Networked unmanned aerial vehicle traffic identification method based on spatio-temporal feature fusion

Abstract

The application belongs to the technical field of network information security and unmanned aerial vehicle communication monitoring, and particularly relates to a network-connected unmanned aerial vehicle traffic identification method based on space-time feature fusion, which comprises the following steps: for each base station, mounting an XDP program to realize zero-copy high-speed packet capture when a network card receives a network frame and establishing a "flow feature-IP mapping table" index; then connecting a Gaussian mixture model (GMM) and a random forest, adaptively deriving an explicit unmanned aerial vehicle traffic judgment threshold for a data packet sequence, and using the threshold as a benchmark to real-time screen unmanned aerial vehicle traffic and reversely lock the communication IP according to the "flow feature-IP mapping table"; and for a global server, constructing an edge dynamic federated distillation framework, receiving the threshold uploaded by each base station, realizing dynamic fusion and efficient alignment of cross-base station global screening features, and ensuring the continuity of IP locking when the unmanned aerial vehicle roams between base stations.

Description

Technical Field

[0001] This invention belongs to the field of network information security and UAV communication monitoring technology, specifically relating to a method for identifying traffic of connected UAVs based on spatiotemporal feature fusion. Background Technology

[0002] In the countermeasures and security monitoring of connected drones, traffic characteristic analysis is a key means of identifying illegal flights under legitimate identities or command and control signals hidden in encrypted tunnels. Drone communication exhibits a high degree of regularity, among which the distribution characteristics of traffic packet size and uplink and downlink communication frequencies are the core benchmarks for distinguishing drones from ordinary ground mobile terminals.

[0003] Currently, existing traffic identification solutions mainly suffer from the following technical bottlenecks: The real target IP is hidden in the massive background traffic: the data throughput of the base station is extremely large, and the drone traffic is often overwhelmed by the massive traffic of ground mobile terminals. In addition, the drone may use dynamically allocated IPs or be hidden behind NAT. The traditional fixed IP blacklist and whitelist mechanism is completely ineffective, making it difficult to extract and lock the communication IP of a specific drone from the complex network traffic.

[0004] Low-level data acquisition faces performance bottlenecks: Traditional packet capture mechanisms based on the kernel network protocol stack (TCP / IPStack) involve frequent context switching and memory copying. When facing high-concurrency, high-throughput scenarios at the base station level, they are prone to high latency and packet loss, resulting in the loss of critical IP flow information.

[0005] Fixed rules lack spatial adaptability: Existing methods mostly rely on manual analysis of a small number of samples to set fixed packet size thresholds and frequency rules for filtering. Due to differences in physical space scenarios, network load fluctuations, and communication protocols among different drone manufacturers, fixed thresholds are prone to failure, resulting in persistently high false positive and false negative rates in traffic filtering.

[0006] Pure machine learning methods are costly to train and lack interpretability: Directly extracting massive multidimensional statistical features into the model based on methods such as pure random forests not only takes too long to train, but also the model exhibits "black box" characteristics, unable to output explicit interception rules with physical guidance significance, and thus unable to guide the gateway to perform real-time IP blocking or locking.

[0007] Multi-base station collaboration faces data silos and privacy constraints: In multi-base station coverage scenarios, directly aggregating the raw traffic of each base station to the central server for global model training will cause core network congestion and seriously violate communication privacy protection standards. Summary of the Invention

[0008] This invention aims to solve the problems of the difficulty in efficiently extracting traffic characteristics of connected drones in complex network environments and the difficulty in screening and locking real communication IPs. It proposes a traffic identification method for connected drones based on spatiotemporal feature fusion.

[0009] The technical solution for implementing the present invention is as follows: In a first aspect, the present invention provides a method for traffic identification of connected drones based on spatiotemporal feature fusion, comprising: At the micro-time dimension: For each base station, the XDP program is mounted to achieve zero-copy high-speed packet capture and establish a "flow feature-IP mapping table" index when the network card receives network frames; then, Gaussian Mixture Model (GMM) and Random Forest are connected in series to adaptively derive an explicit drone traffic judgment threshold for the data packet sequence, and use this as a benchmark to filter drone traffic in real time, and reverse lock its communication IP according to the "flow feature-IP mapping table". In terms of macro-space dimensions: For the global server, an edge dynamic federated distillation framework is constructed to receive thresholds uploaded by each base station. This enables dynamic fusion and efficient alignment of global screening features across base stations, ensuring the continuity of IP locking when drones roam between base stations.

[0010] Optionally, the present invention subsequently concatenates a Gaussian Mixture Model (GMM) and a Random Forest to adaptively derive an explicit drone traffic determination threshold for the data packet sequence. The specific process is as follows: First, regarding the observation packet length sequence Unsupervised clustering was performed using a Gaussian Mixture Model (GMM) to divide the data into groups. There are clusters, and the probability density function of the bag length feature is defined as follows: A weighted sum of Gaussian distributions; the GMM parameters are solved using the EM algorithm until the observed packet length sequence is reached. The log-likelihood function converges under the current GMM parameters; the posterior probability of each cluster corresponding to each payload length sample is used as a soft clustering label to complete the soft clustering labeling of the payload length and extract the time-series feature vector of UAV traffic under the current base station environment. Secondly, the obtained soft clustering labels are used as training labels to train the random forest, and a Gaussian kernel function is introduced to fit the global probability density distribution. The trough position of the adaptive positioning density function is used as the optimal threshold for determining drone traffic flow. ; Finally, load threshold When the packet length distribution and time interval of an active data stream are detected to be highly consistent with the threshold range, it is identified as UAV communication traffic, and its communication IP is locked in reverse according to the "flow feature-IP mapping table".

[0011] Optionally, the probability density function of the packet length feature is defined as follows: Weighted sum of Gaussian distributions:

[0012] in, For the first The mixed weights of each cluster, The mean, For variance, This is a feature of packet length.

[0013] Optionally, the process of solving the GMM parameters using the EM algorithm described in this invention is as follows: Step E: Calculate the sample Belongs to the The posterior probability of each cluster is:

[0014] in, For the first The mixed weights of each cluster, The mean, For variance, It follows a Gaussian distribution. for A weighted sum of Gaussian distributions; M-step: Update model parameters Until the observation packet length sequence The log-likelihood function converges under the current GMM parameters; where, let the... The number of valid samples in each cluster is The samples are weighted using the posterior probabilities obtained in the E-step, and each parameter is updated as follows:

[0015] .

[0016] Optionally, the present invention uses the obtained soft clustering labels as training labels to train a random forest, and introduces a Gaussian kernel function to fit the global probability density distribution. The trough position of the adaptive positioning density function is used as the optimal threshold for determining drone traffic flow. ; Node splitting impurity evaluation: Use the soft clustering labels obtained in step two as training labels to train the random forest, and evaluate the sample set at any decision tree node in the random forest. and candidate packet length partitioning feature values Splitting is performed according to the principle of maximizing the decrease in Gini impurity: KDE kernel density estimation and threshold localization: Extracting the optimal set of internal node split values ​​for the "packet size" feature. A Gaussian kernel function is introduced to fit the global probability density distribution. The trough position of the adaptive positioning density function is used as the optimal threshold for determining drone traffic flow. .

[0017] Optionally, the Gaussian kernel function described in this invention fits the global probability density distribution. :

[0018] in, The bandwidth parameter represents the kernel density estimation. The bag length variable represents the density to be estimated. Represents the set of split values The total number of candidate split values ​​included.

[0019] Optionally, the specific processing procedure in the macroscopic spatial dimension described in this invention is as follows: Dynamic spatial weight allocation: Probability distribution of soft tags received by the global server from each base station and threshold The server calculates local soft tags. With global model soft labels KL divergence between Dynamic Gaussian confidence weights are defined based on KL divergence. ; Global threshold update and network-wide collaborative locking: generating a globally smooth threshold The data is then distributed to each base station; even if the drone changes base station connections, the globally aligned filtering features ensure that the newly connected base station can quickly identify its traffic fingerprint and relock its roaming IP.

[0020] Optionally, the dynamic Gaussian confidence weights defined based on KL divergence described in this invention...

[0021]

[0022] in, This represents the total number of valid edge base stations currently participating in this round of federated aggregation. It represents the proportional adjustment coefficient that controls the degree of influence of KL divergence on the base station confidence weight.

[0023] Beneficial effects: First, it achieves extremely precise drone traffic filtering and IP locking: completely changing the black-box predicament of traditional machine learning that "only classifies, but does not trace the source." The system not only adaptively extracts features, but also outputs extremely clear byte boundary values, directly empowering high-speed gateways to perform white-box filtering of real-time traffic and accurately lock the real IP of drones hidden in massive communications.

[0024] Second, it completely breaks through the bottleneck of high-volume capture at the base station level: by introducing XDP technology, the establishment and zero-copy transmission of the basic session index are completed at the network card driver layer. Even under the background traffic of high concurrency at the base station, it can still capture the key control flow without loss, ensuring the integrity of IP traceability.

[0025] Third, the high robustness and privacy protection of multi-base station collaboration: each base station only interacts with the distribution of soft tags and statistical threshold scalars; sensitive information such as original communication and IP addresses never leaves the local base station, perfectly complying with edge computing security standards. The dynamic weighting mechanism greatly improves the system's global identification stability and continuous tracking capability in complex urban low-altitude networks. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0028] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0029] It should be noted that, unless otherwise specified, the following embodiments and features can be combined with each other; and, based on the embodiments of this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0030] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0031] This application provides an embodiment of a networked drone traffic identification method based on spatiotemporal feature fusion, comprising: At the micro-time dimension, XDP is used to achieve zero-copy high-speed packet capture and establish a 5-tuple index; then, Gaussian mixture model (GMM) and random forest are connected in series to adaptively derive an explicit drone traffic judgment threshold, and based on this, drone traffic is filtered in real time and its communication IP is locked in reverse. In the macro-spatial dimension, a dynamic federated architecture based on knowledge distillation is introduced to achieve dynamic fusion and efficient alignment of global screening features across base stations while protecting the original payload from leaving the base station, thus ensuring the continuity of IP locking when the UAV roams between base stations.

[0032] This application's embodiments combine a multi-base station collaborative system and method that utilizes XDP high-speed traffic interception, unsupervised Gaussian mixture clustering, random forest threshold adaptive extraction, and edge dynamic federated knowledge distillation. It is mainly used to accurately filter UAV communication traffic from complex network background traffic and achieve adaptive locking of UAV target IP addresses.

[0033] The above process is described in detail below in four progressive steps: Step 1: High-speed traffic interception and IP mapping table construction based on XDP In order to break through the performance bottleneck of traditional packet capture and prepare for subsequent IP locking, this system mounts the XDP (eXpress Data Path) program in the NIC driver layer of the edge base station.

[0034] Zero-copy pre-filtering and session indexing: When the network card receives a network frame, before the operating system kernel allocates the sk_buff structure, the XDP program directly parses the MAC header, IP header, and transport layer header. It uses bitwise AND operations to quickly match and extract the five-tuple (source IP, destination IP, source port, destination port, protocol type), discards irrelevant background traffic, and establishes a real-time updated "flow feature-IP mapping table" in user space.

[0035] AF_XDP Memory Redirection: Directs suspected drone TCP / UDP traffic directly to the user-space AF_XDP socket (UMEM memory pool) via the XDP_REDIRECT instruction, achieving zero-copy transmission by bypassing the kernel protocol stack and extracting the time window. Long sequence of data packets within .

[0036] Step 2: Adaptive Unsupervised Clustering of Traffic Fingerprints Based on Gaussian Mixture Model (GMM) Due to the lack of data labels in the unknown network environment, the system needs to adaptively find the natural packet length distribution boundaries of UAV control commands, telemetry data, and video transmission.

[0037] For long data packet sequences The system uses a Gaussian mixture model (GMM) for unsupervised clustering, dividing the data into groups. Each cluster defines the packet length feature. The probability density function is Weighted sum of Gaussian distributions:

[0038] in, For the first The mixed weights of each cluster ( ), The mean, Let Variance be the variance. The parameters are solved using the EM (Expectation-Maximization) algorithm: E-step (Expectation): Calculate the first step... Sample of package length Belongs to the The posterior probability (response) of each cluster ):

[0039] M-step (Maximization): Update model parameters Until the long sequence of data packets The log-likelihood function converges under the current GMM parameters.

[0040] Among them, let the first The number of valid samples in each cluster is The samples are weighted using the posterior probabilities obtained in the E-step, and each parameter is updated as follows:

[0041]

[0042] Therefore, the posterior probability of each cluster corresponding to the long sequence of each data packet is used as a soft label to complete the soft clustering labeling of the data packet length and extract the time-series feature vector of UAV traffic under the current base station environment.

[0043] Step 3: Explicit threshold reverse extraction and real-time locking of UAV target IP This step transforms the clustering results into physical rules that can be used by actual high-speed gateways for traffic filtering and IP locking.

[0044] Node splitting impurity evaluation: Use the soft clustering labels obtained in step two as training labels to train the random forest, and evaluate the sample set at any decision tree node in the random forest. and candidate packet length partitioning feature values Splitting is performed according to the principle of maximizing the decrease in Gini impurity:

[0045] Among them, the sample set Composed of the aforementioned drone traffic time-series feature vectors, and Representing sample sets respectively The left and right subsets are obtained based on the candidate packet length partition value v. This indicates the impurity of the gin.

[0046] KDE kernel density estimation and threshold localization: Extracting the optimal set of internal node split values ​​for the "packet size" feature. A Gaussian kernel function is introduced to fit the global probability density distribution. :

[0047] in, The bandwidth parameter represents the kernel density estimation. The bag length variable represents the density to be estimated. Represents a set The number of optimal internal node split values.

[0048] By solving the first derivative And the second derivative The local maxima are used to determine the troughs of the density function, which are then used as the optimal explicit partitioning threshold. .

[0049] Traffic filtering and IP locking: Edge firewalls or monitoring gateways load the above explicit thresholds in real time. When the packet length distribution and time interval of an active data stream are detected to closely match the threshold range, the system immediately identifies it as UAV communication traffic and, in conjunction with the "flow feature-IP mapping table" established in "Step 1", extracts the 5-tuple information of the data stream, thereby accurately locating the real source IP or destination IP of the connected UAV and triggering an alarm or blocking policy.

[0050] Step 4: Multi-base station spatial feature aggregation and continuous tracking based on dynamic federated knowledge distillation To address the feature distribution differences (Non-IID problem) when drones fly across base stations and ensure the persistence of IP locking, an edge dynamic federated distillation framework is constructed.

[0051] Dynamic spatial weight allocation: The global server only receives the probability distribution of soft tags uploaded by each base station. and the threshold extracted in step three , here Indicates the base station number. Based on The calculated posterior probability statistics of the samples are formed. The global server calculates the local soft-label probability distribution. With global model soft labels KL divergence between:

[0052] Dynamic Gaussian confidence weights based on KL divergence definition :

[0053] in, This represents the total number of valid edge base stations currently participating in this round of federated aggregation.

[0054] Global threshold update and network-wide collaborative locking: The control center generates a globally smooth threshold. The data is then distributed to each base station. Even if the drone changes base station connections, the globally aligned filtering features ensure that the newly connected base station can quickly identify its traffic fingerprint and re-lock its roaming IP.

[0055] In summary, the above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for traffic identification of connected unmanned aerial vehicles (UAVs) based on spatiotemporal feature fusion, characterized in that, include: At the micro-time dimension: For each base station, the XDP program is mounted to achieve zero-copy high-speed packet capture and establish an index of "flow feature-IP mapping table" when the network card receives network frames; then, Gaussian mixture model (GMM) and random forest are connected in series to adaptively derive an explicit drone traffic judgment threshold for the data packet sequence, and use this as a benchmark to filter drone traffic in real time, and reverse lock its communication IP according to the "flow feature-IP mapping table". In terms of macro-space dimensions: For the global server, an edge dynamic federated distillation framework is constructed to receive thresholds uploaded by each base station. This enables dynamic fusion and efficient alignment of global screening features across base stations, ensuring the continuity of IP locking when drones roam between base stations.

2. The method for networked unmanned aerial vehicle (UAV) traffic identification based on spatiotemporal feature fusion according to claim 1, characterized in that, The subsequent concatenation of Gaussian Mixture Model (GMM) and Random Forest adaptively derives an explicit drone traffic determination threshold for the data packet sequence. The specific process is as follows: First, regarding the observation packet length sequence Unsupervised clustering was performed using a Gaussian Mixture Model (GMM) to divide the data into groups. There are clusters, and the probability density function of the bag length feature is defined as follows: A weighted sum of Gaussian distributions; the GMM parameters are solved using the EM algorithm until the observed packet length sequence is reached. The log-likelihood function converges under the current GMM parameters; the posterior probability of each cluster corresponding to each payload length sample is used as a soft clustering label to complete the soft clustering labeling of the payload length and extract the time-series feature vector of UAV traffic under the current base station environment. Secondly, the obtained soft clustering labels are used as training labels to train the random forest, and a Gaussian kernel function is introduced to fit the global probability density distribution. The trough position of the adaptive positioning density function is used as the optimal threshold for determining drone traffic flow. ; Finally, load threshold When the packet length distribution and time interval of an active data stream are detected to be highly consistent with the threshold range, it is identified as UAV communication traffic, and its communication IP is locked in reverse according to the "flow feature-IP mapping table".

3. The networked drone traffic identification method based on spatiotemporal feature fusion according to claim 2, characterized in that, Define the probability density function of the packet length feature. for Weighted sum of Gaussian distributions: in, For the first The mixed weights of each cluster, The mean, For variance, This is a feature of packet length.

4. The method for networked unmanned aerial vehicle (UAV) traffic identification based on spatiotemporal feature fusion according to claim 2, characterized in that, The specific process of solving the GMM parameters using the EM algorithm is as follows: Step E: Calculate the sample Belongs to the The posterior probability of each cluster is: in, For the first The mixed weights of each cluster, The mean, For variance, It follows a Gaussian distribution. for A weighted sum of Gaussian distributions; M-step: Update model parameters Until the observation packet length sequence The log-likelihood function converges under the current GMM parameters; where, let the... The number of valid samples in each cluster is The samples are weighted using the posterior probabilities obtained in the E-step, and each parameter is updated as follows: 。 5. The method for networked unmanned aerial vehicle (UAV) traffic identification based on spatiotemporal feature fusion according to claim 2, characterized in that, The obtained soft clustering labels are used as training labels to train a random forest, and a Gaussian kernel function is introduced to fit the global probability density distribution. The trough position of the adaptive positioning density function is used as the optimal threshold for determining drone traffic flow. ; Node splitting impurity evaluation: Use the soft clustering labels obtained in step two as training labels to train the random forest, and evaluate the sample set at any decision tree node in the random forest. and candidate packet length partitioning feature values Splitting is performed according to the principle of maximizing the decrease in Gini impurity: KDE kernel density estimation and threshold localization: Extracting the optimal set of internal node split values ​​for the "packet size" feature. A Gaussian kernel function is introduced to fit the global probability density distribution. The trough position of the adaptive positioning density function is used as the optimal threshold for determining drone traffic flow. .

6. The method for networked unmanned aerial vehicle (UAV) traffic identification based on spatiotemporal feature fusion according to claim 5, characterized in that, The Gaussian kernel function fits the global probability density distribution. : in, The bandwidth parameter represents the kernel density estimation. The bag length variable represents the density to be estimated. Represents the set of split values The total number of candidate split values ​​included.

7. The method for networked unmanned aerial vehicle (UAV) traffic identification based on spatiotemporal feature fusion according to claim 1, characterized in that, The specific processing procedure in the macroscopic spatial dimension is as follows: Dynamic spatial weight allocation: Probability distribution of soft tags received by the global server from each base station and threshold The server calculates the local soft tag probability distribution. With global model soft labels KL divergence between Dynamic Gaussian confidence weights are defined based on KL divergence. ; Global threshold update and network-wide collaborative locking: generating a globally smooth threshold The data is then distributed to each base station; even if the drone changes base station connections, the globally aligned filtering features ensure that the newly connected base station can quickly identify its traffic fingerprint and relock its roaming IP.

8. The method for networked unmanned aerial vehicle (UAV) traffic identification based on spatiotemporal feature fusion according to claim 7, characterized in that, The dynamic Gaussian confidence weights defined based on KL divergence in, This represents the total number of valid edge base stations currently participating in this round of federated aggregation. It represents the proportional adjustment coefficient that controls the degree of influence of KL divergence on the base station confidence weight.

Images