Unmanned aerial vehicle communication security monitoring system based on cloud edge collaboration

Abstract

The application discloses a UAV communication security monitoring system based on cloud-edge collaboration, relates to the technical field of information transmission security, and comprises a communication data acquisition module, a feature extraction module, an edge monitoring module, a cloud-edge data transmission module, a cloud-end deep analysis module and a monitoring visualization module; the edge end listens to a UAV communication link and checks the consistency of communication instructions and flight telemetry data, extracts a communication behavior feature vector sequence, uses a lightweight anomaly detection model to perform real-time prediction and generate a suspicious event alarm, further uses a cloud-end deep model to perform secondary research and attack type classification on abnormal slice data, and finally generates a visual monitoring report; the application realizes hierarchical monitoring of a UAV communication link through cloud-edge collaboration, performs anomaly detection at the edge end, performs confirmation and classification at the cloud end, solves the problem that existing monitoring methods cannot simultaneously consider real-time performance and accuracy, and improves the efficiency and reliability of UAV communication security monitoring.

Description

Technical Field

[0001] This invention relates to the field of information transmission security technology, specifically a cloud-edge collaborative drone communication security monitoring system. Background Technology

[0002] Communication security for drones is a critical aspect of ensuring the normal operation of drone systems. Communication links between drones and ground stations, as well as between drones themselves, are vulnerable to attacks such as interference, data forgery, and unauthorized takeover. Therefore, it is essential to conduct security monitoring of communication links.

[0003] In existing drone communication security monitoring methods, when relying solely on the airborne terminal for monitoring, the limited onboard computing resources make it difficult to run complex analysis models and result in insufficient ability to identify covert attacks. When relying solely on the cloud for monitoring, continuous transmission of communication data is required, which is limited by communication bandwidth and latency, making it difficult to meet real-time requirements. In addition, existing monitoring methods lack a hierarchical monitoring mechanism for drone communication links, resulting in a tradeoff between real-time monitoring and accuracy.

[0004] How to ensure the real-time performance of UAV communication security monitoring while maintaining its accuracy is a problem we need to solve. To address this, we now offer a UAV communication security monitoring system based on cloud-edge collaboration. Summary of the Invention

[0005] The purpose of this invention is to provide a cloud-edge collaborative drone communication security monitoring system.

[0006] The objective of this invention can be achieved through the following technical solution: a cloud-edge collaborative UAV communication security monitoring system, comprising:

[0007] The communication data acquisition module monitors the UAV's communication link to acquire operational status data, performs consistency verification between communication commands and flight telemetry data, and outputs a communication verification dataset.

[0008] The feature extraction module performs sliding window statistics and feature extraction on the communication verification dataset to generate a sequence of communication behavior feature vectors.

[0009] The edge monitoring module calls a preset anomaly detection model to predict anomalies in the feature vector sequence of communication behavior, generates alarms for suspicious events, and extracts feature vector fragments within a preset time period before and after the alarm time as anomaly slice data.

[0010] The cloud-edge data transmission module is used to perform cloud-edge data exchange, upload suspicious event alarms and abnormal slice data to the cloud, and send updated cloud data to the edge monitoring module.

[0011] The cloud-based deep analysis module calls a preset deep monitoring model to perform secondary analysis on the uploaded suspicious event alarms and abnormal slice data, generates confirmed alarms and attack type determination results, and generates updated cloud data.

[0012] The monitoring visualization module receives confirmed alarms and attack type determination results, generates a visualization monitoring report, and updates the communication security status flags of the corresponding edge nodes.

[0013] Preferably, the process of acquiring runtime status data and generating a communication verification dataset includes:

[0014] Deploy data acquisition probes, connect to the communication link, and passively copy the data packets and physical layer signals transmitted on the communication link. Extract operational status data from the passively copied data packets and physical layer signals.

[0015] The operational status data includes received signal strength indication value, signal-to-noise ratio value, heartbeat interval value, and data packet sequence number value;

[0016] The communication instructions are extracted from the data packets obtained by passive copying, and the target flight parameters are obtained from the communication instructions. The actual flight parameters at the same time are extracted from the flight telemetry data. The target flight parameters and the actual flight parameters are compared item by item to calculate the cross-layer deviation. The cross-layer deviation is compared with the preset deviation threshold to obtain the consistency verification result.

[0017] Add link identifiers and collection timestamps to the running status data and consistency verification results; combine the running status data and consistency verification results with the added link identifiers and collection timestamps, and encapsulate them into a communication verification dataset.

[0018] Preferably, the process of performing sliding window statistical analysis on the communication verification dataset includes:

[0019] Set the sliding window size and sliding step, and start sliding the sliding window from the beginning of the time series of the communication verification dataset;

[0020] For each sliding step, the mean and standard deviation of the received signal strength indication value in the current window are calculated, the mean of the signal-to-noise ratio value is calculated, the average deviation of the heartbeat packet interval value from the preset standard interval is calculated, the number of jumps of the data packet sequence number is calculated, and the mean of the cross-layer deviation is calculated.

[0021] The mean of the received signal strength indication, the standard deviation of the received signal strength indication, the mean of the signal-to-noise ratio, the average deviation of the heartbeat packet interval, the number of hops in the data packet sequence number, and the mean of the cross-layer deviation are concatenated into a fixed-dimensional feature vector in the above order.

[0022] The feature vectors obtained from each window are arranged in chronological order to generate a sequence of communication behavior feature vectors.

[0023] Preferably, the process of calling a preset anomaly detection model to perform anomaly prediction includes:

[0024] The communication behavior feature vector sequence is input frame by frame into the preset first-level lightweight anomaly detection model. The first-level lightweight anomaly detection model calculates anomaly scores for each frame of feature vectors. The anomaly scores are compared with preset alarm thresholds. When the anomaly score exceeds the alarm threshold, a suspicious event alarm is generated.

[0025] Preferably, the process of extracting abnormal slice data includes:

[0026] Centered on the feature vector corresponding to the alarm time, a first preset number of feature vectors are extracted forward, and a second preset number of feature vectors are extracted backward. The extracted feature vectors are arranged in chronological order and packaged together with the link identifier and timestamp in the suspicious event alarm to generate abnormal slice data.

[0027] Preferably, the process of calling a preset depth monitoring model for secondary analysis and generating a confirmation alarm includes:

[0028] The feature vector sequence from the abnormal slice data is input into the preset second-level deep monitoring model. The second-level deep monitoring model reconstructs the feature vector sequence and calculates the reconstruction error. When the reconstruction error exceeds the preset cloud threshold, it is determined to be a real attack and a confirmation alarm is generated.

[0029] Preferably, the process of generating attack type determination results includes:

[0030] Obtain abnormal slice data that is confirmed to be a real attack, match the feature vector sequence in the abnormal slice data with the template sequence of each attack type in the preset attack fingerprint database, calculate the cosine similarity between the two, and select the attack type corresponding to the maximum cosine similarity as the attack type determination result.

[0031] Preferably, the process of generating a visual monitoring report and updating the communication security status marker includes:

[0032] Based on the link identifier and alarm generation timestamp in the confirmed alarm, an alarm distribution map is drawn and attack types are distinguished by color. The number of alarms for each link is counted to generate a link alarm statistics table, and a visual monitoring report is generated by combining the data. Based on the confirmed alarm, the corresponding edge node is marked as abnormal and restored to normal status when no new alarms are generated within a preset time period.

[0033] Compared with existing technologies, the beneficial effects of this invention are: hierarchical monitoring of UAV communication links is achieved through a cloud-edge collaborative architecture; the edge end uses a lightweight anomaly detection model to perform real-time anomaly detection on the communication behavior feature vector sequence; and the cloud uses a deep monitoring model to perform secondary confirmation and attack type classification on the anomaly slice data. This solves the problem that existing monitoring methods are difficult to balance real-time performance and accuracy, improves the ability to detect and identify attack behaviors in UAV communication links, and enhances the efficiency and reliability of UAV communication security monitoring. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0035] Figure 1 This is a schematic diagram of the present invention. Detailed Implementation

[0036] like Figure 1 As shown, the cloud-edge collaborative drone communication security monitoring system includes:

[0037] The communication data acquisition module monitors the UAV's communication link to acquire operational status data, performs consistency verification between communication commands and flight telemetry data, and outputs a communication verification dataset.

[0038] The feature extraction module performs sliding window statistics and feature extraction on the communication verification dataset to generate a sequence of communication behavior feature vectors.

[0039] The edge monitoring module calls a preset anomaly detection model to predict anomalies in the feature vector sequence of communication behavior, generates alarms for suspicious events, and extracts feature vector fragments within a preset time period before and after the alarm time as anomaly slice data.

[0040] The cloud-edge data transmission module is used to perform cloud-edge data exchange, upload suspicious event alarms and abnormal slice data to the cloud, and send updated cloud data to the edge monitoring module.

[0041] The cloud-based deep analysis module calls a preset deep monitoring model to perform secondary analysis on the uploaded suspicious event alarms and abnormal slice data, generates confirmed alarms and attack type determination results, and generates updated cloud data.

[0042] The monitoring visualization module receives confirmed alarms and attack type determination results, generates a visualization monitoring report, and updates the communication security status flags of the corresponding edge nodes.

[0043] Furthermore, the process of monitoring the drone's communication links to obtain operational status data includes:

[0044] Deploy data acquisition probes on the UAV's airborne communication unit and ground communication gateway; connect the data acquisition probes to the communication link between the UAV and the ground station and the communication link between UAVs in a bypass manner; passively copy the data packets and physical layer signals transmitted on the communication link through the data acquisition probes; extract operational status data from the passively copied data packets and physical layer signals; and attach link identifiers and acquisition timestamps to the extracted operational status data.

[0045] It should be further explained that the UAV onboard communication unit is a communication terminal deployed on the UAV platform, and the ground communication gateway is a communication aggregation device deployed on the ground station side;

[0046] Operational status data includes physical layer channel metrics data and link layer and network layer protocol behavior data; physical layer channel metrics data includes received signal strength indication and signal-to-noise ratio; link layer and network layer protocol behavior data includes heartbeat interval and data packet sequence number continuity;

[0047] Furthermore, the process of verifying the consistency between communication commands and flight telemetry data includes:

[0048] The communication instructions are extracted from the data packets obtained by passive replication, and the target flight parameters are obtained from the communication instructions. The actual flight parameters at the same time are extracted from the flight telemetry data. The target flight parameters and the actual flight parameters are compared item by item to calculate the cross-layer deviation. The cross-layer deviation is compared with the preset deviation threshold to obtain the consistency verification result.

[0049] It should be further explained that the target flight parameters include the target position coordinates, the target velocity vector, and the flight mode command, while the actual flight parameters include the actual position coordinates, the actual velocity vector, and the current flight mode status.

[0050] The cross-layer deviation includes the Euclidean distance deviation between the target position coordinates and the actual position coordinates, the magnitude of the difference between the target velocity vector and the actual velocity vector, and the consistency comparison result between the flight mode command and the current flight mode state. The flight mode code indicated by the flight mode command is compared with the flight mode code of the current flight mode state. If the codes are consistent, the comparison result is consistent; if the codes are inconsistent, the comparison result is inconsistent.

[0051] The preset deviation thresholds include spatial position deviation thresholds and velocity vector deviation thresholds; the consistency verification result is determined as follows: when the Euclidean distance deviation exceeds the spatial position deviation threshold, or the velocity vector magnitude deviation exceeds the velocity vector deviation threshold, or the flight mode command is inconsistent with the current flight mode state, the consistency verification result is determined to be inconsistent; otherwise, it is determined to be consistent.

[0052] Furthermore, the process of generating the communication verification dataset includes:

[0053] Add link identifiers and collection timestamps to the running status data and consistency verification results; combine the running status data and consistency verification results with the added link identifiers and collection timestamps, and encapsulate them into a communication verification dataset in structured data format;

[0054] It should be further explained that the link identifier field pre-assigned to the data acquisition probe is read from the configuration information of the data acquisition probe, the current time is obtained as the acquisition timestamp, and the link identifier field and acquisition timestamp are written into the data frame header of the running status data and the data frame header of the consistency verification result, respectively; running status data and consistency verification results with the same link identifier and the same acquisition timestamp are written into the same data record; each data record is arranged in the order of link identifier field, acquisition timestamp field, running status data field and consistency verification result field, and each field is organized in key-value pair form to generate a communication verification dataset.

[0055] Furthermore, the process of performing sliding window statistics and feature extraction on the communication verification dataset to generate a sequence of communication behavior feature vectors includes:

[0056] Set the window size and sliding step of the sliding window; slide the sliding window from the starting point of the time series of the communication verification dataset, and perform statistical calculations on the various indicators in the current window at each sliding step to obtain a feature vector; arrange the feature vectors obtained from each window in chronological order to generate a sequence of communication behavior feature vectors.

[0057] It should be further explained that the process of statistically calculating the various indicators within the current window includes: calculating the mean and standard deviation of the received signal strength indication value within the window; calculating the mean of the signal-to-noise ratio value within the window; calculating the average deviation of the heartbeat packet interval value within the window from the preset standard interval; calculating the number of hops for the data packet sequence number within the window; calculating the mean of the cross-layer deviation within the window; and concatenating the above statistical calculation results into a fixed-dimensional feature vector.

[0058] The formula for calculating the average received signal strength indication is:

[0059] ,

[0060] in, This indicates the average received signal strength within the window. To adjust the sliding window size, Let be the received signal strength indicator value at the i-th sampling point, and t be the end time of the current window;

[0061] The formula for calculating the standard deviation of the received signal strength indication is:

[0062] ,

[0063] in, This indicates the standard deviation of the received signal strength indication within the window. This represents the received signal strength indication value at the i-th sampling point. This represents the average value of the received signal strength within the window.

[0064] The formula for calculating the mean signal-to-noise ratio is:

[0065] ,

[0066] in, This represents the mean signal-to-noise ratio within the window. Let be the signal-to-noise ratio value of the i-th sampling point;

[0067] The formula for calculating the cardiac interval deviation is:

[0068] ,

[0069] in, This indicates the deviation in heart rate interval. This represents the actual time interval between adjacent heartbeats. The standard heartbeat interval specified by the communication protocol;

[0070] The formula for calculating the packet sequence number jump is:

[0071] ,

[0072] in, Indicates the number of data packet sequence number jumps. The sequence number of the current data packet. This is the sequence number of the previous data packet;

[0073] The formula for calculating the mean cross-layer deviation is:

[0074] ,

[0075] in, Indicates the cross-layer deviation. This refers to the target position vector in the communication command. This is the actual position vector in the flight telemetry data. This represents the Euclidean distance.

[0076] The concatenated form of the feature vectors is as follows:

[0077] ,

[0078] in, Let be the feature vector of communication behavior at time t. The transpose is represented by the feature vector, which contains six feature dimensions, corresponding to the mean of received signal strength indication, the standard deviation of received signal strength indication, the mean of signal-to-noise ratio, the heartbeat packet interval deviation, the data packet sequence number jump amount, and the mean of cross-layer deviation, respectively.

[0079] Furthermore, the process of calling a preset anomaly detection model to predict anomalies in the communication behavior feature vector sequence and generating suspicious event alarms includes:

[0080] The communication behavior feature vector sequence is input frame by frame into the preset first-level lightweight anomaly detection model; the first-level lightweight anomaly detection model calculates anomaly scores for each frame of feature vectors; the anomaly scores are compared with preset alarm thresholds, and when the anomaly scores exceed the alarm thresholds, a suspicious event alarm is generated.

[0081] It should be further explained that the first-level lightweight anomaly detection model is an isolated forest model. Its construction process includes: randomly sampling from the feature vector sequence of historical communication behavior, recursively constructing multiple isolated trees by randomly selecting feature dimensions and random selecting segmentation values, and combining multiple isolated trees to form an isolated forest model; when predicting anomalies, the feature vector traverses each isolated tree in the isolated forest model, and the anomaly score is calculated by combining the path length of each isolated tree.

[0082] The formula used to calculate the anomaly score for each frame's feature vector is as follows:

[0083] ,

[0084] in, The anomaly score of feature vector v in an isolated forest with a sample size of n; Let v be the average path length of the feature vector across all isolated trees; Let be the normalization constant for the path length, and its calculation formula is:

[0085] ,

[0086] in, For harmonic numbers, , Let Euler's constant be 1. ;

[0087] The comparison method between the anomaly score and the alarm threshold is as follows: when > When this occurs, it is judged as abnormal and a suspicious event alarm is generated; when When this condition is met, it is considered normal and no alarm is generated; among them, The preset alarm threshold has a value range between 0 and 1.

[0088] It should be further explained that the suspicious event alarm includes the timestamp of the alarm generation time, the anomaly score value, the window number corresponding to the feature vector that triggered the alarm, and the link identifier.

[0089] Furthermore, the process of extracting feature vector fragments within a preset time period before and after the alarm time as anomaly slice data includes:

[0090] The generation time of the suspicious event alarm is obtained as the alarm time; from the communication behavior feature vector sequence, a first preset number of feature vectors are extracted forward and a second preset number of feature vectors are extracted backward, centered on the feature vector corresponding to the alarm time; the extracted feature vectors are arranged in chronological order and packaged together with the link identifier and timestamp in the suspicious event alarm to generate abnormal slice data.

[0091] It should be further explained that the first and second preset quantities are pre-set positive integers, which are assigned values ​​according to the abnormal situation; the abnormal slice data includes the extracted feature vector sequence fragments, the corresponding link identifiers, and the timestamp of the alarm time.

[0092] Furthermore, the process of performing cloud-edge data exchange includes:

[0093] Upload suspicious event alarms and abnormal slice data generated by the edge monitoring module to the cloud deep analysis module; receive cloud update data issued by the cloud deep analysis module and transmit the cloud update data to the edge monitoring module;

[0094] It should be further explained that the updated data in the cloud refers to the updated model parameters generated by the cloud-based deep analysis module after retraining the first-level lightweight anomaly detection model.

[0095] Furthermore, the process of using a preset depth monitoring model to perform secondary analysis on the abnormal slice data includes:

[0096] Receive abnormal slice data uploaded by the cloud-edge data transmission module; input the feature vector sequence in the abnormal slice data into the preset second-level deep monitoring model; reconstruct the feature vector sequence by the second-level deep monitoring model and calculate the reconstruction error; compare the reconstruction error with the preset cloud threshold. When the reconstruction error exceeds the cloud threshold, determine that the suspicious event is a real attack and generate a confirmation alarm. When the reconstruction error does not exceed the cloud threshold, determine that the suspicious event is a false alarm.

[0097] It should be further explained that the second-level deep monitoring model is a long short-term memory autoencoder model, consisting of an encoder and a decoder. The encoder compresses the input feature vector sequence into a fixed-length latent vector, and the decoder restores the latent vector to the reconstructed feature vector sequence. This process extracts the feature vector sequence from the anomaly slice data. The latent vectors are input into the encoder and then input into the decoder to obtain the reconstructed feature vector sequence. The reconstruction error between the original feature vector and the reconstructed feature vector is calculated frame by frame, and the reconstruction error of all frames is averaged to obtain the sequence reconstruction error.

[0098] It should be further explained that the formula for calculating sequence reconstruction error is:

[0099] Single frame reconstruction error:

[0100] ,

[0101] Average sequence reconstruction error:

[0102] ,

[0103] in, Let be the original feature vector of the t-th frame in the anomaly slice. The reconstructed feature vector of the t-th frame from the model. Let T represent the sum of squares of the vector differences, T be the number of feature vector frames contained in the outlier slice, and E be the average sequence reconstruction error.

[0104] The alarm generation method is confirmed as follows: when When a suspicious event is determined to be a real attack, a confirmation alarm is generated; when When a suspicious event is determined to be a false alarm, no confirmed alarm is generated; This is a preset cloud threshold;

[0105] It should be further explained that the alarm confirms that it includes the alarm identifier, the corresponding link identifier, the alarm generation timestamp, and the sequence reconstruction error value.

[0106] Furthermore, the process of classifying the attack types of abnormal data slices confirmed as genuine attacks and generating attack type determination results includes:

[0107] Obtain abnormal slice data that is confirmed to be a real attack; match the feature vector sequence in the abnormal slice data with the template sequence of each attack type in the preset attack fingerprint database, and select the attack type with the highest matching degree as the attack type determination result;

[0108] It should be further explained that the attack fingerprint database contains feature vector sequence templates for known attack types, with each attack type corresponding to a preset template sequence; the known attack types include interference attacks, data forgery attacks, unauthorized takeover attacks, and denial-of-service attacks;

[0109] The method for matching the feature vector sequence in the abnormal slice data with the template sequence of each attack type in the attack fingerprint database is as follows: convert the feature vector sequence in the abnormal slice data and the template sequence of each attack type into vectorized representations respectively, calculate the cosine similarity between the two, and take the attack type corresponding to the maximum cosine similarity as the attack type determination result.

[0110] The formula for calculating cosine similarity is:

[0111] ,

[0112] Where S is the vectorized representation of the feature vector sequence in the outlier slice data. Let be the vectorized representation of the template sequence for the k-th attack type. Represents the vector dot product. Represents the magnitude of a vector;

[0113] The attack type determination result includes the attack type name and the corresponding matching score;

[0114] Furthermore, the process of generating updated cloud data includes:

[0115] Collect abnormal slice data corresponding to alarms that have been confirmed through secondary analysis and mark them as attack samples; collect abnormal slice data that have been determined to be false alarms through secondary analysis and mark them as normal samples; construct a labeled training set using attack samples and normal samples; retrain the first-level lightweight anomaly detection model using the labeled training set to generate updated model parameters, which are then sent to the edge monitoring module as updated data from the cloud.

[0116] It should be further explained that the process of retraining the first-level lightweight anomaly detection model includes: expanding the feature vector sequence in the labeled training set into single-frame feature vectors, marking the frames of attack samples as anomalies, and the frames of normal samples as normal; retraining the isolated forest model with the labeled single-frame feature vectors, redetermining the feature dimension index and segmentation threshold of each node of each isolated tree, and recalculating the normalization constant based on the new sample size.

[0117] It should be further explained that the cloud-updated data includes the feature dimension index and segmentation threshold of each node of each isolated tree after retraining, the normalization constant, and the readjusted alarm threshold.

[0118] Furthermore, the process of generating a visual monitoring report includes:

[0119] Receive confirmed alarms and attack type determination results from the cloud-based deep analysis module; based on the link identifier and alarm generation timestamp in the confirmed alarm, draw an alarm distribution map with the link identifier as the vertical axis and time as the horizontal axis, and mark different attack types with different colors in the alarm distribution map; count the number of alarms corresponding to each link identifier and generate a link alarm statistics table; combine the alarm distribution map and the link alarm statistics table to generate a visual monitoring report;

[0120] The link alarm statistics table includes the link identifier, the number of alarms, and the attack type and occurrence time of the most recent alarm;

[0121] Furthermore, the process of updating the communication security status flag of the corresponding edge node includes:

[0122] Based on the link identifier in the confirmed alarm, locate the edge node corresponding to the edge monitoring module that generated the alarm; update the communication security status mark of the edge node to an abnormal state, and write the attack type judgment result in the confirmed alarm into the status mark; continuously monitor the communication behavior feature vector sequence corresponding to the edge node, and when the edge node does not generate a new suspicious event alarm within a consecutive preset time period, restore the communication security status mark of the edge node to a normal state.

[0123] It should be further explained that the communication security status marker is a key-value pair data structure deployed in the cloud, with the link identifier as the key and the status field, attack type field, and alarm time field as the value. The writing process is as follows: call the cloud database update interface, use the link identifier as the query condition, set the status field to abnormal status, write the attack type name into the attack type field, write the alarm generation timestamp into the alarm time field, and complete the writing through an atomic update operation.

[0124] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any modifications or equivalent substitutions made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A cloud-edge collaborative UAV communication security monitoring system, characterized in that, include: The communication data acquisition module monitors the UAV's communication link to acquire operational status data, performs consistency verification between communication commands and flight telemetry data, and outputs a communication verification dataset. The feature extraction module performs sliding window statistics and feature extraction on the communication verification dataset to generate a sequence of communication behavior feature vectors. The edge monitoring module calls a preset anomaly detection model to predict anomalies in the feature vector sequence of communication behavior, generates alarms for suspicious events, and extracts feature vector fragments within a preset time period before and after the alarm time as anomaly slice data. The cloud-edge data transmission module is used to perform cloud-edge data exchange, upload suspicious event alarms and abnormal slice data to the cloud, and send updated cloud data to the edge monitoring module. The cloud-based deep analysis module calls a preset deep monitoring model to perform secondary analysis on the uploaded suspicious event alarms and abnormal slice data, generates confirmed alarms and attack type determination results, and generates updated cloud data. The monitoring visualization module receives confirmed alarms and attack type determination results, generates a visualization monitoring report, and updates the communication security status flags of the corresponding edge nodes.

2. The UAV communication security monitoring system based on cloud-edge collaboration according to claim 1, characterized in that, The process of acquiring runtime status data and generating a communication verification dataset includes: Deploy data acquisition probes, connect to the communication link, and passively copy the data packets and physical layer signals transmitted on the communication link. Extract operational status data from the passively copied data packets and physical layer signals. The operational status data includes received signal strength indication value, signal-to-noise ratio value, heartbeat interval value, and data packet sequence number value; The communication instructions are extracted from the data packets obtained by passive copying, and the target flight parameters are obtained from the communication instructions. The actual flight parameters at the same time are extracted from the flight telemetry data. The target flight parameters and the actual flight parameters are compared item by item to calculate the cross-layer deviation. The cross-layer deviation is compared with the preset deviation threshold to obtain the consistency verification result. Add link identifiers and collection timestamps to the running status data and consistency verification results; combine the running status data and consistency verification results with the added link identifiers and collection timestamps, and encapsulate them into a communication verification dataset.

3. The UAV communication security monitoring system based on cloud-edge collaboration according to claim 2, characterized in that, The process of performing sliding window statistical analysis on the communication verification dataset includes: Set the sliding window size and sliding step, and start sliding the sliding window from the beginning of the time series of the communication verification dataset; For each sliding step, the mean and standard deviation of the received signal strength indication value in the current window are calculated, the mean of the signal-to-noise ratio value is calculated, the average deviation of the heartbeat packet interval value from the preset standard interval is calculated, the number of jumps of the data packet sequence number is calculated, and the mean of the cross-layer deviation is calculated. The mean of the received signal strength indication, the standard deviation of the received signal strength indication, the mean of the signal-to-noise ratio, the average deviation of the heartbeat packet interval, the number of hops in the data packet sequence number, and the mean of the cross-layer deviation are concatenated into a fixed-dimensional feature vector in the above order. The feature vectors obtained from each window are arranged in chronological order to generate a sequence of communication behavior feature vectors.

4. The UAV communication security monitoring system based on cloud-edge collaboration according to claim 3, characterized in that, The process of calling a preset anomaly detection model to predict anomalies includes: The communication behavior feature vector sequence is input frame by frame into the preset first-level lightweight anomaly detection model. The first-level lightweight anomaly detection model calculates anomaly scores for each frame of feature vectors. The anomaly scores are compared with preset alarm thresholds. When the anomaly score exceeds the alarm threshold, a suspicious event alarm is generated.

5. The UAV communication security monitoring system based on cloud-edge collaboration according to claim 4, characterized in that, The process of extracting abnormal slices of data includes: Centered on the feature vector corresponding to the alarm time, a first preset number of feature vectors are extracted forward, and a second preset number of feature vectors are extracted backward. The extracted feature vectors are arranged in chronological order and packaged together with the link identifier and timestamp in the suspicious event alarm to generate abnormal slice data.

6. The UAV communication security monitoring system based on cloud-edge collaboration according to claim 5, characterized in that, The process of calling the preset deep monitoring model for secondary analysis and generating a confirmation alarm includes: The feature vector sequence from the abnormal slice data is input into the preset second-level deep monitoring model. The second-level deep monitoring model reconstructs the feature vector sequence and calculates the reconstruction error. When the reconstruction error exceeds the preset cloud threshold, it is determined to be a real attack and a confirmation alarm is generated.

7. The UAV communication security monitoring system based on cloud-edge collaboration according to claim 6, characterized in that, The process of generating attack type determination results includes: Obtain abnormal slice data that is confirmed to be a real attack, match the feature vector sequence in the abnormal slice data with the template sequence of each attack type in the preset attack fingerprint database, calculate the cosine similarity between the two, and select the attack type corresponding to the maximum cosine similarity as the attack type determination result.

8. The UAV communication security monitoring system based on cloud-edge collaboration according to claim 7, characterized in that, The process of generating a visual monitoring report and updating the communication security status markers includes: Based on the link identifier and alarm generation timestamp in the confirmed alarm, an alarm distribution map is drawn and attack types are distinguished by color. The number of alarms for each link is counted to generate a link alarm statistics table, and a visual monitoring report is generated by combining the data. Based on the confirmed alarm, the corresponding edge node is marked as abnormal and restored to normal status when no new alarms are generated within a preset time period.

Images