolute deviation of the median;
[0112]
[0113] The formula for the adaptive threshold is:
[0114]
[0115] in, Indicates an adaptive threshold. Represents the cruise data sequence. This indicates an adaptive scaling factor.
[0116] Step S70 includes:
[0117] S710: Compare the adaptive threshold and the global threshold. If the adaptive threshold is greater than the global threshold, then select the adaptive threshold as the decision threshold.
[0118] S720: If the global threshold is greater than the adaptive threshold, then the global threshold is selected as the decision threshold.
[0119] Understandably, the distribution of anomaly scores across flight records often drifts, and the noise exhibits heteroscedasticity. For a single global static threshold, i.e., the global threshold, a large number of false alarms are likely to be generated on noisy or mismatched record files. On the other hand, the adaptive threshold obtained by using only a single flight file may be biased by the random noise in the file prefix. Therefore, a global robust threshold and a single flight early adaptive threshold are estimated in parallel, and the maximum value of the two is taken as the decision threshold. The decision threshold is not lower than the global safety line, which suppresses early false alarms and allows the threshold to be raised on noisy files to match different scenarios.
[0120] Step S80: Compare the anomaly score with the decision threshold to obtain the anomaly detection result for the real data.
[0121] Understandably, this method constructs a complete anomaly detection process around three key stages: spatial relationship modeling, temporal dependency characterization, and threshold discrimination. Spatially, it uses MIC correlation to form a generalizable static prior, and combines it with attention-induced dynamic graphs to achieve adaptive relationship updates, enabling cross-sensor coupling to be expressed and utilized in a structured and controllable manner. Temporally, it employs TCN and a Transformer with causal masking to balance local and long-range dependencies, and completes spatiotemporal representation alignment through masked cross-attention, mechanistically avoiding inconsistencies in training and inference caused by the introduction of non-causal information and phase shifts. On the discrimination side, it uses residual aggregation and EMA... Causal smoothing improves the temporal consistency of anomaly scores, while simultaneously estimating the globally robust global threshold and the adaptive threshold for a single flight in parallel. This mitigates the threshold mismatch problem caused by cross-flight record distribution drift and noise scale changes, thereby enabling more stable control of false alarms and maintaining detection effectiveness under different mission and operating conditions. This enhances the reliability and generalization ability of anomaly alarms and provides a well-structured and reusable spatiotemporal modeling approach for anomaly detection research on multi-source sensor time-series data.
[0122] Furthermore, using the UAV anomaly detection method described in this embodiment, an STGTCN model was constructed for experimentation. Specifically, the experiment was built on an Ubuntu 22.04 platform, using Python 3.10 and PyTorch 2.1.2, with CUDA version 11.8. The hardware configuration consisted of one RTX 4090 (24GB) GPU and a 16 vCPU Intel Xeon Platinum 8358P (2.60GHz) CPU. The experiment used two datasets: ALFA and GPS Attack. ALFA was trained using normal data from multiple flight segments and normal segments of some anomalous data, and tested on four types of fault and anomalous data: aileron, rudder, elevator, and engine. GPS Attack was trained using normal data and tested on GPS Jamming and GPS... The STGTCN model was tested against two types of spoofing attacks. It used a sliding window with 128 timestamps for prediction and learned the normal dynamics of multi-sensor sequences using an end-to-end regression approach. For optimization, AdamW was used in conjunction with learning rate annealing and warmup to improve convergence stability. EMA and gradient pruning were employed to suppress training oscillations. The loss function was primarily Huber. The experiments selected F1, Precision (Prec), False Positive Rate (FPR), and Accurac (ACC) as core metrics. Prec reflects the credibility of alarms; FPR directly characterizes the false alarm ratio on a large number of normal samples, more sensitively measuring the model's ability to suppress false alarms under noise enhancement, distribution drift, and operational condition switching; F1 comprehensively measures the overall detection quality under class imbalance conditions, avoiding the masking effect of ACC by the majority class; and ACC provides an intuitive reference for the overall accuracy, facilitating comparison with baseline methods under a unified standard.
[0123] The experiments included comparative experiments based on the ALFA dataset and comparative experiments based on the GPS Attack dataset. The models compared with the STGTCN model were CNNLSTM, GRU, LSTM, MLP, and TCN. The results of the comparative experiments based on the ALFA dataset are shown in the table below:
[0124]
[0125] The STGTCN model achieved optimal overall performance, with average F1=85.105, Precision=94.585, FPR=4.435, and ACC=92.213. It achieved a lower false positive rate while maintaining high accuracy. Compared to the suboptimal CNNLSTM method (average F1=84.095, Precision=81.378, FPR=8.455, ACC=87.558), the method in this embodiment further improved the F1 score by 1.010, while significantly improving Precision. The high FPR and significant decrease indicate that the alarm triggering is more cautious and has a stronger ability to suppress false anomalies caused by noise and operating condition switching. In elevator-type faults, there are almost no false alarms, making the Prec and FPR indices close to the ideal values. In engine failure scenarios with more complex fault modes and stronger cross-channel coupling, the method in this embodiment still maintains F1=86.93, while the performance of other models in the comparative experiment shows a significant degradation. This shows that the method in this embodiment can more stably characterize the global dependency structure changes caused by the fault, thereby maintaining reliable detection under high-difficulty fault conditions.
[0126] The results of the comparative experiment based on the GPS Attack dataset are shown in the table below:
[0127]
[0128] The STGTCN model achieved near-saturation detection performance on GPS Jamming and GPS Spoofing, with average F1=99.03, Precision=100.00, FPR=0.00, and ACC=99.41. This significantly outperformed baseline models such as LSTM, CNNLSTM, and TCN. For example, LSTM had an average F1=82.155 and FPR=19.77, while CNNLSTM had an average F1=78.32 and FPR=27.06. Furthermore, in the more covert Spoofing scenario, the STGTCN model maintained an F1=98.68 and FPR=0, while other models generally showed significant degradation. This indicates that the proposed method is more sensitive and stable to slowly drifting or consistency-breaking attacks. Overall, the comparative experiments on both datasets validated the advantages of the proposed method: stronger robustness and lower false alarms in real flight failure scenarios, and high detection and zero false alarms in attack scenarios.
[0129] Please see Figure 2 The second embodiment of the present invention provides a drone anomaly detection system that applies the drone anomaly detection method described in the first embodiment above. The system includes:
[0130] The static graph module 10 is used to acquire sensor data sequences, obtain data to be detected from the sensor data sequences through a sliding window, and construct a static graph based on the data to be detected using the MIC correlation coefficient to obtain a subset of nodes.
[0131] Time module 20 is used to encode the node subset using TCN and causal Transformer to obtain time encoding;
[0132] The time module 20 includes:
[0133] The first unit is used to flatten and linearly project the node subset and capture multi-scale dependencies using a multi-layer TCN.
[0134] The second unit is used to capture long-range dependencies based on the multi-scale dependencies using a causal Transformer and output temporal codes.
[0135] Spatial module 30 is used to construct an attention-induced dynamic graph based on the node subset and the static graph, fuse the static graph and the dynamic graph, and perform graph propagation to obtain spatial encoding;
[0136] In the spatial module 30, the node subset includes several nodes, and the spatial module 30 includes:
[0137] The third unit is used to extract the mean summary of several nodes using a short window and project it onto the hidden feature dimension to obtain the node short window summary representation, and obtain the structure mask matrix through the MIC correlation coefficient;
[0138] The fourth unit is used to obtain the integration coefficient, perform a logit transformation on the static graph to form a bias term, and obtain a dynamic graph based on the node short window summary representation, the structure mask matrix, the bias term, and the integration coefficient.
[0139] The fifth unit is used to obtain a structure mask matrix through the MIC correlation coefficient, fuse the dynamic graph and the static graph based on the structure mask matrix to obtain a spatiotemporal fusion code, and perform graph propagation on the spatiotemporal fusion code and the node short window summary representation to obtain a spatial code.
[0140] The formula for the dynamic graph is:
[0141]
[0142] in, This represents a dynamic image. This represents the softmax function. This represents a query obtained by a linear mapping of the node short window summary representation. This represents the transpose of the key matrix obtained by the linear mapping of the node short window summary representation. Indicates the hidden feature dimension. Indicates the integration coefficient. Represents the logit transformation. This represents a static image.
[0143] Alignment module 40 is used to synchronize the end semantics of the temporal encoding and the spatial encoding to obtain an aligned representation, and to decode the aligned representation to obtain prediction data;
[0144] The alignment module 40 includes:
[0145] The sixth unit is used to obtain an end spatial representation based on the spatial encoding, and inject a time context into the time encoding based on the end spatial representation to obtain an updated time encoding;
[0146] The seventh unit is used to obtain an aligned representation by using a multi-head attention alignment operator and a prefix causal mask based on the end space representation and the update time encoding.
[0147] The eighth unit is used to extract the end node representation from the end time step index of the aligned representation, and decode the end node representation using a Dec decoder to generate prediction data.
[0148] The scoring module 50 is used to acquire the updated sensor data sequence, extract real data from the updated sensor data sequence, obtain aggregated residuals based on the predicted data and the real data, and perform smooth scoring on the aggregated residuals to obtain anomaly scores.
[0149] The scoring module 50 includes:
[0150] The ninth unit is used to obtain real data from the updated sensor data sequence according to the time step of the predicted data, obtain residuals in all dimensions based on the predicted data and the real data, and perform mean aggregation on the residuals in all dimensions to obtain aggregated residuals.
[0151] The tenth unit is used to obtain the EMA coefficient and smooth the aggregation residual based on the EMA coefficient to obtain the anomaly score.
[0152] The formula for the anomaly score is:
[0153]
[0154] in, express Abnormal scores at time steps Represents the EMA coefficient. express Abnormal scores at time steps express Aggregation residuals at time steps.
[0155] Global module 60 is used to acquire training data sequence and test data sequence, perform smooth scoring based on the training data sequence and test data sequence to obtain training score sequence, and obtain global threshold based on training score sequence;
[0156] The adaptive module 70 is used to obtain an adaptive magnification, extract a cruise data sequence from the sensor data sequence, obtain an adaptive threshold based on the adaptive magnification and the cruise data sequence, and obtain a decision threshold based on the adaptive threshold and the global threshold.
[0157] The formula for the global threshold is:
[0158]
[0159] in, Indicates the global threshold. This indicates taking the median. Represents the training score sequence. Represents the consistency coefficient. Indicates the absolute deviation of the median;
[0160]
[0161] The formula for the adaptive threshold is:
[0162]
[0163] in, Indicates an adaptive threshold. Represents the cruise data sequence. This indicates an adaptive scaling factor.
[0164] The adaptive module 70 includes:
[0165] The eleventh unit is used to compare the adaptive threshold and the global threshold. If the adaptive threshold is greater than the global threshold, the adaptive threshold is selected as the decision threshold.
[0166] The twelfth unit is used to select the global threshold as the decision threshold if the global threshold is greater than the adaptive threshold.
[0167] The result module 80 is used to compare the anomaly score with the decision threshold to obtain anomaly detection results for the real data.
[0168] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0169] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.
Claims
1. A method for detecting anomalies in unmanned aerial vehicles (UAVs), characterized in that, Includes the following steps: Acquire sensor data sequences, obtain data to be detected from the sensor data sequences through a sliding window, and construct a static graph based on the data to be detected using the MIC correlation coefficient to obtain a subset of nodes; The node subset is encoded using TCN and causal Transformer to obtain temporal encoding; Based on the node subset and the static graph, an attention-induced dynamic graph is constructed, the static graph and the dynamic graph are fused, and graph propagation is performed to obtain spatial encoding; The node subset includes several nodes. The steps of constructing an attention-induced dynamic graph based on the node subset and the static graph, fusing the static graph and the dynamic graph, and performing graph propagation to obtain spatial encoding include: A short window is used to extract the mean summary of several nodes and project it onto the hidden feature dimension to obtain the node short window summary representation. The structure mask matrix is obtained through the MIC correlation coefficient. The integration coefficient is obtained, and the static graph is subjected to a logit transformation to form a bias term. Based on the node short window summary representation, the structure mask matrix, the bias term, and the integration coefficient, a dynamic graph is obtained. The dynamic graph and the static graph are fused based on the structure mask matrix to obtain a spatiotemporal fusion code. The spatiotemporal fusion code and the node short window summary representation are then propagated through graph to obtain a spatial code. Synchronize the end semantics of the temporal encoding and the spatial encoding to obtain an aligned representation, and decode the aligned representation to obtain prediction data; Obtain an updated sensor data sequence, extract real data from the updated sensor data sequence, obtain aggregated residuals based on the predicted data and the real data, and perform smooth scoring on the aggregated residuals to obtain anomaly scores. Obtain training data sequences and test data sequences, perform smooth scoring based on the training data sequences and test data sequences to obtain training score sequences, and obtain a global threshold based on the training score sequences; Obtain an adaptive magnification, extract a cruise data sequence from the sensor data sequence, obtain an adaptive threshold based on the adaptive magnification and the cruise data sequence, and obtain a decision threshold based on the adaptive threshold and the global threshold; The anomaly score and the decision threshold are compared to obtain the anomaly detection result for the real data.
2. The UAV anomaly detection method according to claim 1, characterized in that, The step of encoding the node subset using TCN and causal Transformer to obtain time-coded data includes: The node subset is flattened and linearly projected, and multi-layer TCN is used to capture multi-scale dependencies; Based on the multi-scale dependency, long-range dependencies are captured by a causal Transformer and time-encoded data is output.
3. The UAV anomaly detection method according to claim 1, characterized in that, The formula for the dynamic graph is: in, This represents a dynamic image. This represents the softmax function. This represents a query obtained by a linear mapping of the node short window summary representation. This represents the transpose of the key matrix obtained by the linear mapping of the node short window summary representation. Indicates the hidden feature dimension. Indicates the integration coefficient. Represents the logit transformation. This represents a static image.
4. The UAV anomaly detection method according to claim 1, characterized in that, The steps of synchronizing the end semantics of the temporal encoding and the spatial encoding to obtain an aligned representation, and decoding the aligned representation to obtain the prediction data include: Based on the spatial encoding, an end spatial representation is obtained, and based on the end spatial representation, a temporal context is injected into the temporal encoding to obtain an updated temporal encoding; Based on the terminal spatial representation and the update time encoding, a multi-head attention alignment operator and prefix causal masking are used to obtain the aligned representation. The end node representation is extracted from the end time step index of the aligned representation, and the end node representation is decoded using the Dec decoder to generate prediction data.
5. The UAV anomaly detection method according to claim 1, characterized in that, The steps of extracting real data from the updated sensor data sequence, obtaining aggregated residuals based on the predicted data and the real data, and smoothing and scoring the aggregated residuals to obtain anomaly scores include: Based on the time step of the predicted data, real data is obtained from the updated sensor data sequence. Based on the predicted data and the real data, residuals in all dimensions are obtained, and the residuals in all dimensions are aggregated by mean to obtain aggregated residuals. Obtain the EMA coefficient, and smooth the aggregation residual based on the EMA coefficient to obtain the anomaly score.
6. The UAV anomaly detection method according to claim 5, characterized in that, The formula for the anomaly score is: in, express Abnormal scores at time steps Represents the EMA coefficient. express Abnormal scores at time steps express Aggregation residuals at time steps.
7. The UAV anomaly detection method according to claim 1, characterized in that, The formula for the global threshold is: in, Indicates the global threshold. This indicates taking the median. Represents the training score sequence. Represents the consistency coefficient. Indicates the absolute deviation of the median; The formula for the adaptive threshold is: in, Indicates an adaptive threshold. Represents the cruise data sequence. This indicates an adaptive scaling factor.
8. The UAV anomaly detection method according to claim 1, characterized in that, The step of obtaining the decision threshold based on the adaptive threshold and the global threshold includes: If the adaptive threshold is greater than the global threshold, then the adaptive threshold is selected as the decision threshold. If the global threshold is greater than the adaptive threshold, then the global threshold is selected as the decision threshold.
9. A drone anomaly detection system, employing the drone anomaly detection method as described in any one of claims 1 to 8, characterized in that, The system includes: The static graph module is used to acquire sensor data sequences, obtain the data to be detected from the sensor data sequences through a sliding window, and construct a static graph based on the data to be detected using the MIC correlation coefficient to obtain a subset of nodes. The time module is used to encode the subset of nodes using TCN and causal Transformer to obtain time codes; A spatial module is used to construct an attention-induced dynamic graph based on the node subset and the static graph, fuse the static graph and the dynamic graph, and perform graph propagation to obtain spatial encoding; In the spatial module, the node subset includes several nodes, and the spatial module includes: The third unit is used to extract the mean summary of several nodes using a short window and project it onto the hidden feature dimension to obtain the node short window summary representation, and obtain the structure mask matrix through the MIC correlation coefficient; The fourth unit is used to obtain the integration coefficient, perform a logit transformation on the static graph to form a bias term, and obtain a dynamic graph based on the node short window summary representation, the structure mask matrix, the bias term, and the integration coefficient. The fifth unit is used to obtain a structure mask matrix through the MIC correlation coefficient, fuse the dynamic graph and the static graph based on the structure mask matrix to obtain a spatiotemporal fusion code, and perform graph propagation on the spatiotemporal fusion code and the node short window summary representation to obtain a spatial code; An alignment module is used to synchronize the end semantics of the temporal encoding and the spatial encoding to obtain an aligned representation, and to decode the aligned representation to obtain prediction data. The scoring module is used to acquire the updated sensor data sequence, extract real data from the updated sensor data sequence, obtain aggregated residuals based on the predicted data and the real data, and perform smooth scoring on the aggregated residuals to obtain anomaly scores. The global module is used to acquire training data sequences and test data sequences, perform smooth scoring based on the training data sequences and test data sequences to obtain training score sequences, and obtain a global threshold based on the training score sequences. An adaptive module is used to obtain an adaptive magnification, extract a cruise data sequence from the sensor data sequence, obtain an adaptive threshold based on the adaptive magnification and the cruise data sequence, and obtain a decision threshold based on the adaptive threshold and the global threshold. The results module is used to compare the anomaly score with the decision threshold to obtain anomaly detection results for the real data.