Unmanned equipment threat detection method and system based on cloud-edge collaborative behavior hypergraph

Abstract

The application discloses an unmanned equipment threat detection method and system based on cloud edge collaborative behavior hypergraph, relates to the network technical field, obtains threat behavior identification related fields by processing multi-source observation data, divides into multiple threat behavior segments, and carries out sensitive detail suppression and minimum behavior semantic extraction processing to obtain a local behavior semantic evidence set; the encoded local behavior semantic evidence set is subjected to constrained semantic completion processing to obtain an enhanced behavior semantic evidence set, the correlation strength of the enhanced behavior semantic evidence set is calculated, the correlation relationship is constructed between two enhanced behavior semantic evidences corresponding to the first correlation strength, the global correlation structure is obtained, and the threat correlation expression capability across unmanned equipment nodes, across communication links, across task stages, across time windows and across attack stages can be enhanced; a behavior hypergraph is constructed, threat risk results and key evidences are obtained through aggregation analysis of the behavior hypergraph, and the accuracy of the threat risk results and the key evidences can be improved.

Description

Technical Field

[0001] This invention relates to the field of network technology, specifically to a method and system for threat detection of unmanned equipment based on cloud-edge collaborative behavioral hypergraphs. Background Technology

[0002] With the rapid development of drones, unmanned vehicles, unmanned surface vessels, unmanned underwater vehicles, inspection robots, unmanned platforms, and multi-unmanned equipment collaborative systems, unmanned equipment has been widely applied in scenarios such as inspection and monitoring, emergency rescue, border patrol, port operations, marine monitoring, logistics and transportation, hazardous environment operations, and intelligent combat support. Unmanned equipment systems typically consist of the unmanned equipment itself, mission payloads, edge computing nodes, communication relay nodes, ground control stations, mission management platforms, and cloud or central-side analysis platforms, and achieve collaborative operation through wireless communication links, dedicated communication networks, mission control links, and data backhaul links. During operation, the unmanned equipment continuously generates multi-source raw observation data, including communication traffic, control commands, telemetry data, mission logs, equipment status, positioning trajectories, payload status, system audit records, anomaly alarms, and edge computing process records.

[0003] Unlike typical fixed network environments, the operating environment of unmanned equipment is characterized by high node mobility, dynamic changes in communication links, high requirements for mission continuity, limited equipment computing power and energy consumption, wide distribution of edge nodes, complex mission payload types, and a high degree of dependence on cloud-edge collaboration. Related threats or abnormal behaviors often no longer manifest as isolated events on a single device, but rather evolve gradually across multiple unmanned equipment nodes, multiple communication links, multiple mission stages, multiple time segments, and multiple observation sources. For example, attackers may affect the safe operation of unmanned equipment through abnormal access, communication interference, control command tampering, mission link hijacking, malicious configuration changes, payload data theft, denial-of-service attacks, or cross-equipment propagation. Evidence of these threats is usually scattered across different unmanned equipment, different edge nodes, different communication windows, and different mission stages; relying solely on single-point detection is insufficient to accurately reconstruct the complete threat process.

[0004] Existing safety monitoring methods for unmanned equipment rely on centralized analysis, typically assuming that cloud or central platforms can obtain relatively complete communication traffic, task logs, control commands, and equipment status data. However, in actual operation, edge unmanned equipment nodes are numerous, operating areas are dispersed, communication link bandwidth is limited, and raw observation data is continuously generated with strong real-time requirements. Centrally transmitting all raw data to the cloud or central analysis platform would not only increase the burden of communication transmission, storage, and computation but could also cause task response delays, affecting the unmanned equipment's on-site handling capabilities and task continuity. Furthermore, the raw data may contain sensitive information such as task trajectories, control strategies, payload status, communication relationships, and platform operation details; direct centralized transmission would also increase data exposure and security management risks.

[0005] Meanwhile, unmanned equipment systems typically require cloud-based or central platforms to provide capabilities such as global security analysis, threat intelligence updates, rule base maintenance, mission strategy coordination, and cross-equipment risk assessment. Individual unmanned equipment or edge nodes can only observe local behavioral fragments, making it difficult to independently determine complex threat relationships across equipment, links, and mission phases. While cloud-based or central platforms possess stronger global analysis capabilities, they also struggle to accurately identify complex threats from fragmented evidence without unified semantic representation, constrained completion, and global correlation recovery mechanisms for local behavioral evidence from the edge side.

[0006] Therefore, when using methods in related technologies for threat detection, they mainly focus on modeling single devices, single communication windows, or local behavioral sequences, making it difficult to express the multi-node, multi-link, and multi-stage evolutionary relationships in collaborative tasks of unmanned equipment. Although existing graph-based security detection methods can describe the relationships between entities, ordinary graph structures often represent pairwise dependencies with binary edges, making it difficult to characterize the high-order collaborative behavior involving multiple semantic elements such as control commands, communication behaviors, equipment states, task stages, payload states, and risk cues within the same unmanned equipment operating context. This increases the error of threat detection results and thus reduces their accuracy. Summary of the Invention

[0007] The purpose of this invention is to provide a method and system for detecting threats to unmanned equipment based on cloud-edge collaborative behavioral hypergraphs, in order to solve the problem in related technologies that it is difficult to accurately detect complex threat associations across unmanned equipment nodes, communication links, mission stages, and time windows without centralized transmission of complete original observation data.

[0008] To achieve the above objectives, in a first aspect, the present invention provides a method for threat detection of unmanned equipment based on a cloud-edge collaborative behavioral hypergraph, comprising:

[0009] The multi-source observation dataset generated by edge unmanned equipment nodes in a preset scenario during the operation of the unmanned equipment is obtained. The multi-source observation data is processed by field normalization, noise filtering and threat behavior related field filtering methods to obtain threat behavior identification related fields. The preset scenario is the usage scenario of the unmanned equipment.

[0010] The threat behavior identification-related fields are divided into multiple threat behavior segments. Sensitive detail suppression and minimal behavior semantic extraction are performed on multiple threat behavior segments to obtain a local behavior semantic evidence set. Each threat behavior segment includes closed-loop behavior data related to potential threat behaviors generated by the target unmanned equipment within a preset time period. The closed-loop behavior data includes at least the behavior subject, behavior action, behavior object, occurrence time, and behavior result or status feedback.

[0011] Semantic encoding is performed on the local behavioral semantic evidence set, and constrained semantic completion processing is performed on the encoded local behavioral semantic evidence set according to preset constraints to obtain an enhanced behavioral semantic evidence set. The preset constraints include threat intelligence summary constraints, rule base update constraints, semantic prototype library constraints, relation pattern library constraints, task phase clue library constraints, and attack phase clue library constraints.

[0012] Calculate the association strength between any two enhanced behavioral semantic evidences in the enhanced behavioral semantic evidence set, obtain multiple association strengths, determine the first association strength that is greater than or equal to the first preset association threshold, and construct an association relationship between the two enhanced behavioral semantic evidences corresponding to the first association strength to obtain the global association structure.

[0013] A behavioral hypergraph is constructed based on an enhanced behavioral semantic evidence set and a global association structure. The node features, hyperedge relationships, and global association structure in the behavioral hypergraph are aggregated and analyzed to obtain the threat and risk results of the preset scenario and the corresponding key evidence.

[0014] Optionally, the construction of the behavior hypergraph based on the enhanced behavioral semantic evidence set and global association structure includes:

[0015] Identify the semantic tags, role labels, task phase clues, attack phase clues, and contextual risk clues for each augmented behavior semantic evidence in the augmented behavior semantic evidence set. Construct semantic nodes using semantic tags, role labels, task phase clues, attack phase clues, and contextual risk clues respectively. Construct a set of nodes consisting of multiple semantic nodes belonging to the same augmented behavior semantic evidence as an intra-evidence hyperedge.

[0016] Determine the second association strength in the global association structure that is greater than the second preset association threshold, construct a cross-evidence hyperedge between the two enhanced behavioral semantic evidences corresponding to the second association strength, and obtain a behavioral hypergraph, wherein the first preset association threshold is less than the second preset association threshold.

[0017] Optionally, the local behavioral semantic evidence set is expressed by the following computational formula:

[0018] ;

[0019] in, For local behavioral semantic evidence set, For the first A collection of local behavioral semantic evidence from edge unmanned equipment nodes. This represents the total number of edge unmanned equipment nodes. This is the union operation for sets;

[0020] The local behavioral semantic evidence in the set of local behavioral semantic evidence is expressed by the following computational formula:

[0021] ;

[0022] in, For the first action fragment in the collection The first edge unmanned equipment node Local behavioral semantic evidence generated from individual behavioral fragments F e ( b i,j () is defined as the minimum behavioral semantic extraction function deployed on each edge node. For the first action fragment in the collection The first edge unmanned equipment node A behavioral segment, Semantic markers for key behaviors, Description of character relationships To compress contextual features, This serves as a clue for the current stage.

[0023] Optionally, the suppression of sensitive details in multiple threatening behavior segments includes:

[0024] Identify sensitive details in multiple threat behavior segments, including network addresses, location trajectories, mission area information, control command parameters, file paths, mission files, payload data access paths, actual device identifiers, platform numbers, and communication identifiers.

[0025] Map network addresses in sensitive detail data to node category labels, map location trajectories and task area information in sensitive detail data to area category labels, map control command parameters in sensitive detail data to control category labels, map file paths, task files, and payload data access paths in sensitive detail data to abstract labels, and map actual device identifiers, platform numbers, and communication identifiers in sensitive detail data to locally anonymous node identifiers.

[0026] Remove reversibly recoverable multi-source field values ​​from sensitive detail data, as well as the mapping relationship between multi-source field values ​​and abstract labels.

[0027] Optionally, the constrained semantic completion is expressed by the following computational formula:

[0028] ;

[0029] in, A common index for locally generated behavioral semantic evidence and its corresponding enhanced behavioral semantic evidence, after unified numbering. For the first Semantic evidence of local behavior To The first result obtained after constrained semantic completion An enhanced behavioral semantic evidence, For semantic completion functions, To and Relevant candidate context information.

[0030] Optionally, calculating the association strength between any two pieces of enhanced behavioral semantic evidence in the enhanced behavioral semantic evidence set includes:

[0031] Determine the semantic similarity, role consistency, phase continuity, temporal proximity, and risk coupling degree between any two pieces of enhanced behavioral semantic evidence;

[0032] The association strength between any two enhanced behavioral semantic evidences is calculated based on semantic similarity, role consistency, phase continuity, temporal proximity, and risk coupling.

[0033] Optionally, the correlation strength is expressed by the following formula:

[0034] ;

[0035] in, For the first The first enhanced behavioral semantic evidence and the first The strength of the association between semantic evidence of enhanced behavior To enhance the numbering of behavioral semantic evidence, These are the weight parameters corresponding to semantic similarity. For the first The first enhanced behavioral semantic evidence and the first Semantic similarity between enhanced behavioral semantic evidence The weight parameters corresponding to role consistency. For the first The first enhanced behavioral semantic evidence and the first Role consistency among enhanced behavioral semantic evidence The weight parameters are those corresponding to the continuity of the stages. For the first The first enhanced behavioral semantic evidence and the first Stage continuity between enhanced behavioral semantic evidence The weighting parameters are those corresponding to time proximity. For the first The first enhanced behavioral semantic evidence and the first Temporal proximity between semantic evidence of enhanced behavior The weight parameters are those corresponding to the degree of risk coupling. For the first The first enhanced behavioral semantic evidence and the first Risk coupling between enhanced behavioral semantic evidence.

[0036] Optionally, the detection method further includes:

[0037] Based on the threat risk results and the key evidence, an edge-side response suggestion is generated and transmitted to the corresponding edge unmanned equipment node in the preset scenario, so that the edge unmanned equipment node executes the edge-side response suggestion.

[0038] Secondly, the present invention also provides a threat detection system for unmanned equipment based on cloud-edge collaborative behavior hypergraph, including a data processing module, a semantic extraction module, an encoding constraint module, a calculation module and an analysis module;

[0039] The data processing module is used to acquire multi-source observation datasets generated by edge unmanned equipment nodes in a preset scenario during the operation of the unmanned equipment. The multi-source observation data is processed through field normalization, noise filtering, and threat behavior-related field filtering methods to obtain threat behavior identification-related fields. The preset scenario is the usage scenario of the unmanned equipment.

[0040] The semantic extraction module is used to divide the threat behavior identification related fields into multiple threat behavior segments, perform sensitive detail suppression and minimum behavior semantic extraction processing on multiple threat behavior segments, and obtain a local behavior semantic evidence set. Each threat behavior segment includes closed-loop behavior data related to potential threat behaviors generated by the target unmanned equipment within a preset time period. The closed-loop behavior data includes at least the behavior subject, behavior action, behavior object, occurrence time, and behavior result or status feedback.

[0041] The encoding constraint module is used to semantically encode the local behavioral semantic evidence set and perform constrained semantic completion processing on the encoded local behavioral semantic evidence set according to preset constraints to obtain an enhanced behavioral semantic evidence set. The preset constraints include threat intelligence summary constraints, rule base update constraints, semantic prototype library constraints, relation pattern library constraints, task phase clue library constraints, and attack phase clue library constraints.

[0042] The calculation module is used to calculate the association strength between any two enhanced behavior semantic evidences in the enhanced behavior semantic evidence set, obtain multiple association strengths, determine the first association strength that is greater than or equal to the first preset association threshold, and construct an association relationship between the two enhanced behavior semantic evidences corresponding to the first association strength to obtain a global association structure.

[0043] The analysis module is used to construct a behavior hypergraph based on the enhanced behavioral semantic evidence set and the global association structure. It performs aggregate analysis on the node features, hyperedge relationships and global association structure in the behavior hypergraph to obtain the threat risk results of the preset scenario and the corresponding key evidence.

[0044] The above technical solution processes multi-source observation data using field normalization, noise filtering, and threat behavior-related field selection methods to obtain threat behavior identification-related fields. These fields are then divided into multiple threat behavior segments, and sensitive detail suppression and minimum behavior semantic extraction are performed on these segments to obtain a local behavior semantic evidence set. This reduces the communication, storage, and computational overhead associated with centralized transmission of multi-source observation data. The local behavior semantic evidence set is then semantically encoded, and constrained semantic completion is performed based on preset constraints to obtain an enhanced behavior semantic evidence set. Finally, any two values ​​in the enhanced behavior semantic evidence set are calculated. The system calculates the correlation strength between enhanced behavioral semantic evidence, obtains multiple correlation strengths, determines a first correlation strength that is greater than or equal to a first preset correlation threshold, and constructs a correlation relationship between two enhanced behavioral semantic evidences corresponding to the first correlation strength to obtain a global correlation structure. This enhances the ability to express complex threat correlations across unmanned equipment nodes, communication links, mission phases, time windows, and attack phases. Based on the enhanced behavioral semantic evidence set and the global correlation structure, a behavioral hypergraph is constructed. The node features, hyperedge relationships, and global correlation structure in the behavioral hypergraph are aggregated and analyzed to obtain the threat risk results of the preset scenario and the corresponding key evidence hyperedges, which can improve the accuracy of the threat risk results and key evidence hyperedges.

[0045] Other features and advantages of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0046] Figure 1 This is a schematic diagram illustrating a threat detection method for unmanned equipment based on a cloud-edge collaborative behavioral hypergraph according to an exemplary embodiment of the present invention.

[0047] Figure 2 This is a flowchart illustrating a threat detection method for unmanned equipment based on a cloud-edge collaborative behavioral hypergraph according to an exemplary embodiment of the present invention.

[0048] Figure 3 This is a schematic diagram illustrating the process of multi-source observation dataset processing and local behavioral semantic evidence generation according to an exemplary embodiment of the present invention.

[0049] Figure 4 This is a schematic diagram illustrating the semantic completion, cloud-edge security collaboration, and global association structure process according to an exemplary embodiment of the present invention.

[0050] Figure 5 This is a flowchart illustrating the construction of a behavioral hypergraph according to an exemplary embodiment of the present invention.

[0051] Figure 6This is a schematic diagram illustrating the threat detection and key evidence extraction process according to an exemplary embodiment of the present invention.

[0052] Figure 7 This is a schematic diagram illustrating the process of generating edge-side response suggestions according to an exemplary embodiment of the present invention. Detailed Implementation

[0053] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, so as to provide a better understanding of the concept of the present invention, the technical problem solved, the technical features constituting the technical solution, and the technical effects brought about.

[0054] like Figure 1 As shown, Figure 1 This is a schematic diagram illustrating a threat detection method for unmanned equipment based on a cloud-edge collaborative behavioral hypergraph according to an exemplary embodiment of the present invention, with reference to... Figure 1 The method includes;

[0055] S101: Obtain the multi-source observation dataset generated by the edge unmanned equipment nodes in the preset scenario during the operation of the unmanned equipment. Process the multi-source observation data through field normalization, noise filtering and threat behavior related field filtering methods to obtain threat behavior identification related fields. The preset scenario is the unmanned equipment usage scenario.

[0056] S102: Divide the threat behavior identification related fields into multiple threat behavior segments, perform sensitive detail suppression and minimum behavior semantic extraction processing on multiple threat behavior segments to obtain a local behavior semantic evidence set. Each threat behavior segment includes closed-loop behavior data related to potential threat behaviors generated by the target unmanned equipment within a preset time period. The closed-loop behavior data includes at least the behavior subject, behavior action, behavior object, occurrence time, and behavior result or status feedback.

[0057] S103: Semantically encode the local behavioral semantic evidence set, and perform constrained semantic completion processing on the encoded local behavioral semantic evidence set according to preset constraints to obtain an enhanced behavioral semantic evidence set. The preset constraints include threat intelligence summary constraints, rule base update constraints, semantic prototype library constraints, relation pattern library constraints, task phase clue library constraints, and attack phase clue library constraints.

[0058] S104: Calculate the association strength between any two enhanced behavior semantic evidences in the enhanced behavior semantic evidence set, obtain multiple association strengths, determine the first association strength that is greater than or equal to the first preset association threshold, and construct an association relationship between the two enhanced behavior semantic evidences corresponding to the first association strength to obtain the global association structure.

[0059] S105: Construct a behavioral hypergraph based on the enhanced behavioral semantic evidence set and global association structure, and perform aggregate analysis on the node features, hyperedge relationships and global association structure in the behavioral hypergraph to obtain the threat risk results of the preset scenario and the corresponding key evidence.

[0060] The above technical solution processes multi-source observation data using field normalization, noise filtering, and threat behavior-related field selection methods to obtain threat behavior identification-related fields. These fields are then divided into multiple threat behavior segments, and sensitive detail suppression and minimum behavior semantic extraction are performed on these segments to obtain a local behavior semantic evidence set. This reduces the communication, storage, and computational overhead associated with centralized transmission of multi-source observation data. The local behavior semantic evidence set is then semantically encoded, and constrained semantic completion is performed based on preset constraints to obtain an enhanced behavior semantic evidence set. Finally, any two values ​​in the enhanced behavior semantic evidence set are calculated. The system calculates the correlation strength between enhanced behavioral semantic evidence, obtains multiple correlation strengths, determines a first correlation strength that is greater than or equal to a first preset correlation threshold, and constructs a correlation relationship between two enhanced behavioral semantic evidences corresponding to the first correlation strength to obtain a global correlation structure. This enhances the ability to express complex threat correlations across unmanned equipment nodes, communication links, mission phases, time windows, and attack phases. Based on the enhanced behavioral semantic evidence set and the global correlation structure, a behavioral hypergraph is constructed. The node features, hyperedge relationships, and global correlation structure in the behavioral hypergraph are aggregated and analyzed to obtain the threat risk results of the preset scenario and the corresponding key evidence hyperedges, which can improve the accuracy of the threat risk results and key evidence hyperedges.

[0061] To enable those skilled in the art to better understand the unmanned equipment threat detection method based on cloud-edge collaborative behavioral hypergraph provided by this invention, the above steps are illustrated in detail below.

[0062] For example, the preset scenario can be a scenario of unmanned equipment operation, which may include drones, unmanned vehicles, unmanned surface vessels, etc. This preset scenario can be a safety protection scenario for unmanned equipment, particularly applicable to drone inspections, unmanned vehicle patrols, unmanned surface vessel maritime monitoring, unmanned underwater vehicle mission execution, inspection robot operations, unmanned platform operation, and multi-unmanned equipment collaborative mission scenarios. These scenarios typically involve components such as the unmanned equipment itself, mission payload, edge computing nodes, communication relay nodes, ground control stations, mission management platforms, and cloud or central-side analysis platforms. During operation, these devices continuously generate multi-source observation datasets, including communication traffic, control commands, telemetry data, equipment status, positioning trajectories, mission logs, payload status, and safety alarms.

[0063] Edge unmanned equipment nodes can be autonomous unmanned platforms equipped with airborne or vehicle-mounted edge computing units. In a preset scenario, multiple edge unmanned equipment nodes can be included. Each edge unmanned equipment node can include a drone, unmanned vehicle, unmanned surface vessel, unmanned underwater vehicle, inspection robot, unmanned platform, edge computing terminal, communication relay node, mission payload node, ground control node, or other computing nodes deployed at the unmanned equipment mission site. Each edge unmanned equipment node locally collects multi-source observation datasets generated during the unmanned equipment's operation. These multi-source observation datasets can be one or more of the following: communication traffic, control commands, telemetry data, mission logs, equipment status, positioning trajectory, payload status, edge computing process records, system audit records, and security alarm information. This embodiment of the invention does not specifically limit the types of datasets. The preset scenario includes multiple edge unmanned equipment nodes, thus obtaining multiple multi-source observation datasets, each corresponding to one edge unmanned equipment node.

[0064] In a multi-source observation dataset, the first The multi-source observation dataset collected by an edge unmanned equipment node within one analysis cycle can be expressed by the following formula:

[0065] ;

[0066] Among them, R i Indicates the first i Multi-source observation datasets collected by edge unmanned equipment nodes; r i,t Indicates the first i The t-th multi-source observation data in a number of edge unmanned equipment nodes; i Indicates the node index of edge unmanned equipment; t This represents the index of the multi-source observation data in the multi-source observation dataset; T i Indicates the first i The number of multi-source observation data collected by each edge unmanned equipment node during this analysis period; 1≤ t ≤ T i Indicates index t The range of values ​​for .

[0067] like Figure 2 and Figure 3 As shown, multi-source observation datasets R can be observed through edge unmanned equipment nodes. iThe process involves field normalization, noise filtering, and selection of threat behavior-related fields. Specifically, this involves normalizing the fields in the multi-source observation dataset, standardizing the time format, removing duplicate records, filtering noisy fields, marking missing fields, and selecting behavior-related fields. Fields relevant to threat behavior identification are retained, including the subject of the behavior, the action, the object of the behavior, the communication direction, the time segment, the control command type, the device status, the task stage, the load status, the alarm type, and local statistical features, ultimately yielding the threat behavior identification-related fields.

[0068] For example, after obtaining the threat behavior identification fields, these fields can be divided into multiple threat behavior segments based on temporal proximity, entity relevance, and behavioral continuity. Specifically, when dividing threat behavior segments, closed-loop data belonging to the same edge unmanned equipment node and generating threat behaviors within a preset time period are grouped into one threat behavior segment.

[0069] like Figure 2 and Figure 3 As shown, the edge unmanned equipment nodes then perform sensitive detail suppression and minimal behavioral semantic extraction on multiple threat behavior fragments to generate a local behavioral semantic evidence set. Minimal behavioral semantic extraction can be a method of stripping redundant background, irrelevant noise, invalid pixels, or sensor values ​​from multimodal raw perception data, extracting only the smallest semantic units that constitute a complete and indivisible behavior, and outputting minimally structured behavioral units. The local behavioral semantic evidence set is used to retain the behavioral semantics, role relationships, stage clues, and compressed contextual features required for threat detection without centralized transmission of complete raw observation data, and serves as the minimized semantic input for transmission to the cloud or central analysis platform. The local behavioral semantic evidence set is expressed by the following computational formula:

[0070] ;

[0071] in, For local behavioral semantic evidence set, For the first A collection of local behavioral semantic evidence from edge unmanned equipment nodes. This represents the total number of edge unmanned equipment nodes. This is the union operation for sets;

[0072] Local behavioral semantic evidence in the local behavioral semantic evidence set is expressed by the following computational formula:

[0073] ;

[0074] in, For the first action fragment in the collection The first edge unmanned equipment node Local behavioral semantic evidence generated from individual behavioral fragments F e ( b i,j () is defined as the minimum behavioral semantic extraction function deployed on each edge node. For the first action fragment in the collection The first edge unmanned equipment node A behavioral segment, Key behavioral semantic markers in local behavioral semantic evidence are used to describe behavioral types or threat semantics, including one or more of the following: scanning, authentication failure, abnormal access, abnormal access, command execution, data collection, remote communication, denial of service, lateral connection, abnormal control commands, communication interference, task link hijacking, or abnormal access to payload data. This refers to the description of role relationships in local behavioral semantic evidence, used to describe the acting subject, the acting object, and their relationships, including one or more of the following: source, target, executor, payload, affected unmanned equipment, communication relay node, ground control node, mission management node, or controlled object. These are compressed contextual features in local behavioral semantic evidence, used to describe temporal density, behavioral intensity, number of connections, access frequency, number of failures, packet length statistics, command frequency, device status changes, load status changes, or number of alarms. These are phase clues in the semantic evidence of localized behavior, used to describe the attack phase that the behavior segment may correspond to, including one or more of reconnaissance, initial access, execution, lateral movement, command and control, data collection, or data transmission. The phase clues may also include mission phase markers, communication phase markers, or equipment status phase markers related to the operation of unmanned equipment.

[0075] When generating local behavioral semantic evidence, edge unmanned equipment nodes perform sensitive detail suppression and minimal behavioral semantic extraction to obtain a local behavioral semantic evidence set. The sensitive detail data includes network address, location trajectory, mission area information, control command parameters, file path, mission file, payload data access path, actual equipment identifier, platform number, and communication identifier.

[0076] In possible ways, the suppression of sensitive details of multiple threatening behavior segments includes:

[0077] Identify sensitive details in multiple threat behavior segments, including network addresses, location trajectories, mission area information, control command parameters, file paths, mission files, payload data access paths, actual device identifiers, platform numbers, and communication identifiers.

[0078] Map network addresses in sensitive detail data to node category labels, map location trajectories and task area information in sensitive detail data to area category labels, map control command parameters in sensitive detail data to control category labels, map file paths, task files, and payload data access paths in sensitive detail data to abstract labels, and map actual device identifiers, platform numbers, and communication identifiers in sensitive detail data to locally anonymous node identifiers.

[0079] Remove reversibly recoverable multi-source field values ​​from sensitive detail data, as well as the mapping relationship between multi-source field values ​​and abstract labels.

[0080] It should be understood that node category labels can include labels for edge unmanned equipment nodes, ground control nodes, communication relay nodes, cloud or central-side nodes, mission management nodes, external remote nodes, or unknown remote nodes. Area category labels can include mission area categories, track segment categories, inspection area categories, and unknown area categories. Control category labels can include labels for attitude control, path adjustment, speed adjustment, mission switching, payload control, return-to-home control, remote execution, or anomaly control. Abstract labels can include system directory access, mission data access, payload data access, temporary directory access, or unknown path access.

[0081] For example, after obtaining the local behavioral semantic evidence set, such as Figure 2 and Figure 4As shown, semantic encoding can be performed on local behavioral semantic evidence in a local behavioral semantic evidence set. Then, constrained semantic completion processing is performed on the encoded local behavioral semantic evidence set according to preset constraints to obtain an enhanced behavioral semantic evidence set. The preset constraints include threat intelligence summary constraints, rule base update constraints, semantic prototype library constraints, relational pattern library constraints, task phase clue library constraints, and attack phase clue library constraints. Threat intelligence summary constraints require that the completed threat type candidate, attack phase clue, or behavioral semantic tag matches the attack behavior pattern, attack phase description, threat type description, or risk level description in the threat intelligence summary. Rule base update constraints require that the completion result satisfies preset behavior identification rules, anomaly judgment rules, field combination rules, threshold judgment rules, risk level judgment rules, or conflict elimination rules in the rule base. Semantic prototype library constraints require that the similarity between the completed result and the target semantic prototype in the semantic prototype library is greater than or equal to a preset prototype matching threshold, or that the completed behavioral semantic tag, threat type candidate, or attack phase clue belongs to the target semantic prototype. The prototype corresponds to a predefined label range; the relational pattern library constraint ensures that the relationships between the completed subject, action, object, communication link, task object, or payload object conform to the preset relational patterns in the relational pattern library; the task phase clue library constraint ensures that the completed task phase clues match the current task area, track segment, inspection phase, communication phase, task switching state, or task execution state; the attack phase clue library constraint ensures that the completed attack phase clues conform to a preset attack phase set or attack phase transfer relationship, wherein the preset attack phase set includes one or more of reconnaissance, initial access, execution, lateral movement, command and control, data collection, and data transmission.

[0082] The constrained semantic completion is expressed by the following computational formula:

[0083] ;

[0084] in, A common index for locally generated behavioral semantic evidence and its corresponding enhanced behavioral semantic evidence, after unified numbering. For the first Semantic evidence of local behavior To The first result obtained after constrained semantic completion An enhanced behavioral semantic evidence, For semantic completion functions, To and Relevant candidate context information.

[0085] Constrained semantic completion processing can include role clue completion, mission phase clue completion, attack phase clue completion, threat type candidate completion, contextual semantic disambiguation, and cross-segment weak association markers. The completion process is limited to a predefined set of fields and does not generate open-ended text content unrelated to unmanned equipment threat detection.

[0086] In another possible approach, after obtaining the local behavioral semantic evidence set, it can first undergo unified numbering, semantic encoding, and candidate context retrieval processing. Candidate contexts include semantic prototypes, relational patterns, task phase clues, attack phase clues, threat intelligence summaries, rule base updates, or security policy templates. Then, the processed local behavioral semantic evidence set is further processed using the methods described above to obtain an enhanced behavioral semantic evidence set.

[0087] In another possible approach, a local behavioral semantic evidence set can be received via a cloud-based or central-side analysis platform. This local behavioral semantic evidence set can then be processed as described above to obtain an enhanced behavioral semantic evidence set, enabling cloud-edge collaborative processing. This cloud-edge collaboration refers to the collaborative processing between the cloud-based or central-side analysis platform and edge unmanned equipment nodes. The edge unmanned equipment nodes are responsible for raw observation data acquisition, preprocessing, and generating local behavioral semantic evidence; the cloud-based or central-side analysis platform is responsible for semantic completion, global correlation recovery, behavioral hypergraph construction, threat detection, and response suggestion generation. The cloud-based or central-side analysis platform can be a mission center, an edge cloud platform, a private cloud platform, a central-side security analysis platform, or a centralized analysis node deployed in the unmanned equipment mission network, and is not limited to an external public cloud.

[0088] In this way, cloud-based or central-side analysis platforms can supplement fragmented local behavioral semantic evidence from different edge unmanned equipment nodes into enhanced behavioral semantic evidence, providing a more complete input for subsequent global correlation recovery.

[0089] In another possible approach, when local behavioral semantic evidence suffers from low confidence in completion, conflicting candidate results, or severe missing key fields, constrained corrections can be applied to whitelisted fields such as role clues, task phase clues, attack phase clues, threat type candidates, and cross-segment semantic disambiguation tags. This process does not restore the original fields on the edge side, nor does it output unverified open content. The constraints of this constrained correction are preset constraints. This step can be completed within the difficult evidence-assisted arbitration unit; however, this embodiment of the invention does not specifically limit its implementation.

[0090] The difficult evidence-assisted arbitration unit can be implemented using rule-based reasoning models, domain knowledge bases, statistical discrimination models, language models, or combinations thereof. Regardless of the implementation method, this difficult evidence-assisted arbitration unit is triggered only when the completion confidence is low, candidate results conflict, or key fields are severely missing. It only performs constrained corrections on predefined fields, does not restore the original observation data on the edge side, and does not output open content that has not been structurally validated.

[0091] For example, after obtaining the semantic evidence of enhanced behavior, the correlation strength between different pieces of semantic evidence of enhanced behavior is calculated, and the global correlation structure across unmanned equipment nodes, communication links, mission phases, time windows, observation sources, and attack phases is recovered based on the correlation strength. The specific process is as follows: Figure 4 As shown.

[0092] When the correlation strength When the threshold is greater than or equal to the first preset association threshold, it indicates that there is a valid association between the two enhanced behavioral semantic evidences, thus establishing an association relationship. In this way, it is possible to recover the global association structure across unmanned equipment nodes, communication links, mission phases, time windows, observation sources, and attack phases from the originally scattered local behavioral semantic evidence.

[0093] This global correlation structure is used to describe the potential dependencies between enhanced behavioral semantic evidence, including lateral correlations within the same attack phase, evolutionary correlations between different attack phases, propagation correlations between different unmanned equipment nodes, collaborative correlations between different communication links, connection correlations between different mission phases, and complementary correlations between different observation sources.

[0094] In one possible manner, calculating the association strength between any two pieces of enhanced behavioral semantic evidence in the enhanced behavioral semantic evidence set includes:

[0095] Determine the semantic similarity, role consistency, phase continuity, temporal proximity, and risk coupling degree between any two pieces of enhanced behavioral semantic evidence;

[0096] The association strength between any two enhanced behavioral semantic evidences is calculated based on semantic similarity, role consistency, phase continuity, temporal proximity, and risk coupling.

[0097] It should be understood that association strength can be a numerical indicator that quantifies the degree of semantic relevance, role association, phase continuity, temporal proximity, and risk coupling between any two pieces of augmented behavior semantic evidence. In this embodiment of the invention, the corresponding association strength can be calculated based on the semantic similarity, role consistency, phase continuity, temporal proximity, and risk coupling between two pieces of augmented behavior semantic evidence. Semantic similarity refers to the degree of similarity between behavioral semantic tags, threat type candidates, attack phase clues, or semantic vectors in two pieces of augmented behavior semantic evidence; role consistency refers to the degree of matching between the subject, object, executor, affected unmanned equipment node, communication link, task object, or payload object in two pieces of augmented behavior semantic evidence; phase continuity refers to whether the task phase clues or attack phase clues in two pieces of augmented behavior semantic evidence conform to a preset phase order, phase transition relationship, or phase continuity rule; temporal proximity refers to the closeness between the time windows, time segments, or event occurrence times corresponding to two pieces of augmented behavior semantic evidence; and risk coupling refers to the degree of co-occurrence or association of threat types, risk levels, abnormal behavior patterns, or attack phases in threat intelligence, historical samples, rule bases, or risk coupling rules in two pieces of augmented behavior semantic evidence. The semantic similarity, role consistency, stage continuity, temporal proximity, and risk coupling can all be normalized to the [0,1] interval. The association strength is expressed by the following formula:

[0098] ;

[0099] in, For the first The first enhanced behavioral semantic evidence and the first The strength of the association between semantic evidence of enhanced behavior To enhance the numbering of behavioral semantic evidence, For the first The first enhanced behavioral semantic evidence and the first Semantic similarity between enhanced behavioral semantic evidence For the first The first enhanced behavioral semantic evidence and the first Role consistency among enhanced behavioral semantic evidence For the first The first enhanced behavioral semantic evidence and the first Stage continuity between enhanced behavioral semantic evidence For the first The first enhanced behavioral semantic evidence and the first Temporal proximity between semantic evidence of enhanced behavior For the first The first enhanced behavioral semantic evidence and the first Risk coupling between enhanced behavioral semantic evidence. , , , and These are weight parameters corresponding to semantic similarity, role consistency, phase continuity, temporal proximity, and risk coupling. These weight parameters can be preset or adjusted based on historical data, expert rules, validation set results, or task security level.

[0100] For example, a behavior hypergraph can be used to represent the collaborative relationships of multiple semantic elements within the same unmanned equipment operational context, the same mission context, or the same behavioral context, as well as the cross-evidence synergy between different local behavioral semantic evidence. It can be expressed by the following computational formula. Specific construction methods are as follows... Figure 5 As shown.

[0101] ;

[0102] in, Represents a behavioral hypergraph; This represents the set of nodes in the behavior hypergraph, which includes behavior semantic marker nodes, role label nodes, task phase nodes, attack phase nodes, threat type nodes, device status nodes, communication link nodes, load status nodes, context semantic nodes, and risk clue nodes. This represents the set of hyperedges in the behavior hypergraph, including intra-evidence hyperedges and cross-evidence hyperedges. Intra-evidence hyperedges can be used to connect multiple semantic nodes in the same augmented behavior semantic evidence to represent the joint participation relationship of multiple semantic elements in the same unmanned equipment operating context or the same mission context. Cross-evidence hyperedges can be used to connect semantic nodes in multiple augmented behavior semantic evidences that have global associations to represent collaborative relationships across unmanned equipment nodes, communication links, time windows, mission phases, or attack phases.

[0103] Subsequently, the node features, hyperedge relationships, and global association structure in the behavioral hypergraph can be aggregated and analyzed to obtain the threat risk results of the preset scenario and the corresponding key evidence hyperedges. The threat risk structure of the preset scenario can include the threat risk results of edge unmanned equipment nodes, unmanned equipment objects, behavioral segments, communication windows, task phases, payload objects, asset objects, associated evidence groups, or global threat units within a time period. This embodiment of the invention does not specifically limit the specifics of these results. Threat risk results can include one of the following: normal, low risk, medium risk, and high risk. They can also be one or more threat types, including normal, abnormal communication, abnormal control, unauthorized access, abnormal configuration changes, data collection, denial of service, communication interference, task link hijacking, abnormal access to payload data, or other anomalies. Furthermore, they can be continuous risk scores.

[0104] like Figure 6 As shown, key evidence supporting the threat risk outcome can then be extracted from the behavioral hypergraph based on the contribution of hyperedges. This key evidence includes key evidence hyperedges, key behavioral semantic markers, key role relationships, key task phases, key attack phases, key contextual clues, and cross-evidence associations. The contribution of hyperedges can be calculated based on attention weights, changes in risk scores, prediction differences before and after hyperedge deletion, rule contribution weights, or manually configured weights. Hyperedges with higher contribution values ​​are selected as key evidence hyperedges, serving as the primary basis for explaining the threat risk outcome.

[0105] The node and hyperedge types in the behavior hypergraph can be expanded according to different unmanned equipment scenarios. For example, in a UAV inspection scenario, flight control nodes, ground control nodes, flight path segment nodes, payload status nodes, image acquisition nodes, communication link nodes, and safety alarm nodes can be added; in an unmanned vehicle patrol scenario, path planning nodes, vehicle control nodes, sensing payload nodes, positioning nodes, communication session nodes, and anomaly alarm nodes can be added; in an unmanned surface vessel or unmanned underwater vehicle mission scenario, navigation control nodes, mission payload nodes, communication relay nodes, environmental perception nodes, positioning status nodes, and safety alarm nodes can be added; in an inspection robot or unmanned platform scenario, operation task nodes, edge control nodes, sensor status nodes, actuator nodes, and communication link nodes can be added. Correspondingly, intra-evidence hyperedges in the behavior hypergraph can be used to represent the collaborative relationships between control commands, communication behaviors, equipment status, mission stages, payload status, and alarm cues in the same local behavioral semantic evidence; cross-evidence hyperedges can be used to represent the potential threat association relationships between different unmanned equipment nodes, different communication links, different time windows, or different mission stages.

[0106] In another possible approach, threat detection methods can utilize hypergraph neural networks, hypergraph convolutional networks, hypergraph attention networks, or feature aggregation methods based on hypergraph structures, all of which take behavioral hypergraphs as input and jointly model the collaborative relationships between multiple semantic elements and cross-evidence associations to achieve complex threat detection.

[0107] Threat risk results can be output as discrete categories or as continuous risk scores. When discrete categories are used, the threat risk results include one or more of the following: normal, low risk, medium risk, and high risk. When continuous risk scores are used, the continuous risk scores can be mapped to low risk, medium risk, and high risk levels according to preset thresholds, and corresponding edge response suggestions can be generated accordingly.

[0108] In possible ways, the construction of the behavior hypergraph based on the enhanced behavioral semantic evidence set and the global association structure includes:

[0109] Identify the semantic tags, role labels, task phase clues, attack phase clues, and contextual risk clues for each augmented behavior semantic evidence in the augmented behavior semantic evidence set. Construct semantic nodes using semantic tags, role labels, task phase clues, attack phase clues, and contextual risk clues respectively. Construct a set of nodes consisting of multiple semantic nodes belonging to the same augmented behavior semantic evidence as an intra-evidence hyperedge.

[0110] Determine the second association strength in the global association structure that is greater than the second preset association threshold, construct a cross-evidence hyperedge between the two enhanced behavioral semantic evidences corresponding to the second association strength, and obtain a behavioral hypergraph, wherein the first preset association threshold is less than the second preset association threshold.

[0111] It should be understood that, such as Figure 5 As shown, when enhanced behavioral semantic evidence simultaneously includes semantic tags, role labels, task phase clues, attack phase clues, and contextual risk clues, the enhanced behavioral semantic evidence is constructed as an intra-evidence hyperedge. If the correlation strength between two enhanced behavioral semantic evidences is greater than a second preset correlation threshold, a cross-evidence hyperedge can be constructed based on their correlation relationship. In this way, the behavioral hypergraph can express multi-entity, multi-semantic elements, and multi-stage collaborative behaviors that are difficult to directly represent using ordinary graph structures.

[0112] In some possible ways, the detection method further includes:

[0113] Based on the threat risk results and the key evidence, an edge-side response suggestion is generated and transmitted to the corresponding edge unmanned equipment node in the preset scenario, so that the edge unmanned equipment node executes the edge-side response suggestion.

[0114] It should be understood that, such as Figure 7 As shown, when a threat risk occurs, a corresponding edge-side response suggestion can be generated based on the threat risk outcome. This suggestion is then transmitted to the edge unmanned equipment nodes in the corresponding preset scenario, enabling the edge unmanned equipment nodes to execute the edge-side response suggestion. The edge-side response suggestion includes one or more of the following: risk level, threat type, attack phase indication, task phase indication, key evidence summary, action suggestion, and response priority.

[0115] Specifically, edge-side response suggestions may include: generating alarm prompts, continuous monitoring, or log recording suggestions when the risk level is low; generating suggestions for enhanced auditing, access restrictions, communication frequency restrictions, command frequency restrictions, or tightened security policies when the risk level is medium; generating suggestions for node isolation, connection blocking, communication rate limiting, task degradation, control link protection, account freezing, or asset protection when the risk level is high; generating synchronous handling suggestions for relevant edge unmanned equipment nodes when key evidence points to a risk of propagation across unmanned equipment nodes; and generating suggestions for task security review, control command review, load security check, or manual review when key evidence points to abnormal control commands, abnormal equipment status, abnormal communication links, abnormal task stages, or abnormal payload status.

[0116] Upon receiving a response suggestion from the edge side, the edge unmanned equipment node executes corresponding operations based on its local security policy, mission status, and handling permissions. In this way, the present invention can achieve complex threat detection and edge-side response support in a preset scenario without centrally transmitting complete multi-source observation data.

[0117] In this embodiment of the invention, the threat detection method is designed for preset scenarios such as unmanned aerial vehicles (UAVs), unmanned vehicles, unmanned surface vessels (USVs), unmanned underwater vehicles (UUVs), inspection robots, unmanned platforms, and collaborative operation of multiple unmanned equipment. It is applicable to security detection scenarios involving multiple edge UAV nodes, multi-source observation data, and complex threat propagation across nodes within an unmanned equipment network. Edge UAV nodes locally collect multi-source observation datasets, including communication traffic, control commands, telemetry data, task logs, device status, positioning trajectories, payload status, edge computing process records, system audit records, and security alarms. Preprocessing, behavioral segmentation, and minimal behavioral semantic extraction are performed at the edge, generating a local behavioral semantic evidence set that can be transmitted to the cloud or central analysis platform. After receiving the local behavioral semantic evidence sets from multiple edge UAV nodes, the cloud or central analysis platform performs constrained semantic completion and global correlation recovery, and further constructs a behavioral hypergraph for threat detection. After the detection is completed, the cloud or central analysis platform outputs threat risk results and key evidence, and generates edge-side response suggestions to return to the corresponding edge unmanned equipment nodes for security actions such as alarm prompts, continuous monitoring, audit enhancement, communication rate limiting, connection blocking, node isolation, task degradation, manual review, or security policy adjustment.

[0118] Based on the same concept, embodiments of the present invention also disclose an unmanned equipment threat detection system based on cloud-edge collaborative behavior hypergraph, including a data processing module, a semantic extraction module, an encoding constraint module, a calculation module, and an analysis module;

[0119] The data processing module is used to acquire multi-source observation datasets generated by edge unmanned equipment nodes in a preset scenario during the operation of the unmanned equipment. The multi-source observation data is processed through field normalization, noise filtering, and threat behavior-related field filtering methods to obtain threat behavior identification-related fields. The preset scenario is the usage scenario of the unmanned equipment.

[0120] The semantic extraction module is used to divide the threat behavior identification related fields into multiple threat behavior segments, perform sensitive detail suppression and minimum behavior semantic extraction processing on multiple threat behavior segments, and obtain a local behavior semantic evidence set. Each threat behavior segment includes closed-loop behavior data related to potential threat behaviors generated by the target unmanned equipment within a preset time period. The closed-loop behavior data includes at least the behavior subject, behavior action, behavior object, occurrence time, and behavior result or status feedback.

[0121] The encoding constraint module is used to semantically encode the local behavioral semantic evidence set and perform constrained semantic completion processing on the encoded local behavioral semantic evidence set according to preset constraints to obtain an enhanced behavioral semantic evidence set. The preset constraints include threat intelligence summary constraints, rule base update constraints, semantic prototype library constraints, relation pattern library constraints, task phase clue library constraints, and attack phase clue library constraints.

[0122] The calculation module is used to calculate the association strength between any two enhanced behavior semantic evidences in the enhanced behavior semantic evidence set, obtain multiple association strengths, determine the first association strength that is greater than or equal to the first preset association threshold, and construct an association relationship between the two enhanced behavior semantic evidences corresponding to the first association strength to obtain a global association structure.

[0123] The analysis module is used to construct a behavior hypergraph based on the enhanced behavioral semantic evidence set and the global association structure. It performs aggregate analysis on the node features, hyperedge relationships and global association structure in the behavior hypergraph to obtain the threat risk results of the preset scenario and the corresponding key evidence.

[0124] Through the above technical solutions, the multi-source observation datasets generated during the operation of unmanned equipment (UAVs) are transformed into transmittable local behavioral semantic evidence at the edge UAV node side, including large-scale communication traffic, control commands, telemetry data, task logs, equipment status, positioning trajectories, payload status, and safety alarm information. This reduces the communication transmission, storage, and computational overhead associated with transmitting the complete original dataset. Constrained completion and global correlation recovery of fragmented behavioral semantic evidence from different edge UAV nodes enhance the ability to express complex threat correlations across UAV nodes, communication links, task phases, time windows, and attack phases. Furthermore, through cloud-edge controlled security information collaboration, threat intelligence summaries, rule base updates, security policy templates, semantic prototypes, and phase clues are integrated with the edge-side local behavioral semantic evidence. This approach enables cloud-based or centrally-based platforms to perform global threat analysis without centrally receiving complete raw observation data, while reducing the risk of exposing sensitive information such as mission trajectories, control strategies, payload status, communication relationships, and equipment operation details. It uses behavioral hypergraphs to express high-order collaborative relationships between multiple semantic elements in the unmanned equipment's operational context, including control commands, communication behaviors, equipment status, mission phases, attack phases, payload status, and risk cues. Compared to ordinary binary graph structures, this approach is more suitable for characterizing multi-node, multi-link, and multi-stage evolving threats. It can output threat risk results, key evidence hyperedges, and edge-side response suggestions, enabling detection results not only for threat identification but also to further serve local security actions at the edge of unmanned equipment, such as alarms, speed limits, blocking, isolation, mission degradation, manual review, and security policy adjustments.

[0125] This invention generates local behavioral semantic evidence at the edge of unmanned equipment nodes that can be transmitted to the cloud or central analysis platform. It performs constrained semantic completion and global correlation recovery on fragmented local behavioral semantic evidence at the cloud or central level. Furthermore, it combines threat intelligence summaries, rule base updates, security policy templates, semantic prototypes, and stage clues with edge-side local behavioral evidence through cloud-edge security collaboration. It further characterizes the high-order collaborative relationships of multiple semantic elements in the same unmanned equipment operating context based on behavioral hypergraphs, thereby realizing cloud-edge collaborative threat detection, key evidence extraction, and edge-side response support in unmanned equipment operating scenarios.

[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A threat detection method for unmanned equipment based on cloud-edge collaborative behavioral hypergraph, characterized in that, include: The multi-source observation dataset generated by edge unmanned equipment nodes in a preset scenario during the operation of the unmanned equipment is obtained. The multi-source observation data is processed by field normalization, noise filtering and threat behavior related field filtering methods to obtain threat behavior identification related fields. The preset scenario is the usage scenario of the unmanned equipment. The threat behavior identification-related fields are divided into multiple threat behavior segments. Sensitive detail suppression and minimal behavior semantic extraction are performed on multiple threat behavior segments to obtain a local behavior semantic evidence set. Each threat behavior segment includes closed-loop behavior data related to potential threat behaviors generated by the target unmanned equipment within a preset time period. The closed-loop behavior data includes at least the behavior subject, behavior action, behavior object, occurrence time, and behavior result or status feedback. Semantic encoding is performed on the local behavioral semantic evidence set, and constrained semantic completion processing is performed on the encoded local behavioral semantic evidence set according to preset constraints to obtain an enhanced behavioral semantic evidence set. The preset constraints include threat intelligence summary constraints, rule base update constraints, semantic prototype library constraints, relation pattern library constraints, task phase clue library constraints, and attack phase clue library constraints. Calculate the association strength between any two enhanced behavioral semantic evidences in the enhanced behavioral semantic evidence set, obtain multiple association strengths, determine the first association strength that is greater than or equal to the first preset association threshold, and construct an association relationship between the two enhanced behavioral semantic evidences corresponding to the first association strength to obtain the global association structure. A behavioral hypergraph is constructed based on an enhanced behavioral semantic evidence set and a global association structure. The node features, hyperedge relationships, and global association structure in the behavioral hypergraph are aggregated and analyzed to obtain the threat and risk results of the preset scenario and the corresponding key evidence.

2. The method for threat detection of unmanned equipment based on cloud-edge collaborative behavioral hypergraph as described in claim 1, characterized in that, The construction of the behavior hypergraph based on the enhanced behavioral semantic evidence set and global association structure includes: Identify the semantic tags, role labels, task phase clues, attack phase clues, and context risk clues for each enhanced behavior semantic evidence in the enhanced behavior semantic evidence set. Construct the semantic tags, role labels, task phase clues, attack phase clues, and context risk clues into semantic nodes, and construct the node set consisting of multiple semantic nodes belonging to the same enhanced behavior semantic evidence into an evidence-in-evidence hyperedge. Determine the second association strength in the global association structure that is greater than the second preset association threshold, construct a cross-evidence hyperedge between the two enhanced behavioral semantic evidences corresponding to the second association strength, and obtain a behavioral hypergraph, wherein the first preset association threshold is less than the second preset association threshold.

3. The method for threat detection of unmanned equipment based on cloud-edge collaborative behavioral hypergraph as described in claim 1, characterized in that, The local behavioral semantic evidence set is expressed by the following computational formula: ； in, For local behavioral semantic evidence set, For the first A collection of local behavioral semantic evidence from edge unmanned equipment nodes. This represents the total number of edge unmanned equipment nodes. This is the union operation for sets; The local behavioral semantic evidence in the set of local behavioral semantic evidence is expressed by the following computational formula: ； in, For the first action fragment in the collection The first edge unmanned equipment node Local behavioral semantic evidence generated from individual behavioral fragments F e ( b i,j () is defined as the minimum behavioral semantic extraction function deployed on each edge node. For the first action fragment in the collection The first edge unmanned equipment node A behavioral segment, Semantic markers for key behaviors, Description of character relationships To compress contextual features, This serves as a clue for the current stage.

4. The method for threat detection of unmanned equipment based on cloud-edge collaborative behavioral hypergraph according to claim 1, characterized in that, The sensitive detail suppression of multiple threatening behavior segments includes: Identify sensitive details in multiple threat behavior segments, including network addresses, location trajectories, mission area information, control command parameters, file paths, mission files, payload data access paths, actual device identifiers, platform numbers, and communication identifiers. Map network addresses in sensitive detail data to node category labels, map location trajectories and task area information in sensitive detail data to area category labels, map control command parameters in sensitive detail data to control category labels, map file paths, task files, and payload data access paths in sensitive detail data to abstract labels, and map actual device identifiers, platform numbers, and communication identifiers in sensitive detail data to locally anonymous node identifiers. Remove reversibly recoverable multi-source field values ​​from sensitive detail data, as well as the mapping relationship between multi-source field values ​​and abstract labels.

5. The method for threat detection of unmanned equipment based on cloud-edge collaborative behavioral hypergraph according to claim 1, characterized in that, The constrained semantic completion is expressed by the following computational formula: ； in, A common index for local behavioral semantic evidence and its corresponding enhanced behavioral semantic evidence after unified numbering. For the first Semantic evidence of local behavior To The first result obtained after constrained semantic completion An enhanced behavioral semantic evidence, For semantic completion functions, To and Relevant candidate context information.

6. The method for threat detection of unmanned equipment based on cloud-edge collaborative behavioral hypergraph according to claim 1, characterized in that, The calculation of the association strength between any two pieces of enhanced behavioral semantic evidence in the enhanced behavioral semantic evidence set includes: Determine the semantic similarity, role consistency, phase continuity, temporal proximity, and risk coupling degree between any two pieces of enhanced behavioral semantic evidence; The association strength between any two enhanced behavioral semantic evidences is calculated based on semantic similarity, role consistency, phase continuity, temporal proximity, and risk coupling.

7. The method for threat detection of unmanned equipment based on cloud-edge collaborative behavioral hypergraph according to any one of claims 1-6, characterized in that, The correlation strength is expressed by the following formula: ； in, For the first The first enhanced behavioral semantic evidence and the first The strength of the association between semantic evidence of enhanced behavior To enhance the numbering of behavioral semantic evidence, These are the weight parameters corresponding to semantic similarity. For the first The first enhanced behavioral semantic evidence and the first Semantic similarity between enhanced behavioral semantic evidence The weight parameters corresponding to role consistency. For the first The first enhanced behavioral semantic evidence and the first Role consistency among enhanced behavioral semantic evidence The weight parameters are those corresponding to the continuity of the stages. For the first The first enhanced behavioral semantic evidence and the first Stage continuity between enhanced behavioral semantic evidence The weighting parameters are those corresponding to time proximity. For the first The first enhanced behavioral semantic evidence and the first Temporal proximity between semantic evidence of enhanced behavior The weight parameters are those corresponding to the degree of risk coupling. For the first The first enhanced behavioral semantic evidence and the first Risk coupling between enhanced behavioral semantic evidence.

8. The method for threat detection of unmanned equipment based on cloud-edge collaborative behavioral hypergraph according to claim 1, characterized in that, The detection method further includes: Based on the threat risk results and the key evidence, an edge-side response suggestion is generated and transmitted to the corresponding edge unmanned equipment node in the preset scenario, so that the edge unmanned equipment node executes the edge-side response suggestion.

9. A threat detection system for unmanned equipment based on a cloud-edge collaborative behavioral hypergraph, characterized in that, It includes a data processing module, a semantic extraction module, an encoding constraint module, a calculation module, and an analysis module; The data processing module is used to acquire multi-source observation datasets generated by edge unmanned equipment nodes in a preset scenario during the operation of the unmanned equipment. The multi-source observation data is processed through field normalization, noise filtering, and threat behavior-related field filtering methods to obtain threat behavior identification-related fields. The preset scenario is the usage scenario of the unmanned equipment. The semantic extraction module is used to divide the threat behavior identification related fields into multiple threat behavior segments, perform sensitive detail suppression and minimum behavior semantic extraction processing on multiple threat behavior segments, and obtain a local behavior semantic evidence set. Each threat behavior segment includes closed-loop behavior data related to potential threat behaviors generated by the target unmanned equipment within a preset time period. The closed-loop behavior data includes at least the behavior subject, behavior action, behavior object, occurrence time, and behavior result or status feedback. The encoding constraint module is used to semantically encode the local behavioral semantic evidence set and perform constrained semantic completion processing on the encoded local behavioral semantic evidence set according to preset constraints to obtain an enhanced behavioral semantic evidence set. The preset constraints include threat intelligence summary constraints, rule base update constraints, semantic prototype library constraints, relation pattern library constraints, task phase clue library constraints, and attack phase clue library constraints. The calculation module is used to calculate the association strength between any two enhanced behavior semantic evidences in the enhanced behavior semantic evidence set, obtain multiple association strengths, determine the first association strength that is greater than or equal to the first preset association threshold, and construct an association relationship between the two enhanced behavior semantic evidences corresponding to the first association strength to obtain a global association structure. The analysis module is used to construct a behavior hypergraph based on the enhanced behavioral semantic evidence set and the global association structure. It performs aggregate analysis on the node features, hyperedge relationships and global association structure in the behavior hypergraph to obtain the threat risk results of the preset scenario and the corresponding key evidence.

Images