A dedicated airspace unmanned aerial vehicle management and control system and method based on communication link intervention

Abstract

The application relates to the technical field of wireless communication, in particular to a proprietary airspace unmanned aerial vehicle management and control system and method based on communication link intervention. The method comprises the following steps: capturing an unmanned aerial vehicle radio frequency signal through spectrum sensing, extracting physical layer features such as in-phase quadrature components and entropy values, and constructing a multi-dimensional time sequence vector representing communication state changes; inputting the feature sequence into an LSTM unsupervised protocol syntax inference model, learning inter-frame dependence and state transition, and outputting a dynamic protocol syntax tree; constructing a reinforcement learning action space based on the syntax tree, searching for authentication and encryption verification fragile states by injecting a perturbation probe packet; combining a rolling code to observe and predict subsequent code values and calibrate a timestamp and a check bit, sending a takeover frame in a receiving window period, taking over an original remote control link and establishing a unique control channel; issuing a virtual geographic fence and navigation correction, planning an obstacle avoidance path in combination with a three-dimensional potential field, and guiding the unmanned aerial vehicle to safely land.

Description

Technical Field

[0001] This application relates to the field of wireless communication technology, specifically to a proprietary airspace unmanned aerial vehicle (UAV) management system and method based on communication link intervention. Background Technology

[0002] With the increase in low-altitude airspace activities, the need for safe and controllable management of unauthorized drones within designated airspace is becoming increasingly prominent. In existing technologies, common methods for handling and managing the wireless communication link between drones and their remote controllers include identification based on frequency band monitoring, message parsing based on known protocols, and link intervention based on preset rules.

[0003] In real-world applications, the communication protocols used by target drones are often unknown or dynamically changing. Their frame structure, key field positions, state interaction sequences, and security fields (such as rolling codes, sequence numbers, and timestamps) may exhibit non-static characteristics depending on the communication state. This makes it difficult for existing link-side methods to quickly establish stable and usable protocol understanding and sustainable control capabilities. Especially when rapid on-site handling in the airspace is required, existing technologies typically struggle to simultaneously achieve: real-time capture and parsing of the target link, online modeling of protocol interaction sequences, dynamic positioning of key fields, and establishing repeatable control injection and a stable control channel while maintaining link availability. Consequently, it is difficult to achieve real-time intelligent parsing and stable takeover of unauthorized drone communication links.

[0004] In view of this, this application proposes a proprietary airspace unmanned aerial vehicle (UAV) management system and method based on communication link intervention. Summary of the Invention

[0005] To achieve the above objectives, this application provides a dedicated airspace UAV management system and method based on communication link intervention, the specific technical solution of which is as follows:

[0006] A method for managing unmanned aerial vehicles (UAVs) in dedicated airspace based on communication link intervention, comprising:

[0007] Step 1: Use spectrum sensing equipment to capture the radio frequency communication signal of the target UAV, extract the physical layer features of in-phase orthogonal components and signal entropy values, and construct a multi-dimensional time-series feature vector sequence that characterizes the dynamic changes in communication status;

[0008] Step 2: Input the constructed multi-dimensional temporal feature vector sequence into the protocol syntax inference model based on long short-term memory network. Through unsupervised learning, the temporal dependencies and state transition probabilities between communication frames are mined, and a dynamic protocol syntax tree containing the predicted protocol frame structure and key field positions is output.

[0009] Step 3: Construct the action space of the reinforcement learning agent based on the dynamic protocol syntax tree, and use maintaining the connection and inducing anomalies as rewards to control the agent to generate and inject micro-perturbation probe data packets, and iteratively search the potential abnormal state space of the protocol regarding authentication logic and encryption verification.

[0010] Step 4: Generate takeover control instructions based on the searched abnormal state space, predict subsequent rolling code values ​​based on the captured rolling code observation sequence and dynamically adjust the timestamp and check bit of the instructions, send takeover frames within the receiving window, take over the original UAV remote control link and establish a unique control channel;

[0011] Step 5: Continuously send navigation correction commands containing virtual geofence information through the established control channel, calculate the obstacle avoidance guidance path by combining the three-dimensional environmental potential field model of the dedicated airspace, and drive the UAV to fly smoothly to the preset landing area according to the planned trajectory.

[0012] Preferably, the communication frequency band of the UAV is scanned, and frequency hopping or direct-sequence spread spectrum signals are identified by dynamic energy detection threshold;

[0013] The received signal is converted into a zero-IF complex baseband signal stream, and the in-phase and quadrature components are extracted.

[0014] Demodulate and delimit communication frames, and identify dynamic security fields such as rolling codes, sequence numbers, and timestamps;

[0015] The signal stream is segmented using a sliding time window mechanism. The signal entropy, average signal amplitude, signal amplitude variance, and average phase change rate within the window are calculated and combined to form a multidimensional time-series feature vector sequence.

[0016] Preferably, the protocol syntax inference model adopts a long short-term memory network autoencoder architecture consisting of an encoder and a decoder;

[0017] The encoder compresses the input temporal feature vector sequence into a fixed-dimensional context vector, and the decoder reconstructs the original input sequence from the context vector;

[0018] Unsupervised training is performed by minimizing the reconstruction error between the input sequence and the reconstructed sequence to learn the structure of normal communication sequences;

[0019] The sequence of temporal feature vectors is input into the trained encoder, and the hidden state vector corresponding to each time step is extracted as the contextual representation of the current time in the communication sequence.

[0020] Preferably, a density-based noisy spatial clustering algorithm is used to perform unsupervised clustering of the hidden state vector set, transforming the continuous feature vector sequence into a discrete protocol state sequence;

[0021] The discrete state sequence is modeled as a first-order Markov chain. The occurrence frequency of adjacent state pairs is counted to construct a state transition counting matrix and then normalized to a probability matrix.

[0022] Construct a dynamic protocol syntax tree rooted at the virtual communication start node. The nodes of the tree represent protocol states, the directed edges represent state transitions, and the edge weights are the transition probabilities.

[0023] It infers typical communication frame sequences by traversing high-probability paths and combines state statistical attributes to identify fields.

[0024] Preferably, the action space of the intelligent agent is defined as a triplet of micro-perturbation operations on a standard communication frame, including a target field identifier, an operation type, and operation parameters. The operation types include bit flipping, byte substitution, field replay, and numerical increment / decrement.

[0025] Design a dual-objective composite reward function that includes a reward component for maintaining connectivity and a reward component for inducing anomalies;

[0026] The continuity component is triggered upon receiving a response signal, while the anomalous component is induced based on a measure of the difference between the response signal feature vector and the normal baseline.

[0027] Set penalty items and explore strategies by balancing weight coefficients.

[0028] Preferably, a deep Q-network is used as the agent, and the agent is selected based on the currently observed communication state. - Greedy strategy selects actions;

[0029] The state, action, reward and new state are stored in the experience replay pool. Experience data is periodically extracted to train the network to update the weights and the agent is iteratively updated.

[0030] The experience tuples that cause the response deviation metric to exceed a preset threshold in the experience replay pool are summarized, and the state and action combinations in the experience tuples are identified as potential abnormal state spaces in the protocol regarding authentication logic and encryption verification.

[0031] Preferably, instruction types related to changes in control or emergency operations are selected from the abnormal state space as load templates, and the instruction content is filled in according to the conditions that trigger the abnormality.

[0032] A time series prediction model based on an autoregressive integral moving average model is established. The model is trained offline using the rolling code observation sequence to predict subsequent rolling code values ​​and fill them into the takeover command.

[0033] The reverse-engineered verification algorithm is invoked to calculate the data packet and generate the final check bit, thus constructing the takeover control command.

[0034] Preferably, the remote control interaction cycle is modeled using the timestamp sequence of the captured frames. The timing of injecting the takeover control command is set within the gap between when the UAV has finished processing the previous frame and has not yet received the next remote control frame. When calculating the injection time point, the communication cycle, signal propagation time, and protection interval are taken into account.

[0035] After the drone executes the takeover frame and updates its internal state variables, it takes over the drone's original remote control frame.

[0036] A unique control channel is maintained by continuously sending takeover frames with correctly predicted and incrementing rolling codes and timestamps.

[0037] Preferably, a navigation correction command containing virtual geofence information consisting of three-dimensional waypoints is sent to the UAV, the command encapsulating the target heading, speed and waypoint coordinates;

[0038] A three-dimensional environmental potential field model is introduced to calculate the gravitational potential field generated by the target path point and the repulsive potential field generated by the obstacle, and the negative gradient of the total potential field is transformed into a virtual guiding force.

[0039] A cascaded PID controller is used to convert the virtual guiding force into adjustments to the drone's attitude and throttle.

[0040] When the drone enters the horizontal range of the landing area, it switches to vertical landing mode to suppress horizontal drift and descend at a constant speed until landing is confirmed, at which point the drone's power is shut off.

[0041] A dedicated airspace UAV management and control system based on communication link intervention, used in the aforementioned dedicated airspace UAV management and control method based on communication link intervention, includes: a signal feature construction module, a protocol syntax inference module, an anomaly detection module, a takeover command generation module, and a path-guided landing module;

[0042] The signal feature construction module uses a spectrum sensing device to capture the radio frequency communication signal of the target UAV, extracts the physical layer features of in-phase orthogonal components and signal entropy values, and constructs a multi-dimensional time-series feature vector sequence that characterizes the dynamic changes in the communication state.

[0043] The protocol syntax inference module inputs the constructed multi-dimensional temporal feature vector sequence into the protocol syntax inference model based on a long short-term memory network. Through unsupervised learning, it mines the temporal dependencies and state transition probabilities between communication frames and outputs a dynamic protocol syntax tree containing the predicted protocol frame structure and key field positions.

[0044] The anomaly exploration module constructs the action space of the reinforcement learning agent based on the dynamic protocol syntax tree, and uses maintaining the connection and inducing anomalies as rewards to control the agent to generate and inject micro-perturbation detection data packets, and iteratively searches the potential abnormal state space of the protocol regarding authentication logic and encryption verification.

[0045] The takeover command generation module generates takeover control commands based on the searched abnormal state space, predicts subsequent rolling code values ​​based on the captured rolling code observation sequence and dynamically adjusts the timestamp and check bit of the command, sends a takeover frame within the receiving window, takes over the original UAV remote control link and establishes a unique control channel.

[0046] The path-guided landing module continuously sends navigation correction commands containing virtual geofence information through the established control channel, calculates the obstacle avoidance guidance path in combination with the three-dimensional environmental potential field model of the dedicated airspace, and drives the UAV to fly smoothly to the preset landing area according to the planned trajectory.

[0047] The beneficial effects of this application are as follows: By performing spectrum sensing on the target link and extracting physical layer features such as IQ and entropy values, this application can achieve real-time characterization of communication status and capture of abnormal precursors without relying on plaintext protocols, thereby improving observability, identification sensitivity and early warning capabilities in complex electromagnetic environments.

[0048] This application utilizes LSTM unsupervised learning to mine inter-frame temporal dependencies and state transitions, which can automatically form a model of dynamic frame structure and key field positions, reducing reliance on manual priors and manufacturer data, and enhancing the adaptive parsing and continuous evolution capabilities for different models and versions of the link.

[0049] This application constructs a strategy learning space based on a dynamic model, and conducts online interactive assessments under the constraints of ensuring link stability and minimizing interference. It can systematically locate high-risk states and abnormal triggering conditions, providing quantitative basis for subsequent graded handling, thereby reducing false alarms and business interruptions caused by blind intervention.

[0050] This application implements precise timing control and consistency constraints for handling based on risk status, which can complete the isolation and monitoring access of abnormal control links within the receiving window, reduce handling delays and avoid repeated triggering; at the same time, it improves the reliability of handling and audit availability through traceable instruction integrity verification.

[0051] This application continuously issues virtual fences and navigation corrections under the regulatory control channel, and completes obstacle avoidance path planning in combination with three-dimensional potential field. This can guide drones from sensitive areas to designated landing points, reduce secondary risks to ground personnel and facilities, and improve the stability, controllability and safety of the disposal process.

[0052] The technical solution proposed in this application is aimed at low-altitude security and operation management in private airspace. It is committed to building a closed loop of discovery, identification, assessment, handling, and guidance, so as to have continuous monitoring and model self-adaptation capabilities even under unknown or encrypted link conditions; to achieve graded intervention and traceable audit under the premise of quantifiable risks; and to implement the handling results to safe landing and area recovery through virtual fences and path guidance. It is applicable to compliance supervision in scenarios such as parks, airports, energy facilities, and major events. Attached Figure Description

[0053] Figure 1 A flowchart of a proprietary airspace unmanned aerial vehicle (UAV) management method based on communication link intervention provided for this application;

[0054] Figure 2 The technical solution provided in this application is illustrated in a real-world scenario.

[0055] Figure 3 A schematic diagram of the takeover frame generation and precise timing injection process provided in this application;

[0056] Figure 4 A schematic diagram of three-dimensional potential field obstacle avoidance and non-destructive landing provided for this application;

[0057] Figure 5 This application provides a structural diagram of a proprietary airspace unmanned aerial vehicle (UAV) management system based on communication link intervention. Detailed Implementation

[0058] To make the above-mentioned objectives, features and advantages of this application more readily understood, the specific embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0059] Many specific details are set forth in the following description in order to provide a full understanding of this application. However, this application may also be implemented in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0060] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of this application. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0061] Example 1

[0062] Reference Figures 1 to 5 This is the first embodiment of the present application, such as Figure 1 As shown, a method for managing unmanned aerial vehicles (UAVs) in dedicated airspace based on communication link intervention is provided. Figure 2This is a diagram illustrating a real-world scenario of the technical solution presented in this application.

[0063] Step 1: Use spectrum sensing equipment to capture the radio frequency communication signal of the target UAV, extract the physical layer features of in-phase orthogonal components and signal entropy values, and construct a multi-dimensional time-series feature vector sequence that characterizes the dynamic changes in communication status.

[0064] Specifically, a proprietary high-sensitivity spectrum sensing device is deployed, consisting of a wideband omnidirectional antenna, a low-noise amplifier (LNA), a software-defined radio (SDR) platform, and a high-performance signal processing unit. This device performs continuous broadband spectrum scanning and monitoring of the 2.4 GHz and 5.8 GHz ISM (Industrial, Scientific, and Medical) bands commonly used by UAVs. During the scanning process, the signal processing unit calculates the power spectral density of the received signal in real time. By setting a dynamic energy detection threshold, it quickly identifies signals with abnormal energy spikes in the spectral background noise and exhibiting typical UAV communication characteristics such as frequency hopping (FHSS) or direct-sequence spread spectrum (DSSS). Once the target signal is locked, the SDR platform immediately adjusts its center frequency and receiving bandwidth to completely cover the occupied bandwidth of the target signal, ensuring complete signal acquisition. This process, through the coordinated operation of the high-gain antenna and the low-noise amplifier, significantly improves the signal-to-noise ratio (SNR), providing the raw data foundation for subsequent high-fidelity signal analysis, thereby ensuring stable acquisition of weak UAV remote control signals even in complex electromagnetic environments.

[0065] After locking onto and digitally acquiring the target RF signal, the physical layer features of the target RF signal are extracted. The SDR platform transforms the received intermediate frequency (IF) digital signal into a zero-IF complex baseband signal stream using digital quadrature downconversion technology. The complex baseband signal stream consists of two real number sequences: an in-phase component (I) and a quadrature component (Q). Its mathematical expression at discrete time point n is as follows: ;in, This represents the complex sample value at sampling time n. For in-phase components, For orthogonal components, The I / Q component is the imaginary unit. It completely preserves the amplitude and phase information of the original RF signal, making it fundamental for refined signal analysis. By extracting the I / Q data, this scheme can analyze signal characteristics from the lowest physical level without complex demodulation or decoding, offering universal applicability across protocol types.

[0066] While extracting I / Q data, perform preliminary demodulation and frame delimitation on the captured communication frames to identify and record the dynamic security fields therein. Specifically, the signal processing unit executes corresponding soft demodulation algorithms according to the modulation mode of the target signal (such as FSK, GFSK or OFDM), and restores the I / Q complex baseband data to a bit stream. Subsequently, perform frame boundary detection on the bit stream based on the identified synchronization preamble pattern, and segment out independent communication frames. For each successfully segmented communication frame, locate the positions of the fields with increasing or pseudo-random change rules through statistical analysis. These fields usually correspond to dynamic security mechanisms such as rolling codes, serial numbers or timestamps. Extract and store the values of these fields in the order of capture time to form a rolling code observation sequence , denotes the rolling code captured at the th capture. The rolling code observation sequence records the historical evolution law of the dynamic security fields during the communication process of the drone itself, providing key raw data for the training of the rolling code prediction model in subsequent steps. In addition, while recording the rolling code value, synchronously record the accurate capture timestamp of each frame , denotes the timestamp of the

[0067] th capture of the rolling code, which is used to analyze the communication cycle and support subsequent precise timing injection. . Subsequently, perform quantization processing on the W amplitude values within the window, map them into M preset discrete level intervals, and count the occurrence frequencies of the samples in each interval to obtain the probability estimates of each interval. Based on this probability distribution, calculate the Shannon entropy of the signal within the current window: ; where represents the signal entropy value within the current time window; is the total number of quantization levels of the signal amplitude quantization; denotes the th quantization interval; is the normalized probability that the signal amplitude value falls into the th quantization interval.

[0068] Exemplarily, in a window with a length of W = 2048 samples, if the amplitude range is divided into M = 256 levels, when the signal is encrypted data payload, its amplitude distribution is close to uniform, and each When the values ​​are similar, the calculated entropy value H is relatively high; conversely, if the signal is a fixed-pattern synchronization preamble or idle padding sequence, its amplitude distribution will be concentrated in a few specific intervals, resulting in a significantly lower entropy value H. Introducing the characteristic of signal entropy allows this scheme to quantitatively describe the inherent structural complexity and information content of the signal, providing a strong basis for distinguishing different stages of communication protocols (such as handshake, control, and data transmission).

[0069] The extracted physical layer features are integrated to construct a multi-dimensional temporal feature vector sequence that can characterize the dynamic changes in communication state. Within each sliding time window (corresponding to a time step t), features from multiple dimensions are calculated and combined to form a feature vector. The feature vector Specifically, this includes: the average signal amplitude within the window. Signal amplitude variance Average phase change rate and signal entropy Therefore, the eigenvector can be represented as As the sliding window moves across the entire I / Q data stream, a complete sequence of temporal feature vectors is generated. ,in The sequence is the total length. This sequence transforms the original high-dimensional unstructured RF sampling data into low-dimensional structured time-series data of physical layer dynamic information. This transformation not only significantly reduces the computational complexity of subsequent processing, but also directly maps the physical fluctuations of the signal into mathematical language that can be understood by machine learning models, accurately depicting the dynamic behavior patterns of the UAV communication link under different working modes (such as link establishment, heartbeat maintenance, command transmission, data backhaul, etc.).

[0070] This step utilizes non-intrusive remote spectrum sensing to blindly capture the communication signals of the target UAV without any prior knowledge of its communication protocol, and extracts features that comprehensively characterize its physical layer dynamic behavior. The resulting normalized multidimensional temporal feature vector sequence provides high-information-density input data for the unsupervised learning model used in subsequent steps to infer protocol syntax, greatly improving the accuracy and efficiency of subsequent protocol reverse analysis.

[0071] Step 2: Input the constructed multidimensional temporal feature vector sequence into the protocol syntax inference model based on a long short-term memory network. Unsupervised learning is used to mine the temporal dependencies and state transition probabilities between communication frames, outputting a dynamic protocol syntax tree containing the predicted protocol frame structure and key field positions. This step aims to perform in-depth analysis on the multidimensional temporal feature vector sequence generated in Step 1, automatically mining the inherent syntax rules and state logic of the proprietary protocol through unsupervised learning.

[0072] A protocol syntax inference model based on Long Short-Term Memory (LSTM) networks is constructed. The core reason for choosing LSTM networks lies in their unique gating mechanism (input gate, forget gate, output gate), which can effectively learn and remember long-term dependencies in time series data. This aligns perfectly with the strong temporal logic features of communication protocols, such as frame structures and field sequences. The protocol syntax inference model employs an unsupervised autoencoder architecture, specifically an LSTM network pair consisting of an encoder and a decoder. The encoder is responsible for processing a sequence of temporal feature vectors as input. Compressed into a fixed-dimensional context vector The decoder then uses this context vector. The original input sequence is reconstructed from the original input sequence. The training objective of the protocol syntax inference model is to minimize the reconstruction error, i.e., the difference between the input sequence and the reconstructed sequence. In this way, the protocol syntax inference model can learn the inherent structure and dynamic patterns of normal communication sequences without relying on any manual annotation.

[0073] After the protocol syntax inference model is trained, its learned capabilities are used to divide the protocol states. This involves generating a complete sequence of temporal feature vectors. The data is input segment by segment into the trained LSTM encoder, and the hidden state vector corresponding to each time step t is extracted. The hidden state vector Is the network processing... At that time, it is a highly condensed representation of all past information, which is more efficient than the original feature vector. This better reflects the context of the current moment within the entire communication sequence. Subsequently, the density-based noisy spatial clustering (DBSCAN) algorithm is used to process all hidden state vectors. The DBSCAN algorithm performs unsupervised clustering on the set of data. It does not require pre-specifying the number of clusters and can automatically discover clusters of arbitrary shapes, identifying vectors in sparse regions as noise. This makes it well-suited for identifying various states of unknown type and duration in protocols (such as synchronization preambles, frame headers, control payloads, data payloads, cyclic redundancy check (CRC), etc.). After clustering, the feature vectors at each time step t are... They were all assigned a cluster label This represents the protocol state to which it belongs. This process transforms a continuous sequence of feature vectors into a discrete sequence of protocol states. This effectively achieves the symbolic abstraction of communication behavior.

[0074] Based on the generated protocol state sequence, the temporal dependencies and state transition probabilities between communication frames are further explored. This discrete state sequence is modeled as a first-order Markov chain, where each cluster represents a state. A state transition counting matrix is ​​constructed by counting the occurrences of all adjacent state pairs in the sequence. Elements in the matrix Indicates the protocol status Then transition to the protocol state The number of observations is calculated. The counting matrix is ​​then normalized row-wise to obtain the state transition probability matrix. Its elements The calculation formula is: ;in, Indicates from protocol state Transition to protocol state The conditional probability; From the protocol state To the protocol state The frequency of direct transfer observations; It is the total number of protocol states obtained after DBSCAN clustering; the denominator is the total number of protocol states obtained after DBSCAN clustering. This is from the protocol state The total frequency of all transitions from state 3 to state 5. For example, if an analysis yields a state sequence where state 3 (representing the frame header) appears 100 times, followed by state 5 (representing the control payload) 95 times, state 6 (representing the data payload) 2 times, and other states 3 times, then the transition probability from state 3 to state 5 is... That is This probability matrix precisely quantifies the protocol's internal syntax logic, and the high-probability transition paths reveal the typical structure of the protocol frames.

[0075] By integrating the analysis results, a dynamic protocol syntax tree is constructed, containing the predicted protocol frame structure and the positions of key fields. This tree structure is rooted at a virtual communication start node. Each level of the tree represents a different protocol state identified through clustering (e.g., ...). Synchronization code, Frame type : load, (Checksum, etc.). Directed edges between nodes represent state transitions, and the weight of the edge is the calculated state transition probability. By traversing the most probable path in this tree, a typical communication frame sequence can be inferred. For example, a high-probability path Root->C1->C2->C3->C4 corresponds to a complete protocol frame structure. Furthermore, each state node is accompanied by its statistical properties, including the average duration of that state (i.e., the number of steps to continuously maintain the same cluster label), which can be used to estimate the length of the corresponding protocol field; and the original feature vector of that state (especially the signal entropy). The statistical distribution of the data helps identify the function of the fields (e.g., high entropy corresponds to encrypted data, and low entropy corresponds to a fixed-pattern synchronization code or identifier). The final output dynamic protocol syntax tree is a structured and visualized reverse engineering result of the target UAV's proprietary communication protocol.

[0076] This step utilizes unsupervised deep learning and clustering analysis techniques to automate the parsing of unknown communication protocols. This method requires no protocol specification documents; starting solely from physical layer features, it successfully infers the protocol's state structure, frame format, field boundaries, and the functional attributes of key fields, presenting them in a structured form as a dynamic protocol syntax tree. This provides a crucial map and grammar book for subsequent precise and intelligent intervention and utilization at the protocol level, representing a key step in the leap from perception to cognition.

[0077] Step 3: Construct the action space of the reinforcement learning agent based on the dynamic protocol syntax tree. Using maintaining connectivity and inducing anomalies as rewards, control the agent to generate and inject micro-perturbation probe data packets, iteratively searching the potential anomalous state space related to authentication logic and encryption verification within the protocol. This step aims to build an intelligent detection framework based on the dynamic protocol syntax tree deduced in Step 2, and to iteratively search for potential anomalies related to authentication logic and encryption verification within the target UAV communication protocol through proactive interaction.

[0078] A deep reinforcement learning (DRL) model is introduced, specifically using a deep Q network (DQN) as the core agent. This agent treats UAV communication as an environment and learns the optimal detection strategy by performing actions (injecting probe data packets) and observing environmental feedback (UAV response signals).

[0079] Specifically, the action space of the reinforcement learning agent is accurately constructed based on a dynamic protocol syntax tree. The protocol syntax tree clearly reveals the structure of the communication frame, including each field (corresponding to nodes in the tree) and their possible lengths and functions. Each atomic action 'a' of the agent is defined as a micro-perturbation operation on a standard communication frame. Specifically, an action 'a' is a triple. ,in, It is the target field identifier, which is directly mapped to a node in the syntax tree, such as the frame header field, sequence number field, or payload field; It refers to the manipulation type, including preset perturbation methods such as bit flipping, byte replacement, field replay, and value increment / decrement; These are manipulation parameters used to specify specific perturbation details, such as the bit indices to be flipped and the byte values ​​to be replaced. In this way, the fuzzy protocol fuzzing problem is transformed into a structured, discretized action space. This makes the agent's exploration no longer blind, but focused on syntactically valid but semantically potentially anomalous boundary cases, greatly improving detection efficiency.

[0080] To guide the agent to learn toward the goal of detecting anomalies, this scheme designs a dual-objective composite reward function. This function is calculated at each interaction time step t, aiming to balance the seemingly contradictory goals of maintaining the communication link and inducing abnormal responses. Its mathematical expression is: ;in, It is an indicator function. Its value is 1 when the agent receives a response signal from the drone within the expected time after injecting a disturbance packet, and 0 otherwise. It is used to reward the behavior of maintaining the connection. It is a response deviation metric used to quantify the degree of anomaly in a UAV's response. It is calculated by comparing the difference between the characteristic vector of the response signal (such as signal entropy, constellation diagram dispersion, etc.) and the statistical baseline of similar response signal characteristics during normal communication. For example, it calculates the KL divergence between the two; the greater the difference, the higher the probability of anomalies. The higher the value; It is a large penalty that is triggered only when the communication link is completely interrupted (no signal is received for several consecutive time steps) to prevent the agent from taking overly aggressive and destructive actions; and It is a weighting coefficient used to adjust the relative importance of the two reward components, ensuring that the agent actively explores actions that can trigger the largest abnormal response without interrupting communication.

[0081] For example, if an agent performs a small increment operation on the timestamp field in an authentication request frame, and the drone returns a response frame containing a new error code (which never appears in normal communication), then... The value is 1, and because the signal characteristics of the erroneous code frames (such as entropy values ​​that may be significantly different) deviate from the baseline, By obtaining a high score, the agent receives a high positive reward.

[0082] The learning and exploration process of an agent is an iterative loop. At each time step, the DQN model learns based on the currently observed communication state. (Composed of the characteristics of recently received drone signals), using The -greedy strategy selects an action. Execution. After executing the action, the agent captures the drone's response, forming a new state. The reward is calculated based on the reward function described above. This empirical tuple The data is stored in an experience replay pool. The DQN network periodically draws a batch of random experience data from the pool for training, updating its internal neural network weights by minimizing temporal difference errors, thereby continuously optimizing its estimation of the "state-action" value (Q-value). Continuing this process, the agent gradually shifts from random exploration to precise detection using learned knowledge, and its behavior converges to action sequences that consistently yield high rewards. Ultimately, all data in the experience replay pool that leads to reward values ​​(especially response bias metrics) are processed. Experience tuples exceeding a preset threshold To summarize, R represents the reward. For the next state, the state in the empirical tuple With action The combination of these elements constitutes the potential anomalous state space for authentication logic and encryption verification within the protocol. This space details what specific data packet tampering (e.g., flipping the parity bit of the sequence number) can induce exploitable anomalous responses from the drone under what communication state (e.g., immediately after a handshake or when continuously sending heartbeat packets).

[0083] This step establishes an automated protocol anomaly detection process. By combining reinforcement learning with protocol structures obtained through reverse engineering, it simulates the detection approach of security experts, conducting purposeful and strategic interactive testing instead of traditional blind fuzzy testing. This not only significantly improves the efficiency and success rate of discovering deep-seated, state-dependent vulnerabilities (such as authentication bypass), but also ensures the stealth of the detection process and the stability of the link through a carefully designed reward function, avoiding target disconnection due to overly aggressive testing behavior. The resulting anomaly state space provides a direct and reliable decision-making basis for subsequent precise and efficient takeover control.

[0084] Step 4: Generate takeover control commands based on the discovered anomalous state space. Predict subsequent rolling code values ​​based on the captured rolling code observation sequence and dynamically adjust the timestamp and checksum of the commands. Precisely send takeover frames within the receiving window to take over the original UAV remote control link and establish a unique control channel. The purpose of this step is to utilize the anomalous state space discovered in Step 3 to construct and send one or more frames of takeover control commands with the highest takeover authority. This interrupts the communication link between the target UAV and the original remote controller within a precise time window and establishes a channel dominated and uniquely controlled by the regulatory authority. See also... Figure 3 This is a schematic diagram of the takeover frame generation and precise timing injection process provided in this step.

[0085] Specifically, takeover control commands are generated based on an anomaly state space. This space records a series of (state, action) pairs that can cause usable anomalies in the UAV communication protocol stack. This scheme selects command types related to changes in control, mode switching, or emergency operations, such as "frequency binding," "control handover," and "emergency landing," as payload templates for the takeover commands. Command generation is not blind filling; rather, it precisely reproduces the specific conditions that trigger anomalies. For example, if the anomaly lies in an improper response to a specific error sequence number during authentication, the takeover command will precisely fill that error sequence number into the corresponding field. In this way, the generated commands naturally have a high success rate because they directly exploit verified protocol implementation flaws. This process ensures the determinism and specificity of the takeover behavior, avoiding inefficient brute-force attacks.

[0086] To ensure that takeover commands can pass the timing and encryption verification of the UAV receiver, dynamic fields in the commands are predicted and filled in real time. The key lies in predicting the rolling code or sequence number. This solution establishes a time-series prediction model based on the Autoregressive Integrated Moving Average (ARIMA) model. The ARIMA model utilizes the rolling code observation sequence captured and recorded in step 1. Offline training is performed. When preparing for takeover instructions, the ARIMA model is used to predict the next or several scroll codes. The prediction function can be expressed as: ;in, It is the predicted rolling code value; It is a pre-trained ARIMA model function; These are the L most recently observed historical rolling code sequences; and These represent the autoregressive and moving average parameters of the model, respectively. Simultaneously, the timestamp field in the command will be precisely filled based on the current system time or via a synchronized GPS clock to ensure its validity. After all static and dynamic fields are filled, this scheme will call the verification algorithm (such as CRC-32 or a custom checksum algorithm) derived from the reverse analysis in step 2 to calculate the final checksum for the entire data packet or a specified portion. This precise prediction and synchronization of dynamic fields makes the takeover frame indistinguishable from the original remote control command of the drone at the protocol level, thus seamlessly passing the syntax and security verification of the drone communication protocol.

[0087] Furthermore, the precise timing of the takeover frame injection aims to ensure that the takeover frame sent by the supervisor arrives at the drone before the remote control frame within an extremely narrow time window. To achieve this, the frame capture timestamp sequence recorded in step 1 is utilized. By calculating the difference in timestamps between adjacent frames and performing statistical analysis, the interaction cycle between the remote controller and the drone can be accurately modeled. The best time to inject This period is defined as the interval between when the drone has just finished processing the previous frame, opened the receiver window, but has not yet received the next remote control frame. The calculation formula is: In this formula, It is the timestamp of the last observed remote control frame transmission; It is a fixed period of communication; It is the propagation time required for the regulatory signal to reach the drone, which can be accurately calculated based on the ranging results; This is a tiny protection interval designed to handle clock drift and network jitter, ensuring the injection point occurs before the arrival of the remote control frame. For example, if the observed packet transmission period of the remote control is 20 milliseconds, the regulator's signal propagation delay is 0.1 milliseconds, and a 0.2 millisecond protection interval is set, the regulator will inject the signal after observing the previous remote control frame. Transmit takeover frames with precise timing, down to the millisecond.

[0088] Once the drone successfully receives and executes the supervisor's takeover frame, its internal communication synchronization state variables (such as the expected next rolling code) are updated according to the content of the supervisor's takeover frame. This directly causes subsequent remote control frames to be judged invalid by the drone due to outdated rolling codes or sequence numbers, and thus discarded. At this point, the original remote control link is effectively taken over. To maintain this control state, this scheme immediately begins communication at the same frequency. The system continuously sends subsequent takeover frames (which can be "heartbeats" to maintain the current state or new control commands), each frame carrying a correctly predicted and incrementing rolling code and timestamp. This process establishes a single control channel that is completely controlled by the regulator, and the original remote controller will lose control of the drone without strong intervention operations such as re-pairing the frequency.

[0089] This step addresses the technical leap from vulnerability discovery to stable control. By combining anomaly knowledge, dynamic field prediction, and precise timed injection techniques, it enables surgical-like precise takeover of target drones in complex proprietary protocol environments with extremely high success rates and strong stealth. It not only takes over the control of existing non-compliant operators but also establishes a stable and reliable one-way channel, providing essential technical prerequisites and communication guarantees for subsequent non-destructive actions (such as guided landing).

[0090] Step 5: Continuously send navigation correction commands containing virtual geofence information through the established control channel. Combined with the 3D environmental potential field model of the dedicated airspace, calculate the obstacle avoidance guidance path and drive the UAV to fly smoothly to the preset landing area along the planned trajectory. The purpose of this step is to utilize the unique control channel established in Step 4 to guide the target UAV safely to avoid obstacles in complex dedicated airspace by continuously sending precise navigation correction commands, and finally land smoothly in the preset area, achieving non-destructive disposal of the target. See also Figure 4 This is a schematic diagram of three-dimensional potential field obstacle avoidance and damage-free landing provided for this step.

[0091] Specifically, navigation correction commands containing virtual geofence information are injected into the drone via the control channel. This virtual geofence is not a simple no-fly zone, but rather a series of dynamically generated three-dimensional waypoints. The safe flight corridor formed, its final waypoint This refers to the center coordinates of the preset forced landing area. Instead of directly sending the raw analog signals from the remote controller joystick, the commands are generated as high-level navigation instructions encapsulating the target's heading, speed, or coordinates of the next waypoint. This approach better utilizes the drone's built-in flight control and attitude stabilization systems. The regulator only needs to handle macro-level trajectory planning and corrections, while the drone itself handles the underlying attitude calculations and power distribution. Through this continuous injection of high-level commands, the regulator completely takes control of the drone's navigation, ensuring its flight intentions are perfectly aligned with the regulator's strategy. This lays the foundation for subsequent refined trajectory control, transforming the drone from an uncontrolled target into a predictable and guideable execution unit.

[0092] Furthermore, to ensure the flight safety of the UAV as it flies to the target area, a three-dimensional environmental potential field model of the dedicated airspace is introduced for real-time obstacle avoidance guidance path calculation. The three-dimensional environmental potential field model abstracts the motion of the UAV in space as particle motion within a composite potential field. The total potential field... by gravitational potential field and repulsive potential field Composed of multiple layers: ;in, This is the current three-dimensional spatial position vector of the drone. The gravitational potential field is generated by the target path point, and its purpose is to guide the drone to the target position. Its mathematical expression is: ,, It is the Euclidean norm, in which, It is the current target path point (e.g.) The position vector of ) This is a positive constant representing the gravitational potential field gain coefficient. The repulsive potential field is generated by obstacles (such as buildings, towers, other aircraft, etc.) within the designated airspace, with the aim of relocating the drone out of the danger zone. For each obstacle... The repulsive potential field it generates It can be defined as:

[0093] ;

[0094] obstacle The condition for its existence is the distance between the drone and the obstacle. Smaller than the preset radius of influence Otherwise, the resulting repulsive potential field will be zero; This is the repulsive potential field gain coefficient, the magnitude of which is related to the hazard level of the obstacle. Total repulsive potential field. It is the sum of the repulsive potential fields generated by all obstacles; the drone is at any position The virtual guiding force received This is the negative gradient of the total potential field: , This represents the gradient operator, the guiding force vector. It directly points to the optimal direction of travel from the current position, comprehensively balancing the gravitational pull towards the target and the repulsive force to avoid obstacles. This path planning method based on the potential field method is computationally efficient, can respond to environmental changes in real time, and generate smooth and collision-free flight trajectories.

[0095] Calculate the virtual guiding force Transformed into navigation correction commands executable by the drone. The direction of the velocity vector defines the desired velocity direction of the UAV, and its magnitude is proportional to the desired acceleration. A cascaded PID controller is used, taking the error between the desired velocity vector and the actual velocity vector fed back by the UAV's own sensors (such as GPS and IMU) as input, and outputting adjustments to the UAV's pitch, roll, yaw attitude, and throttle. For example, if... Pointing the drone slightly to the upper right, the controller generates a compound command to increase throttle, roll to the right, and pitch upward. These adjustments are encoded into navigation correction commands conforming to the protocol format and sent to the drone via the established control channel.

[0096] When the drone enters the preset landing area on the horizontal plane Within a very small radius (e.g., 5 meters), the system switches to vertical landing mode. In vertical landing mode, navigation correction commands are primarily used to suppress the drone's horizontal drift, keeping it hovering directly above the landing point. Simultaneously, commands to descend are continuously sent at a constant, low vertical speed (e.g., -0.5 m / s). This process continues until onboard sensors (such as a barometric altimeter, ultrasonic altitude hold module, or landing gear ground contact sensor) indicate that the drone has made contact with the ground. Once landing is confirmed, the drone's power is shut off to prevent accidental bounce or rollover. This series of sophisticated end-stage guidance and landing procedures ensures smooth and controllable final stages of the entire drone handling process, enabling safe takeover and guided landing of drones that have entered exclusive airspace without authorization.

[0097] This step provides a complete landing plan for successfully taken-over drones. By combining virtual geofencing, 3D potential field obstacle avoidance, and closed-loop flight control technologies, it not only guides the drone to fly autonomously in complex environments but also ensures that it lands at the designated location in the safest and smoothest manner. This not only avoids the risks of crashes, secondary disasters on the ground, and property damage that might result from forced disposal but also maintains the structural integrity of the drone, facilitating subsequent status analysis and data traceability, demonstrating a high degree of technical controllability and safety.

[0098] Example 2

[0099] Reference Figure 5 This is the second embodiment of the present application, which provides a proprietary airspace unmanned aerial vehicle (UAV) management system based on communication link intervention.

[0100] The system includes: a signal feature construction module, a protocol syntax inference module, an anomaly detection module, a takeover instruction generation module, and a path-guided landing module.

[0101] The signal feature construction module uses a spectrum sensing device to capture the radio frequency communication signal of the target UAV, extracts the physical layer features of in-phase orthogonal components and signal entropy values, and constructs a multi-dimensional time-series feature vector sequence that characterizes the dynamic changes in the communication state.

[0102] The protocol syntax inference module inputs the constructed multi-dimensional temporal feature vector sequence into the protocol syntax inference model based on a long short-term memory network. Through unsupervised learning, it mines the temporal dependencies and state transition probabilities between communication frames and outputs a dynamic protocol syntax tree containing the predicted protocol frame structure and key field positions.

[0103] The anomaly exploration module constructs the action space of the reinforcement learning agent based on a dynamic protocol syntax tree. It uses maintaining the connection and inducing anomalies as rewards to control the agent to generate and inject micro-perturbation probe data packets and iteratively search the potential anomaly state space in the protocol regarding authentication logic and encryption verification.

[0104] The takeover command generation module generates takeover control commands based on the searched abnormal state space, predicts subsequent rolling code values ​​based on the captured rolling code observation sequence, and dynamically adjusts the timestamp and check bit of the command. It accurately sends takeover frames within the receiving window period, takes over the original UAV remote control link, and establishes a unique control channel.

[0105] The path-guided landing module continuously sends navigation correction commands containing virtual geofence information through the established control channel, calculates the obstacle avoidance guidance path in combination with the three-dimensional environmental potential field model of the dedicated airspace, and drives the UAV to fly smoothly to the preset landing area according to the planned trajectory.

[0106] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0107] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments under the guidance of this application without departing from the spirit and scope of protection of the claims. All of these variations are within the protection scope of this application.

Claims

1. A method for managing unmanned aerial vehicles (UAVs) in dedicated airspace based on communication link intervention, characterized in that, include: Step 1: Use spectrum sensing equipment to capture the radio frequency communication signal of the target UAV, extract the physical layer features of in-phase orthogonal components and signal entropy values, and construct a multi-dimensional time-series feature vector sequence that characterizes the dynamic changes in communication status; Step 2: Input the constructed multi-dimensional temporal feature vector sequence into the protocol syntax inference model based on long short-term memory network. Through unsupervised learning, the temporal dependencies and state transition probabilities between communication frames are mined, and a dynamic protocol syntax tree containing the predicted protocol frame structure and key field positions is output. Step 3: Construct the action space of the reinforcement learning agent based on the dynamic protocol syntax tree, and use maintaining the connection and inducing anomalies as rewards to control the agent to generate and inject micro-perturbation probe data packets, and iteratively search the potential abnormal state space of the protocol regarding authentication logic and encryption verification. Step 4: Generate takeover control instructions based on the searched abnormal state space, predict subsequent rolling code values ​​based on the captured rolling code observation sequence and dynamically adjust the timestamp and check bit of the instructions, send takeover frames within the receiving window, take over the original UAV remote control link and establish a unique control channel; Step 5: Continuously send navigation correction commands containing virtual geofence information through the established control channel, calculate the obstacle avoidance guidance path by combining the three-dimensional environmental potential field model of the dedicated airspace, and drive the UAV to fly smoothly to the preset landing area according to the planned trajectory.

2. The method for managing and controlling unmanned aerial vehicles in dedicated airspace based on communication link intervention according to claim 1, characterized in that, Scan the communication frequency bands of UAVs and identify frequency hopping or direct-sequence spread spectrum signals through dynamic energy detection thresholds; The received signal is converted into a zero-IF complex baseband signal stream, and the in-phase and quadrature components are extracted. Demodulate and delimit communication frames, and identify dynamic security fields such as rolling codes, sequence numbers, and timestamps; The signal stream is segmented using a sliding time window mechanism. The signal entropy, average signal amplitude, signal amplitude variance, and average phase change rate within the window are calculated and combined to form a multidimensional time-series feature vector sequence.

3. The method for managing and controlling unmanned aerial vehicles in dedicated airspace based on communication link intervention according to claim 2, characterized in that, The protocol syntax inference model adopts a long short-term memory network autoencoder architecture consisting of an encoder and a decoder. The encoder compresses the input temporal feature vector sequence into a fixed-dimensional context vector, and the decoder reconstructs the original input sequence from the context vector; Unsupervised training is performed by minimizing the reconstruction error between the input sequence and the reconstructed sequence to learn the structure of normal communication sequences; The sequence of temporal feature vectors is input into the trained encoder, and the hidden state vector corresponding to each time step is extracted as the contextual representation of the current time in the communication sequence.

4. The method for managing and controlling unmanned aerial vehicles in dedicated airspace based on communication link intervention according to claim 3, characterized in that, A density-based noisy spatial clustering algorithm is used to perform unsupervised clustering of the hidden state vector set, transforming the continuous feature vector sequence into a discrete protocol state sequence; The discrete state sequence is modeled as a first-order Markov chain. The occurrence frequency of adjacent state pairs is counted to construct a state transition counting matrix and then normalized to a probability matrix. Construct a dynamic protocol syntax tree rooted at the virtual communication start node. The nodes of the tree represent protocol states, and the directed edges represent state transitions. The edge weights are the transition probabilities. It infers typical communication frame sequences by traversing high-probability paths and combines state statistical attributes to identify fields.

5. The method for managing and controlling unmanned aerial vehicles in dedicated airspace based on communication link intervention according to claim 4, characterized in that, The action space of an agent is defined as a triplet of perturbation operations on a standard communication frame, including the target field identifier, manipulation type, and manipulation parameters. Manipulation types include bit flipping, byte substitution, field replay, and numerical increment / decrement. Design a dual-objective composite reward function that includes a reward component for maintaining connectivity and a reward component for inducing anomalies; The continuity component is triggered upon receiving a response signal, while the anomalous component is induced based on a measure of the difference between the response signal feature vector and the normal baseline. Set penalty items and explore strategies by balancing weight coefficients.

6. The method for managing and controlling unmanned aerial vehicles in dedicated airspace based on communication link intervention according to claim 5, characterized in that, A deep Q-network is used as the agent, and the agent is selected based on the currently observed communication state. - Greedy strategy selects actions; The state, action, reward and new state are stored in the experience replay pool. Experience data is periodically extracted to train the network to update the weights and the agent is iteratively updated. The experience tuples that cause the response deviation metric to exceed a preset threshold in the experience replay pool are summarized, and the state and action combinations in the experience tuples are identified as potential abnormal state spaces in the protocol regarding authentication logic and encryption verification.

7. The method for managing and controlling unmanned aerial vehicles in dedicated airspace based on communication link intervention according to claim 6, characterized in that, The instruction types related to changes in control or emergency operations are selected from the abnormal state space as payload templates, and the instruction content is filled in according to the conditions that trigger the abnormality. A time series prediction model based on an autoregressive integral moving average model is established. The model is trained offline using the rolling code observation sequence to predict subsequent rolling code values ​​and fill them into the takeover command. The reverse-engineered verification algorithm is invoked to calculate the data packet and generate the final check bit, thus constructing the takeover control command.

8. The method for managing and controlling unmanned aerial vehicles in dedicated airspace based on communication link intervention according to claim 7, characterized in that, The remote control interaction cycle is modeled using the timestamp sequence of the captured frames. The timing of injecting the takeover control command is set within the gap between when the UAV has finished processing the previous frame and has not yet received the next remote control frame. The communication cycle, signal propagation time and protection interval are considered when calculating the injection time. After the drone executes the takeover frame and updates its internal state variables, it takes over the drone's original remote control frame. A unique control channel is maintained by continuously sending takeover frames with correctly predicted and incrementing rolling codes and timestamps.

9. A method for managing and controlling unmanned aerial vehicles in dedicated airspace based on communication link intervention according to claim 8, characterized in that, Send navigation correction instructions to the drone containing virtual geofence information consisting of three-dimensional waypoints. The instructions encapsulate the target heading, speed, and waypoint coordinates. A three-dimensional environmental potential field model is introduced to calculate the gravitational potential field generated by the target path point and the repulsive potential field generated by the obstacle, and the negative gradient of the total potential field is transformed into a virtual guiding force. A cascaded PID controller is used to convert the virtual guiding force into adjustments to the drone's attitude and throttle. When the drone enters the horizontal range of the landing area, it switches to vertical landing mode to suppress horizontal drift and descend at a constant speed until landing is confirmed, at which point the drone's power is shut off.

10. A dedicated airspace unmanned aerial vehicle (UAV) management system based on communication link intervention, used to implement the dedicated airspace UAV management method based on communication link intervention as described in any one of claims 1 to 9, characterized in that, include: The module includes a signal feature construction module, a protocol syntax inference module, an anomaly detection module, a takeover command generation module, and a path-guided landing module. The signal feature construction module uses a spectrum sensing device to capture the radio frequency communication signal of the target UAV, extracts the physical layer features of in-phase orthogonal components and signal entropy values, and constructs a multi-dimensional time-series feature vector sequence that characterizes the dynamic changes in the communication state. The protocol syntax inference module inputs the constructed multi-dimensional temporal feature vector sequence into the protocol syntax inference model based on a long short-term memory network. Through unsupervised learning, it mines the temporal dependencies and state transition probabilities between communication frames and outputs a dynamic protocol syntax tree containing the predicted protocol frame structure and key field positions. The anomaly exploration module constructs the action space of the reinforcement learning agent based on the dynamic protocol syntax tree, and uses maintaining the connection and inducing anomalies as rewards to control the agent to generate and inject micro-perturbation detection data packets, and iteratively searches the potential abnormal state space of the protocol regarding authentication logic and encryption verification. The takeover command generation module generates takeover control commands based on the searched abnormal state space, predicts subsequent rolling code values ​​based on the captured rolling code observation sequence and dynamically adjusts the timestamp and check bit of the command, sends a takeover frame within the receiving window, takes over the original UAV remote control link and establishes a unique control channel. The path-guided landing module continuously sends navigation correction commands containing virtual geofence information through the established control channel, calculates the obstacle avoidance guidance path in combination with the three-dimensional environmental potential field model of the dedicated airspace, and drives the UAV to fly smoothly to the preset landing area according to the planned trajectory.

Images