Method for distinguishing between open and closed based on signal characteristics and multi-model fusion

Abstract

The application provides a clear and secret identification method based on signal characteristics and multi-model fusion, relates to the technical field of wireless signal monitoring, and solves the problems of insufficient robustness, weak generalization ability, low identification efficiency and low interpretability of existing clear and secret identification technology. The method first collects labeled wireless communication signal training samples and pre-processes, extracts time domain features, frequency domain features and mixed domain features, uses a random forest model to filter out an important feature subset, inputs corresponding features and labels, and trains a random forest classification model and a support vector machine classification model; after the same pre-processing and feature extraction are performed on the wireless communication signal to be identified, the two trained models are input, and the output results of the two models are integrated by using a soft voting integration strategy, so that a clear and secret identification judgment value is obtained. The application realizes high-precision and strong-robustness automatic identification of signal clear and secret state, and improves the model interpretability and deployment flexibility.

Description

Technical Field

[0001] This invention relates to the field of wireless signal monitoring technology, and more specifically to a method for signal and density identification based on signal features and multi-model fusion. Background Technology

[0002] With the deep application of wireless communication technology in key areas such as industrial control, communication security has become an important guarantee for industry operation. The open nature of wireless channels makes signals vulnerable to interception, tampering, or imitation. Although encryption technology is widely used, the "open transmission" of sensitive information due to equipment configuration errors, operational oversights, or protocol implementation defects is still common. There is an urgent need to establish an efficient and reliable routine monitoring mechanism for open and closed states in order to promptly detect potential risks.

[0003] Current mainstream identification methods mostly rely on the premise that the protocol is known. They involve demodulating and decoding the signal to perform protocol analysis, or performing randomness statistical tests on the payload bit sequence, such as referring to NIST testing standards or my country's cryptographic industry standard GM / T 0005-2021. These methods have high requirements for the integrity of the protocol specification and the quality of signal demodulation. Their adaptability decreases significantly in scenarios with unknown protocols, signal distortion, or sudden interference. Furthermore, the testing process is sensitive to data length and distribution characteristics, making it difficult to meet the real-time monitoring needs in complex field environments.

[0004] To overcome protocol dependency limitations, some research has introduced deep learning techniques, attempting to automatically learn discriminative features from raw signals using models such as convolutional neural networks to achieve end-to-end recognition. While this approach reduces the need for manual feature design, model training heavily relies on a large number of high-quality labeled samples, making it prone to overfitting or convergence difficulties in industry scenarios where clear signal samples are scarce. Furthermore, deep models are sensitive to input noise and channel disturbances, exhibiting insufficient stability in complex electromagnetic environments such as multipath fading and sudden interference. Their network structure design is also highly empirical, limiting their cross-scenario transferability. Internally, the models' decision-making logic is often obscure, lacking a clear explanation of the recognition criteria, making it difficult to support subsequent vulnerability tracing and defense strategy optimization.

[0005] Existing technologies still have significant shortcomings in terms of robustness, small-sample adaptability, feature effectiveness, and result interpretability. Complex electromagnetic environments easily lead to misjudgments, sample scarcity limits model generalization, redundant features interfere with recognition efficiency, and industry applications increasingly demand transparency in decision-making. Therefore, there is an urgent need to explore a novel transparent identification path that can integrate physical layer signal characteristics with the advantages of intelligent discrimination, while balancing environmental adaptability and analytical credibility, to provide more reliable technical support for wireless communication security monitoring. Summary of the Invention

[0006] The purpose of this invention is to address the problems of insufficient robustness of existing wireless communication signal density identification technologies in complex electromagnetic environments, weak generalization ability under small sample data conditions, inefficiency in identifying redundant interference from original signal features, and lack of interpretability in the model decision-making process. This invention proposes a density identification method based on signal features and multi-model fusion. By fusing physical layer features from the time domain, frequency domain, and mixed domain of the signal, and combining a soft-voting ensemble strategy of Random Forest (RF) and Support Vector Machine (SVM), it achieves high-precision and robust automatic identification of signal density states, while improving model interpretability and deployment flexibility.

[0007] The present invention employs the following technical solutions to achieve its objective: A method for identifying explicit and implicit signals based on signal features and multi-model fusion includes the following steps: S1. Preprocess the collected tagged wireless communication signal training samples, including synchronization processing, noise suppression processing and signal parameter normalization processing. S2. Extract time-domain features, frequency-domain features, and mixed-domain features from the preprocessed training samples to form an initial feature set; S3. Based on the initial feature set, calculate the importance score of each feature using a random forest model, and select an important feature subset according to a preset threshold or a preset number. S4. Using the features and labels corresponding to the important feature subset as input, train the random forest classification model and the support vector machine classification model respectively; S5. Perform the same preprocessing as step S1 and the same feature extraction as step S2 on the wireless communication signal to be identified. Select the corresponding feature values ​​according to the important feature subset determined in step S3, and input them into the random forest classification model and support vector machine classification model trained in step S4. Then, use a soft voting ensemble strategy to fuse the output results of the two models and output the clear / closed identification judgment value.

[0008] Specifically, in step S1, the signal modulation method of the tagged wireless communication signal training samples includes at least two of the following modulation methods: orthogonal frequency division multiplexing, frequency shift keying, and orthogonal phase shift keying; the signal-to-noise ratio ranges from -5dB to 20dB; in the tag definition, the value 1 corresponds to the clear signal and the value 0 corresponds to the secret signal.

[0009] Specifically, in step S1, the synchronization processing includes frame synchronization and carrier synchronization operations; the noise suppression processing uses Wiener filtering or a threshold denoising method based on wavelet transform; the signal parameter normalization processing includes linear scaling and normalization of the signal amplitude and compensation and correction of the carrier frequency offset.

[0010] Preferably, in step S2, the time-domain features include at least one of the following features: mean time-domain amplitude, root mean square value, variance, skewness, kurtosis, peak-to-peak value, waveform index, peak index, impulse index, and margin index.

[0011] Preferably, in step S2, the frequency domain features include at least one of the following features: power spectral density, spectral entropy, spectral flatness, centroid frequency, and root mean square value of frequency; the power spectral density is obtained by taking the square of the modulus after performing a fast Fourier transform on the signal.

[0012] Preferably, in step S2, the hybrid domain features include at least one of the following features: time-frequency energy distribution features extracted based on short-time Fourier transform, second-order cumulant, fourth-order cumulant, and sixth-order cumulant; the fourth-order cumulant is obtained by a combination operation of the fourth-order moment and the second-order moment.

[0013] Furthermore, in step S3, for the multidimensional features in the initial feature set, principal component analysis is first used to reduce dimensionality, retaining principal components whose cumulative variance contribution rate is not less than a preset percentage; the dimensionality-reduced features are concatenated with the single-dimensional features in the initial feature set to form a fused feature vector; based on the random forest model, the reduction in the Gini coefficient of each feature corresponding to the fused feature vector at the split node is calculated as the importance score of each feature; all features corresponding to the fused feature vector are sorted in descending order according to the importance score, and the features with a quantity ratio of at least 20% and ranked at the top are selected to form the important feature subset.

[0014] Preferably, in the dimensionality reduction process of the principal component analysis, the time-frequency matrix obtained by the short-time Fourier transform is vectorized according to time frames or frequency points and then input into the dimensionality reduction process; the single-dimensional feature includes any one of the following features: mean amplitude in the time domain, spectral entropy, and fourth-order cumulant.

[0015] Preferably, in step S4, the preprocessed and feature-extracted training samples are divided into a training set and a validation set according to a preset ratio, and a random forest classification model and a support vector machine classification model are trained respectively; the number of decision trees and the maximum depth are preset in the random forest classification model; a radial basis kernel function is used in the support vector machine classification model, and the corresponding regularization parameters and kernel coefficients are optimized and determined on the validation set through five-fold cross-validation.

[0016] Preferably, in step S5, the soft voting ensemble strategy includes: obtaining the probability values ​​of the clear signal class output by the random forest classification model respectively. The probability values ​​of the bright signal class output by the support vector machine classification model By weight and To each and Perform a weighted average calculation, where This represents the normalized classification accuracy of the random forest classification model on the validation set. This is the normalized value of the classification accuracy of the support vector machine classification model on the validation set, or let... If the probability value obtained after weighted average calculation is greater than or equal to the preset threshold, the wireless communication signal to be identified is determined to be a clear signal; otherwise, it is determined to be a secret signal, thereby completing the clear-secret identification.

[0017] In summary, due to the adoption of this technical solution, the beneficial effects of this invention are as follows: The method for identifying signals in both visible and invisible environments provided by this invention significantly improves the stability and anti-interference capability of wireless communication signals in complex electromagnetic environments. This method can effectively adapt to real-world interference scenarios such as multipath fading, background noise, and dynamic channel changes, ensuring high reliability of the identification process under various non-ideal communication conditions, greatly reducing the risk of misjudgment and missed judgment, and providing continuous and reliable monitoring protection for the security of sensitive information transmission.

[0018] This invention, by optimizing the feature processing flow and model building strategy, exhibits excellent generalization performance and computational efficiency under conditions of limited sample resources. Its feature selection mechanism accurately targets key discriminative information, effectively suppresses redundancy and noise interference, significantly reduces dependence on large-scale labeled data, and improves processing speed and resource utilization efficiency, which is particularly suitable for the real-world needs of scarce clear signal samples in highly confidential industrial control scenarios.

[0019] The features relied upon in this invention all have clear physical layer meanings, making the identification basis clear and traceable, facilitating technicians to quickly locate security weaknesses in communication links and optimize protection strategies. Its multi-model collaborative discrimination mechanism integrates the advantages of different algorithms, improving judgment accuracy while enhancing system fault tolerance, providing flexible and efficient technical support for the practical deployment and iterative optimization of wireless communication security monitoring systems. Attached Figure Description

[0020] The present invention is described in detail with reference to the following figures, which include five figures as follows: Figure 1 This is a schematic diagram illustrating the overall process of the confidentiality identification method of the present invention; Figure 2 This is a detailed logical diagram illustrating the specific execution flow of the method of the present invention; Figure 3 This is a schematic diagram of the feature selection and classification process based on random forest in the method of the present invention; Figure 4 This is a schematic diagram illustrating the training process of the support vector machine classification model in the method of this invention; Figure 5 This is a schematic diagram illustrating the integrated decision-making process of two types of models in the method of this invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0022] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0023] A method for explicit and implicit identification based on signal features and multi-model fusion. Figure 1 A brief overview of the overall process of this method is provided below; the key steps of this method are summarized as follows: S1. Preprocess the collected tagged wireless communication signal training samples. The preprocessing includes synchronization processing, noise suppression processing, and signal parameter normalization processing. S2. Extract time-domain features, frequency-domain features, and mixed-domain features from the preprocessed training samples to form an initial feature set; S3. Based on the initial feature set, use the random forest model to calculate the importance score of each feature, and select an important feature subset according to a preset threshold or preset number. S4. Using the features and labels corresponding to the important feature subsets as input, train the random forest classification model and the support vector machine classification model respectively. S5. Perform the same preprocessing as step S1 and the same feature extraction as step S2 on the wireless communication signal to be identified. Select the corresponding feature values ​​according to the important feature subset determined in step S3, and input them into the random forest classification model and support vector machine classification model trained in step S4. Then, use a soft voting ensemble strategy to fuse the output results of the two models and output the clear / closed identification judgment value.

[0024] This embodiment will provide a preferred description of the specific details of the above method. Figure 2 The specific execution logic of this method is shown and can be viewed simultaneously.

[0025] In step S1 of this embodiment, the signal modulation method of the tagged wireless communication signal training samples preferably includes at least two modulation methods selected from orthogonal frequency division multiplexing, frequency shift keying, and orthogonal phase shift keying; and involves multi-band, large dynamic signal-to-noise ratio signal samples, with a preferred signal-to-noise ratio range of -5dB to 20dB. This tagged wireless communication signal training sample covers signals in both bright and dense states, thereby constructing a tagged measured dataset. , ,in, Represents the original baseband signal. The time is a secret signal. The time is a clear signal. For the actual test dataset The total number of samples in the sample.

[0026] In a preferred embodiment, step S1 includes frame synchronization and carrier synchronization operations; noise suppression uses Wiener filtering or wavelet transform-based threshold denoising; signal parameter normalization includes linear scaling and normalization of the signal amplitude and compensation correction of the carrier frequency offset. In this embodiment, the discrete original baseband signal is denoted as... , This represents the discrete time sequence number, which is used for synchronization and noise reduction. Noise is reduced through synchronization detection and adaptive filtering. Then, parameters such as signal amplitude and frequency offset are normalized to eliminate hardware differences and environmental interference.

[0027] In step S2 of this embodiment, multi-domain features of the signal are extracted, specifically physically meaningful features from the time domain, frequency domain, and mixed domain. First, the original baseband signal... It has the following mixing moments:

[0028]

[0029]

[0030]

[0031]

[0032] These mixing moments will be used in the subsequent extraction and calculation of the mixing domain features, and this implementation will describe their calculation in detail when introducing the mixing domain features; wherein, Represents mathematical expectation, Represents the original baseband signal .

[0033] In this embodiment, the time-domain features preferably include at least one of the following: mean amplitude, root mean square value, variance, skewness, kurtosis, peak-to-peak value, waveform index, peak index, impulse index, and margin index. In the least case, selecting just one feature is sufficient to represent the time-domain features and achieve the basic application effect of the method. The selection of frequency-domain and mixed-domain features follows the same principle. Based on this, this embodiment provides a total of 18 specific features preferably used in actual recognition and their corresponding calculation formulas, as shown in Table 1 below.

[0034] Table 1. Schematic diagram of time-domain characteristics

[0035] In Table 1, Discrete time sequence number The total number.

[0036] In this embodiment, the frequency domain features include at least one of the following: power spectral density, spectral entropy, spectral flatness, centroid frequency, and root mean square value of frequency. The power spectral density is obtained by taking the square of the modulus after performing a fast Fourier transform on the signal. Based on this, this embodiment provides a total of 12 specific features that are preferably used in actual identification and their corresponding calculation formulas, as shown in Table 2 below.

[0037] Table 2. Schematic diagram of frequency domain characteristics

[0038] In Table 2, This refers to the index number of the discrete frequency point. Represents the total number of discrete frequency points; The base of the natural logarithm; Represents the imaginary unit; Represents the cycle frequency; Representing the Energy / intensity at discrete frequency points.

[0039] In this embodiment, the hybrid domain features include at least one of the following features extracted based on the short-time Fourier transform: time-frequency energy distribution features, second-order cumulants, fourth-order cumulants, and sixth-order cumulants; the fourth-order cumulants are obtained through a combination operation of fourth-order moments and second-order moments. Based on the aforementioned original baseband signal... The mixed moment is given in this embodiment. It provides four specific features that are preferably used in actual identification and their corresponding calculation formulas, as shown in Table 3 below.

[0040] Table 3. Schematic diagram of hybrid domain characteristics

[0041] In Table 3, For window functions, Represents the sliding position of the window, with a total length of .

[0042] In step S3 of this embodiment, feature filtering and preliminary classification based on random forest are performed. (See [link to previous document]). Figure 3 This is an illustration. The actual test dataset will be shown here. The dataset is divided into training and validation sets according to a preset ratio, preferably 8:2 or 7:3. After preprocessing the sample data, feature extraction is performed. The features in the initial feature set are classified according to their dimensions, resulting in multi-dimensional features and single-dimensional features. For example, features such as the spectrum and short-time Fourier transform are multi-dimensional features, while the mean amplitude in the time domain and the root mean square amplitude in the time domain are single-dimensional features.

[0043] For the multidimensional features in the initial feature set, principal component analysis is first used for dimensionality reduction, retaining principal components whose cumulative variance contribution rate is not less than a preset percentage. The dimensionality-reduced features are then concatenated with the single-dimensional features in the initial feature set to form a fused feature vector, thus constructing the feature dataset. , , That is, the fused feature sequence. For this feature dataset The total number of samples in the sample.

[0044] In this implementation, based on the random forest model, the reduction in the Gini coefficient of each feature corresponding to the fused feature vector at the split node is calculated as the importance score of each feature. Specifically, the feature dataset is used. Train a random forest classifier, calculate the importance of each feature, and retain features with a cumulative importance of 85% or higher, while also retaining features that account for at least 20% of the total number of features.

[0045] In this implementation, the importance scores are sorted in descending order, and the top 20% of features are selected to form an important feature subset. This top 20% of features will include those with an importance of 85% or higher. If the number of features with an importance of 85% or higher is less than 20% of the total number of features, they are supplemented by sorting them in descending order to make up the number of features. The random forest model is then retrained using the selected features from this important feature subset to obtain the random forest classification model needed for classification.

[0046] In step S4 of this implementation, when training the random forest classification model based on the partitioned training and validation sets, the number of decision trees and the maximum depth are preset in the random forest classification model. For the support vector machine classification model, please refer to... Figure 4The illustration shows that a support vector machine (SVM) classifier is trained based on the first 20% of features, thus obtaining the model. Specifically, the SVM classification model training uses a radial basis function kernel, and the corresponding regularization parameters and kernel coefficients are optimized and determined on the validation set through five-fold cross-validation.

[0047] In this embodiment, after preprocessing and feature extraction, the data in the training set, along with the important feature subset selected based on the random forest model, are fused together to obtain the data used for support vector machine training. .

[0048] Data The data is imported into a support vector machine network for training and validated using a validation set. This implementation constructs a binary classifier based on support vector machines. By employing a radial basis function kernel function, the optimal combination of penalty parameters and kernel function parameters is found through a finite number of iterations in the parameter space, thereby maximizing the performance of the trained random forest classification model.

[0049] Furthermore, the support vector machine classification model used in this embodiment can be further replaced by a one-dimensional convolutional neural network, an autoencoder, or a deep neural network based on an attention mechanism. This embodiment does not impose any restrictions on this, and mature technologies in the field can be used for replacement in practical applications.

[0050] In step S5 of this embodiment, please refer to Figure 5 As illustrated, the processed wireless communication signal to be identified is input into the trained random forest classification model and support vector machine classification model, respectively, yielding the output probabilities of the two models. Therefore, the probability values ​​of the clear signal class output by the random forest classification model are obtained separately. The probability values ​​of the bright signal class output by the support vector machine classification model A soft-voting ensemble strategy is used for these two probabilities, as shown in the following equation:

[0051] In the formula, To determine the probability value; For the corresponding The weight, For the corresponding The weight, and These can be the normalized values ​​of the classification accuracy of the two models on the validation set, or simply let... , and They are all Ultimately, if the probability value is determined... Greater than or equal to the preset judgment threshold If the signal is clear, it is determined to be a plain signal; otherwise, it is determined to be a secret signal, as shown in the following formula:

[0052] In the formula, The result is determined by a value of 1 indicating a signal and 0 indicating a dense signal; a preset threshold is used for the determination. It can be adjusted according to the security policy, and can be used in high-security scenarios. Set it to 0.5 to appropriately increase the recall rate of clear signals.

Claims

1. A method for identifying explicit and implicit signals based on signal features and multi-model fusion, characterized in that, Includes the following steps: S1. Preprocess the collected tagged wireless communication signal training samples, including synchronization processing, noise suppression processing and signal parameter normalization processing. S2. Extract time-domain features, frequency-domain features, and mixed-domain features from the preprocessed training samples to form an initial feature set; S3. Based on the initial feature set, calculate the importance score of each feature using a random forest model, and select an important feature subset according to a preset threshold or a preset number. S4. Using the features and labels corresponding to the important feature subset as input, train the random forest classification model and the support vector machine classification model respectively; S5. Perform the same preprocessing as step S1 and the same feature extraction as step S2 on the wireless communication signal to be identified. Select the corresponding feature values ​​according to the important feature subset determined in step S3, and input them into the random forest classification model and support vector machine classification model trained in step S4. Then, use a soft voting ensemble strategy to fuse the output results of the two models and output the clear / closed identification judgment value.

2. The confidential identification method according to claim 1, characterized in that: In step S1, the signal modulation method of the tagged wireless communication signal training samples includes at least two of the following modulation methods: orthogonal frequency division multiplexing, frequency shift keying, and orthogonal phase shift keying; the signal-to-noise ratio ranges from -5dB to 20dB; in the tag definition, the value 1 corresponds to the clear signal and the value 0 corresponds to the secret signal.

3. The confidential identification method according to claim 1, characterized in that: In step S1, the synchronization processing includes frame synchronization and carrier synchronization operations; the noise suppression processing uses Wiener filtering or a threshold denoising method based on wavelet transform; the signal parameter normalization processing includes linear scaling and normalization of the signal amplitude and compensation and correction of the carrier frequency offset.

4. The confidential identification method according to claim 1, characterized in that: In step S2, the time-domain features include at least one of the following: mean amplitude, root mean square value, variance, skewness, kurtosis, peak-to-peak value, waveform index, peak index, impulse index, and margin index.

5. The confidential identification method according to claim 1, characterized in that: In step S2, the frequency domain features include at least one of the following features: power spectral density, spectral entropy, spectral flatness, centroid frequency, and root mean square frequency value. The power spectral density is obtained by performing a fast Fourier transform on the signal and then taking the square of the modulus.

6. The confidential identification method according to claim 1, characterized in that: In step S2, the hybrid domain features include at least one of the following features: time-frequency energy distribution features extracted based on short-time Fourier transform, second-order cumulant, fourth-order cumulant, and sixth-order cumulant. The fourth-order cumulant is obtained through a combination of fourth-order moments and second-order moments.

7. The confidential identification method according to claim 1, characterized in that: In step S3, for the multidimensional features in the initial feature set, principal component analysis is first used to reduce dimensionality, retaining principal components whose cumulative variance contribution rate is not less than a preset percentage; the dimensionality-reduced features are concatenated with the single-dimensional features in the initial feature set to form a fused feature vector; based on the random forest model, the reduction in Gini coefficient at the split node for each feature corresponding to the fused feature vector is calculated as the importance score of each feature; all features corresponding to the fused feature vector are sorted in descending order according to the importance score, and the features with a quantity ratio of at least 20% and ranked at the top are selected to form the important feature subset.

8. The confidential identification method according to claim 7, characterized in that: In the dimensionality reduction process of the principal component analysis, the time-frequency matrix obtained by the short-time Fourier transform is vectorized according to time frames or frequency points and then input into the dimensionality reduction process; the single-dimensional feature includes any one of the following features: mean amplitude in the time domain, spectral entropy, and fourth-order cumulant.

9. The confidential identification method according to claim 1, characterized in that: In step S4, the preprocessed and feature-extracted training samples are divided into training set and validation set according to a preset ratio, and a random forest classification model and a support vector machine classification model are trained respectively. The number of decision trees and the maximum depth are preset in the random forest classification model. The radial basis kernel function is used in the support vector machine classification model, and the corresponding regularization parameters and kernel coefficients are optimized and determined on the validation set through five-fold cross-validation.

10. The confidential identification method according to claim 1, characterized in that, In step S5, the soft voting ensemble strategy includes: obtaining the probability values ​​of the clear signal class output by the random forest classification model respectively. The probability values ​​of the bright signal class output by the support vector machine classification model By weight and To each and Perform a weighted average calculation, where This represents the normalized classification accuracy of the random forest classification model on the validation set. This is the normalized value of the classification accuracy of the support vector machine classification model on the validation set, or let... If the probability value obtained after weighted average calculation is greater than or equal to the preset threshold, the wireless communication signal to be identified is determined to be a clear signal; otherwise, it is determined to be a secret signal, thereby completing the clear-secret identification.

Images