Abnormal behavior detection method and system based on flight mission context awareness

Abstract

The invention provides an abnormal behavior detection method and system based on flight mission context awareness, and is applied to the technical field of data processing. The method comprises the following steps: processing flight dynamic data and task protocol data of an unmanned aerial vehicle, obtaining a task type by analyzing a MASSIONITEM field in a task protocol, and generating a dynamic tag; combining the GPS positioning data with normalized mutual information and random forest importance score to screen task sensitive features, and generating a task related feature subset; processing the task related feature subsets based on a random forest model, training an exclusive classification model for each task type, and generating an exclusive classification model of each type of tasks; and predicting the real-time flight state data of the unmanned aerial vehicle based on the exclusive classification model of each task to obtain probability distribution of each task type, performing judgment according to a set threshold, and generating an unmanned aerial vehicle abnormal behavior judgment result.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to an abnormal behavior detection method and system based on flight mission context awareness. Background Technology

[0002] In today's wave of technological development, drones are widely used in logistics, agriculture, rescue, and many other fields, leading to the inclusion of the low-altitude economy in the national strategic emerging industries category. As the core carrier of the low-altitude economy, the safe, efficient, and compliant operation of drones is crucial for the industry's successful implementation. Against this backdrop, the importance of drone regulatory technology is increasingly prominent, with abnormal behavior detection technology being a key element in ensuring drone operational safety.

[0003] Currently, existing drone abnormal behavior detection technologies mainly rely on static thresholds (such as geofencing, speed, and altitude exceeding limits) or general sensor data analysis to identify abnormal behavior. However, these traditional technologies have significant limitations. First, they lack adaptability; static thresholds are difficult to match the dynamic behavior patterns of different task types (such as logistics transportation, inspection, and emergency response). Taking logistics transportation tasks as an example, different cargo weights, delivery areas, and time requirements will cause significant differences in drone flight speed, altitude, and other behavior patterns. Static thresholds cannot flexibly adapt to these changes, leading to misjudgments of normal flight behavior or missed detections of abnormal behavior. Second, they have low computational efficiency; directly using raw sensor data will generate a large amount of feature redundancy. This not only increases the consumption of computing resources and prolongs data processing time but also leads to an increase in false alarm rates, reducing the accuracy and real-time performance of detection. Third, they lack semantic association; existing technologies do not closely link flight task types with behavioral characteristics, making it difficult to identify task spoofing attacks. For example, illegal filming under the guise of inspection is difficult to detect and stop in a timely manner due to the lack of comprehensive analysis of task type and behavioral characteristics.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide an abnormal behavior detection method and system based on flight mission context awareness, which at least to some extent overcomes the problems existing in the prior art. It collects UAV flight dynamics, GPS positioning, and mission protocol data, parses the protocols to generate dynamic labels, and then combines NMI and random forest importance scoring to select features, training a mission-specific random forest model. These models are used to predict flight status data, identify anomalies, and analyze attributes. Through dynamic feature selection and mission-behavior verification, it improves detection accuracy and real-time performance, ensuring the safe and compliant operation of UAVs.

[0006] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part by practice of the invention.

[0007] According to one aspect of this application, an abnormal behavior detection method based on flight mission context awareness is provided, comprising: acquiring real-time flight status data of a UAV, UAV flight dynamic data, GPS positioning data, and mission protocol data; processing the UAV flight dynamic data and mission protocol data, obtaining the mission type by parsing the MASSION_ITEM field in the mission protocol, and generating dynamic labels; combining GPS positioning data with normalized mutual information and random forest importance scoring to filter mission-sensitive features and generate a subset of mission-related features; processing the subset of mission-related features based on a random forest model, training a dedicated classification model for each mission type, and generating mission-specific classification models for each type; predicting the real-time flight status data of the UAV based on the mission-specific classification models to obtain the probability distribution of each mission type, judging according to a set threshold, and generating a judgment result of abnormal UAV behavior.

[0008] Another aspect of this application discloses an abnormal behavior detection device based on flight mission context awareness, comprising: a data collection module for acquiring real-time flight status data of a UAV, UAV flight dynamic data, GPS positioning data, and mission protocol data; a data processing module for processing the UAV flight dynamic data and mission protocol data, obtaining the mission type by parsing the MASSION_ITEM field in the mission protocol, and generating dynamic labels; combining GPS positioning data with normalized mutual information and random forest importance scoring to filter mission-sensitive features and generate a subset of mission-related features; processing the subset of mission-related features based on a random forest model, training a dedicated classification model for each mission type, and generating mission-specific classification models; predicting the real-time flight status data of the UAV based on the mission-specific classification models to obtain the probability distribution of each mission type, judging according to a set threshold, and generating a judgment result of abnormal UAV behavior.

[0009] According to another aspect of this application, an electronic device includes: a first processor; and a memory for storing executable instructions of the first processor; wherein the first processor is configured to execute the above-described abnormal behavior detection method based on flight mission context awareness by executing the executable instructions.

[0010] According to another aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a second processor, implements the above-described abnormal behavior detection method based on flight mission context awareness.

[0011] This application provides a method and system for detecting abnormal behavior based on flight mission context awareness. The system involves a server collecting multi-source data, encompassing UAV flight dynamics, GPS positioning, and mission protocol data. The mission protocol is then parsed to determine the mission type, and dynamic labels are automatically generated. Next, key features are selected using Non-Missing Memory (NMI) and Random Forest Importance Score (RFS) to construct a weight matrix. A random forest model is then trained using the selected feature subset to obtain a mission-specific classification model. Finally, these models are used to predict flight status data, and anomalies are identified based on thresholds, with anomaly attributes analyzed. This technology, through dynamic feature selection and mission-behavior consistency verification, improves the accuracy and real-time performance of UAV abnormal behavior detection, accurately identifying camouflage attacks and abnormal behaviors, effectively ensuring the safe, efficient, and compliant operation of UAVs.

[0012] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0013] Figure 1 The flowchart illustrates an abnormal behavior detection method based on flight mission context awareness provided in an embodiment of this application. Figure 2 The diagram shows a schematic representation of an abnormal behavior detection device based on flight mission context awareness, provided in one embodiment of this application. Detailed Implementation

[0014] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0015] The following is combined with Figure 1 This application describes an abnormal behavior detection method based on flight mission context awareness according to exemplary embodiments thereof. It should be noted that the following application scenarios are shown only to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way. Rather, the embodiments of this application can be applied to any applicable scenario.

[0016] In one embodiment, this application also proposes an abnormal behavior detection method and system based on flight mission context awareness. Figure 1 A schematic flowchart of an abnormal behavior detection method based on flight mission context awareness according to an embodiment of this application is shown.

[0017] S101 acquires real-time flight status data, flight dynamic data, GPS positioning data, and mission protocol data of the UAV.

[0018] In one implementation, the drone is equipped with multiple sensors to acquire real-time flight status data. For example, in a logistics delivery scenario, the drone's inertial measurement unit (IMU) can collect data such as acceleration and angular velocity in real time. This data reflects the real-time changes in the drone's flight attitude, such as whether tilting or rolling occurs. The barometric altimeter measures the drone's current flight altitude to determine if it is flying within the specified altitude range. The airspeed sensor provides the drone's speed relative to the air, helping to monitor its flight speed. This data is transmitted to the data storage and processing module via an internal data bus, enabling precise monitoring and recording of the drone's real-time flight status.

[0019] Flight dynamic data encompasses information such as flight trajectory, speed changes, and heading adjustments. Taking agricultural plant protection drones as an example, when performing pesticide spraying tasks in farmland, the drone's flight control system records a series of data during the flight. For instance, the flight trajectory from the takeoff point to various areas of the farmland can be obtained through the built-in track recorder; the flight speed is adjusted according to the farmland terrain and crop distribution during flight, such as speed changes when encountering obstacles or areas requiring focused spraying; and heading adjustments are made according to farmland boundaries and operational plans. All of these data constitute part of the flight dynamic data. This data is crucial for analyzing whether the drone's flight behavior during the mission meets expectations.

[0020] With the help of the Global Positioning System (GPS), drones can obtain precise geographical location information. In urban inspection missions, drones rely on their GPS modules to receive satellite signals and determine their latitude and longitude coordinates in real time. For example, when drones inspect urban infrastructure, GPS positioning data can accurately determine the drone's specific location, such as being above a street or near a building. Combined with map data, the drone's flight path can be accurately plotted, providing locational basis for subsequent data analysis and anomaly detection.

[0021] The mission protocol data contains key information about the UAV mission. Taking the MAVLink protocol as an example, when a UAV performs an emergency relief supplies transport mission, the MASSION_ITEM field in the mission protocol will clearly state the mission type as "emergency relief supplies transport." It will also include information such as the destination and priority of the supplies, for example, if the destination is "a temporary relief point in a disaster-stricken area," and the priority is marked as "high." Additionally, it will include other mission-related instructions, such as flight path planning and communication frequency settings with the ground command center. This data is transmitted and received through the communication link between the UAV and the ground control station, ensuring that the UAV executes its flight mission according to the predetermined mission requirements.

[0022] S102 processes the UAV flight dynamic data and mission protocol data, obtains the mission type by parsing the MASSION_ITEM field in the mission protocol, and generates dynamic tags.

[0023] In one implementation, the MASSION_ITEM field in the mission protocol data is parsed to obtain the mission type and generate preliminary mission type information. In modern UAV applications, to ensure data standardization and compatibility, mission protocols follow the MAVLink protocol standard for data transmission and storage. When a UAV is ready to execute a mission, the ground control station encodes the mission information according to the MAVLink protocol standard based on mission requirements and sends the mission protocol data to the UAV via a wireless communication link. After receiving this data, the UAV's internal mission parsing system begins operation, with its primary task being to parse the crucial MASSION_ITEM field in the protocol.

[0024] In the specific scenario of logistics and delivery tasks, the MASSION_ITEM field is assigned specific encoding rules to accurately describe task details. For example, the field content is "LOGISTICS_DELIVERY_URBAN_AREA_01". This encoding is not arbitrary but contains rich task information. The "LOGISTICS_DELIVERY" part is a pre-defined identifier representing the task type. The system was designed with built-in parsing rules for the MASSION_ITEM field. These rules act as a "decoder," extracting key information from complex field content. When the system reads "LOGISTICS_DELIVERY", based on the parsing rules, it can quickly identify that the task is related to logistics and delivery, thus initially determining the task type as a logistics and delivery task. At this point, the system records "logistics and delivery" as the initially determined task type information, providing important foundational information for subsequent task processing and data analysis. This initially determined task type information is the key starting point of the entire task processing flow; subsequent verification, data association, and annotation operations will all revolve around it.

[0025] The system verifies and confirms the initially determined task type information to generate accurate task type results. Ensuring the accuracy of task type information is crucial in UAV task processing, as it directly impacts the accuracy and effectiveness of subsequent operations. Therefore, the system performs rigorous verification and confirmation. The system has a built-in task type library, which acts as a vast and organized information warehouse, storing all known task types and their related attribute information. This task type library was built through long-term practice and data accumulation, covering all types of tasks that UAVs may perform. Each task type is associated with a series of specific attributes that describe the characteristics and requirements of that task type, serving as a crucial basis for determining the accuracy of the task type.

[0026] Taking the "Logistics Delivery" task type as an example, it is associated with numerous attributes in the task type library. Regarding the category of delivered items, it includes different types such as ordinary packages, fresh food, and fragile items. The requirements for drones during transportation vary depending on the category of items. For example, fresh food may require specific temperature control, while fragile items require more stable flight operations. Delivery area restrictions are also an important attribute, determining the drone's flight range, which may involve urban areas, rural areas, specific industrial parks, etc. In addition, attributes such as delivery time windows and transportation priorities are also associated. Once the system initially determines the task type as "Logistics Delivery," it will compare the initially determined task type information with the "Logistics Delivery" task type information in the task type library in detail. In this example, the "LOGISTICS_DELIVERY_URBAN_AREA_01" field in the MASSION_ITEM field, upon further analysis, reveals that "URBAN_AREA_01" represents delivery to a specific urban area. The delivery area restriction attribute of the "Logistics Delivery" task type in the task type library indicates that urban area delivery is one of its possible execution scenarios. Through careful comparison, the system confirmed that the task's key attribute of delivery area matches the relevant attribute of the "logistics delivery" task type in the task type library.

[0027] After comparing and verifying each key attribute, the system determined that this task not only belonged to logistics delivery but also specifically involved logistics delivery within a particular urban area. Therefore, the system generated a precise task type result: "Urban Area Logistics Delivery." This accurate task type result provides a clearer direction for subsequent task execution and monitoring, ensuring that the drone operates according to relevant specifications and requirements during the task, improving the accuracy and efficiency of task execution. It also provides a more precise basis for detecting abnormal behavior; if the drone's flight behavior does not conform to the attribute requirements of the "Urban Area Logistics Delivery" task, the system can identify the anomaly more promptly and accurately.

[0028] The system segments and associates UAV flight dynamic data according to precise task type results to generate initially labeled data segments. After determining the task type as "urban area logistics delivery," the system processes the UAV flight dynamic data. Flight dynamic data includes information such as flight trajectory, speed, and altitude. Taking flight trajectory data over a period of time as an example, it includes trajectory data for different stages, such as from the takeoff point to the first delivery point, and from the first delivery point to the second delivery point. Based on the characteristics of the logistics delivery task, the system segments the flight trajectory according to the delivery process. For example, the trajectory from takeoff to the first delivery point is marked as the "delivery start segment," and the trajectory from the first delivery point to the second delivery point is marked as the "delivery middle segment," etc. Simultaneously, it associates the corresponding timestamps, speed, and other flight dynamic data to generate initially labeled data segments. For example, the "delivery start segment" data segment includes the coordinates of the takeoff point, takeoff time, takeoff speed, time and altitude to reach a certain altitude, forming an initially labeled data segment related to the logistics delivery task process.

[0029] The format of the initially labeled data segments may vary due to differences in data acquisition equipment or transmission processes, so the system standardizes its format. The timestamp format of the unified data segments is a standard time format, and the coordinate data format is standardized to a specific coordinate system format. Regarding information completion, additional information related to the logistics and delivery task is supplemented based on the task. For example, in the "delivery start segment" data segment, information such as the weight and volume of the goods is added, as this information is closely related to the logistics and delivery task. After format standardization and information completion, dynamic tags are generated. These dynamic tags contain standardized flight trajectory, speed, altitude, time, and other flight dynamic data, as well as supplementary cargo information and delivery stage information, such as "Urban Area Logistics Delivery_Delivery Start Segment_Cargo Weight 5kg_Cargo Volume 0.2 cubic meters_Start Time 2024-10-01 10:00:00_Takeoff Coordinates [116.3, 39.9]...". Such dynamic tags accurately reflect the real-time status and task-related attributes of the UAV during task execution, providing clear and accurate data support for subsequent feature selection, model training, and abnormal behavior detection.

[0030] S103 combines GPS positioning data with normalized mutual information and random forest importance scores to screen task-sensitive features and generate a subset of task-related features.

[0031] In one implementation, during actual flight, the GPS positioning data of the UAV may experience inconsistent data formats or missing data due to signal interference, obstruction, or other reasons. For example, in the GPS positioning data collected at a certain moment, the representation of latitude and longitude may have different precision, with some data accurate to six decimal places and others only accurate to four; there may also be cases where positioning data for certain time points is completely missing. The system first unifies the format of these data, adjusting the precision of all latitude and longitude data to six decimal places to ensure data format consistency. For missing values, the system uses linear interpolation to fill in the missing values ​​based on positioning data from before and after the missing data. If a data point is missing between 10:00:00 and 10:00:05, the system uses the positioning data from 10:00:00 and 10:00:05 to calculate the estimated location of the missing point through linear calculation and fills in the missing value. After this series of preprocessing operations, preliminary processed GPS positioning data is generated. In this logistics and delivery scenario, the task type is labeled "urban area logistics and delivery." Normalized mutual information (NMI) is used to measure the initial processed GPS location data (i.e., features). The system calculates the correlation between location-related features (such as latitude and longitude, speed changes, etc.) and the task type label T. For example, latitude and longitude features directly reflect the location changes of a drone within an urban area, which is crucial for determining whether it is flying along a logistics delivery route. The system calculates the NMI value between latitude and longitude features and the "urban area logistics delivery" task type label. The calculated latitude and longitude features... The NMI value of the task type label T This indicates a strong correlation between latitude and longitude features and the "urban area logistics distribution" task type, and this feature is valuable for distinguishing different task types. By calculating the NMI values ​​between all GPS positioning-related features (such as speed change features, altitude change features, etc.) and the task type label, normalized mutual information association data is generated. These data reflect the degree of correlation between each feature and the task type.

[0032] Random forest is a powerful machine learning algorithm used to evaluate the importance of each feature in a model. For pre-processed GPS positioning data, the system uses the random forest algorithm to calculate the importance score of each feature. When building the random forest model, features such as latitude and longitude, speed variation, and altitude variation from the pre-processed GPS positioning data are used as input, with the task type ("urban area logistics delivery") as the output label. After model training, the importance score of each feature is obtained. The latitude and longitude features are calculated... The importance score of the random forest is This means that latitude and longitude features have an importance of 0.6 in the process of determining task type based on the random forest model. Random forest score data is generated by calculating all relevant features.

[0033] Normalized mutual information association data and random forest score data are combined based on the formula. Perform fusion calculations to generate feature weight calculation results, where, Indicates the first The combined weight of each feature, For adaptively adjustable coefficients, To normalize mutual information, used to measure the first Features With task type tags The correlation between them Representing the Each feature is a specific feature selected from a large number of data features collected by the drone. The task type label identifies the type of task the drone is currently performing. The first one was obtained by calculating using the random forest algorithm. Features Importance rating.

[0034] In this logistics and delivery scenario, the system automatically adjusts based on factors such as feature dimensions. Still based on latitude and longitude characteristics For example, combining the calculations obtained earlier... and Substituting into the formula, we get: By performing similar calculations on all GPS positioning-related features, a comprehensive weight for each feature is obtained, generating feature weight calculation results. These results comprehensively consider the relevance of features to the task type and their importance in the random forest model, providing a more comprehensive assessment of the importance of each feature for the "urban area logistics distribution" task.

[0035] The feature weight calculation results are sorted in descending order of weight, retaining the features whose total weight accounts for the top 80%, generating a task-relevant feature subset. The weight calculation results of all features are then sorted in descending order of weight value. For example, among the many features related to GPS positioning (latitude and longitude, speed change, altitude change, etc.), the weight of the latitude and longitude feature is... Weights of velocity change characteristics Weights of highly variable features wait.

[0036] The system selects features with higher weights from the sorted features, continuing until the sum of the weights of the selected features reaches 80% of the total weights of all features. For example, if the sum of the weights of features such as latitude and longitude and speed changes reaches exactly 80%, these features are grouped into a task-relevant feature subset. This subset contains the most critical GPS positioning features for the "urban area logistics delivery" task type. Subsequent model training based on these features can more effectively detect abnormal behavior of drones during this task, reduce interference from redundant data, and improve detection accuracy and efficiency.

[0037] S104 uses a random forest model to process a subset of task-related features, trains a dedicated classification model for each task type, and generates dedicated classification models for various tasks.

[0038] In one implementation, after completing the crucial feature selection step in the UAV mission processing flow, a subset of task-related features is obtained for different task types, representing a data set characterizing the corresponding task features. Taking urban logistics delivery tasks as an example, the latitude and longitude features included in the task-related feature subset are crucial for determining the specific location of the UAV in the complex urban traffic environment. Accurate latitude and longitude data clearly indicates whether the UAV is flying on the planned delivery route; deviations indicate abnormalities. Speed ​​variation features reflect the fluctuations in the UAV's flight speed during delivery. In cities, due to factors such as traffic conditions and building distribution, the UAV's flight speed needs to be adjusted reasonably according to the actual situation. Abnormally fast or slow speeds indicate that the UAV has encountered some problem, such as a sudden speed change that fails to return to normal when avoiding obstacles, or prolonged low-speed flight without special circumstances—all signs of abnormal behavior. The dwell time within the delivery area is also a significant characteristic; in urban logistics delivery, the dwell time of the UAV at each delivery point should follow a certain pattern. If the stay is too long, there may be problems with loading and unloading goods or signal interference at the delivery point; if the stay is too short, the delivery task may not have been completed.

[0039] For emergency rescue missions in mountainous areas, the characteristic subset is unique. Terrain altitude variation is a key factor in mountainous environments. Mountainous terrain is complex and undulating, requiring drones to constantly adjust their altitude during flight. Abnormal terrain altitude variation data, such as rapid altitude changes within a short period, indicates that the drone has encountered strong airflow, collided with obstacles, or is in a dangerous situation. Distance characteristics to the rescue target directly affect the progress of the rescue mission. In emergency rescue, quickly and accurately approaching the target is crucial. If the distance between the drone and the target does not change as expected, such as failing to approach or moving away from the target for an extended period, it indicates abnormal drone flight behavior. Flight attitude adjustment frequency is also very important in mountainous environments. Unstable airflow in mountainous areas requires drones to frequently adjust their flight attitude to maintain stable flight. However, excessively high or low flight attitude adjustment frequencies indicate problems with the drone's flight control system or interference from external abnormal factors.

[0040] Random forest models were used to construct models for analyzing the features relevant to these tasks. Random forest models belong to the ensemble learning model type, which makes predictions by constructing multiple decision trees. Specific basic structures and parameters were set when pre-setting the initial random forest models for urban logistics delivery tasks and mountain emergency rescue tasks. The pre-set initial random forest model structure included 50 decision trees. Each decision tree acts as a "mini-expert" within the model, making independent judgments and decisions based on the input feature data. Multiple decision trees collaborate, combining their individual judgments to make the model's predictions more accurate and stable. The choice of the number of decision trees is a trade-off between computational resources and model performance. Too few decision trees prevent the model from fully learning the complex patterns in the data, leading to inaccurate predictions; too many trees increase training time and computational resource consumption, and may even cause overfitting.

[0041] The maximum depth is set to 10 layers. The depth of a decision tree determines the level of detail in its data segmentation. A depth of 10 layers means the decision tree can perform relatively detailed classification of the data. During the growth of the decision tree, starting from the root node, the data is segmented according to different features, with each layer's segmentation based on the results of the previous layer. Deeper layers can capture more complex relationships in the data, but if the depth is too large, it may lead to an overly complex model, overfitting the training data, and thus performing poorly on new data. Setting the maximum depth to 10 layers ensures that the decision tree has sufficient capacity to learn the complex relationships between task-related features and task types, while also avoiding overfitting to some extent.

[0042] In urban logistics and delivery tasks, during data denoising, the system checks for abnormal jumps in latitude and longitude data. If a significant abrupt change occurs in latitude and longitude data at a certain moment, and the difference from data before and after is too large, it is determined that this is not a normal change in the delivery route, and the data point is considered a noise point and corrected or removed. For feature selection, the contribution of each feature to identifying abnormal behavior in logistics and delivery tasks is further analyzed. If a feature, such as the average speed fluctuation over a period of time, is found to be highly correlated with other features and contributes little to the anomaly detection, it is removed from the feature subset. During standardization, speed variation features are normalized. The speed variation range is 0-20 m / s, and it is normalized to the 0-1 range using a formula to facilitate comparison and calculation between different features during subsequent model training, generating preprocessed feature subset data for urban logistics and delivery tasks.

[0043] For emergency rescue missions in mountainous areas, data denoising targets terrain elevation change data, removing unreasonable elevation jumps caused by sensor errors. Feature filtering removes features with low relevance to the rescue mission, such as minor attitude jitter during flight, which has little impact on identifying anomalies in the complex mountainous environment. Standardization processing standardizes the distance features to the rescue target, bringing them into a uniform dimensional range, generating a preprocessed subset of features for mountainous emergency rescue missions.

[0044] In urban logistics and delivery scenarios, urban areas are typically large and delivery demands are diverse. To more accurately model and analyze drone behavior, preprocessed subset data of urban logistics and delivery task characteristics are grouped according to different delivery batches or delivery areas. Taking urban areas A and B as examples, the drone data responsible for delivery in area A is grouped together, based on the unique geographical environment, traffic rules, and delivery demands of area A. Area A is the city's commercial center, with dense buildings, high traffic volume, and delivery demands concentrated during weekday daytime, with extremely high requirements for delivery timeliness. This group of data includes characteristic data such as the latitude and longitude, speed changes, and dwell time of drones within the area. The latitude and longitude data accurately records the drone's flight trajectory within area A. By analyzing this data, it is possible to understand whether the drone flies according to the planned delivery route and whether there are abnormal dwell times or deviations at certain locations. If frequent abnormal changes in the latitude and longitude of a drone are found near a shopping mall in area A, it means that there is signal interference or other factors affecting the normal flight of the drone in that area.

[0045] Speed ​​variation characteristics reflect the real-time speed adjustments made by the drone while flying within area A. In commercial centers, due to the large number of pedestrians and vehicles, drones need to frequently adjust their speed to ensure safe flight. Abnormal speed changes, such as sudden braking or prolonged high-speed flight without obvious obstacles, indicate abnormal behavior. Dwell time characteristics reflect the duration the drone spends at various delivery points within area A. In commercial centers, dwell time at different delivery points should follow a certain pattern; for example, dwell time at parcel collection points may be shorter, while dwell time at loading and unloading points in large shopping malls may be longer. If the dwell time at a delivery point deviates significantly from normal, it suggests problems with loading and unloading or other abnormal conditions.

[0046] Similarly, the drone data responsible for deliveries in Area B is grouped into another set. Area B is a residential area where delivery demand is mainly concentrated in the evenings and weekends, and noise restrictions are relatively strict. This set of data also includes features such as latitude and longitude, speed variations, and dwell time. In residential areas, the drone's flight trajectory and speed need to comply with local noise control requirements; latitude and longitude and speed variation features can reflect whether the drone complies with these regulations. Dwell time features can help determine the delivery efficiency and any abnormal situations of drones near residential buildings. By grouping data according to delivery areas in this way, drone data with similar characteristics and needs can be aggregated to form a dataset grouped by urban logistics delivery task type, providing strong support for subsequent accurate model training tailored to the characteristics of different areas.

[0047] In emergency rescue missions in mountainous areas, the complex terrain and variable environment mean that rescue needs and difficulties vary significantly across different regions. Therefore, grouping data according to different rescue operations or areas is essential. Taking mountainous region X as an example, data from drones responsible for rescue operations in this region are grouped together. Region X is an earthquake-stricken area with severely damaged terrain, disrupted roads, and significant rescue challenges. This data group includes features such as terrain elevation changes, distance to rescue targets, and frequency of flight attitude adjustments. Terrain elevation change characteristics are crucial for drones performing rescue missions in region X. Earthquakes can cause landslides and ground subsidence, making the terrain extremely complex. Drones need to constantly monitor terrain elevation changes during flight to avoid collisions with obstacles. Analyzing terrain elevation change data helps determine the drone's flight safety in this area. Abnormal abrupt changes in terrain elevation change data, such as a sudden drop or rise in altitude within a short period, indicate an imminent collision with a landslide or entrapment in a terrain trap—a highly dangerous signal.

[0048] The distance to the rescue target directly affects the progress of the rescue mission. In the earthquake-stricken mountainous area X, time is of the essence; drones need to deliver relief supplies to the affected people or obtain crucial disaster information as quickly as possible. By monitoring changes in the distance to the rescue target, it can be determined whether the drone is approaching the target according to the predetermined plan. If the distance change is not as expected, such as being unable to approach the rescue target for an extended period, it is because the drone is affected by severe weather, navigation system failure, or other obstacles, requiring timely adjustments to the rescue strategy. The frequency of flight attitude adjustments reflects the stability of the drone in the complex airflow environment of the mountainous area. In the post-earthquake mountainous area, airflow is turbulent, and drones need to frequently adjust their flight attitude to maintain balance and stable flight. If the frequency of flight attitude adjustments is too high or too low, it indicates a problem with the drone's flight control system. An excessively high adjustment frequency means that the drone is experiencing strong airflow interference and cannot effectively cope with it, while an excessively low adjustment frequency indicates a malfunction in the flight attitude control system, causing the drone to be unable to respond to environmental changes in a timely manner. By grouping the drone data responsible for rescue in the mountainous area X according to the above characteristics, a mountainous emergency rescue mission type grouped dataset is constructed. This grouping method can fully take into account the uniqueness of different mountain rescue areas, thereby improving the model's ability to detect abnormal drone behavior in mountain emergency rescue missions.

[0049] For the urban logistics delivery task type grouped dataset, training parameters were set. The learning rate was set to 0.1, which determines the step size of parameter updates during training. The sample sampling ratio was set to 0.8, meaning that 80% of the sample data is randomly selected for training each time to avoid overfitting. Other parameters, such as the minimum number of samples required for node splitting, were also set to generate training parameters for a random forest model suitable for urban logistics delivery tasks. For the mountain emergency rescue task type grouped dataset, based on its data characteristics and task requirements, the learning rate was set to 0.05 and the sample sampling ratio to 0.7. Due to the complex mountain environment and large fluctuations in data characteristics, a smaller learning rate and sample sampling ratio help the model better learn the data features, generating training parameters for a random forest model for mountain emergency rescue tasks.

[0050] In urban logistics delivery tasks, after the preceding data processing steps, a grouped dataset of urban logistics delivery task types was obtained, and the corresponding training parameters were determined. The grouped datasets contain feature data closely related to logistics delivery, such as latitude and longitude, speed variations, and dwell time within the delivery area. This data records various behavioral information of drones during urban logistics delivery. The training parameters are set based on task characteristics and experience, such as a learning rate of 0.1 and a sample sampling ratio of 0.8. The preset initial random forest model has 50 decision trees and a maximum depth of 10 layers. After inputting the grouped datasets of urban logistics delivery task types and the corresponding training parameters into the preset initial random forest model, the model begins iterative training. During iterative training, each decision tree acts as an independent "intelligent judgment unit," splitting and growing based on the input feature data.

[0051] Taking the first decision tree as an example, the data is first divided based on latitude and longitude characteristics. In urban logistics and delivery scenarios, each delivery route is precisely planned, and latitude and longitude are key criteria for determining whether a drone is on the designated delivery route. The decision tree compares the latitude and longitude information in the data with the preset latitude and longitude range of the delivery route to determine whether the drone's location is compliant. If the latitude and longitude of a drone recorded in a data point exceeds the allowable range for a certain delivery route within a specific time period, the decision tree will classify it under the "potentially off-route" branch; if the latitude and longitude are within the normal range, it will be classified under the "normal route" branch. The decision tree gradually builds the judgment logic of the relationship between latitude and longitude characteristics and delivery routes.

[0052] The second decision tree makes judgments based on speed change characteristics. In urban logistics delivery, the flight speed of drones needs to be adjusted reasonably according to the actual situation. Different delivery areas, traffic conditions, and task requirements will all affect the drone's speed. The decision tree learns the reasonable speed range for drones in different delivery scenarios. For example, during peak hours in commercial areas, the drone's speed may be relatively slow and fluctuate greatly; while during off-peak hours or in open areas, the speed will be relatively fast and stable. When new data is input, the decision tree will determine whether the drone's flight speed meets the delivery task requirements based on speed change characteristics. If the speed change is abnormal, such as a sudden and significant acceleration or deceleration, and does not conform to the normal speed change pattern of the current delivery scenario, the decision tree will mark it as a potentially abnormal sample.

[0053] Subsequent decision trees will then perform similar segmentation and judgment on the data based on other features, such as dwell time within the delivery area. Each decision tree analyzes the data from different perspectives, learning the relationship between features and normal task behavior patterns. In each iteration, the decision tree continuously adjusts its splitting conditions and node partitions to better fit the data and improve its classification ability. After multiple rounds of iterative training, each decision tree gradually develops judgment rules and classification capabilities for its assigned features. These decision trees collaborate to form a preliminary trained random forest classification model for urban logistics delivery tasks. At this point, the model has begun to learn the relationship between task-related features and task types, enabling it to perform preliminary classification and judgment on newly input urban logistics delivery task data and identify some obvious abnormal behaviors.

[0054] For emergency rescue missions in mountainous areas, a grouped dataset of different mission types and corresponding training parameters are prepared. The grouped datasets include key features reflecting the characteristics of mountainous rescues, such as terrain elevation changes, distance to the rescue target, and frequency of flight attitude adjustments. The training parameters are also set according to the complexity and specificities of mountainous rescue missions; for example, the learning rate is set to 0.05, and the sample ratio is set to 0.7. After inputting the grouped datasets of different mountainous emergency rescue mission types and the corresponding training parameters into a pre-set random forest initial model, the model begins iterative training. The decision tree processes the data based on features such as terrain elevation changes and distance to the rescue target.

[0055] The first decision tree focuses on terrain altitude change characteristics. In mountainous areas, the terrain is complex and varied, and drones need to constantly adapt to changes in altitude to ensure safe flight. The decision tree learns the normal altitude change patterns of drones under different mountainous terrains; the altitude change patterns differ near valleys and peaks. When the terrain altitude changes in the input data do not conform to the normal pattern, such as a sharp drop or rise in altitude within a short period, the decision tree identifies this as a potentially dangerous situation and classifies and marks it accordingly. The second decision tree makes judgments based on the distance characteristics to the rescue target. In emergency rescue missions, approaching the rescue target as quickly as possible is crucial. The decision tree learns the reasonable trend of distance changes between the drone and the rescue target under different rescue scenarios. If the drone is unable to approach the rescue target for an extended period, or if the distance changes abnormally, the decision tree considers this an anomaly and records and analyzes it in the model. Subsequent decision trees will perform similar processing based on other characteristics such as flight attitude adjustment frequency. Flight attitude adjustment frequency reflects the stability of the drone in complex airflow environments in mountainous areas. The decision tree learns the normal adjustment frequency range and identifies and classifies abnormal adjustment frequencies. After multiple rounds of iterative training, a preliminary random forest classification model for mountain emergency rescue missions was developed. This model can perform preliminary analysis and judgment on the behavior of drones in mountain emergency rescue missions, and identify some situations that do not conform to normal rescue mission behavior patterns.

[0056] The performance of the initially trained random forest classification model for urban logistics delivery tasks was evaluated using a test dataset containing data on urban logistics delivery tasks with known normal and abnormal behaviors. Performance was assessed by calculating metrics such as accuracy and recall. The initial model achieved an accuracy of 70% and a recall of 65%. Based on the evaluation results, hyperparameters were adjusted, such as increasing the number of decision trees to 80 and adjusting the maximum depth to 12 layers. After repeated training and evaluation, and multiple adjustments and trials, the model's accuracy was finally improved to 90% and its recall to 85%, resulting in a classification model specifically suitable for urban logistics delivery tasks.

[0057] For emergency rescue missions in mountainous areas, the performance of the initially trained model was evaluated. The initial model achieved an accuracy of 60% and a recall of 55% on the test dataset. By adjusting hyperparameters, such as changing the sample ratio and learning rate, and after multiple trials, a final classification model specifically for emergency rescue missions in mountainous areas was obtained with an accuracy of 85% and a recall of 80%. These task-specific classification models can more accurately identify the behavior of drones under different task types, providing strong support for subsequent abnormal behavior identification.

[0058] S105 predicts the real-time flight status data of the UAV based on various task-specific classification models, obtains the probability distribution of each task type, makes judgments based on set thresholds, and generates abnormal behavior judgment results for the UAV.

[0059] In one implementation, a pre-trained classification model for urban logistics delivery tasks is used in urban logistics delivery scenarios. When a drone performs a delivery task, its real-time flight status data (such as current latitude and longitude, speed, and flight attitude) is input into the model. The model analyzes and processes this data, and based on previously learned characteristics and patterns of urban logistics delivery tasks, outputs initial probability distribution information for each task type. For example, the model might output a probability of 0.8 for the drone performing an "urban area logistics delivery" task, 0.1 for performing a "non-logistics delivery (such as inspection)" task, and 0.1 for performing other unknown task types. This indicates that, based on the current flight status data, the model believes there is an 80% probability that the drone is performing an urban area logistics delivery task. In mountainous emergency rescue scenarios, a classification model specifically for mountainous emergency rescue tasks receives real-time flight status data from the drone (such as changes in terrain altitude, distance to the rescue target, and frequency of flight attitude adjustments). The model calculates the probability for each task type. For example, the probability of the drone performing the "mountain emergency rescue material transportation" mission is 0.7, the probability of performing the "mountain terrain survey (non-rescue mission)" mission is 0.2, and the probability of other mission types is 0.1. It is preliminarily judged that the drone is most likely performing the mountain emergency rescue material transportation mission.

[0060] For urban logistics delivery tasks, probabilities are grouped according to task type based on the initial probability distribution information. For example, the probabilities of logistics delivery-related task types (such as urban area logistics delivery, rural logistics delivery, etc., considering only the sub-type of urban area logistics delivery here) are grouped into one group, while the probabilities of other non-logistics delivery task types are grouped into another. This yields probability distribution grouping information for different task types, such as the "Urban Logistics Delivery Task Probability Group" and the "Non-Urban Logistics Delivery Task Probability Group." In the "Urban Logistics Delivery Task Probability Group," the probability of "Urban Area Logistics Delivery" is 0.8; in the "Non-Urban Logistics Delivery Task Probability Group," the probability of "Non-Logistics Delivery (such as Inspection)" is 0.1, and so on. In mountainous emergency rescue scenarios, the probabilities of rescue-related task types such as "Mountainous Emergency Rescue Material Transportation" and "Mountainous Personnel Search and Rescue" are grouped into the "Mountainous Emergency Rescue Task Probability Group," while the probabilities of non-rescue task types such as "Mountainous Terrain Survey" are grouped into the "Non-Mountainous Emergency Rescue Task Probability Group." The probability of the "Mountain Emergency Rescue Material Transportation" mission is 0.7 in the "Mountain Emergency Rescue Mission Probability Group", and the probability of the "Mountain Topographic Survey (Non-Rescue Mission)" mission is 0.2 in the "Non-Mountain Emergency Rescue Mission Probability Group".

[0061] In the "Urban Logistics Delivery Task Probability Group" for urban logistics delivery tasks, the key probability value is the probability value of 0.8 for the "Urban Area Logistics Delivery" task, which is extracted to form the probability feature data for this group. For the "Non-Urban Logistics Delivery Task Probability Group," the probability value of 0.1 for the "Non-Logistics Delivery (e.g., Inspection)" task is extracted as the key probability value to form the corresponding probability feature data. This results in probability feature datasets for different groups, each containing probability values ​​for key task types within the corresponding group. These values ​​highlight the key characteristics of the probability distribution for different task types. In mountain emergency rescue tasks, the probability value of 0.7 for the "Mountain Emergency Rescue Material Transportation" task is extracted from the "Mountain Emergency Rescue Task Probability Group," and the probability value of 0.2 for "Mountain Topographic Survey (Non-Rescue Task)" is extracted from the "Non-Mountain Emergency Rescue Task Probability Group," forming two probability feature datasets for each group. These datasets reflect the probability characteristics of different task types under the current flight conditions.

[0062] The expected threshold for urban logistics delivery tasks is set at 0.6, and the unexpected threshold at 0.5. For the "Urban Logistics Delivery Task Probability Group," the probability of "Urban Area Logistics Delivery" is 0.8, greater than the expected threshold of 0.6; the probability of "Non-Logistics Delivery (e.g., Inspection)" is 0.1, less than the unexpected threshold of 0.5. Preliminary judgment indicates that the drone's current behavior conforms to the normal pattern of urban logistics delivery tasks. If the opposite occurs, i.e., the probability of "Urban Area Logistics Delivery" is less than 0.6, while the probability of other non-logistics delivery tasks is greater than 0.5, then the drone's behavior is preliminarily judged to be abnormal and not performing a normal urban logistics delivery task. In mountainous emergency rescue tasks, the expected threshold is 0.7, and the unexpected threshold is 0.5. For the "Mountainous Emergency Rescue Task Probability Group," the probability of "Mountainous Emergency Rescue Material Transportation" is 0.7, equal to the expected threshold; the probability of "Mountainous Terrain Survey (Non-Rescue Task)" is 0.2, less than the unexpected threshold. Preliminary judgment indicates that the drone's behavior is more likely to be performing a normal mountainous emergency rescue material transportation task. If the probability of the "mountain emergency rescue material transportation" mission is less than 0.7, while the probability of the "mountain terrain survey (non-rescue mission)" mission is greater than 0.5, it is preliminarily judged that the drone's behavior is abnormal and it has not carried out the rescue mission as planned.

[0063] If an initial assessment indicates abnormal drone behavior in urban logistics delivery tasks, further analysis of the probability feature datasets for the "urban logistics delivery task probability group" and the "non-urban logistics delivery task probability group" is conducted. This involves examining which flight status data points lead to a decrease in the probability of "urban area logistics delivery" tasks. For example, latitude and longitude data might show the drone deviating from the preset delivery route, or speed data might show an abnormally slow speed. Based on this information, detailed attribute information for the abnormal behavior is generated, such as "The drone may have deviated from the delivery route and its flight speed is abnormal, suggesting it may not be performing the urban area logistics delivery task normally," clarifying the specific manifestations and possible causes of the abnormal behavior. In mountainous emergency rescue tasks, if an anomaly is initially identified, analysis of the probability feature dataset reveals a low probability for "mountainous emergency rescue material transportation" tasks because the distance to the rescue target has not decreased for an extended period, and the frequency of flight attitude adjustments is abnormally high. Detailed attribute information is then generated, such as "The distance between the drone and the rescue target has not shortened as expected, and the flight attitude adjustments are frequent, possibly indicating obstacles encountered during flight that are affecting the execution of the rescue mission," providing a detailed description of the abnormal situation.

[0064] By integrating detailed attribute information from different groups of urban logistics delivery tasks to determine abnormal behaviors, a comprehensive and accurate judgment result is obtained. If the analysis previously indicated that the drone deviated from its route and exhibited abnormal speed, the final judgment result might be, "This drone exhibited abnormal behavior during an urban logistics delivery task, deviating from the planned delivery route and exhibiting abnormal flight speed; further investigation is required to determine the cause." This result integrates multiple aspects of abnormal information, providing a more comprehensive and accurate description of the drone's abnormal behavior.

[0065] For emergency rescue missions in mountainous areas, the abnormal attribute information from the "probability group for emergency rescue missions in mountainous areas" and the "probability group for emergency rescue missions in non-mountainous areas" is integrated. If distance and flight attitude issues were previously analyzed, the final judgment is "The UAV is malfunctioning while performing emergency rescue material transportation missions in mountainous areas. The distance to the rescue target has not been effectively shortened and the flight attitude adjustment is abnormal. It may encounter flight obstacles and requires close monitoring and measures." This fully and accurately presents the abnormal situation of the UAV, providing a clear basis for subsequent handling.

[0066] In this application, the server performs multi-source data collection to acquire real-time data such as UAV flight dynamics, GPS positioning, and mission protocols. Next, the MASSION_ITEM field in the mission protocol is parsed to determine the mission type, and dynamic labels are automatically generated by labeling the data. Subsequently, normalized mutual information (NMI) and random forest importance scoring are combined to screen mission-sensitive features, construct a feature weight matrix, and retain key features. Then, for each mission type, a random forest model is trained using the filtered feature subset to obtain a specific classification model. Finally, these models are used to predict the real-time flight status data of the UAV. Based on a set threshold, if the probability of the current mission type is lower than the expected threshold, and the probabilities of other mission types are higher than the unexpected threshold, it is judged as an anomaly, and the anomaly attributes are analyzed in depth. Through dynamic feature selection and mission-behavior consistency verification, the accuracy and real-time performance of UAV anomaly behavior detection are effectively improved, enabling accurate identification of camouflage attacks and abnormal behaviors, providing strong protection for the safe, efficient, and compliant operation of UAVs.

[0067] In one implementation, such as Figure 2 As shown, this application also provides an abnormal behavior detection device based on flight mission context awareness, comprising: Data collection module 201 is used to acquire real-time flight status data of UAV, flight dynamic data of UAV, GPS positioning data, and mission protocol data; The data processing module 202 is used to process UAV flight dynamic data and mission protocol data. It obtains the mission type by parsing the MASSION_ITEM field in the mission protocol and generates dynamic labels. It combines GPS positioning data with normalized mutual information and random forest importance scores to filter mission-sensitive features and generate a subset of mission-related features. It processes the subset of mission-related features based on the random forest model and trains a dedicated classification model for each mission type to generate a dedicated classification model for each type of mission. Based on the dedicated classification models for each type of mission, it predicts the real-time flight status data of the UAV to obtain the probability distribution of each mission type. It then judges the abnormal behavior of the UAV based on the set threshold and generates the judgment result of the UAV abnormal behavior.

[0068] The various embodiments in this application are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for evaluating the abnormal behavior detection method, electronic device, electronic device, and readable storage medium based on flight mission context awareness are basically similar to the above-described embodiments of the abnormal behavior detection method based on flight mission context awareness, and therefore the description is relatively simple. Relevant parts can be referred to in the descriptions of the above-described embodiments of the abnormal behavior detection method based on flight mission context awareness.

[0069] While this application discloses the above information, it is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of this application; therefore, the scope of protection of this application shall be determined by the scope defined in the claims.

Claims

1. An abnormal behavior detection method based on flight mission context awareness, characterized in that, include: Acquire real-time flight status data, drone flight dynamic data, GPS positioning data, and mission protocol data of the drone; Process the UAV flight dynamic data and mission protocol data, obtain the mission type by parsing the MASSION_ITEM field in the mission protocol, and generate dynamic tags; By combining GPS positioning data with normalized mutual information and random forest importance scores, task-sensitive features are screened to generate a subset of task-related features; The random forest model is used to process the subset of task-related features, and a dedicated classification model is trained for each task type to generate a dedicated classification model for each type of task. Based on various task-specific classification models, the real-time flight status data of UAVs is predicted to obtain the probability distribution of each task type. Judgments are then made based on set thresholds to generate abnormal behavior judgment results for UAVs.

2. The method as described in claim 1, characterized in that, The data processing involves analyzing UAV flight dynamics and mission protocol data, obtaining the mission type by parsing the MASSION_ITEM field in the mission protocol, and generating dynamic tags, including: The MASSION_ITEM field in the task protocol data is parsed to obtain the task type and generate preliminary task type information. Verify and confirm the initially determined task type information to generate accurate task type results; The drone flight dynamics data is segmented and correlated according to the precise task type results to generate initially labeled data segments; The format of the initially labeled data segments is standardized and the information is improved to generate dynamic tags.

3. The method as described in claim 1, characterized in that, By combining GPS positioning data with normalized mutual information and random forest importance scores, task-sensitive features are screened to generate a subset of task-related features, including: The GPS positioning data is formatted and missing values ​​are filled to generate preliminary processed GPS positioning data. The pre-processed GPS positioning data is combined with task type labels to calculate normalized mutual information and generate normalized mutual information association data. Random forest importance scores are calculated on the pre-processed GPS positioning data to generate random forest score data; Normalized mutual information association data and random forest score data are combined based on the formula. Perform fusion calculations to generate feature weight calculation results, where, Indicates the first The combined weight of each feature, For adaptively adjustable coefficients, To normalize mutual information, used to measure the first Features With task type tags The correlation between them Representing the Each feature is a specific feature selected from a large number of data features collected by the drone. The task type label identifies the type of task the drone is currently performing. The first one was obtained by calculating using the random forest algorithm. Features Importance rating; The feature weight calculation results are sorted in descending order of weight, and the features with the highest total weight are retained to generate a task-related feature subset.

4. The method as described in claim 1, characterized in that, The task-related feature subset is processed using a random forest model, and a dedicated classification model is trained for each task type, generating task-specific classification models for each type, including: Obtain a subset of task-related features and a preset random forest initial model. The subset of task-related features is used to represent the key data features selected under different task types. Data denoising, feature filtering, and standardization are performed on task-related feature subsets to generate preprocessed feature subset data. The preprocessed feature subset data is grouped and organized according to task type to generate task type grouped datasets; The training parameters of the task type grouped dataset are set to generate training parameters for the random forest model. The initial random forest model is iteratively trained based on the training parameters of the random forest model to generate a preliminary trained random forest classification model. The performance of the initially trained random forest classification model is evaluated and hyperparameters are adjusted to generate classification models specific to various tasks.

5. The method as described in claim 4, characterized in that, Based on task-specific classification models, real-time flight status data of UAVs is predicted to obtain the probability distribution of each task type. Judgments are then made based on set thresholds to generate abnormal UAV behavior determination results, including: Based on various task-specific classification models, the real-time flight status data of UAVs is processed to generate initial probability distribution information for each task type. The initial probability distribution information for each task type is classified and organized to generate probability distribution grouping information for different task types. The probability distribution grouping information is processed by extracting key probability values ​​to generate probability feature datasets for different groups; The probability feature datasets of different groups are combined with the target threshold for judgment processing to obtain preliminary results of the judgment of abnormal drone behavior; Based on the preliminary results of the abnormal behavior determination of drones, the probability feature datasets of different groups are further analyzed and processed to generate detailed attribute information of the abnormal behavior determination corresponding to different groups. A comprehensive and accurate result for judging abnormal drone behavior is generated based on the detailed attribute information corresponding to the abnormal behavior judgment of different groups.

6. An abnormal behavior detection device based on flight mission context awareness, characterized in that, The device includes: The data collection module is used to acquire real-time flight status data, flight dynamic data, GPS positioning data, and mission protocol data of the UAV. The data processing module processes UAV flight dynamics data and mission protocol data. It obtains the mission type by parsing the MASSION_ITEM field in the mission protocol and generates dynamic labels. It combines GPS positioning data with normalized mutual information and random forest importance scoring to filter mission-sensitive features, generating a subset of mission-related features. Based on the random forest model, it processes this subset of features, trains a dedicated classification model for each mission type, and generates mission-specific classification models. Based on these mission-specific classification models, it predicts the real-time flight status data of the UAV, obtains the probability distribution of each mission type, and judges based on set thresholds to generate abnormal UAV behavior judgment results.

7. An electronic device, characterized in that, include: First processor; and memory for storing executable instructions of the first processor; The first processor is configured to execute the abnormal behavior detection method based on flight mission context awareness as described in any one of claims 1 to 5 by executing the executable instructions.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the second processor, it implements the abnormal behavior detection method based on flight mission context awareness as described in any one of claims 1 to 5.

Images