A pilot contamination attack detection method and system based on multi-point channel mapping
By constructing a baseline channel map in a non-cellular massive MIMO network and combining Z-score trajectory jump detection with DBSCAN density clustering, the problem of identifying and locating pilot contamination attacks was solved, achieving efficient and low-cost detection and location in complex multipath environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NAT UNIV OF DEFENSE TECH
- Filing Date
- 2026-02-12
- Publication Date
- 2026-05-26
AI Technical Summary
Existing technologies rely on attacker prior information to detect pilot contamination attacks in complex multipath environments. They have poor noise robustness, are difficult to distinguish between sudden environmental noise and continuous attacks, and require a large amount of labeled data for training.
A multi-point channel mapping method is adopted, which utilizes distributed access points to collaboratively collect channel state information, constructs a baseline channel map, projects real-time signals into a low-dimensional manifold space through a weighted K-nearest neighbor algorithm, and combines Z-score trajectory jump detection and DBSCAN density clustering to achieve accurate identification of pilot pollution attacks and relative location of attack sources.
It enables efficient identification of pilot contamination attacks and location of attack sources without the need for attack sample labels, reduces false alarm rate, has stronger noise robustness and environmental adaptability, and is suitable for complex multipath environments.
Smart Images
Figure CN122093802A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of wireless communication security technology, specifically to a method and system for detecting pilot contamination attacks based on multi-point channel mapping. Background Technology
[0002] Integrated Sensing and Communication (ISAC) is a key technology for 6G networks. However, due to the openness of wireless channels, physical layer security faces severe challenges, particularly Pilot Contamination Attack (PCA). In PCA, attackers send the same pilot sequences as legitimate users during the training phase, contaminating the Channel State Information (CSI) obtained by the base station and thus disrupting beamforming and system sensing capabilities.
[0003] Extensive research has been conducted in academia on the detection of pilot contamination attacks, with existing methods mainly categorized into three types: energy feature-based, statistical subspace-based, and machine learning-based. Early research primarily relied on power anomalies in the received signal, proposing energy ratio detector methods to detect attacks by comparing the asymmetry of received power between the base station and the user end. Methods for identifying active eavesdroppers using pilot power anomalies were also explored in cell-free architectures. However, these methods assume that attackers cannot precisely control transmit power, often failing against adversaries with intelligent power control capabilities. To improve detection robustness, subsequent research shifted to utilizing channel statistical characteristics, employing the minimum description length criterion to analyze the subspace dimension of the received signal. This criterion points out that the presence of an attack leads to an abnormal increase in the signal subspace dimension, identifying anomalies by utilizing the orthogonality of the channel covariance matrix. However, these methods typically require long observation times to accumulate statistics, and in the typical multipath and scattering environment of ISAC, multipath effects easily lead to the failure of subspace dimension estimation. In recent years, deep learning has also been introduced into this field, proposing DNN-based identification networks. While these supervised learning methods perform well on specific datasets, they heavily rely on training with large amounts of labeled data containing attack samples. However, obtaining real attack samples in practical electromagnetic spectrum control scenarios is extremely challenging. More importantly, most of these methods are limited to snapshot-style analysis of instantaneous signal characteristics, ignoring the inherent spatiotemporal continuity of users moving in physical space. Summary of the Invention
[0004] Existing technologies rely on attackers' prior information in complex multipath environments, suffer from poor noise robustness, and have difficulty distinguishing between sudden environmental noise and continuous attacks. The purpose of this invention is to provide a pilot contamination attack detection method and system based on multi-point channel mapping, which realizes active pilot contamination attack detection and relative location of attack sources by utilizing the manifold characteristics of channel state information in a non-cellular massive MIMO network architecture.
[0005] This invention provides a pilot contamination attack detection method based on multi-point channel mapping, comprising: Step S1: Receive pilot signals sent by multiple users using multiple distributed access points, and extract the paths of the pilot signals; Step S2: Calculate the local dissimilarity between the pilot signals and fuse the local dissimilarity of each distributed access point to obtain the global dissimilarity matrix; Step S3: Receive the real-time signal, calculate the distance between the real-time signal and the reference anchor point in the reference channel graph using the weighted K-nearest neighbor algorithm, and project the real-time signal onto the low-dimensional manifold space using inverse distance weighting based on the distance to obtain the real-time coordinates; Step S4: Calculate the trajectory step size of the real-time coordinates. When the standardized score of the trajectory step size exceeds the threshold, it is determined that a non-physical jump has occurred, and the real-time coordinates are marked as candidate anomalies. Step S5: When the number of candidate anomalies reaches a preset cumulative trigger threshold, DBSCAN clustering is performed on the candidate anomalies to obtain clusters. When the number of candidate anomalies in a cluster is greater than or equal to the minimum number of points in the cluster and the root mean square radius of the cluster is less than a preset radius threshold, it is determined that an attack has occurred, and the center of the cluster is determined to be the attacker's virtual anchor point.
[0006] In one possible implementation, step S1 includes: Utilizing multiple distributed access points to receive pilot signals sent by multiple users; The channel features of the pilot signal are extracted using a multiple signal classification algorithm; The channel characteristics are mapped onto a two-dimensional Cartesian coordinate system to obtain the path of the pilot signal.
[0007] In one possible implementation, the channel characteristics are represented by the following formula. : in, For the first On the first distributed access point Channel characteristics of individual users The angle of arrival for the first path. For the first The angle of arrival of the path, The path power of the first path, For the first The path power of each path.
[0008] In one possible implementation, the path of the pilot signal is represented by the following formula. : in, For the first The pilot signal The angle of arrival of the path, For the first The pilot signal The reciprocal of the normalized power of the path, For the first On the first distributed access point The path of a pilot signal.
[0009] In one possible implementation, step S2 includes: Density-based clustering methods are used to determine whether any two pilot signals share a cluster. When a shared cluster exists, the Euclidean distance between the strongest path pairs shared by the two pilot signals is taken as the local dissimilarity of the two pilot signals; When there is no shared cluster, the principal diameter distance between the two pilot signals is taken as the local dissimilarity of the two pilot signals respectively; Calculate the global dissimilarity matrix based on the local dissimilarity of each distributed access point.
[0010] In one possible implementation, the elements of the global dissimilarity matrix are a weighted average of the local dissimilarity of all distributed access points; step S2 further includes: The elements of the global dissimilarity matrix are represented by the following formula. : in, For the first On the first distributed access point The pilot signal and the first Projected weights of pilot signals, For the first The weighted average of the local dissimilarity of the distributed access points The number of distributed access points. This is the number of the distributed access point.
[0011] In one possible implementation, step S3 includes: Receive real-time signals; Calculate the distance between the real-time signal and the anchor point in the reference channel diagram, and select the one with the smallest distance. One anchor point is used as the reference anchor point; It is a positive integer; Based on the reference anchor point, a set of neighbors is formed, and the projection weight of the neighbors is calculated using the inverse distance weighting method based on the distance; The real-time coordinates are obtained by weighted summation of the low-dimensional coordinates of the neighbors based on the projection weights.
[0012] In one possible implementation, step S4 includes: The trajectory step size between adjacent time points is calculated using the following formula. : in, for Real-time coordinates at any given moment for Real-time coordinates at any given moment; The standardized score of the trajectory step length is expressed by the following formula. : in, This represents the median trajectory step size under normal conditions. This represents the absolute median difference of the trajectory step size under normal conditions. To prevent division by zero of small constants.
[0013] In one possible implementation, attack-free historical data is obtained; Based on the global dissimilarity matrix, the attack-free historical data is mapped to low-dimensional manifold coordinates using the t-SNE manifold learning algorithm to obtain the reference channel map.
[0014] This invention also provides a pilot contamination attack detection system based on multi-point channel mapping, used to execute any of the above-described pilot contamination attack detection methods, including: The path extraction module is used to receive pilot signals sent by multiple users using multiple distributed access points and extract the path of the pilot signals; A global dissimilarity matrix generation module is used to calculate the local dissimilarity between the pilot signals and fuse the local dissimilarity of each distributed access point to obtain a global dissimilarity matrix. The real-time coordinate generation module is used to receive real-time signals, calculate the distance between the real-time signal and the reference anchor point in the reference channel graph using the weighted K-nearest neighbor algorithm, and project the real-time signal onto a low-dimensional manifold space based on the distance using inverse distance weighting to obtain real-time coordinates. The candidate anomaly marking module is used to calculate the trajectory step size of the real-time coordinates. When the standardized score of the trajectory step size exceeds a threshold, it is determined that a non-physical jump has occurred, and the real-time coordinates are marked as candidate anomalies. The virtual anchor point determination module is used to perform DBSCAN clustering on the candidate anomaly points to obtain clusters when the number of candidate anomaly points reaches a preset cumulative trigger threshold. When the number of candidate anomaly points in a cluster is greater than or equal to the minimum number of points in the cluster and the root mean square radius of the cluster is less than a preset radius threshold, it is determined that an attack has occurred, and the center of the cluster is determined as the attacker's virtual anchor point.
[0015] This invention provides a pilot contamination attack detection method and system based on multi-point channel mapping. It utilizes distributed access points in a non-cellular massive MIMO architecture to collaboratively collect multipath geometric features, constructing a benchmark channel map reflecting the topology of a normal electromagnetic environment. Through out-of-sample mapping based on weighted K-nearest neighbors, the real-time acquired pilot signals are efficiently projected onto a low-dimensional manifold space. Leveraging the topological traction mechanism of manifold trajectories generated by attackers at fixed locations, a two-stage detection algorithm combining Z-score trajectory jump detection and DBSCAN density clustering confirmation is designed to achieve accurate identification of pilot contamination attacks and relative location of the attack source. Attached Figure Description
[0016] Figure 1 A flowchart illustrating a pilot contamination attack detection method based on multi-point channel plotting, provided for an embodiment of the present invention; Figure 2(a) is a detection probability diagram under the first false alarm rate constraint provided in the embodiment of the present invention; Figure 2(b) is a detection probability diagram under the second false alarm rate constraint provided in the embodiment of the present invention; Figure 3(a) is a first schematic diagram of the user trajectory jump situation provided in an embodiment of the present invention; Figure 3(b) is a second schematic diagram of the user trajectory jump situation provided in the embodiment of the present invention; Figure 3(c) is a third schematic diagram of the user trajectory jump situation provided in the embodiment of the present invention; Figure 4 This is a schematic diagram illustrating the relative location of an attacker, provided in an embodiment of the present invention. Detailed Implementation
[0017] The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and examples. The following detailed description of the embodiments and the accompanying drawings are used to illustrate the principles of the present invention by way of example, but should not be used to limit the scope of the present invention. That is, the present invention is not limited to the described preferred embodiments, and the scope of the present invention is defined by the claims.
[0018] In the description of this invention, it should be noted that, unless otherwise stated, "a plurality of" means two or more; the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance; those skilled in the art can understand the specific meaning of the above terms in this invention as appropriate.
[0019] Figure 1 A flowchart illustrating the pilot contamination attack detection method based on multi-point channel mapping provided for embodiments of the present invention is shown below. Figure 1 As shown, this invention provides a pilot contamination attack detection method based on multi-point channel mapping, comprising: Step S1: Receive pilot signals sent by multiple users using multiple distributed access points and extract the paths of the pilot signals; In one possible implementation, multiple distributed access points are used to receive pilot signals transmitted by multiple users. A multi-signal classification algorithm is used to extract the channel features of the pilot signals. Considering that strong paths (such as line-of-sight paths) play a dominant role in positioning within multipath signals, the channel features are mapped to a two-dimensional Cartesian coordinate system to simultaneously fuse angular directionality and power distance information, thus obtaining the paths of the pilot signals. This transformation maps strong paths to the vicinity of the origin, while mapping weak paths to regions far from the origin, thereby highlighting the dominant role of strong paths.
[0020] In one possible implementation, the channel characteristics are represented by the following formula. : in, For the first On the first distributed access point Channel characteristics of individual users The angle of arrival for the first path. For the first The angle of arrival of the path, The path power of the first path, For the first The path power of each path.
[0021] In one possible implementation, the path of the pilot signal is represented by the following formula. : in, For the first The pilot signal The angle of arrival of the path, For the first The pilot signal The reciprocal of the normalized power of the path, For the first On the first distributed access point The path of a pilot signal.
[0022] Step S2: Calculate the local dissimilarity between pilot signals and fuse the local dissimilarity of each distributed access point to obtain the global dissimilarity matrix; In one possible implementation, Density-based clustering methods are used to determine whether any two pilot signals share a cluster. When a shared cluster exists, the Euclidean distance between the strongest shared path pairs of the two pilot signals is taken as the local dissimilarity of the two pilot signals. If two different pilot signals are clustered into the same cluster, it means that they have been reflected by the same physical scatterer, and they are considered to be spatially adjacent.
[0023] When there is no shared cluster, the principal path distance between the two pilot signals is taken as the local dissimilarity of the two pilot signals respectively; this method can effectively overcome the disturbance caused by multipath effect.
[0024] Calculate the global dissimilarity matrix based on the local dissimilarity of each distributed access point.
[0025] In one possible implementation, the elements of the global dissimilarity matrix are a weighted average of the local dissimilarity of all distributed access points: the elements of the global dissimilarity matrix are expressed by the following formula. : in, For the first On the first distributed access point The pilot signal and the first The projection weights of the pilot signals, the projection weights Two pilot signals at the distributed access point The average signal-to-noise ratio of the link determines the ranging reliability and the projection weight. The higher the signal-to-noise ratio of the link, the higher its ranging reliability and the greater its projection weight. For the first The weighted average of the local dissimilarity of the distributed access points The number of distributed access points. This is the number of the distributed access point.
[0026] Step S3: Receive the real-time signal, use the weighted K-nearest neighbor algorithm to calculate the distance between the real-time signal and the reference anchor point in the reference channel graph, and project the real-time signal onto the low-dimensional manifold space based on the distance using inverse distance weighting to obtain the real-time coordinates; In one possible implementation, trajectory change detection is based on Z-score, specifically by receiving real-time signals; calculating the distance between the real-time signal and anchor points in the reference channel graph; and selecting the point with the smallest distance. Anchor points are used as reference anchor points; a set of neighbors is formed based on the reference anchor points, and the projection weights of the neighbors are calculated using the inverse distance weighting method based on the distance; the low-dimensional coordinates of the neighbors are weighted and summed according to the projection weights to obtain the real-time coordinates.
[0027] in, It is a positive integer. For the th Each neighbor, its projected weight It is inversely proportional to its distance from the pilot signal.
[0028] In one possible implementation, attack-free historical data is obtained; Based on the global dissimilarity matrix, the attack-free historical data is mapped to low-dimensional manifold coordinates using the t-SNE manifold learning algorithm to obtain the reference channel map. .
[0029] Among them, the attack-free historical data is a set of attack-free, clean CSI pilot signals collected during safe periods.
[0030] Step S4: Calculate the trajectory step size of the real-time coordinates. When the standardized score of the trajectory step size exceeds the threshold, it is determined that a significant non-physical jump has occurred, that is, it has been subjected to topological traction by the attacker, and the real-time coordinates are marked as candidate anomalies. In one possible implementation, The trajectory step size between adjacent time points is calculated using the following formula. : in, for Real-time coordinates at any given moment for Real-time coordinates at any given moment; The standardized score of the trajectory step length is expressed by the following formula. : in, This represents the median trajectory step size under normal conditions. This represents the absolute median difference of the trajectory step size under normal conditions. To prevent division by zero of small constants.
[0031] Step S5: When the number of candidate anomalies reaches the preset cumulative trigger threshold, DBSCAN clustering is performed on the candidate anomalies to obtain clusters. When the number of candidate anomalies in a cluster is greater than or equal to the minimum number of points in the cluster and the root mean square radius of the cluster is less than the preset radius threshold, it is determined that an attack has occurred, and the center of the cluster is determined to be the attacker's virtual anchor point.
[0032] In one example, if the generated cluster The following two conditions must be met: 1) The number of samples within the cluster is sufficient, i.e. ,in The minimum number of points within the cluster; 2) Root mean square radius of the cluster ,in This is a preset radius threshold.
[0033] This indicates a pilot contamination attack. At this point, the geometric center of the anomalous cluster... This is determined as the attacker's relative position (virtual anchor point) in the channel manifold space, which can be used for subsequent active defense.
[0034] This invention presents an unsupervised manifold learning detection architecture, an MPCC detection framework that does not rely on attack sample labels and only utilizes normal CSI to construct a baseline channel map. It leverages the phenomenon of a fixed attacker forcibly guiding legitimate user trajectories to virtual anchor points as a core criterion for distinguishing attacks from noise. Through a two-stage cascaded detection algorithm, combining Z-score instantaneous jump detection and DBSCAN continuous clustering confirmation, this invention effectively reduces false alarms caused by sudden environmental noise. Furthermore, this invention employs calibration-free relative positioning, utilizing abnormal cluster centers as virtual anchor points for attack source localization, eliminating the need for complex geolocation calibration by the base station.
[0035] The present invention will be further described below with reference to specific embodiments.
[0036] First, let's explain the background of the embodiment: The system simulation was performed using Matlab software, and the parameter settings do not affect the generality. Considering a multi-access point non-cellular network in an outdoor scenario, the simulation area is set to 200m. 200m.
[0037] The network contains A fixed-location AP and A single-antenna legitimate UE that moves randomly, and an active pilot attacker (Eve) with a fixed location.
[0038] Each AP is equipped with A half-wavelength uniform linear array antenna.
[0039] The system carrier frequency is 28 The bandwidth is 100 It contains 256 OFDM subcarriers, and the uplink pilot sequence length is... .
[0040] The channel environment is generated using a ray tracing model, including line-of-sight (LoS) paths and non-line-of-sight (NLoS) scattering paths generated by building reflections. The number of multipath paths is set to [value missing]. Furthermore, the background noise power spectral density is -174. The user's transmit power is 23. .
[0041] Secondly, the detection and localization method of this invention for dealing with covert pilot contamination attacks in complex multipath environments is as follows: Step 1 involves collaboratively acquiring pilot signals using distributed access points to transform the high-dimensional CSI into multipath geometric features. Further, the feature extraction described in Step 1 utilizes the MUSIC algorithm to estimate the angle of arrival and power of the multipath paths, and maps each path to a two-dimensional Cartesian coordinate system. This is to highlight the dominant role of strong pathways.
[0042] Step 2: Calculate the local dissimilarity among samples and fuse them into a global dissimilarity to construct a baseline channel map reflecting the electromagnetic environment topology. Further, density-based clustering is used to determine whether multipath components share scattering clusters, and local dissimilarity is calculated; subsequently, a global dissimilarity matrix is generated based on the signal-to-noise ratio of each link. In the offline phase, the t-SNE algorithm is used to map attack-free historical data into low-dimensional manifold coordinates. .
[0043] Step 3, the online monitoring phase, utilizes OOS technology to process real-time signals. Further, a weighted K-nearest neighbor algorithm is employed to calculate the distance between the real-time signal and the reference anchor point. This distance is then projected onto a low-dimensional manifold space using inverse distance weighting to obtain the real-time coordinates. .
[0044] Step 4: Perform the first stage of detection: trajectory transition detection based on Z-score. Further, calculate the trajectory step size for real-time coordinates. If its standardized score Exceeding the threshold If a non-physical jump occurs, it is determined to be a candidate anomaly.
[0045] Step 5: Perform the second-stage detection: attack confirmation and localization based on density clustering. Further, when the accumulated candidate anomalies reach a trigger threshold... At that time, DBSCAN clustering is performed. If the generated clusters meet the high density ( And compact convergence (radius) If this is confirmed, then an attack has been detected, and the cluster center will be... The output is the attacker's virtual anchor point location.
[0046] Step 6: Repeat steps 3 to 5 to achieve continuous real-time security monitoring of the system.
[0047] Figure 2(a) shows the false alarm rate. The detection probability plot, Figure 2(b) shows the false alarm rate. The detection probability map is used to present the performance of the proposed MPCC method and the comparison algorithms (Energy Statistics Detection ESD, Covariance Detection CDD). In covert attack scenarios ( The MPCC method proposed in this invention exhibits significant advantages, achieving a low false alarm rate (…). Under the constraint of [unclear], the detection probability is maintained at approximately 45%; while traditional ESD and CDD algorithms have a detection rate close to zero because statistical features are overwhelmed by noise. This indicates that traditional methods rely on signal energy or statistical orthogonality and fail under strong interference or covert attacks, while the present invention utilizes the geometric fingerprint of manifold topology, which has stronger noise robustness.
[0048] Combined with Figure 3 and Figure 4 This study demonstrates the impact of pilot contamination attacks on user trajectories in manifold space. Under normal circumstances, user trajectories are continuous curves; however, when an attack occurs, the trajectories of all affected users undergo drastic, non-physical jumps and forcibly converge to the same specific region in the manifold space (i.e., the attacker's virtual anchor point). This result intuitively confirms the topological traction mechanism revealed in this invention, namely, that an attacker in a fixed position forms a strong static anchor point in the feature space, thus giving the detection logic based on trajectory jumps and density clustering a natural advantage in handling dynamic environments.
[0049] In summary, this invention models the complex pilot contamination detection problem as a trajectory anomaly analysis and density clustering problem in a manifold space by mapping high-dimensional CSI to a low-dimensional manifold space. Through these operations, Z-score is used to screen for mutation points and DBSCAN is used to remove environmental noise, solving the problem that traditional methods cannot effectively deal with covert attacks and distinguish environmental noise. Simulation results show that the detection and localization scheme proposed in this patent is highly effective and can achieve relative localization of attack sources without prior location information.
[0050] This invention also provides a pilot contamination attack detection system based on multi-point channel mapping, used to execute any of the above-described pilot contamination attack detection methods, including: The path extraction module is used to receive pilot signals sent by multiple users using multiple distributed access points and extract the path of the pilot signals. The global dissimilarity matrix generation module is used to calculate the local dissimilarity between pilot signals and fuse the local dissimilarity of each distributed access point to obtain the global dissimilarity matrix. The real-time coordinate generation module is used to receive real-time signals, calculate the distance between the real-time signal and the reference anchor point in the reference channel map using the weighted K-nearest neighbor algorithm, and project the real-time signal onto the low-dimensional manifold space based on the distance using inverse distance weighting to obtain the real-time coordinates. The candidate outlier marking module is used to calculate the trajectory step size of real-time coordinates. When the standardized score of the trajectory step size exceeds the threshold, it is determined that a non-physical jump has occurred, and the real-time coordinates are marked as candidate outliers. The virtual anchor point determination module is used to perform DBSCAN clustering on the candidate anomalies when the number of candidate anomalies reaches a preset cumulative trigger threshold. When the number of candidate anomalies in a cluster is greater than or equal to the minimum number of points in the cluster and the root mean square radius of the cluster is less than a preset radius threshold, it is determined that an attack has occurred, and the center of the cluster is determined as the attacker's virtual anchor point.
[0051] Compared with existing technologies, the significant advantages of the pilot contamination attack detection method and system based on multi-point channel mapping provided by this invention lie in breaking through the dependence of traditional methods on prior attack information and high ISR. By introducing an unsupervised multi-point channel mapping framework, only normal communication data is needed to construct a baseline channel map, effectively solving the problems of difficulty in obtaining real attack samples and high training overhead, and achieving low-cost real-time detection. Utilizing the topological traction mechanism generated by a fixed attacker's manifold trajectory, this invention has stronger robustness than traditional energy detection or subspace detection algorithms in complex multipath and low-power covert attack scenarios. The unique two-stage mechanism combining Z-score trajectory jump detection and DBSCAN density clustering confirmation can accurately distinguish between sudden environmental noise and persistent attacks, keeping the false alarm rate at a low level. In addition, this invention can lock the attacker's virtual anchor point in the manifold space without the need for expensive hardware calibration or prior geographical information, providing accurate spatial relative positioning basis for the ISAC system to implement active defenses such as beam nulling.
[0052] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A pilot contamination attack detection method based on multi-point channel mapping, characterized in that, include: Step S1: Receive pilot signals sent by multiple users using multiple distributed access points, and extract the paths of the pilot signals; Step S2: Calculate the local dissimilarity between the pilot signals and fuse the local dissimilarity of each distributed access point to obtain the global dissimilarity matrix; Step S3: Receive the real-time signal, calculate the distance between the real-time signal and the reference anchor point in the reference channel graph using the weighted K-nearest neighbor algorithm, and project the real-time signal onto the low-dimensional manifold space using inverse distance weighting based on the distance to obtain the real-time coordinates; Step S4: Calculate the trajectory step size of the real-time coordinates. When the standardized score of the trajectory step size exceeds the threshold, it is determined that a non-physical jump has occurred, and the real-time coordinates are marked as candidate anomalies. Step S5: When the number of candidate anomalies reaches a preset cumulative trigger threshold, DBSCAN clustering is performed on the candidate anomalies to obtain clusters. When the number of candidate anomalies in a cluster is greater than or equal to the minimum number of points in the cluster and the root mean square radius of the cluster is less than a preset radius threshold, it is determined that an attack has occurred, and the center of the cluster is determined to be the attacker's virtual anchor point.
2. The pilot contamination attack detection method based on multi-point channel mapping according to claim 1, characterized in that, Step S1 includes: Utilizing multiple distributed access points to receive pilot signals sent by multiple users; The channel features of the pilot signal are extracted using a multiple signal classification algorithm; The channel characteristics are mapped onto a two-dimensional Cartesian coordinate system to obtain the path of the pilot signal.
3. The pilot contamination attack detection method based on multi-point channel mapping according to claim 2, characterized in that, Also includes: Channel characteristics are expressed by the following formula. : in, For the first On the first distributed access point Channel characteristics of individual users The angle of arrival for the first path. For the first The angle of arrival of the path, The path power of the first path, For the first The path power of each path.
4. The pilot contamination attack detection method based on multi-point channel mapping according to claim 2, characterized in that, Also includes: The path of the pilot signal can be represented by the following formula. : in, For the first The pilot signal The angle of arrival of the path, For the first The pilot signal The reciprocal of the normalized power of the path, For the first On the first distributed access point The path of a pilot signal.
5. The pilot contamination attack detection method based on multi-point channel mapping according to claim 1, characterized in that, Step S2 includes: Density-based clustering methods are used to determine whether any two pilot signals share a cluster. When a shared cluster exists, the Euclidean distance between the strongest path pairs shared by the two pilot signals is taken as the local dissimilarity of the two pilot signals; When there is no shared cluster, the principal diameter distance between the two pilot signals is taken as the local dissimilarity of the two pilot signals respectively; Calculate the global dissimilarity matrix based on the local dissimilarity of each distributed access point.
6. The pilot contamination attack detection method based on multi-point channel mapping according to claim 1, characterized in that, The elements of the global dissimilarity matrix are the weighted average of the local dissimilarity of all distributed access points. Step S2 further includes: The elements of the global dissimilarity matrix are represented by the following formula. : in, For the first On the first distributed access point The pilot signal and the first Projected weights of pilot signals, For the first The weighted average of the local dissimilarity of the distributed access points The number of distributed access points. This is the number of the distributed access point.
7. The pilot contamination attack detection method based on multi-point channel mapping according to claim 1, characterized in that, Step S3 includes: Receive real-time signals; Calculate the distance between the real-time signal and the anchor point in the reference channel diagram, and select the one with the smallest distance. One anchor point is used as the reference anchor point; It is a positive integer; Based on the reference anchor point, a set of neighbors is formed, and the projection weight of the neighbors is calculated using the inverse distance weighting method based on the distance; The real-time coordinates are obtained by weighted summation of the low-dimensional coordinates of the neighbors based on the projection weights.
8. The pilot contamination attack detection method based on multi-point channel mapping according to claim 1, characterized in that, Step S4 includes: The trajectory step size between adjacent time points is calculated using the following formula. : in, for Real-time coordinates at any given moment for Real-time coordinates at any given moment; The standardized score of the trajectory step length is expressed by the following formula. : in, This represents the median trajectory step size under normal conditions. This represents the absolute median difference of the trajectory step size under normal conditions. To prevent division by zero of small constants.
9. The pilot contamination attack detection method based on multi-point channel mapping according to claim 1, characterized in that, Also includes: Obtain historical data on no attacks; Based on the global dissimilarity matrix, the attack-free historical data is mapped to low-dimensional manifold coordinates using the t-SNE manifold learning algorithm to obtain the reference channel map.
10. A pilot contamination attack detection system based on multi-point channel mapping, used to execute the pilot contamination attack detection method according to any one of claims 1-9, characterized in that, include: The path extraction module is used to receive pilot signals sent by multiple users using multiple distributed access points and extract the path of the pilot signals; A global dissimilarity matrix generation module is used to calculate the local dissimilarity between the pilot signals and fuse the local dissimilarity of each distributed access point to obtain a global dissimilarity matrix. The real-time coordinate generation module is used to receive real-time signals, calculate the distance between the real-time signal and the reference anchor point in the reference channel graph using the weighted K-nearest neighbor algorithm, and project the real-time signal onto a low-dimensional manifold space based on the distance using inverse distance weighting to obtain real-time coordinates. The candidate anomaly marking module is used to calculate the trajectory step size of the real-time coordinates. When the standardized score of the trajectory step size exceeds a threshold, it is determined that a non-physical jump has occurred, and the real-time coordinates are marked as candidate anomalies. The virtual anchor point determination module is used to perform DBSCAN clustering on the candidate anomaly points to obtain clusters when the number of candidate anomaly points reaches a preset cumulative trigger threshold. When the number of candidate anomaly points in a cluster is greater than or equal to the minimum number of points in the cluster and the root mean square radius of the cluster is less than a preset radius threshold, it is determined that an attack has occurred, and the center of the cluster is determined as the attacker's virtual anchor point.