Method and system for threat signal identification based on wireless signal feature library

Abstract

This invention discloses a threat signal identification method and system based on a wireless signal feature library, relating to the field of communication control technology. The method includes scanning electromagnetic signals in a preset frequency band in space using a radio frequency receiving unit to acquire raw spectrum data; parsing the raw spectrum data to extract signal features; matching the extracted signal features with features in a preset wireless signal feature library to determine the initial classification of the signal; determining the threat level of the threat signal and / or unknown signal based on a preset strategy for the signal application scenario, and outputting the threat signal identification result. By extracting signal features and matching them with features in a preset wireless signal feature library, threat signals can be quickly identified, solving the problem of low efficiency in existing threat signal identification methods.

Description

Technical Field

[0001] This invention relates to the field of communication control technology, specifically to a method and system for identifying threat signals based on a wireless signal feature database. Background Technology

[0002] Wireless communication technology is now widely used in many fields such as mobile communication, UAV remote control and image transmission, wireless data links, satellite navigation, walkie-talkies, and various remote control devices, with application scenarios constantly expanding and signal systems continuously being updated. Due to the needs of airspace management and security control, wireless control equipment such as UAV countermeasures, frequency jamming, and mobile communication control are widely used. Radio reconnaissance, as a core link in obtaining information such as electromagnetic spectrum and signal identification, is the foundation of various communication control and countermeasure technologies.

[0003] Current wireless reconnaissance methods mainly fall into two categories: broadband spectrum monitoring and in-depth analysis of specific signals. Due to limitations in hardware processing capabilities, wireless signals span a wide frequency band and change rapidly in the time domain, making it difficult for existing equipment to handle signals across the entire spectrum. Traditional spectrum monitoring can only visualize the spectrum, relying on manual identification of threat signals, resulting in low efficiency and susceptibility to variations in personnel skill and effort; accuracy is also difficult to guarantee in complex electromagnetic environments. In-depth protocol analysis can only identify single types of signals, limiting its applicability and also failing to achieve efficient, comprehensive screening.

[0004] Existing technologies either perform only shallow spectrum observation (broadband spectrum detection) or deep signal analysis (deep analysis of specific signals), lacking intermediate adaptation solutions and unable to automatically complete signal classification and threat determination based on spectrum analysis. High levels of human intervention and low overall identification efficiency make it difficult to meet the current practical needs for rapid and intelligent identification of threatening wireless signals. Summary of the Invention

[0005] The purpose of this invention is to provide a threat signal identification method and system based on a wireless signal feature library. By extracting signal features and matching them with features in a preset wireless signal feature library, threat signals can be quickly identified, thus solving the problem of low efficiency in existing threat signal identification methods.

[0006] This invention is achieved through the following technical solution:

[0007] The first aspect of this application provides a threat signal identification method based on a wireless signal feature database, including:

[0008] The original spectrum data is obtained by scanning electromagnetic signals in a preset frequency band in space using a radio frequency receiving unit.

[0009] The original spectrum data is analyzed to extract signal features, including signal frequency, bandwidth, modulation scheme, time-domain characteristics, and coding scheme.

[0010] The extracted signal features are matched with features in a preset wireless signal feature library to determine the initial classification of the signal; the wireless signal feature library includes the features of various known wireless communication signals and their respective categories, and the initial classification includes known regular signals, known threat signals, and unknown signals not existing in the wireless signal feature library;

[0011] Based on a preset strategy for the signal application scenario, the threat level of the threat signal and / or unknown signal is determined, and the threat signal identification result is output.

[0012] In one feasible implementation, parsing the original spectrum data and extracting signal features includes:

[0013] The original spectrum data is preprocessed to reconstruct the baseband IQ time domain signal;

[0014] The baseband IQ time-domain signal is converted into a frequency-domain signal by fast Fourier transform, and the power spectrum distribution is determined. The center frequency, operating frequency band, and bandwidth characteristics of the signal are extracted from the power spectrum distribution.

[0015] Based on the power spectrum distribution and the preset signal threshold, valid signals are selected, and the power level and signal-to-noise ratio of the valid signals are determined.

[0016] The selected valid signals are demodulated to identify the modulation method of the valid signals;

[0017] Time-series statistics are performed on the duration and occurrence of valid signals to extract time-domain features;

[0018] Analyze the frame structure and data format of the demodulated effective signal to determine the encoding method used by the signal.

[0019] In one feasible implementation, the wireless signal feature library includes a daily signal library and a key target signal library;

[0020] The everyday signal library stores the characteristics of known non-threat signals;

[0021] The key target signal library stores the characteristics of signals that need to be continuously monitored; whether a signal needs to be continuously monitored is determined by the application scenario of the signal.

[0022] In one feasible implementation, before determining the initial classification of the signal, the method further includes:

[0023] Each set of signal features extracted based on real-time signals is compared with a preset wireless signal feature library and prior knowledge to determine the known type of the real-time signal; the known type includes known signal types and unknown signal types.

[0024] The real-time signals are divided into m known signal sub-streams and n unknown signal sub-streams according to their known types; each sub-stream contains continuous feature data of at least two signals of the same source or type.

[0025] The aliased independent signals in each sub-stream are separated to generate multiple independent signals and a signal feature sequence corresponding to each independent signal; the signal feature sequence is used to match with a wireless signal feature library to determine the initial classification of the signal.

[0026] In one feasible implementation, the preset frequency band is 30MHz-6GHz.

[0027] In one feasible implementation, the method further includes:

[0028] The threat level of the threat signal and / or unknown signal is determined based on the frequency and timing of its occurrence.

[0029] The second aspect of this application provides a threat signal identification system based on a wireless signal feature database, including a radio frequency receiving unit, a signal processing host, and a host computer;

[0030] The radio frequency receiving unit is used to receive electromagnetic signals in a preset frequency band in space, and to preprocess the electromagnetic signals to output a fixed-frequency intermediate frequency signal to the signal processing host; the intermediate frequency signal is a signal with a constant frequency obtained by down-converting the electromagnetic signals through a mixer.

[0031] The signal processing host analyzes the intermediate frequency signal and extracts signal features; it matches the extracted signal features with features in a preset wireless signal feature library to determine the initial classification of the signal; the wireless signal feature library includes the features and categories of known wireless communication signals, and the initial classification includes known regular signals, known threat signals, and unknown signals not present in the wireless signal feature library; based on a preset strategy for the signal application scenario, it determines the threat level of the threat signals and / or unknown signals, and summarizes and sends the entire process data to the host computer; the signal features include signal frequency, bandwidth, modulation method, time domain characteristics, and coding method;

[0032] The host computer displays the data sent to the signal processing host through an interface.

[0033] In one feasible implementation, the radio frequency receiving unit includes a nine-element uniform circular array composed of horizontally and vertically polarized antenna elements, a radio frequency switch matrix, and a multi-channel receiver.

[0034] The nine-element uniform circular array is used to receive electromagnetic signals in a preset frequency band in space and convert the electromagnetic signals into electrical signals.

[0035] The radio frequency switch matrix selects the antenna receiving channel and the correction path based on logic instructions.

[0036] The multi-channel receiver is used to sequentially perform pre-selection filtering, mixing, signal amplification, and intermediate frequency filtering on the radio frequency signals received by the selected antenna receiving channels, and output an intermediate frequency signal of a fixed frequency.

[0037] In one feasible implementation, the signal processing host includes an intermediate frequency processing module, a signal processing module, and a main control module:

[0038] The intermediate frequency processing module is used to preprocess the intermediate frequency signal and reconstruct the baseband IQ time domain signal; the baseband IQ time domain signal is converted into a frequency domain signal through fast Fourier transform, and the power spectrum distribution is determined.

[0039] The signal processing module is used to extract the center frequency, operating frequency band, and bandwidth characteristics of the signal through the power spectrum distribution;

[0040] Based on the power spectrum distribution and preset signal threshold, valid signals are selected, and their power level and signal-to-noise ratio are determined. The selected valid signals are demodulated to identify their modulation scheme. The duration and occurrence of the valid signals are statistically analyzed to extract time-domain features. The frame structure and data format of the demodulated valid signals are analyzed to determine the encoding scheme. The extracted signal features are matched with features in a preset wireless signal feature library to determine the initial signal classification. Based on a preset strategy for the signal application scenario, the threat level of threat signals and / or unknown signals in the initial classification is determined.

[0041] The main control module is used to summarize and send the data from the entire process to the host computer.

[0042] In one feasible implementation, the signal processing module is further configured to determine the threat level of the threat signal and / or unknown signal based on the frequency and timing of the signal occurrence.

[0043] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0044] This embodiment of the application establishes a pre-built wireless signal feature database. Since this database stores the characteristics and categories of various known wireless communication signals, matching the characteristics of real-time received electromagnetic signals with this database quickly distinguishes between known conventional signals, known threat signals, and unknown signals. This eliminates the need for traditional manual judgment and improves the efficiency of threat signal detection. Furthermore, this embodiment also determines the threat level of threat signals and unknown signals based on preset strategies for different application scenarios and outputs identification results. It can flexibly determine the signal threat level according to different usage scenarios and output targeted identification conclusions, adapting to the actual usage needs of diverse wireless control scenarios. Attached Figure Description

[0045] To more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention and should not be considered as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort. In the drawings:

[0046] Figure 1 A flowchart illustrating a threat signal identification method based on a wireless signal feature database provided in this application embodiment;

[0047] Figure 2 This is a schematic diagram of frequency domain analysis for signal simulation of a wireless communication device according to an embodiment of this application;

[0048] Figure 3 This is a schematic diagram of time-domain analysis for signal simulation of a wireless communication device according to an embodiment of this application;

[0049] Figure 4 A schematic diagram of the signal classification process in a threat signal identification method based on a wireless signal feature library provided in this application embodiment;

[0050] Figure 5 A schematic diagram of the modulation identification process in a threat signal identification method based on a wireless signal feature library provided in an embodiment of this application;

[0051] Figure 6 A schematic diagram illustrating the usage of a wireless signal feature database in a threat signal identification method based on a wireless signal feature database, provided in an embodiment of this application;

[0052] Figure 7 This is a schematic diagram illustrating a complete threat signal identification process in a threat signal identification method based on a wireless signal feature library provided in this application embodiment.

[0053] Figure 8A schematic diagram of the structure of a threat signal identification system based on a wireless signal feature database provided in this application embodiment;

[0054] Figure 9 A schematic diagram of the system structure of a threat signal identification system based on a wireless signal feature database provided in this application embodiment;

[0055] Figure 10 This is a schematic diagram illustrating the workflow of a threat signal identification system based on a wireless signal feature database, provided as an embodiment of this application.

[0056] The attached diagram shows the markings and corresponding component names:

[0057] 81-RF receiver unit, 82-Model processing host, 83-Host computer. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments and accompanying drawings. The illustrative embodiments and descriptions of the present invention are only used to explain the present invention and are not intended to limit the present invention.

[0059] As will be known to those skilled in the art, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0060] The terms “comprising” and “having”, and any variations thereof, in the specification, claims, and accompanying drawings of this application are intended to cover non-exclusive inclusion, so that a process, method, system, product, or apparatus that comprises a series of elements is not necessarily limited to those elements, but may include other elements not expressly listed or inherent to such process, method, product, or apparatus.

[0061] Example 1:

[0062] Embodiment 1 of this application provides a threat signal identification method based on a wireless signal feature library to solve the problem of low efficiency in existing threat signal identification methods.

[0063] like Figure 1 The diagram shown is a flowchart illustrating a specific implementation of a threat signal identification method based on a wireless signal feature database provided in this application, including the following steps 11-15:

[0064] Step 11: Scan the electromagnetic signals in the preset frequency band in space using the radio frequency receiving unit to obtain the raw spectrum data.

[0065] The preset frequency band in this embodiment is 30MHz-6GHz.

[0066] The raw spectrum data includes basic raw information such as signal amplitude, frequency distribution, and time-domain waveform, and serves as the data source for subsequent analysis and feature extraction.

[0067] Step 12: Analyze the original spectrum data and extract signal features; the signal features include signal frequency, bandwidth, modulation method, time domain characteristics and coding method.

[0068] This step is achieved through the following steps 1201-1206:

[0069] Step 1201: Preprocess the original spectrum data to reconstruct the baseband IQ (In-phase and Quadrature) time-domain signal.

[0070] The raw spectrum data undergoes preprocessing operations such as format normalization and clutter filtering to remove invalid data such as environmental noise and sudden interference. Then, digital down-conversion (DDC) technology is used to shift the high-frequency RF signal to the zero intermediate frequency position, simultaneously performing multi-stage filtering and rate decimation to reduce the signal sampling rate. Utilizing the principle of quadrature demodulation, two signals with a 90° phase difference are separated, and finally, a continuous and complete baseband in-phase (I) and quadrature (Q) time-domain signal is reconstructed, completing the signal conversion from the RF domain to the baseband time domain.

[0071] Step 1202: Convert the baseband IQ time-domain signal into a frequency-domain signal using Fast Fourier Transform and determine the power spectrum distribution. Extract the center frequency, operating frequency band, and bandwidth characteristics of the signal using the power spectrum distribution.

[0072] The segmented and windowed baseband IQ time-domain signal is input into a Fast Fourier Transform (FFT) module to convert it from the time domain to the frequency domain, obtaining complex spectral data corresponding to each frequency point. The power spectrum distribution is calculated by squaring the modulus of the spectral data, visually reflecting the signal power at different frequency points. The peak position of the power spectrum is used as the center frequency; the operating frequency band is defined based on the effective coverage of the power spectrum; and the signal bandwidth is calculated by combining the difference between the left and right frequency points corresponding to the power spectrum decreasing to a preset threshold. This completes the extraction of three frequency domain features: center frequency, operating frequency band, and bandwidth.

[0073] Step 1203: Based on the power spectrum distribution and the preset signal threshold, select the effective signals and determine the power level and signal-to-noise ratio of the effective signals.

[0074] A fixed signal power threshold is pre-set based on the electromagnetic environment at the site, and the overall power spectrum distribution is traversed: signals with power values ​​higher than the threshold are determined to be valid signals, while noise and clutter below the threshold are directly filtered out. The average power within the valid signal spectrum range is taken as the power level of the signal; the average power of the valid signal region and the average power of the pure noise region are calculated separately, and the signal-to-noise ratio is obtained by converting the power ratio.

[0075] Step 1204: Demodulate the selected valid signals and identify the modulation method of the valid signals.

[0076] For each selected valid signal, coherent or non-coherent demodulation is performed according to existing wireless communication demodulation rules. Combining the variation patterns of signal amplitude, phase, and frequency, the waveform characteristics and parameter patterns of different modulation standards such as FM, AM, GMSK, QPSK, BPSK, and OFDM are compared. The modulation method corresponding to the signal is automatically matched through a standard discrimination algorithm.

[0077] Step 1205: Perform time-series statistics on the duration and occurrence of the valid signal to extract time-domain features.

[0078] For each valid signal, long-term time-series tracking is performed, recording the signal's appearance time, disappearance time, and intermittent state in real time. Timing parameters such as the duration of a single signal, the frequency of signal occurrence per unit time, and the signal interval period are accumulated and calculated to form a time-domain feature that characterizes the dynamic changes of the signal.

[0079] Step 1206: Analyze the frame structure and data format of the demodulated effective signal to determine the encoding method used by the signal.

[0080] The demodulated baseband bitstream is analyzed frame by frame to identify its components, including the preamble, frame header, data segments, and parity bits, thus clarifying the complete frame structure and data encapsulation format. By combining the bitstream's code type, encoding rules, error correction algorithms, and other characteristics with the corresponding encoding specifications of various wireless communication standards, the encoding method used by the signal is determined.

[0081] For each group of signal features extracted in steps 1201-1206 above, pre-sorting is performed, specifically including the following steps 1211-1213: the pre-sorted signals are input into step 13 to perform the initial classification operation.

[0082] Step 1211: Each set of signal features extracted based on the real-time signal is compared with a preset wireless signal feature library and prior knowledge to determine the known type of the real-time signal; the known type includes known signal type and unknown signal type.

[0083] Step 1212: Divide the real-time signal into m known signal sub-streams and n unknown signal sub-streams according to known types; each sub-stream contains continuous feature data of at least two signals of the same source or type.

[0084] Step 1213: Separate the aliased independent signals in each sub-stream to generate multiple independent signals and a signal feature sequence corresponding to each independent signal; the signal feature sequence is used to match with the wireless signal feature library to determine the initial classification of the signal.

[0085] Step 13: Match the extracted signal features with features in a preset wireless signal feature library to determine the initial classification of the signal; the wireless signal feature library includes the features of various known wireless communication signals and their respective categories, and the initial classification includes known regular signals, known threat signals, and unknown signals not existing in the wireless signal feature library.

[0086] The wireless signal feature database mainly contains the frequency, bandwidth, modulation method, time-domain characteristics, and coding method of various known wireless communication signals within the 30MHz-6GHz frequency band. The main sources of the wireless signal feature database include three aspects:

[0087] First, we retrieved and collected various wireless communication signal parameters based on publicly available information.

[0088] Secondly, we collected physical samples of various wireless communication devices available on the market and collected their wireless communication signals.

[0089] Third, based on the parameter manual of the communication signal generation chip of the wireless communication device, the signal waveform is simulated and generated by simulation software such as MATLAB, and the signal characteristic parameters are obtained by analysis through simulation software.

[0090] like Figure 2 As shown in the frequency domain graph obtained through simulation analysis, the left graph represents the power spectrum of a broadband signal. The horizontal axis represents frequency, and the vertical axis represents the power spectrum amplitude, indicating the energy of the signal at the corresponding frequency point. The horizontal line at the bottom of the curve represents the noise floor, and the peak region in the middle represents the signal energy. The following features can be extracted from this graph:

[0091] Center frequency: The location of the power spectrum peak, approximately around 11000 Hz (11 kHz);

[0092] Signal bandwidth: The difference between the two frequency points corresponding to the power spectrum envelope dropping to a preset threshold (e.g., 3dB or 6dB lower than the peak value). As shown in the figure, the signal energy is mainly distributed between approximately 10.7kHz and 11.3kHz, with a bandwidth of approximately 600Hz.

[0093] Power level: Peak signal power (maximum value on the vertical axis, approximately 2.5 × 10⁻⁶)7 (), representing the signal strength.

[0094] Signal-to-noise ratio (SNR): the ratio of peak signal power to noise floor (approximately 0.1 × 10⁻⁶). 7 The ratio of ( ) reflects the signal quality.

[0095] Spectral shape / envelope characteristics: The spectral envelope shape of a signal is the basis for distinguishing different modulation methods or signal systems.

[0096] Figure 2 The right-hand image shows the power spectrum of two single-frequency signals, with the horizontal axis representing frequency and the vertical axis representing power spectrum amplitude. The following features can be extracted from this image:

[0097] Center frequency: The frequency points corresponding to the two sharp spectral lines, namely f1 and f2.

[0098] Power level: The peak power of each of the two signals.

[0099] Signal-to-noise ratio (SNR): The ratio of the peak power of each signal to the noise floor.

[0100] Signal quantity and spacing: There are two signals in the figure, and their frequency spacing is f2-f1.

[0101] like Figure 3 As shown in the figure, this embodiment presents a time-domain waveform sequence of a simulated wireless signal at different processing stages. From top to bottom, the waveforms are: the demodulated digital baseband code stream, the shaped and filtered baseband waveform, the quadrature modulated I / Q signal, and the original RF / IF complex signal. The horizontal axis represents time, and the vertical axis represents signal amplitude. The following features can be extracted from this figure:

[0102] Temporal characteristics: Based on the duration, frequency, intermittent period and burst characteristics of the signal, the temporal behavior pattern of the signal can be extracted, providing a temporal basis for subsequent threat level determination;

[0103] Modulation characteristics: By observing the phase and amplitude variation patterns of the I / Q components, different modulation schemes such as PSK, FSK, and QAM can be identified, providing a core basis for signal classification;

[0104] Encoding and frame structure features: The frame header, frame tail and data segment structure can be analyzed through the top digital baseband code stream waveform, the encoding rules of the signal can be identified, and protocol layer features can be provided for matching with the wireless signal feature library;

[0105] Signal quality characteristics: By comparing the signal amplitude with the noise floor, the signal-to-noise ratio can be estimated, and the signal's recognizability and environmental adaptability can be evaluated.

[0106] This embodiment acquires various commonly used wireless signal characteristic parameters within the 30MHz-6GHz frequency band using the three methods described above, forming a wireless signal characteristic library. Due to the large number of wireless communication objects and the continuous updates and expansions of wireless communication signal systems, the wireless signal characteristic library cannot completely cover all wireless signal data; therefore, continuous updates and expansion are necessary.

[0107] The wireless signal feature library in this embodiment covers the wireless signal features of most wireless communication targets. The main categories include civilian wireless remote control devices, mobile communications, industrial remote control devices, conventional analog / digital / trunking radios, conventional UAV telemetry and image transmission signals, mobile satellite communication signals, WIFI / Bluetooth, navigation signals, broadcast signals, satellite television signals, and some communication data links, radio stations, and satellite communication signals. Some wireless signal feature parameters are shown in Table 1 below.

[0108] Table 1. Partial Wireless Signal Characteristic Parameters:

[0109]

[0110] The wireless signal feature library in this embodiment includes a daily signal library and a key target signal library;

[0111] The routine signal database stores the characteristics of known non-threat signals, i.e., normal signals. This includes broadcast signals, normal communication signals, signals emitted by known sources, and information such as known communication signal types and parameters, radio station attributes, and direction of arrival. These are no longer the focus of monitoring work; as long as the detected signal is in these records, the operator will not analyze or process it further.

[0112] The key target signal database stores the characteristics of signals that require continuous monitoring; the need for continuous monitoring is determined by the signal's application scenario. Once a signal characteristic is detected to match a record in the key target signal database, the program immediately issues an alarm to the operator, reminding them to take appropriate action. The key target signal database needs to be set based on the system's application scenario, designating the corresponding targets in the database as key targets. For example, in anti-UAV domain applications, conventional UAV telemetry, control, and image transmission signals need to be set as key targets.

[0113] During the matching process, if signal parameters (center frequency, bandwidth, azimuth, etc.) not recorded in either the routine signal database or the key target signal database are encountered, it often indicates the presence of an unknown signal that has not been discovered or understood in the past. In such cases, manual analysis is usually required. The manual analysis and judgment stage primarily involves professional signal analysts performing in-depth operations such as modulation analysis, direction finding, and attribute assessment to determine the type of the unknown signal (whether it is a conventional signal or a threat signal).

[0114] The conclusions obtained through manual analysis and judgment can be displayed as identification and classification results, and can also be used as new signal samples, which can be added to the wireless signal feature database automatically or manually. In this way, the existing databases of known daily signals and key target signals are enriched. After a certain period of accumulation, a complete signal background database can be formed for the monitoring bandwidth. The large number of signals present can effectively eliminate known signals, discover unknown signals, and monitor key signals (and provide target-related information) without relying on human intervention.

[0115] In one feasible implementation, after detecting an unknown signal, the unknown signal can be stored in an unknown signal database, specifically storing various unknown communication signal types and parameters, radio attributes, direction of arrival, etc.

[0116] In automatic identification mode, the system can complete all tasks such as detection, sorting, measurement, and identification of all signals within one detection window. It can achieve near real-time identification (delay not exceeding one detection window time, i.e., within 2 seconds) and directly submit all identification results to the operator.

[0117] like Figure 4 As shown, a specific implementation process of steps 12 and 13 in this embodiment includes:

[0118] The system acquires electromagnetic signals, specifically shortwave signals, from the radio frequency receiving unit. The FPGA (Field Programmable Gate Array) processor in the signal processing host performs real-time high-speed calculations on the directly acquired shortwave signals to measure basic physical parameters. Based on these FPGA-measured parameters, multi-dimensional feature vectors are extracted: frequency domain features (center frequency, bandwidth, spectral shape, peak position), time domain features (duration, burst period, frequency of occurrence), and modulation / coding features (modulation method, symbol rate, coding type). Mixed signals are separated and classified: different signal sources are distinguished based on frequency, bandwidth, and power characteristics. Aliased signals are separated into independent single-channel signals, and corresponding feature sequences are generated. The sorted signal features are compared with a pre-defined threat signal feature library to determine if they match the characteristics of threat shortwave signals. The initial classification is completed; if not, the signal is directly stored in the database; if yes, it enters the targeted threat signal processing link. The targeted threat signal processing link includes I / Q signal sampling (for targets identified as threat signals, high-resolution I / Q baseband signal acquisition is initiated), signal processing (deep analysis of the acquired I / Q signals), and determination of whether it is a threat signal (based on the deep analysis results, secondary threat confirmation is performed on the signal). If it is confirmed as a threat signal, it enters the spatial spectrum direction finding; if it is a misjudged signal, it is archived in the database. Spatial spectrum direction finding: using the signal received by the array antenna, the direction of arrival of the threat signal is calculated through the spatial spectrum estimation algorithm; the direction finding results and signal characteristic data are sent to the ADBF (Adaptive Digital Beamforming) device for subsequent directional control or countermeasures.

[0119] like Figure 5 As shown, the signal modulation method identification process includes: taking the baseband IQ signal as input, extracting the instantaneous amplitude, phase, and frequency parameters of the signal; wherein, the baseband IQ signal is I(n) and Q(n), and the extracted instantaneous parameters include the instantaneous amplitude. Instantaneous phase and instantaneous frequency ;

[0120] Based on these instantaneous parameters, characteristic parameters that can distinguish different modulation schemes are calculated;

[0121] Finally, the signal is fed into a classification and recognition unit to automatically identify various modulation formats such as FM, AM, ASK, and 16QAM.

[0122] like Figure 6The diagram illustrates the signal classification and processing flow based on a wireless signal feature database. This includes: inputting the channel parameters (center frequency, bandwidth, etc.) of the signal to be classified; performing database comparison based on the input parameters; matching the input signal parameters with a preset signal feature database; and routing the signal to different processing links based on the matching results. Matching to the known daily signal database: determined as a non-threatening, routine signal; matching to the key target signal database: determined as a known threat or highly suspicious signal, and entering the key processing link. For signals matched to the daily signal database, modulation analysis and attribute assessment are performed (demodulating the signal, identifying the modulation method (e.g., AM / FM / ASK); parsing signal attributes such as signal system, communication protocol, and service type (e.g., broadcast, walkie-talkie, civilian remote control, etc.)). After classification and database entry (standardizing and classifying the assessed signal data and updating it to the signal database), the process is repeated. Signals matching the key target signal database are subject to focused monitoring, continuously tracking their frequency of occurrence, duration, power changes, and other behavioral characteristics; the spatiotemporal distribution patterns of the signals are recorded to provide time-series data for subsequent threat level assessment; identification and storage: in-depth identification and data archiving of key monitored threat signals are performed: combining the signal's modulation method, coding characteristics, and behavioral patterns, the specific threat type of the signal is confirmed (such as drone remote control, illegal radio, interference sources, etc.); complete signal characteristics, monitoring data, and identification results are stored.

[0123] By matching signal features with features in a wireless signal feature database, representative features can be selected for matching. Feature selection, as a major component of pattern recognition, reduces the dimensionality of the dataset and the amount of computation by selecting representative features to replace the original data. This has a direct impact on the design and performance of the classifier and the accuracy of the classification.

[0124] Through the above matching of wireless signal feature databases, the feature database is the key to realizing the automatic classification and recognition of signal detection results, and it mainly has the following functions:

[0125] It stores characteristic parameters of known signals, including center frequency, bandwidth, modulation method, azimuth, intensity level, and occurrence time; it stores attributes of known signals, including signal type, purpose, and nature, providing a reference for reconnaissance work; it stores characteristic parameters and information of threat monitoring signals and forms a key target database; it records characteristic parameters of new signals; it allows manual addition of relevant attributes, including station affiliation, purpose, and nature; and it supports the system in classifying and identifying signals within the monitoring bandwidth.

[0126] When using a wireless signal feature database, comparing the signal detection results with relevant records in the database is the foundation for classification and identification. Based on this, the following objectives can be achieved:

[0127] It automatically classifies and identifies signals, directly submitting reconnaissance results to operators, significantly reducing their workload; it discovers new time-frequency signals, i.e. signals appearing at new frequencies and time periods, and conducts in-depth analysis in conjunction with manual methods to clarify their attribution and nature; for the large number of signals existing in the reconnaissance bandwidth, it can eliminate known signals (filtering broadcasts, normal communication channels, known transmission sources, etc.), discover unknown signals (new time-frequency signals), and monitor key targets (key targets).

[0128] Step 14: Based on the preset strategy in the signal application scenario, determine the threat level of the threat signal and / or unknown signal, and output the threat signal identification result.

[0129] Pre-defined strategies for application scenarios are determined based on the signal's purpose and inherent attributes. For example, in electronic warfare environments, the primary focus is on signals from target communication devices, such as VHF / UHF communication signals and data link signals; in airport airspace management electromagnetic spectrum monitoring, UAV telemetry and image transmission signals are key threat signals; in wireless explosion-proof applications, signals from civilian wireless remote control devices need to be identified as key threat signals; and in information leakage prevention environments in important locations, wireless communication signals such as walkie-talkies, radios, mobile communications, and Wi-Fi need to be identified as key threat signals.

[0130] In one feasible implementation, the threat level of the threat signal and / or unknown signal is determined based on the frequency and timing of its occurrence. Since wireless signal monitoring is a continuous, long-term, and cumulative process, some signals in the radio electromagnetic environment, such as broadcast signals, satellite communication signals, and mobile communication signals, are persistent and generally not considered high-threat signals. During continuous electromagnetic signal reconnaissance, the system continuously lists and organizes the detected signals, including signal type, timing of occurrence, and duration. Irregular or sudden signals are considered potential threat signals and require further analysis or manual assessment.

[0131] like Figure 7 As shown, the entire process of threat signal identification and control based on a wireless signal feature database includes:

[0132] Spectrum detection: The radio frequency receiving unit collects spatial electromagnetic signals, scans and monitors preset frequency bands, obtains raw spectrum data, and identifies basic information such as the frequency and power of valid signals;

[0133] Signal demodulation algorithm: Combine the known signal system information in the feature library to perform targeted demodulation processing on the target signal, reconstruct the baseband IQ signal, and extract key features such as the modulation mode and coding mode of the signal;

[0134] Signal recognition and classification: The extracted signal features are compared with the wireless signal feature database to complete the initial classification of the signals, distinguishing between known regular signals, known threat signals and unknown signals;

[0135] Signal classification list: The classification results are summarized into a standardized signal list, which also provides data support for the next two stages;

[0136] Threat signal determination: Combining scenario strategies and historical data (frequency and timing of signal occurrence), a secondary analysis is performed on the signals (known threat signals and unknown signals) in the classification list to determine the threat level of the signals;

[0137] Threat signal display: Information such as the frequency, power, location, and threat level of threat signals is displayed through a visual interface, while also supporting human intervention to confirm or correct the judgment results.

[0138] Response measures for threat signals: The system executes preset control actions based on the threat level, such as directional interference, signal suppression, and location tracking, to complete the closed loop from identification to handling.

[0139] The diagram also includes a closed-loop update mechanism for the wireless signal signature database:

[0140] Continuous updates through multiple methods: New signal features are continuously added to the feature library through manual annotation, new signal acquisition, protocol upgrades, and other means.

[0141] Unknown signal addition: Unknown signals discovered during the identification and classification process are added to the feature library.

[0142] This embodiment of the application establishes a pre-built wireless signal feature database. Since this database stores the characteristics and categories of various known wireless communication signals, matching the characteristics of real-time received electromagnetic signals with this database quickly distinguishes between known conventional signals, known threat signals, and unknown signals. This eliminates the need for traditional manual judgment and improves the efficiency of threat signal detection. Furthermore, this embodiment also determines the threat level of threat signals and unknown signals based on preset strategies for different application scenarios and outputs identification results. It can flexibly determine the signal threat level according to different usage scenarios and output targeted identification conclusions, adapting to the actual usage needs of diverse wireless control scenarios.

[0143] Example 2:

[0144] To address the problem of low efficiency in identifying threat signals in existing systems, and based on the same inventive concept as Embodiment 1, this application also provides a threat signal identification system based on a wireless signal feature database.

[0145] The specific structural diagram of the system is as follows: Figure 8As shown, it includes an RF receiving unit 81, a signal processing host 82, and a host computer 83.

[0146] The radio frequency receiving unit 81 is used to receive electromagnetic signals in a preset frequency band in space, and to preprocess the electromagnetic signals to output a fixed-frequency intermediate frequency signal to the signal processing host; the intermediate frequency signal is a signal with a constant frequency obtained after the electromagnetic signal is down-converted by a mixer.

[0147] The signal processing host 82 parses the intermediate frequency signal and extracts signal features; it matches the extracted signal features with features in a preset wireless signal feature library to determine the initial classification of the signal; the wireless signal feature library includes the features and categories of known wireless communication signals, and the initial classification includes known regular signals, known threat signals, and unknown signals not present in the wireless signal feature library; based on a preset strategy for the signal application scenario, it determines the threat level of the threat signals and / or unknown signals, and summarizes and sends the entire process data to the host computer; the signal features include signal frequency, bandwidth, modulation method, time domain characteristics, and coding method;

[0148] The host computer 83 is used to display the data sent by the signal processing host through the interface.

[0149] In a specific implementation, such as Figure 9 As shown, the radio frequency receiving unit includes a nine-element uniform circular array composed of horizontally and vertically polarized antenna elements, a radio frequency switch matrix, and a multi-channel receiver.

[0150] The nine-element uniform circular array is used to receive electromagnetic signals in a preset frequency band in space and convert the electromagnetic signals into electrical signals.

[0151] The radio frequency switch matrix selects the antenna receiving channel and the correction path based on logic instructions.

[0152] The multi-channel receiver is used to sequentially perform pre-selection filtering, mixing, signal amplification, and intermediate frequency filtering on the radio frequency signals received by the selected antenna receiving channels, and output an intermediate frequency signal of a fixed frequency.

[0153] The signal processing host includes an intermediate frequency processing module, a signal processing module, and a main control module:

[0154] The intermediate frequency processing module is used to preprocess the intermediate frequency signal and reconstruct the baseband IQ time domain signal; the baseband IQ time domain signal is converted into a frequency domain signal through fast Fourier transform, and the power spectrum distribution is determined.

[0155] The signal processing module is used to extract the center frequency, operating frequency band, and bandwidth characteristics of the signal through the power spectrum distribution;

[0156] Based on the power spectrum distribution and preset signal threshold, valid signals are selected, and their power level and signal-to-noise ratio are determined. The selected valid signals are demodulated to identify their modulation method. The duration and occurrence of valid signals are statistically analyzed to extract time-domain features. The frame structure and data format of the demodulated valid signals are analyzed to determine the encoding method used by the signals. The extracted signal features are matched with features in a preset wireless signal feature library to determine the initial classification of the signals. Based on a preset strategy for the signal application scenario, the threat level of threat signals and / or unknown signals in the initial classification is determined. The signal processing module is also used to determine the threat level of the threat signals and / or unknown signals based on the frequency and timing of their occurrence.

[0157] The main control module is used to summarize and send the data from the entire process to the host computer.

[0158] like Figure 10 As shown, the system workflow specifically includes:

[0159] After completing self-test and receiving task instructions, the system first sets the mode, supporting three working modes: wideband scanning, narrowband analysis, and wide / narrowband fusion, and configures the parameters for each mode. The system then continuously searches for electromagnetic background signals, preprocesses the collected data, and calculates power spectrum data through spectrum conversion. This data is used for spectrum display on various platforms and for storing raw IQ or spectrum data, while also providing a basic data source for data fusion processing and analysis. Based on the spectrum data, parameter estimation is performed, and valid signals are filtered through signal thresholds. Noise or invalid signals below the threshold trigger the system to continue or stop the search; valid signals above the threshold enter the IQ demodulation process. The demodulated signal undergoes parallel characteristic parameter calculation, waveform detection algorithm invocation, and direction finding algorithm invocation, outputting complete data including signal scanning analysis results and direction finding results. The data is then compared with a wireless signal feature database to complete signal filtering and classification, and unknown signals are added to the database to ensure continuous updates. Finally, the system outputs threat signal identification and classification results.

[0160] This embodiment of the application establishes a pre-built wireless signal feature database. Since this database stores the characteristics and categories of various known wireless communication signals, matching the characteristics of real-time received electromagnetic signals with this database quickly distinguishes between known conventional signals, known threat signals, and unknown signals. This eliminates the need for traditional manual judgment and improves the efficiency of threat signal detection. Furthermore, this embodiment also determines the threat level of threat signals and unknown signals based on preset strategies for different application scenarios and outputs identification results. It can flexibly determine the signal threat level according to different usage scenarios and output targeted identification conclusions, adapting to the actual usage needs of diverse wireless control scenarios.

[0161] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A threat signal identification method based on a wireless signal feature database, characterized in that, include: The original spectrum data is obtained by scanning electromagnetic signals in a preset frequency band in space using a radio frequency receiving unit. The original spectrum data is analyzed to extract signal features, including signal frequency, bandwidth, modulation scheme, time-domain characteristics, and coding scheme. The extracted signal features are matched with features in a preset wireless signal feature library to determine the initial classification of the signal; the wireless signal feature library includes the features of various known wireless communication signals and their respective categories, and the initial classification includes known regular signals, known threat signals, and unknown signals not existing in the wireless signal feature library; Based on a preset strategy for the signal application scenario, the threat level of the threat signal and / or unknown signal is determined, and the threat signal identification result is output.

2. The threat signal identification method based on a wireless signal feature database according to claim 1, characterized in that, Analyzing the raw spectrum data and extracting signal features includes: The original spectrum data is preprocessed to reconstruct the baseband IQ time domain signal; The baseband IQ time-domain signal is converted into a frequency-domain signal by fast Fourier transform, and the power spectrum distribution is determined. The center frequency, operating frequency band, and bandwidth characteristics of the signal are extracted from the power spectrum distribution. Based on the power spectrum distribution and the preset signal threshold, valid signals are selected, and the power level and signal-to-noise ratio of the valid signals are determined. The selected valid signals are demodulated to identify the modulation method of the valid signals; Time-series statistics are performed on the duration and occurrence of valid signals to extract time-domain features; Analyze the frame structure and data format of the demodulated effective signal to determine the encoding method used by the signal.

3. The threat signal identification method based on a wireless signal feature database according to claim 1, characterized in that, The wireless signal signature database includes a daily signal database and a key target signal database; The everyday signal library stores the characteristics of known non-threat signals; The key target signal library stores the characteristics of signals that need to be continuously monitored; whether a signal needs to be continuously monitored is determined by the application scenario of the signal.

4. The threat signal identification method based on a wireless signal feature database according to claim 1, characterized in that, Before determining the initial classification of the signal, the method further includes: Each set of signal features extracted based on real-time signals is compared with a preset wireless signal feature library and prior knowledge to determine the known type of the real-time signal; the known type includes known signal types and unknown signal types. The real-time signals are divided into m known signal sub-streams and n unknown signal sub-streams according to their known types; each sub-stream contains continuous feature data of at least two signals of the same source or type. The aliased independent signals in each sub-stream are separated to generate multiple independent signals and a signal feature sequence corresponding to each independent signal; the signal feature sequence is used to match with a wireless signal feature library to determine the initial classification of the signal.

5. The threat signal identification method based on a wireless signal feature database according to claim 1, characterized in that, The preset frequency band is 30MHz-6GHz.

6. The threat signal identification method based on a wireless signal feature database according to claim 1, characterized in that, The method further includes: The threat level of the threat signal and / or unknown signal is determined based on the frequency and timing of its occurrence.

7. A threat signal identification system based on a wireless signal feature database, characterized in that, Includes an RF receiving unit, a signal processing host, and a host computer; The radio frequency receiving unit is used to receive electromagnetic signals in a preset frequency band in space, and to preprocess the electromagnetic signals to output a fixed-frequency intermediate frequency signal to the signal processing host; the intermediate frequency signal is a signal with a constant frequency obtained by down-converting the electromagnetic signals through a mixer. The signal processing host analyzes the intermediate frequency signal and extracts signal features; it matches the extracted signal features with features in a preset wireless signal feature library to determine the initial classification of the signal; the wireless signal feature library includes the features and categories of known wireless communication signals, and the initial classification includes known regular signals, known threat signals, and unknown signals not present in the wireless signal feature library; based on a preset strategy for the signal application scenario, it determines the threat level of the threat signals and / or unknown signals, and summarizes and sends the entire process data to the host computer; the signal features include signal frequency, bandwidth, modulation method, time domain characteristics, and coding method; The host computer displays the data sent to the signal processing host through an interface.

8. The threat signal identification system based on a wireless signal feature database according to claim 7, characterized in that, The radio frequency receiving unit includes a nine-element uniform circular array composed of horizontal and vertical polarized antenna elements, a radio frequency switch matrix, and a multi-channel receiver. The nine-element uniform circular array is used to receive electromagnetic signals in a preset frequency band in space and convert the electromagnetic signals into electrical signals. The radio frequency switch matrix selects the antenna receiving channel and the correction path based on logic instructions. The multi-channel receiver is used to sequentially perform pre-selection filtering, mixing, signal amplification, and intermediate frequency filtering on the radio frequency signals received by the selected antenna receiving channels, and output an intermediate frequency signal of a fixed frequency.

9. The threat signal identification system based on a wireless signal feature database according to claim 7, characterized in that, The signal processing host includes an intermediate frequency processing module, a signal processing module, and a main control module: The intermediate frequency processing module is used to preprocess the intermediate frequency signal and reconstruct the baseband IQ time domain signal; the baseband IQ time domain signal is converted into a frequency domain signal through fast Fourier transform, and the power spectrum distribution is determined. The signal processing module is used to extract the center frequency, operating frequency band, and bandwidth characteristics of the signal through the power spectrum distribution; Based on the power spectrum distribution and the preset signal threshold, valid signals are selected, and the power level and signal-to-noise ratio of the valid signals are determined. The selected valid signals are demodulated to identify their modulation methods; the duration and occurrence of valid signals are statistically analyzed to extract temporal features; the frame structure and data format of the demodulated valid signals are analyzed to determine the encoding method used by the signals; the extracted signal features are matched with features in a preset wireless signal feature library to determine the initial classification of the signals; based on a preset strategy for the signal application scenario, the threat level of threat signals and / or unknown signals in the initial classification is determined. The main control module is used to summarize and send the data from the entire process to the host computer.

10. The threat signal identification system based on a wireless signal feature database according to claim 9, characterized in that, The signal processing module is also used to determine the threat level of the threat signal and / or unknown signal based on the frequency and timing of the signal occurrence.

Images