Unmanned aerial vehicle new attack class discovery method and device based on multi-source information fusion

Abstract

The application discloses a novel attack category discovery method and device for a UAV based on multi-source information fusion, acquires communication link flow data in the flight process of the UAV, determines an open set score of the communication link flow data through an open set identification model, stores the communication link flow data in a memory library when the communication link flow data is unknown attack type data, extracts features from the unknown attack type data in the memory library in sequence and clusters the unknown attack type data to obtain pseudo labels corresponding to the unknown attack type data, performs incremental learning on the open set identification model based on the unknown attack type data, known attack type data and normal communication link flow data, and identifies subsequent to-be-detected data based on the open set identification model after the incremental learning. The application gradually expands the identification range of the model through a circulation mechanism of "detection-labelling-data expansion-model updating".

Description

Technical Field

[0001] This invention belongs to the field of interdisciplinary technology of UAV network security and artificial intelligence, and in particular relates to a method and device for discovering new types of UAV attacks based on multi-source information fusion. Background Technology

[0002] Because drones perform different tasks, they are typically equipped with various sensors, actuators, and processing units to complete specific operations. As a cyber-physical system, drones use sensors such as cameras and optical flow sensors to collect measurement data, receive and process command signals from ground controllers, and then use actuators to complete corresponding physical actions. Like all cyber-physical systems, drones are also vulnerable to security vulnerabilities and can be subjected to various cyberattacks, including denial-of-service attacks, distributed denial-of-service attacks, GPS spoofing, replay attacks, man-in-the-middle attacks, malicious twin attacks, and channel occupancy attacks.

[0003] In the field of drone intrusion detection, existing open-set identification schemes based on Adversarial Reciprocal Point Learning (ARPL) can intercept some abnormal traffic by setting security boundaries. However, when facing dynamically evolving attack environments, existing technologies can only uniformly classify traffic deviating from known patterns as "Unknown" based on distance thresholds, and cannot perform deeper, finer-grained classification of these unknown samples. This leads to a "semantic vacuum" in the defense system, making it impossible to inform users what specific new attack variants the intercepted threats represent, severely weakening the decision-making value of early warning information. Summary of the Invention

[0004] The purpose of this invention is to provide a novel method and apparatus for discovering drone attack categories based on multi-source information fusion, so as to perform fine-grained classification of drone intrusion detection.

[0005] This invention adopts the following technical solution: This invention discloses a novel UAV attack category detection method based on multi-source information fusion, comprising the following steps: Acquire communication link traffic data during the flight of the UAV. The communication link traffic data includes physical layer information and network layer information. The open set score of the communication link traffic data is determined by the open set identification model, and the open set score is used to determine whether the communication link traffic data is data of an unknown attack type. When the communication link traffic data is of an unknown attack type, it is stored in the memory bank; The unknown attack type data in the memory are sequentially subjected to feature extraction and clustering to obtain pseudo-labels corresponding to the unknown attack type data. Incremental learning of the open set identification model is performed based on unknown attack type data with pseudo-labels, known attack type data with real labels, and normal communication link traffic data; among which, normal communication link traffic data refers to the communication link traffic data of the UAV when it is not under attack. The open set recognition model, based on incremental learning, is used to identify subsequent data to be detected.

[0006] Another technical solution of the present invention: a novel UAV attack category detection device based on multi-source information fusion, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the above-described method when executing the computer program.

[0007] The beneficial effects of this invention are as follows: This invention gradually expands the recognition range of the model through a cyclical mechanism of "detection-labeling-data augmentation-model update", focusing on "knowledge retention and incremental expansion". On the one hand, by fully retaining the training data of each stage, it ensures that the model can continuously access historical data when learning new categories, avoiding the forgetting of old knowledge; on the other hand, by parameter transfer and reasonable initialization strategies, it reduces the difficulty of learning new categories and improves the efficiency of model update. Attached Figure Description

[0008] Figure 1 This is a flowchart of a novel UAV attack category discovery method based on multi-source information fusion, according to the present invention. Figure 2 This is a schematic diagram illustrating the effect of boundary adversarial constraints on the open set recognition model in an embodiment of the present invention. Detailed Implementation

[0009] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0010] The basic principle of drone intrusion detection is to identify potential malicious intrusions and abnormal attack behaviors by modeling and analyzing multi-source features such as drone communication links, network traffic, and flight behavior. Based on the degree of reliance on attack knowledge and the different detection strategies, existing research can be broadly divided into three categories: rule / signature-based intrusion detection methods, abnormal behavior-based intrusion detection methods, and hybrid intrusion detection methods.

[0011] When an intrusion detection system observes network traffic or system behavior matching these predefined rules or signatures, it issues a warning indicating a potential intrusion. Anomaly-based intrusion detection methods learn the communication patterns and behavioral characteristics of drones during normal operation, comparing normal behavior with abnormal traffic to detect intrusions and anomalies. When observed features significantly deviate from normal patterns, a potential intrusion is identified. Hybrid intrusion detection methods combine the advantages of rule / signature detection and anomaly detection, improving overall detection performance and robustness through multi-model or multi-stage discrimination mechanisms.

[0012] Existing unmanned aerial vehicle (UAV) systems generally rely on multiple communication links to interact with ground control stations, satellite systems, other UAVs, or cloud services. Typical communication links include remote control links for transmitting flight control commands, telemetry links for reporting UAV position, altitude, battery status, and other information, image / data links for transmitting video streams or mission data, and navigation links for receiving GNSS / GPS signals to achieve high-precision positioning. Although these communication links have different functions, they all use wireless transmission and are characterized by high openness and weak security, making them highly vulnerable to network attacks. Current research and practical applications show that typical security threats to UAV communication links include denial-of-service attacks that disrupt remote control and telemetry links through channel interference or resource exhaustion, causing UAVs to lose connection or control; distributed denial-of-service attacks that simultaneously launch high-intensity interference or false traffic from multiple attack sources, causing command delays or interruptions and ultimately paralyzing the system; GPS spoofing attacks that forge GPS signals to mislead the positioning system, causing it to deviate from its flight path or even crash; replay attacks that intercept and resend legitimate commands to interfere with control logic; man-in-the-middle attacks that implant malicious nodes in the communication link to achieve eavesdropping, tampering, and covert manipulation; malicious twin attacks that forge legitimate control station access points to lure UAVs out of normal connections; and channel occupation attacks that cause critical link interruptions through high-power interference or illegal occupation of frequency bands.

[0013] In the field of drone intrusion detection, however, it still has the following shortcomings when facing dynamically evolving attack environments: 1. Static Model Defense Logic (Lack of Evolutionary Capability): The model weights in existing solutions are quasi-static after deployment, lacking the ability to autonomously absorb new knowledge. When new attack methods emerge in the environment, the system cannot update its knowledge base in real time, requiring manual data collection and offline retraining, resulting in defense performance consistently lagging behind the evolution of attack methods.

[0014] 2. The "catastrophic forgetting" problem in incremental updates (knowledge cannot be robustly internalized): When traditional solutions attempt to introduce newly detected attack categories through fine-tuning or retraining, deep neural networks are prone to drastic parameter shifts, causing the model's detection accuracy for known attacks in the initial training set (such as normal Mavlink heartbeat packet recognition, known DoS attacks, etc.) to drop drastically, making it impossible to absorb new knowledge while ensuring the robustness of old knowledge.

[0015] 3. Low clustering purity due to single feature representation dimension: Existing technologies mostly rely on single message features. When facing highly mimicked or complex unknown attacks, their inter-class distance compression in the latent feature space is insufficient, which makes it easy for overlap to occur in subsequent clustering analysis and makes it impossible to accurately delineate the physical boundaries of new categories.

[0016] Therefore, based on the fundamental theories of UAV communication security protection, deep learning open set recognition, and incremental learning, this invention designs a novel UAV attack category discovery method and device based on multi-source information fusion.

[0017] In the field of known technologies, the operating logic of UAV intrusion detection systems is usually based on real-time monitoring and pattern recognition of Mavlink protocol (a lightweight binary communication protocol designed for resource-constrained systems, mainly used for efficient data exchange between ground stations and UAVs and between components within the UAV) traffic and physical layer heterogeneous signals (such as Received Signal Strength Indicator (RSSI), Signal-to-Noise Ratio (SNR), Noise Floor Power, etc.).

[0018] This invention encompasses several cutting-edge branches, including UAV communication link protection, open set recognition, deep learning spatiotemporal feature fusion, unsupervised category discovery, and incremental learning. It aims to integrate the spatial capture capabilities of convolutional neural networks (CNNs) with the temporal modeling capabilities of temporal convolutional networks (TCNs), and combine this with topological distance features constructed using adversarial reciprocal point learning (ARPL), to form a CTD heterogeneous feature system capable of deeply representing traffic from communication protocols such as Mavlink. Furthermore, it utilizes an improved HDBSCAN (density-based hierarchical clustering) algorithm to automatically segment unknown attack clusters and generate pseudo-labels without prior annotation. Finally, it relies on sample memory replay and knowledge distillation techniques to guide the model to achieve dynamic expansion of the knowledge base and autonomous evolution of defense performance without "catastrophic forgetting."

[0019] At the feature extraction level, CNNs, with their powerful spatial representation capabilities, are often used to extract the spatial distribution features between fields within traffic data packets; while TCNs, by utilizing causal convolution and dilated convolution structures, can capture long-distance temporal depth dependencies in communication sequences while ensuring computational efficiency, and have a significant advantage in identifying attacks with periodic or temporal evolution characteristics (such as replay attacks).

[0020] In addressing the core challenge of "unknown attacks," the well-known technology introduces the theory of Adversarial Reciprocal Points Learning (ARPL). Its core principle is to assign a reciprocal point to each known attack category in a high-dimensional feature space. By introducing an adversarial loss function constraint, potential sample points belonging to the unknown space are pushed away from the distribution area of ​​the known classes, thereby defining a clear closed set recognition boundary.

[0021] Furthermore, to achieve automatic classification of unlabeled outlier data, the HDBSCAN algorithm is widely used for unsupervised identification of cluster structures in complex data, without requiring a pre-defined number of clusters. In the model evolution phase, sample replay and knowledge distillation techniques in incremental learning are core methods for addressing the "catastrophic forgetting" problem that occurs when deep neural networks absorb new knowledge. By retaining representative samples from the old classes and constraining the consistency of the outputs of the old and new models, the model ensures that it maintains its accuracy in recognizing old attacks while learning new attack features.

[0022] Through the above-described technical means, the present invention can solve the following problems: 1. Achieve automated semantic deconstruction of unknown threats: By constructing a CTD heterogeneous feature vector that integrates topological distance, spatial and temporal three-dimensional features, the separability of the feature space is enhanced. Combined with an adaptive density clustering algorithm, the chaotic "unknown space" is automatically divided into specific attack clusters with clear semantic boundaries, and pseudo-labels are automatically assigned to eliminate blind spots in identification.

[0023] 2. Construct an unmanned "defense closed loop" evolutionary architecture: Establish an automated process from "detecting the unknown" to "clustering discovery" and then to "automatic incremental learning", so that the UAV detection system has the ability to dynamically expand the knowledge base without manual annotation, and improve the real-time response speed of the system in dynamic adversarial environments.

[0024] 3. Overcoming the bottleneck of anti-forgetting technology in incremental update process: Introducing a joint loss function of core sample memory replay and knowledge distillation, while the model learns newly discovered attack features, it is forced to retain the recognition logic of existing known attack patterns, ensuring the global robustness of the detection performance of the system in the process of continuous evolution.

[0025] 4. Dynamically reshape and compress the open risk space: By dynamically generating and iteratively optimizing the coordinates of adversarial reciprocal points for newly discovered categories in the feature space, the "actual control zone" of new categories continuously squeezes the originally uncontrollable "unknown risk domain", fundamentally improving the security defense depth of the UAV system in the open environment.

[0026] In summary, this invention uses "pre-detection - category discovery - model update" as the core logical chain to construct a three-level progressive closed-loop technical framework. Each link is closely connected and data flows efficiently, forming a complete dynamic defense system.

[0027] The pre-detection layer, serving as the entry point for the entire framework, is based on the open-set recognition concept and a dual-branch neural network model (an architecture containing two parallel sub-network paths used to extract different features of the input data (such as spatial / temporal, multimodal, local / global), which are then integrated by the fusion layer to output the final result; its core lies in the feature complementarity of divide and conquer rather than necessarily sharing weights, solving the limitation of a single path in capturing multi-scale, multimodal, or multi-view information simultaneously, and improving the model's ability to represent complex patterns). It fully utilizes the fusion data of the physical and network layers of the UAV communication link to accurately distinguish between known attacks, normal traffic, and unknown attack samples. This layer models open-space risk through adversarial reciprocity points, extracts spatiotemporal features using a CNN+TCN dual-branch structure, and introduces information entropy regularization (a regularization technique that introduces the information entropy term of the policy or distribution into the optimization objective (usually the loss function or reward function) to encourage randomness, prevent premature convergence, improve exploration capabilities, or smooth decision boundaries; it is mainly used in reinforcement learning and is seen in confidence calibration of classification models in a few scenarios) to enhance sensitivity to unknown samples. Detected unknown attack samples are filtered for noise and stored in a dedicated sample memory bank to provide high-quality raw data support for subsequent processing.

[0028] The category discovery layer is the core component for solving the problem of distinguishing between multiple types of unknown attacks. For sample sets containing a mixture of various unknown attack types in the memory bank, this layer first integrates the spatial features, temporal features, and reciprocal point distance features of the samples through multi-source feature fusion technology (aligning, combining, and optimizing feature vectors extracted from different sources, modalities, or sensors at the feature level to generate a richer, more robust, and discriminative unified feature representation than a single source, thereby improving the accuracy and generalization ability of machine learning / deep learning models). This constructs a comprehensive and accurate sample representation vector, enhancing the distinguishability between different types of unknown attacks. Subsequently, the HDBSCAN algorithm is used for clustering. Without pre-setting the number of categories, it automatically mines the potential category structure in the sample set and assigns a unique pseudo-label to each cluster, realizing the transformation from "unknown attack set" to "multiple clear new categories".

[0029] The model update layer, as the closed-loop terminal of the framework, merges new category samples with pseudo-labels with historical known category data to form an expanded training set. By designing targeted incremental learning strategies, it updates the model's parameters, classification head structure, and adversarial reciprocal point set. While efficiently learning new category knowledge, it avoids catastrophic forgetting through a triple mechanism of parameter transfer, full data retention, and regularization constraints, thereby achieving dynamic expansion of the model's recognition capabilities and enabling the system to continuously adapt to the ever-changing attack environment.

[0030] First, the implementation of various attack types and the collection of multi-dimensional data in this invention are described in detail below.

[0031] To construct a comprehensive attack scenario and dataset, this solution, based on a Kali Linux virtual machine environment and combined with a wireless network card and HackRF software radio, designed and implemented seven typical drone communication link attacks, covering existing mainstream attack types and supplementing new attack scenarios. These include DoS attacks (attackers send massive amounts of junk requests to saturate the server's bandwidth, memory, or CPU resources), DDoS attacks (attackers control a large number of "zombie" devices distributed in different locations to send massive amounts of requests to a single target, exhausting bandwidth or system resources and causing service paralysis), GPS spoofing attacks, replay attacks, man-in-the-middle attacks, malicious twin attacks, and channel occupancy attacks.

[0032] All attacks were launched after gaining root privileges, utilizing the network penetration tools built into the Kali system. Specific attack flows were designed for the different communication link characteristics of drones: For Wi-Fi links, DoS attacks, malicious twin attacks, and man-in-the-middle attacks were launched by monitoring target channels and MAC addresses through the wireless network card, employing methods such as traffic flooding, fake access point cloning, and communication link hijacking. For satellite or radio communication links, GPS spoofing, replay attacks, and channel occupancy attacks were launched by recording, forging, or interfering with signals through software-defined radio devices to maliciously manipulate the positioning system and control commands. DDoS attacks were launched simultaneously from multiple Kali virtual machines to enhance attack intensity and destructiveness. Each attack was implemented strictly according to standardized procedures to ensure the reproducibility of attack effects, providing realistic and comprehensive attack scenarios to support subsequent data collection and model training.

[0033] To comprehensively capture the characteristics of UAV communication links under different attack conditions, this solution designs a multi-dimensional data acquisition strategy of "single-line acquisition + dual-line backup," simultaneously acquiring physical layer and network layer information, thus solving the problems of single-feature and incomplete data in traditional acquisition methods. The acquisition platform is developed based on the open-source network sniffing library Scapy and the MAVLink protocol parsing library Pymavlink, supporting standardized data packet format storage to adapt to subsequent algorithm training and testing needs.

[0034] To address attack types that do not cause communication disruption, such as man-in-the-middle attacks, GPS spoofing attacks, and replay attacks, a single-line data acquisition scheme is adopted: the wireless network card is connected to the drone's hotspot, a designated listening interface (e.g., wlan0) is specified, and all wireless data packets on the interface are captured in real time. During the acquisition process, the physical layer information (including key fields such as position, attitude, altitude, and battery level) is extracted using the MAVLink protocol parsing module, and the network layer information (including IP address, port number, protocol type, packet length, and timestamp) is extracted using the Scapy library. All data is ultimately saved as a .pcap file, which can be parsed into .csv format for model training.

[0035] To address attack types that easily lead to communication disruptions, such as DoS attacks, DDoS attacks, malicious twin attacks, and channel occupancy attacks, a dual-line information acquisition scheme is adopted to avoid data loss: Physical layer information is obtained by directly downloading and parsing ground station flight log files, ensuring the integrity of core data such as flight status and attitude; network layer information is obtained by setting the wireless network card to monitoring mode and using a dedicated command (sudo airodump-ng --bssid [target MAC] -c [channel] -w [save filename] wlan0mon) to capture target channel data and save it as a .cap file (compatible with .pcap format). Subsequently, by parsing the ground station logs and the .cap file, a .csv file containing physical and network layer characteristics is jointly output (please confirm again). Table 1 below shows the characteristic content contained in the .csv file. Network layer data includes, but is not limited to, packet length, frame type, source / destination address, sequence number, protocol fields, and timestamps; physical status data includes, but is not limited to, the UAV's position, speed, altitude, attitude, battery status, and flight time. This data collection strategy ensures the comprehensiveness and completeness of data collection under different attack scenarios, providing a high-quality, multi-dimensional dataset for subsequent feature fusion and model training.

[0036] Table 1 contains network layer and physical layer features in the .csv file. In other words, the UAV communication link data to be detected in this invention is sample data or sample sequences obtained by preprocessing, time-aligning, and feature fusion of network layer communication data and physical state data collected during UAV operation. Specifically, the data to be detected may include normal communication data, known attack data, and unknown attack data that did not appear during the training phase.

[0037] To simulate the dynamic process of new attacks emerging sequentially in real-world scenarios, this method relies on a dual-branch model and adversarial reciprocity mechanism in the pre-detection layer to ensure the accuracy of unknown attack detection and provide high-quality data input for incremental learning. The entire process requires no manual intervention, achieving an automated flow from unknown attack detection to model capability expansion, ensuring the system can adapt to the dynamic growth of attack types.

[0038] Specifically, this invention discloses a novel method for detecting UAV attack categories based on multi-source information fusion, such as... Figure 1 As shown, the process includes the following steps: acquiring communication link traffic data during UAV flight, including physical layer and network layer information; determining the open set score of the communication link traffic data using an open set recognition model, and using the open set score to determine whether the communication link traffic data is of an unknown attack type; when the communication link traffic data is of an unknown attack type, storing it in a memory bank; sequentially extracting features and clustering the unknown attack type data in the memory bank to obtain pseudo-labels corresponding to the unknown attack type data; incrementally learning the open set recognition model based on the unknown attack type data with pseudo-labels, the known attack type data with real labels, and normal communication link traffic data; wherein, normal communication link traffic data is the communication link traffic data when the UAV is not under attack; and identifying subsequent data to be detected based on the incrementally learned open set recognition model.

[0039] (1) Stage division and data evolution process.

[0040] In the initial training phase, an initial training set was constructed using labeled data of normal traffic (Benign) and two typical known attack types (such as DoS and Replay). The corresponding category set is defined as , where 0 represents normal traffic, and 1 and 2 represent two known attack types, respectively.

[0041] In this stage, a CNN+TCN dual-branch open-set recognition model is trained using the initial training set, and the open-set detection threshold is calculated and determined using validation set data. (The quintile of the open set scores for known category samples in the validation set) This threshold is used as the discrimination criterion for subsequent unknown samples. After training, the model has the ability to accurately identify communication link data of known categories of UAVs, and can also preliminarily detect unknown attack samples based on the open set scores.

[0042] In the first incremental learning phase, a third attack type (such as FDI, fake data injection attack) is treated as an unknown attack. UAV communication link data containing this attack type is input into the open-set recognition model obtained in the initial training phase. The open-set recognition model calculates the open-set score for each sample. (Calculated based on the opposition distance between the sample and each known category of reciprocal points, and the information entropy value), and combined with the threshold. If a comparison is made, If the sample is identified as an unknown attack, it is stored in the unknown sample set. Subsequently, all samples in this set were assigned a uniform pseudo-label 3, and randomly divided into training subsets in a 7:3 ratio. With test subset Compare the training subset with the initial training set. The training set is then merged to form an expanded training set. (in (For the training subset of unknown samples with pseudo-labels), the corresponding category set is expanded to The training objective at this stage is to enable the open-set model to learn the newly added attack types while maintaining the accuracy of its recognition of the original three types of data.

[0043] In the final training phase, the fourth attack type (such as the Evil Twin malicious twin attack) is treated as a new unknown attack. The process of the first incremental learning phase is repeated: unknown samples are detected using the current model and assigned pseudo-labels 4. After dividing the training and testing subsets, the training set is expanded to obtain the complete training set. The category set is expanded to .

[0044] By analogy, incremental training can be completed for all attack types. At this point, all attack types have been included in the model's recognition range, and the system switches from open-set recognition mode to closed-set classification mode. The model is then optimized to ensure excellent classification performance across all categories of data.

[0045] (2) Unknown sample detection and pseudo-label generation mechanism.

[0046] The detection of unknown samples is based on the core capability of the open set recognition model. This model calculates the opposition distance between sample features and the mutual points of each known class (combining Euclidean distance and dot product similarity), and combines this with the information entropy value to obtain the open set score. In each incremental learning phase The system uses the detection threshold determined by the validation set in the previous stage. For newly received data streams For each sample in the dataset, a discrimination is made: if the sample's open set score is... Or, the minimum distance between a sample and all known class mutual points is greater than the learnable radius. If the sample is identified as an unknown attack, it is added to the unknown sample detection set. .

[0047] The pseudo-tag generation adopts a unified allocation strategy. Since this method introduces only one new unknown attack type in each incremental stage, it is therefore... All samples were assigned the same pseudo-label ,in This represents the number of known categories at the current stage. This pseudo-label assignment method eliminates the need for complex cluster analysis, relying solely on open set detection results to ensure the efficiency of the labeling process. Although pseudo-labels may contain some noise (such as some known category samples being misclassified as unknown category samples due to feature anomalies), the high open set detection accuracy brought by the bi-branch model and adversarial reciprocal point mechanism guarantees the overall quality of the pseudo-labels, sufficient to support subsequent incremental learning processes.

[0048] (3) Incremental update strategy for models.

[0049] The core of incremental model updates is to avoid catastrophic forgetting while expanding the recognition range, which is achieved through three key steps: parameter initialization, objective function design, and threshold update. Parameter initialization employs a knowledge transfer strategy: the parameters of the feature extractors (CNN and TCN branches) are directly inherited from the model trained in the previous stage, ensuring that their learned spatiotemporal feature extraction capabilities are preserved. In the classification head, the weight matrices corresponding to the existing known categories are completely retained, while the weights corresponding to the new categories are randomly initialized using a Gaussian distribution with a mean of 0 and a standard deviation of 0.05, providing a reasonable initial decision space for the new categories. The adversarial reciprocity point set is expanded synchronously, and the reciprocity points for the new categories are also randomly initialized using a Gaussian distribution, and gradually optimized during subsequent training.

[0050] The objective function follows the total loss function of the two-branch model. ,in Cross-entropy loss is used to optimize class discrimination ability; Radius boundary constraint loss is used to reduce open space risk and limit the feature distribution range of known class samples; Information entropy regularization loss is used to enhance the model's sensitivity to unknown samples. During training, the model is trained on the expanded complete training set. The model is trained on a single platform, with each training batch uniformly sampling all samples from both the old and new classes. This ensures that the model's gradient updates pay equal attention to all classes, naturally achieving the retention of old knowledge and the learning of new knowledge. This experience-replay-based strategy effectively mitigates catastrophic forgetting without the need for additional knowledge distillation or parameter regularization terms. Furthermore, the temporal feature extraction capability of the dual-branch model and the regularization effect of the adversarial reciprocal points stabilize the geometric structure of the feature space, further mitigating the drift of old class feature representations.

[0051] After each training phase is completed, the open set detection threshold is recalculated based on the new validation set data. To ensure the threshold is adapted to the updated model feature space and maintains the accuracy of unknown sample detection, the threshold calculation uses the same method as the initial stage, namely the quintile of the open set scores of known class samples in the validation set, ensuring the consistency and rationality of the threshold setting.

[0052] To address the limitation of single incremental learning methods in distinguishing between multiple unknown attack types, this method introduces a category discovery mechanism of "multi-source feature fusion + hierarchical density clustering," forming an enhanced closed loop of "detection-clustering-labeling-update." The core design idea is to improve the distinguishability of different types of unknown attacks through feature enhancement, and then use an adaptive clustering algorithm to automatically mine potential category structures, solving the classification problem of multiple unknown attacks in scenarios without manual labeling.

[0053] The open set recognition model is built based on adversarial reciprocity point learning, and the open set score of communication link traffic data in the open set recognition model is... pass Calculate, where, Represents communication link traffic data The distance between the reciprocal points of the k-th class in the open set recognition model and the total number of classes in the open set recognition model. Represents communication link traffic data Embedding features, This represents the reciprocity point of the k-th category. , express and The Euclidean distance between them express and The dot product between them.

[0054] When the opening score Less than the detection threshold or communication link traffic data When the minimum distance to all reciprocal points is greater than the learnable radius, the communication link traffic data is determined to be data of unknown attack type; where t represents the index of the last incremental learning.

[0055] Adversarial reciprocity point learning aims to solve the open set identification problem, namely, effectively distinguishing between known and unknown classes when faced with unknown categories. This paper applies this method to the detection of unknown attacks on UAV communication links. Normal traffic data and traffic data with known attack types are treated as known classes, while traffic data with unknown attack types is treated as unknown classes. Reciprocity points are introduced to leverage the features of known-type traffic data to improve the ability to model and identify potential unknown risks in the open space. Specifically, normal traffic data and known-type attack data are used to characterize the potential features of unknown-type attacks. At the same time, adversarial boundary constraints are used to reduce misclassification of unknown-type attacks. Adversarial reciprocity point learning introduces adversarial boundary constraints based on reciprocity points into the optimization objective, aiming to ensure sufficient robustness of the sample feature space, thereby improving the performance of open set intrusion detection. Specifically, it can be divided into three stages: reciprocity point initialization, embedding-reciprocity point joint optimization, and adversarial boundary constraint learning.

[0056] Reciprocity Point Initialization Phase: In adversarial reciprocity point learning, a reciprocity point is a relative representative point for each known class, located in the opposing region of the feature space. Reciprocity point initialization is the first step in the training process, aiming to provide an initial location for each class k. In this phase, a learnable reciprocity point is initialized for each known class k. The reciprocal point represents the opposite of class k in the feature space, i.e., the location with the maximum distance from class k. During training, the network will optimize and adjust this location to better reflect the class boundaries. Reciprocal Point The position is initialized using a normal distribution, and its position does not depend on any sample; instead, it is initialized independently as a global parameter. Specifically, each reciprocal point... All samples were randomly obtained from a Gaussian distribution with a mean of 0 and a standard deviation of 0.05. Assuming the embedding space has a dimension of m and the total number of categories is K, then the mutual benefit points... The initialization can be represented as This means that the location of each reciprocal point is initialized using a normal distribution, and their initial locations are randomly distributed relative to the classes. During initialization, each element of the reciprocal point matrix... The values ​​are all randomly generated and conform to a standard normal distribution, then adjusted for standard deviation by multiplying by 0.05. The mutual benefit points are learnable during training and their locations can be optimized through backpropagation.

[0057] In this way, reciprocal points are randomly initialized in the early stages of training, and their positions are then updated based on the features of the sample data and the gradient of the loss function.

[0058] Embedding-Reciprocity Point Joint Optimization Stage: In this stage, the embedding space of the feature extraction network is optimized, while the reciprocity points are also optimized. The position is determined to maximize the discriminative power between categories and to maximize the distance from known class samples to their corresponding reciprocal points.

[0059] Specifically, the reciprocity points of a category are represented by an m-dimensional vector and can be optimized using a deep embedding function C with learnable parameters θ. In this method, the deep embedding function specifically refers to a feature extraction network. Given a sample x, its feature vector, i.e., the embedding representation C(x), is obtained through the feature extraction network. C(x) and the reciprocity points... Distance between It is calculated by combining Euclidean distance and dot product.

[0060] Each known category is relative to its corresponding mutual point in both spatial location and angular direction. Euclidean distance measures the difference between a sample and its mutual point by calculating the straight-line distance between the two points; a larger value indicates a greater distance between the two points. The dot product measures the directional similarity of two vectors; it is calculated by taking the dot product between the sample's feature vector and the mutual point's vector. A larger value indicates higher directional similarity, and vice versa. The combination of Euclidean similarity and the dot product provides a more comprehensive assessment of the similarity between the sample's embedded features and the mutual point.

[0061] Adversarial boundary constraint learning phase: In the embedding-reciprocity point joint optimization phase, although maximizing the known space S... k and open space O k The spacing between centers, but without constraint on O. k The boundary. Therefore, S k and O k There may still be overlapping areas between the boundaries, which means that the risks of open space still exist.

[0062] To reduce the risk of opening a collection To construct effective class boundaries in the feature space and further enable clear distinction between known and unknown class samples, an Adversarial Margin Constraint (AMC) is introduced to constrain the open set space. In this constraint, each class k contains a positive open set space. and infinitely negative open set space For the multi-class open set recognition problem, the open set spaces of multiple classes will be merged into a single global open set space O. G ,Right now The total open set risk can be constrained by limiting the open set risk of each known class.

[0063] To separate S as much as possible k and O k The open set space O must be restricted for each known class. k This is to allow estimation of the total open set space. In other words, the goal of the study is to constrain the open set space O of known classes. k Within a limited scope, the risk of open sets for each known class is reduced. This increases the distance between negative samples of the known class and reciprocal points, ensuring that this distance does not exceed a predetermined threshold R, thereby obtaining... Clearly, managing open set risk by restricting the open set space is nearly impossible, because the open set space O k It contains a large number of unknown samples D U However, considering S k and O k They are complementary; open set risk can be indirectly limited by S. k Samples and their reciprocity points Constraints are imposed by the distance between them, and formally expressed as Where R is a learnable boundary, computed using Euclidean distance instead of a direction metric to obtain a wider range of non-k class samples. This means that if sample x and reciprocal point... If the distance between them exceeds the radius R, then the loss value is... Otherwise, the loss is 0. By minimizing this loss function, we can ensure that the distance between samples of the known class and the reciprocal points does not exceed R, thereby reducing the overlap between the known and unknown classes. For a logistic regression neural network whose layers consist of reciprocal points, sample x∈ If and only if the following conditions are met: Then L c and L o It can be minimized simultaneously.

[0064] During the adversarial boundary constraint learning phase, the optimization objective is to simultaneously minimize the mutual point classification loss L. c and adversarial boundary constraint loss L o The former aims to optimize the distance between known class samples and reciprocal points, thereby ensuring correct classification of the samples; the latter aims to prevent known samples from entering unknown class regions by limiting the maximum distance between class samples and reciprocal points. Therefore, the final total loss function L... ARPL It consists of the following two parts , where λ is a hyperparameter used to control the weights of the mutual point classification loss and the adversarial boundary constraint loss. This is achieved by minimizing the total loss L. ARPL While optimizing the classification ability of known categories, it also enhances the separation between known and unknown categories.

[0065] After introducing adversarial boundary constraints, during the training process, the network will minimize the total loss function L. ARPL To optimize the reciprocal point classification loss and adversarial boundary constraint loss, the position of reciprocal points and the distance between categories are gradually adjusted. The core of this process is to ensure that the distance between known category samples and reciprocal points does not exceed the set adversarial boundary R while optimizing category classification. This makes the gap between known category samples and reciprocal points larger, while the gap between reciprocal points of other categories smaller, preventing unknown category samples from entering the known category's region.

[0066] Adversarial boundary constraint learning is a crucial stage in adversarial reciprocity point learning. The difference between adding and not adding adversarial boundary constraints to reciprocity points is as follows: Figure 2 As shown, the adversarial boundary constraint ensures effective separation between known and unknown classes by maximizing the distance between known class samples and mutual points. By jointly optimizing the mutual point classification loss and the adversarial boundary constraint loss, the model can improve the recognition ability of known classes and effectively reject unknown classes, thus achieving excellent performance in open set recognition tasks.

[0067] In intrusion detection of UAV communication links, unknown attack types refer to attack samples that have not been seen in the training data. Since the attack patterns or features of these samples do not appear in the training set, they can be considered samples from the open set. The goal of open set identification is to enable the model to recognize known categories while avoiding misclassifying these unknown attack types as known categories. Therefore, the core issue in unknown attack type discrimination is how to distinguish between attack samples from known categories and those that have never been seen before.

[0068] Within the framework of this invention, traffic data from the UAV communication link under both unattacked and various attack conditions is primarily used to determine whether the UAV has been attacked and the type of attack. Data samples of unknown attack types did not appear during training and therefore cannot be classified as known types. The unknown attack detection method based on adversarial reciprocity points utilizes the distance between reciprocity points and sample features to not only distinguish known attack types but also accurately identify and reject unknown attack types.

[0069] Each category k corresponds to a reciprocity point. The location of a sample in the feature space represents the corresponding unknown feature space boundary of that category. By calculating the distance between a sample and the mutual points of each category, it can be determined whether the sample belongs to a known category.

[0070] Suppose that the embedding features of sample x are C(x), and the reciprocity points of class k are... Then, the distance between the sample and the reciprocal point is... The algorithm calculates the distances between a sample and all known class mutual points according to this formula, and uses these distances to determine whether the sample belongs to a known class. Based on the algorithm design, the features of unknown samples will naturally be closer to all mutual points than those of samples from known classes. The discrimination criterion is... Where δ is a preset threshold, equivalent to the one mentioned earlier. If the maximum distance from sample x to all known class reciprocal points is greater than or equal to δ, it is determined to be a known class; otherwise, it is determined to be an unknown class (i.e., an unknown type of attack).

[0071] Furthermore, the probability that a test sample x belongs to a certain known class is proportional to the distance between the farthest reciprocal point corresponding to sample x and class k, which can be formally expressed as: Where f(x) represents the feature representation of sample x, that is, when a sample is judged to be known, its feature vector is the farthest from the adversarial reciprocal point corresponding to type k, then this sample is classified into class k.

[0072] Feature extraction of unknown attack type data in the memory bank includes: extracting communication link traffic data separately. CNN features and TCN features; constructing reciprocal point distance features based on CNN feature extraction. ;in, , express and The Euclidean distance between them express and The dot product between the features is calculated; after standardizing the CNN features, TCN features, and reciprocal point distance features, they are concatenated to form a multi-source fusion feature vector; the multi-source fusion feature vector is then dimensionality-reduced to obtain clustering features.

[0073] Specifically, firstly, spatial, temporal, and reciprocal point distance features of samples are integrated through multi-source feature fusion to construct a comprehensive and accurate sample representation; then, HDBSCAN is adopted, which automatically adapts to changes in the number of unknown attack types without pre-setting the number of categories, to achieve fine-grained classification of mixed unknown attack samples; finally, new category samples with pseudo-labels are fused with known category data, and the model is updated through incremental learning to achieve dynamic expansion and accuracy improvement of the model's recognition capabilities, while optimizing the model structure to meet the computing power requirements of UAV edge computing devices.

[0074] The core of multi-source feature fusion is to integrate three types of complementary features to construct a sample representation vector that can comprehensively characterize attack behavior, thus solving the problem that a single feature is difficult to distinguish heterogeneous attacks.

[0075] The first type of feature is CNN features (numerical representations of local patterns in input data, such as edges, textures, and parts, automatically extracted by convolutional neural networks through sliding convolution kernel operations). These features are extracted using a one-dimensional convolutional neural network, which consists of multiple one-dimensional convolutional layers, batch normalization layers, LeakyReLU activation functions, and max-pooling layers. This network effectively captures local statistical features and spatial patterns in UAV communication link traffic data, reflecting the static characteristics of attack behavior. This is denoted as... ,in, Dimensions of CNN features.

[0076] The second type of feature is the TCN feature, which combines causal convolution, dilated convolution, and residual connections to achieve equal-length mapping and efficient long-term dependency modeling for sequences of arbitrary length. It is extracted through a temporal convolutional network, which employs a multi-layer causal convolutional structure with exponentially increasing dilation factors (e.g., 1, 2, 4, 8). This allows for an exponential expansion of the receptive field without significantly increasing the number of parameters, effectively capturing long-range temporal dependencies in traffic data and characterizing the dynamic evolution of attack behavior. This feature is denoted as TCN. ,in Dimensions of TCN features.

[0077] It should be noted that TCN can be replaced by LSTM, GRU or TransformerEncoder structures with long-range dependency capture capabilities.

[0078] The third type of feature is the reciprocity point distance feature, which is constructed based on the adversarial reciprocity points learned by the open set recognition model. It calculates the Euclidean distance and dot product difference between the sample CNN features and each known class of reciprocity points. ,in, Represents Euclidean distance. This represents the dot product, which concatenates the distance differences between all known categories to form a reciprocal point distance feature vector. ( (Number of known categories). This feature introduces prior knowledge of known categories and helps distinguish different types of unknown attacks through the geometric relationship between samples and reciprocal points.

[0079] After the three types of features are extracted, standardization is first performed (zero mean, unit variance) to eliminate the dimensional differences between different feature sources and ensure the effectiveness of feature fusion. Then, the standardized CNN features, TCN features, and reciprocal point distance features are directly concatenated to form a multi-source fused feature vector. , This represents the standardization operation; finally, PCA dimensionality reduction technology is used to reduce the fused feature vector to 32 dimensions (denoted as ). This process removes feature redundancy, reduces computational complexity, and retains key discrimination information, providing high-quality sample representations for subsequent clustering analysis and ensuring that the model can adapt to the computing power limitations of drones.

[0080] In terms of dimensionality reduction techniques, PCA can be replaced by UMAP (a nonlinear dimensionality reduction technique based on manifold learning and topological data analysis, which constructs a "fuzzy simplex" topological structure of high-dimensional data and finds the optimal approximate mapping in a low-dimensional space (usually 2D / 3D)) or t-SNE (a nonlinear dimensionality reduction algorithm that maps high-dimensional data to 2D / 3D space through probabilistic modeling, preserving the local neighborhood structure to the extreme to reveal complex clustering patterns, but not preserving global distance and topological relationships).

[0081] In one embodiment, the clustering method chosen is HDBSCAN. This method can automatically infer the number of categories from the inherent density structure of the data, without manual pre-setting, making it perfectly suited for scenarios where the number of unknown attack types is uncertain. Its core principle is to construct a hierarchical clustering tree based on the local density and reach distance of samples, and determine the optimal partitioning result by analyzing the clustering stability.

[0082] First, the core distance of each sample is calculated, reflecting the local density of the sample's region. Then, the cross-distance between any two samples is calculated, defined as the maximum value of the core distance and the original distance between samples. This distance design ensures that samples from low-density regions are not incorrectly merged into high-density clusters. A minimum spanning tree for the sample set is constructed based on the cross-distance matrix, encoding the global density connectivity structure of the data. A hierarchical clustering tree is constructed by sequentially deleting edges from the minimum spanning tree in ascending order of distance. The stability of each cluster at different levels (the persistence of clusters at different density scales) is calculated, and a bottom-up strategy is used to select the cluster partition with optimal stability, automatically outputting the number of clusters. Clustering label for each sample.

[0083] Regarding parameter settings, to ensure the stability of clustering results under different sample sizes, HDBSCAN employs adaptive parameter configuration: minimum cluster size. , The number of samples is unknown. (This indicates a floor function), minimum number of samples. The cluster extraction strategy used is EOM (Excess of Mass), which can effectively balance the integrity and purity of clustering.

[0084] To address potential noise points (samples with a cluster label of -1) that may arise during clustering, this method employs a specialized post-processing mechanism. When noisy data is generated during clustering, it is assigned to the cluster with the closest Euclidean distance.

[0085] First, calculate the center of each valid cluster. , For the first The sample set of each cluster is calculated; then the Euclidean distance between each noise point and the center of each cluster is calculated, and the noise point is assigned to the cluster with the closest Euclidean distance to ensure that all unknown samples can obtain effective category labeling and avoid some attack samples being unable to participate in subsequent incremental learning due to the existence of noise points.

[0086] Furthermore, at the category discovery level, HDBSCAN can be replaced by an improved DBSCAN combined with silhouette coefficient optimization (using silhouette coefficient as a quantitative indicator to evaluate the quality of DBSCAN clustering results and assist in the optimization of its core parameters (eps, min_samples)), the OPTICS algorithm (which generates ordered sequences and reachability graphs by calculating the core distance and reachability distance of points, thereby revealing the clustering structure of arbitrary shapes and multi-density levels in the data, effectively reducing the sensitivity of traditional DBSCAN to the neighborhood radius parameter), or latent space clustering based on VAE / GAN (using generative models to map high-dimensional data to a structured low-dimensional latent space, and directly or jointly optimizing clustering tasks in this space, realizing an unsupervised deep learning method that simultaneously completes representation learning and clustering).

[0087] The core of pseudo-label mapping is to transform the cluster labels obtained from clustering into continuous, ordered category labels, which facilitates subsequent model updates. An ordered mapping strategy is adopted. ,in This represents the number of currently known categories. This is the cluster index (starting from 1), and the cluster labels 1, 2, ... are assigned through this mapping. Convert to new category label , ... This ensures that the new category labels are continuous with and do not repeat existing category labels, generating the final set of pseudo-labels. .

[0088] In incremental learning, unknown attack type data with pseudo-labels are added to the existing dataset used for training the open set recognition model to form an expanded training set; the open set recognition model is then incrementally learned based on the expanded training set; in incremental learning, each training batch covers all categories of training samples in the expanded training set through uniform sampling.

[0089] The model ensemble process merges new category samples with pseudo-labels with historical known category data to form an expanded training set. ,in Labeled data for known categories. Based on the number of newly discovered categories. The output dimension of the classifier is changed from Extended to The classification weights for newly added categories are randomly initialized using a Gaussian distribution, while the classification weights for existing categories in the feature extractor are inherited from the model of the previous stage. Model training employs the same objective function as the incremental learning method. Along with the training strategy, end-to-end training is performed on an expanded training set. Batch uniform sampling covers both new and old category samples, ensuring the model learns new category knowledge without forgetting previously known category information. The accuracy of category discovery directly affects the effectiveness of subsequent incremental learning; the number of clusters obtained from clustering... When the number of true unknown attack types is consistent, the cluster purity is high (each cluster mainly contains samples of a single true category), and the clustering is complete (all true categories are found to be independent clusters), the pseudo-label quality is high, the model can quickly and accurately learn new category knowledge, and achieve an effective expansion of recognition capabilities.

[0090] In terms of anti-forgetting strategies, sample memory replay can be replaced by pseudo-sample replay based on generative models. Knowledge distillation loss (a technical solution that transfers the generalized knowledge and soft labels of a large model (teacher) to a small model (student) through a "teacher-student" architecture, so as to retain near-original model performance while significantly reducing the number of parameters, or a lightweight model trained by this) can be replaced by EWC (Elastic Weight Integration) (which limits the large changes in neural network parameters that are important for old tasks by introducing a regularization term based on the Fisher information matrix, thereby alleviating the catastrophic forgetting problem) or meta-learning strategies (a high-order management strategy for planning, monitoring and regulating the "learning process itself", the core of which is "cognition of cognition", aiming to improve learning efficiency and adaptability through self-regulation).

[0091] Furthermore, the spatial modeling of Adversarial Reciprocity Points (ARP) can be equivalently replaced by a probability fitting scheme based on Extremum Theory (EVT) and OpenMax (the open-set recognition algorithm OpenMax uses EVT to model the Weibull distribution of the distance tails from known class samples to their average activation vectors (MAV) in a deep neural network, aiming to quantify the probability of "unknown samples" and calibrate classification scores). All of these alternative schemes can maintain the "detection-discovery-evolution" closed-loop logic of this invention while implementing corresponding intrusion detection and model self-updating functions based on differences in computing power requirements or scenario characteristics.

[0092] Verification experiments were also conducted on the method of the present invention. Different attack types were treated as unknown types of attacks, and the recognition accuracy data for each attack type (including unknown type attacks and known type attacks) are shown in Table 2 below.

[0093] Table 2 As shown in Table 2, even after adding unknown attack types (first column from the left in the table), the recognition rate of the Benign class still remained above 98.4%, which strongly demonstrates the technical effectiveness of the "knowledge distillation and sample replay" mechanism in overcoming catastrophic forgetting.

[0094] In summary, this invention addresses the bottleneck problem of UAV communication link intrusion detection in dynamic and open environments. Through deep fusion of CTD feature representation, adaptive density clustering, and incremental learning techniques, it achieves a qualitative leap from "passive interception" to "active evolution." Compared to existing technologies, the advantages of this invention are mainly reflected in the following aspects: 1. Achieved fine-grained perception and semantic extraction of unknown threats: Existing technologies often only classify abnormal traffic as "Unknown," creating a blind spot in early warning. This invention constructs a CTD (CNN-TCN-Distance) heterogeneous feature vector, using "distance features" as a topological reference, greatly enhancing the inter-class separability of unknown samples in the feature space. Combined with an adaptive clustering mechanism, the system can automatically subdivide the chaotic unknown space into specific attack variant clusters and assign pseudo-labels. This allows security personnel not only to know that "there is an attack," but also to clearly understand "what kind of new attack it is," providing a basis for decision-making in subsequent targeted defense deployments. This changes the current situation where existing technologies can only achieve fuzzy "denial," enabling security personnel to accurately grasp the specific types and behavioral characteristics of new attacks, providing a basis for decision-making in subsequent targeted defense deployments.

[0095] 2. Capable of self-evolution of the model with zero human intervention: This invention constructs a closed-loop automated architecture of "detection-caching-discovery-learning". When the number of unknown samples captured by the system reaches a threshold, the system can autonomously complete category classification and model updates without manual data annotation. This "self-healing" defense mechanism solves the problem of drones being unable to perform offline retraining in a timely manner during remote missions or dynamic battlefields, ensuring that the defense strategy can be updated in real time as attack methods evolve, greatly reducing system operation and maintenance costs and security response time.

[0096] 3. This invention addresses the "catastrophic forgetting" problem in incremental learning: During knowledge base expansion, it introduces a dual mechanism of core sample memory replay and knowledge distillation. By retaining representative samples from older classes and using the old model as a "teacher" to guide the training of the new model, the weight distribution of new and old knowledge is effectively balanced. Experimental data shows that after continuously introducing multiple new attack categories, the system's detection accuracy against initially known attacks (such as DoS and replay attacks) decreases by less than 2%, achieving truly lossless knowledge increment.

[0097] 4. Significantly improved detection accuracy for complex spoofing attacks: Thanks to the ability of CNN to capture the spatial distribution of protocol fields and the ability of TCN to model long-distance temporal dependencies of traffic, this invention exhibits extremely high sensitivity to attacks with highly mimicking characteristics (such as FDI and malicious twin attacks). The fusion of multi-dimensional features enables the model to capture attack traces from the micro-fluctuations of the physical and network layers, significantly reducing the false negative and false positive rates in complex environments.

[0098] 5. Effectively compresses the risk domain of open space: By dynamically generating and optimizing adversarial reciprocal points of new categories in the feature space, this invention not only acquires new knowledge but also gradually transforms the space, originally belonging to the "uncontrollable unknown domain," into the "controllable known domain" by reshaping the feature boundaries. This continuous compression of open space substantially reduces the possibility of attackers bypassing defenses using new variants, fundamentally improving the security and robustness of unmanned aerial vehicle systems in open environments.

[0099] The core advantages of this invention are mainly reflected in three aspects: First, it provides comprehensive attack scenario coverage and complete data collection. Based on the Kali system, wireless network card, and software radio equipment, it designs and implements seven typical UAV communication link attacks, covering existing mainstream attack types and new scenarios. Simultaneously, it adopts a "single-line acquisition + dual-line backup" strategy to simultaneously acquire multi-dimensional data from the physical and network layers, solving the problem of single attack types and incomplete features in traditional datasets, thus providing high-quality support for model training. Second, it offers accurate detection of unknown attacks and strong category differentiation capabilities. By modeling unknown attack detection as an open-set recognition problem, it introduces an adversarial reciprocity point mechanism to capture open-space risks. Combined with a CNN+TCN dual-branch structure, it fully extracts the spatiotemporal features of traffic data. Simultaneously, it introduces information entropy regularization to enhance sensitivity to unknown samples, significantly improving the accuracy of unknown attack detection. Furthermore, through multi-source feature fusion and HDBSCAN adaptive clustering, it achieves automatic classification of multiple types of unknown attacks, avoiding the limitation of traditional methods that can only detect unknown attacks but cannot differentiate them. Third, the model is dynamically expandable, efficient, and robust. It achieves flexible expansion of the model's recognition range through an incremental learning strategy, without the need for full retraining. Combined with a triple anti-forgetting mechanism of parameter transfer, full data retention, and regularization constraints, it ensures that the ability to recognize known historical attacks is not lost when learning new attack knowledge. At the same time, the model structure has been optimized for lightweight design, and the training and testing efficiency is improved by more than 40% compared with traditional methods. It can adapt to the computing power requirements of edge computing devices such as drones and has strong practical application value.

[0100] In addition to the comparative experiments, this section presents ablation experiments for HDBSCAN and DBSCAN. During the feature fusion step, experiments were conducted to ablate TCN features, the distance feature between samples and mutual points, and both features, to demonstrate the contribution of each feature to the clustering results. The ablation experiment results for the HDBSCAN method are shown in Table 3, and the ablation experiment results for the DBSCAN method are shown in Table 4.

[0101] In the CT-HDBSCAN experiments shown in Table 3, the distance feature between samples and mutual points was removed. The results show that removing this feature significantly reduced clustering performance. With the Replay+Evil Twin combination, the clustering accuracy dropped to 80.22%, the NMI decreased to 61.65%, and the ARI also decreased significantly to 74.87%. In other attack combinations, such as FDI+Replay and DoS+FDI, the clustering accuracy of CT-HDBSCAN decreased to 74.32% and 93.24%, respectively, a significant difference compared to the results of CTD-HDBSCAN (89.19% and 98.65%). This indicates that the distance feature between samples and mutual points plays a crucial role in distinguishing different attack types and improving clustering accuracy. Removing this feature significantly reduced the clustering model's ability to distinguish complex attacks (such as the Replay and Evil Twin combination).

[0102] In the CD-HDBSCAN experiments, the TCN temporal features were removed. Even after removing the temporal features, the model's clustering performance remained poor, especially in complex attack combinations (such as Replay + Evil Twin), where the clustering accuracy dropped to 64.84%, significantly lower than CTD-HDBSCAN's 97.80%. In other attack combinations, such as FDI + Replay and DoS + FDI, the clustering accuracies were 77.03% and 93.24%, respectively, showing a significant performance decline compared to CTD-HDBSCAN before removing the temporal features (89.19% and 98.65%). Removing the temporal features demonstrates that temporal information is crucial for modeling dynamic patterns in attack traffic, especially in detecting dynamically changing attacks (such as Replay and FDI), where the lack of temporal features significantly worsens the clustering results.

[0103] Table 3 In the C-HDBSCAN experiments, the model retained only CNN features, removing TCN temporal features and distance features between samples and mutual points. Experimental results show that removing temporal and distance features significantly reduced clustering performance. In the Replay+Evil Twin combination, the clustering accuracy dropped to 64.84%, NMI was 55.60%, and ARI was 48.95%. Performance was also poor in other attack-type clustering tasks, especially in FDI+Replay (ClusterACC = 75.68%) and DoS+Evil Twin (ClusterACC = 75.25%). This indicates that while CNN features can provide some spatial information, retaining only CNN features fails to effectively capture temporal information and distance relationships between attack samples, resulting in poor clustering performance.

[0104] Table 4 In the CT-DBSCAN experiments shown in Table 4, the clustering performance generally decreased after removing the distance feature from the sample to the mutual point. In the Replay+Evil Twin clustering, the clustering accuracy was 80.22%, with NMI and ARI values ​​of 61.65% and 74.87%, respectively, lower than the results of CTD-DBSCAN. Similarly, in other attack combinations, such as DoS+FDI, the clustering accuracy was 78.38%, lower than the CTD-DBSCAN result (91.89%), indicating that the distance feature from the sample to the mutual point contributes to the clustering results.

[0105] In the CD-DBSCAN experiments, removing the TCN temporal features resulted in a decrease in clustering accuracy across multiple attack combinations. For example, in the Replay+Evil Twin clustering, the clustering accuracy was 80.22%, with NMI and ARI at 68.20% and 78.37%, respectively. Although the method performed well on certain attack types (such as FDI+Evil Twin) (clustering accuracy of 70.21%), overall, removing temporal features reduced the model's clustering accuracy when handling attacks with strong temporal dependencies (such as FDI+Replay).

[0106] In the C-DBSCAN experiments, the clustering performance was limited when only CNN features were retained. In the Replay+Evil Twin combination, the clustering accuracy was 83.52%, significantly lower than the CTD-DBSCAN result (89.36%). In the FDI+Evil Twin clustering task, C-DBSCAN's clustering accuracy was 44.68%, showing that relying solely on CNN features significantly limits the model's clustering ability, especially in detecting complex attacks, where performance is poor.

[0107] While CTD-DBSCAN generally outperformed other ablation methods, it exhibited some instability in certain cases. In the DoS+FDI combination, CTD-DBSCAN achieved a Cluster ACC of 91.89%, an NMI of 55.11%, and an ARI of 63.84%, showing a significant advantage over CT-DBSCAN, CD-DBSCAN, and C-DBSCAN. This indicates that in this scenario, simultaneously fusing CNN features, TCN temporal features, and distance features from samples to mutual points can effectively enhance density-based clustering results. In the FDI+Replay combination, some ablation versions showed little difference from or even slightly exceeded CTD-DBSCAN in certain metrics. However, in the FDI+Evil Twin combination, CTD-DBSCAN performed the worst, with only ARI slightly better than other methods, but its clustering results remained poor. This indicates that for DBSCAN, increasing the feature dimension and simply superimposing multi-source features does not always lead to a monotonic performance improvement. When the feature space dimension is too high or there are redundant or noisy features, it may interfere with density estimation and weaken its ability to characterize cluster structure.

[0108] From the perspective of cluster count, DBSCAN's cluster count is also quite unstable across multiple experiments. Under certain unknown attack combinations (such as DoS+Replay), all variants output only one cluster; while in combinations like Replay+Evil Twin and DoS+EvilTwin, the cluster count fluctuates between 2 and 3, which is not entirely consistent with the prior assumption of two types of unknown attack samples. This phenomenon further reflects that DBSCAN is highly sensitive to parameter settings and local data density distribution, and is prone to undersegmentation or oversegmentation, exhibiting certain deficiencies in robustness and controllability on complex network attack data.

[0109] Ablation experiments on CTD-HDBSCAN and CTD-DBSCAN show that each feature contributes to clustering performance. In complex attack types like Replay and Evil Twin, removing the distance feature from the target to the mutual point leads to a significant decrease in clustering accuracy. This feature helps provide information about the relative differences between samples, thus improving the discriminative power of clustering. Removing temporal features significantly impacts the model's ability to capture temporal changes in attack traffic, resulting in decreased clustering performance, especially in attack types with strong temporal dependencies, where the decline in clustering effect is most pronounced. CNN features can provide some spatial information about attack samples, but the clustering effect is poor without the support of temporal and distance features. While CNNs can play a role in processing static data, relying solely on CNN features is insufficient to provide enough information for accurate clustering when facing dynamically changing attack types.

[0110] The analysis of the experimental results shows that CTD-HDBSCAN, by combining CNN features, TCN temporal features, and distance features between samples and mutual points, demonstrates the best clustering performance. The role of each feature in different attack types is significant; removing any feature leads to a decrease in clustering accuracy. While CTD-DBSCAN also exhibits some clustering performance, its density-based clustering strategy is sensitive to sample distribution, and its clustering effect is less stable than that of TCD-HDBSCAN. The experimental results further validate the effectiveness and superiority of CTD-HDBSCAN in detecting dynamic unknown attacks, especially in the identification and category discovery of complex attack combinations.

[0111] The present invention also discloses a novel UAV attack category detection device based on multi-source information fusion, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement any of the above methods.

[0112] The present invention also discloses an embodiment that provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the above-described method embodiments.

[0113] The present invention also provides a computer program product that, when run on a data storage device, enables the data storage device to implement the steps in the above-described method embodiments.

[0114] If the integrated unit module is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a storage device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0115] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0116] Those skilled in the art will recognize that the algorithmic steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0117] It should be noted that the data used in the implementation of this invention were all collected or gathered through legal and compliant channels, and the collection and gathering activities fully comply with the requirements of relevant laws, regulations and industry standards; the existing technical methods involved in this invention were also obtained and used through legal and compliant means.

Claims

1. A novel UAV attack category discovery method based on multi-source information fusion, characterized in that, Includes the following steps: Acquire communication link traffic data during the flight of the UAV. The communication link traffic data includes physical layer information and network layer information. The open set score of the communication link traffic data is determined by the open set identification model, and the open set score is used to determine whether the communication link traffic data is data of an unknown attack type. When the communication link traffic data is of an unknown attack type, it is stored in the memory bank; The unknown attack type data in the memory are sequentially subjected to feature extraction and clustering to obtain pseudo-labels corresponding to the unknown attack type data. Incremental learning of the open set identification model is performed based on unknown attack type data with pseudo-labels, known attack type data with real labels, and normal communication link traffic data; among which, normal communication link traffic data refers to the communication link traffic data of the UAV when it is not under attack. The open set recognition model, based on incremental learning, is used to identify subsequent data to be detected.

2. The method for discovering novel UAV attack categories based on multi-source information fusion as described in claim 1, characterized in that, The open-set recognition model is built based on adversarial reciprocity point learning, and the open-set score of communication link traffic data in the open-set recognition model is... pass Calculate, where, Represents communication link traffic data The distance between the reciprocal points of the k-th class in the open set recognition model and the total number of classes in the open set recognition model. Represents communication link traffic data Embedding features, This represents the reciprocity point of the k-th category. , express and The Euclidean distance between them express and The dot product between them.

3. The method for discovering novel UAV attack categories based on multi-source information fusion as described in claim 2, characterized in that, When the opening score Less than the detection threshold When the communication link traffic data is determined to be of an unknown attack type, t represents the index of the last incremental learning iteration.

4. A novel UAV attack category discovery method based on multi-source information fusion as described in claim 2 or 3, characterized in that, Feature extraction of unknown attack type data in the memory bank includes: Extract communication link traffic data separately CNN features and TCN features; Constructing mutual point distance features based on CNN feature extraction ;in, , express and The Euclidean distance between them express and dot product between; After standardizing the CNN features, TCN features, and reciprocal point distance features, they are concatenated to form a multi-source fusion feature vector. The multi-source fusion feature vector is dimensionality reduced to obtain clustering features.

5. A novel UAV attack category discovery method based on multi-source information fusion as described in claim 4, characterized in that, When noisy data is generated during clustering, the noisy data is assigned to the cluster with the closest Euclidean distance.

6. The method for discovering novel UAV attack categories based on multi-source information fusion as described in claim 5, characterized in that, In incremental learning, data of unknown attack types with pseudo-labels are added to the existing dataset used for training the open set recognition model to form an expanded training set. Incremental learning of the open set recognition model is performed based on an expanded training set; In incremental learning, each training batch covers all classes of training samples in the expanded training set through uniform sampling.

7. A novel UAV attack category detection device based on multi-source information fusion, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, The processor executes a computer program to implement the method as claimed in any one of claims 1-6.

Images