Unmanned aerial vehicle network security inspection space visualization method based on signal heat map

Abstract

The application discloses a UAV network security inspection space visualization method based on signal heat map, wherein a UAV cluster inspects the airspace along a planned flight path, an airborne multi-mode radio frequency module synchronously collects multi-system wireless signals such as WiFi, LoRa and 5G, synchronously collects signal identification, RSSI and sampling space coordinates, and forms multi-point original signal data. The coordinates and signal strength of the same source sampling points are matched, a dedicated space strength data set of each signal source is constructed, continuous distribution signal risk heat data is generated through gridding interpolation estimation, a heat map layer is matched with a GIS electronic map coordinate to be superimposed and displayed, a high-light area exceeding an alarm threshold is highlighted, and a visual inspection situation map is output. The application combines the whole space maneuvering collection of the UAV and the space visualization technology, converts the traditional discrete point monitoring into continuous heat situation display, operation and maintenance personnel can quickly lock the abnormal signal area according to the heat color and aggregation characteristics, the defects that the fixed monitoring probe data is fragmented and the airspace signal blind area cannot be intuitively presented are overcome, and the network security inspection situation awareness speed and the signal source space positioning accuracy are greatly improved.

Description

Technical Field

[0001] This invention belongs to the field of network security and drone inspection technology, specifically relating to a spatial visualization method for drone network security inspection based on signal heatmaps. Background Technology

[0002] With the deep integration and development of 5G, IoT, and the Industrial Internet, wireless communication networks have accelerated their evolution from "wired-dominated" to "ubiquitous wireless." The blurring of network boundaries and the three-dimensional reconstruction of spatial dimensions have brought unprecedented structural challenges to network security protection systems. Multiple wireless signals, such as WiFi, LoRa, and 5G, coexist in high-density device access and complex spatial environments. Wireless network attack methods such as phishing hotspots, fake base stations, malicious twin access points (Evil Twins), and illegal LoRa nodes are increasingly prevalent. These attacks are highly covert, low-cost, and have become one of the main sources of enterprise data leaks and privacy theft.

[0003] Currently, the inspection and situational awareness of wireless network security mainly rely on the following two types of technical means:

[0004] Firstly, there is the wireless signal monitoring scheme based on fixed probes. This involves deploying several signal acquisition probes at fixed locations within the target area, and then aggregating the collected signal data to a central server for analysis via wired or wireless backhaul. The limitations of this scheme are: (1) the deployment locations of fixed probes are fixed, and the signal acquisition range is limited by the coverage radius of the probes themselves, making it impossible to cover blind spots such as the top floor of buildings, high-rise factories, and three-dimensional pipe corridors; (2) the RSSI values ​​collected at a single point cannot reflect the continuous attenuation trend and distribution pattern of the signal in space, and the data reported by each probe are isolated from each other, making it difficult to form an effective inference of the spatial location of abnormal signal sources; (3) in scenarios such as temporary activities, emergency communications, or temporary control, fixed probes cannot be quickly deployed and dynamically adjusted.

[0005] Secondly, there is the road test and inspection scheme based on handheld devices. This involves maintenance personnel carrying handheld spectrum analyzers or wireless signal detection equipment to walk around the target area, measure and record signal strength. The limitations of this scheme are: (1) manual inspection is inefficient and time-consuming in large-scale parks or complex terrain environments; (2) personnel cannot reach special locations such as the facades of high-rise buildings and dangerous industrial areas, resulting in a physical accessibility bottleneck; (3) the signal strength data recorded manually has low density and discontinuous spatial coverage, making it difficult to support high-resolution signal spatial distribution reconstruction.

[0006] In recent years, drone technology has been gradually introduced into inspection fields such as power line inspection, environmental monitoring, and emergency communications. However, its deep integration with network security detection is still in its initial stage. Existing technical solutions involving drones and wireless signal acquisition typically only enable drones to carry signal acquisition equipment for single-point signal recording. The generated data is still presented in the form of discrete sampling point lists or simple trajectory annotations. When faced with massive amounts of sampled data, maintenance personnel find it difficult to intuitively and quickly determine the spatial distribution characteristics of abnormal signals, signal aggregation areas, and risk evolution trends from discrete point information.

[0007] Furthermore, current technologies lack a method for fusing multi-point RSSI data collected by drone swarms with GIS maps to create a heatmap display. Due to the lack of effective means to transform discrete sampling points into a continuous spatial distribution pattern, the spatial visibility of abnormal signals is poor. Maintenance personnel cannot directly locate high-risk areas through a visual interface, significantly hindering the efficiency of the closed-loop process from "data collection" to "situational awareness" in network security inspections.

[0008] In summary, existing technologies lack a method to effectively transform multi-point discrete RSSI data collected by UAV swarms in three-dimensional space into a visualization method that reflects the continuous spatial distribution of signal strength, and on this basis, to achieve rapid identification and visualization labeling of spatial clusters of anomalous signal sources. Summary of the Invention

[0009] This invention aims to address the technical problems in existing wireless network security inspection visualization technologies, such as the inability to effectively transform discrete sampling points into continuous spatial distributions reflecting signal strength, the difficulty in quickly identifying spatial clustering characteristics of abnormal signals, and the lack of dynamic three-dimensional spatial signal heatmap generation and GIS fusion visualization methods. It provides a spatial visualization method and system for UAV network security inspection based on signal heatmaps.

[0010] To achieve the above objectives, the present invention provides the following technical solution:

[0011] A spatial visualization method for UAV network security inspection based on signal heatmaps includes the following steps:

[0012] Acquisition steps: The drone swarm flies along a preset track within the target inspection airspace and uses an onboard multi-mode radio frequency acquisition module to capture wireless communication signals in real time, acquiring multi-point signal data including signal source identification information, received signal strength index (RSSI), and corresponding spatial coordinates.

[0013] Construction steps: Associate the spatial coordinates of multiple sampling points belonging to the same signal source with RSSI values ​​to construct a spatial signal intensity dataset for each signal source;

[0014] Generation steps: Based on the spatial signal strength dataset, perform gridded signal strength estimation on the inspection area to generate risk heat map data reflecting the spatial distribution of signal strength;

[0015] Overlay step: The risk heat map data is overlaid on the corresponding spatial coordinates of the GIS electronic map, and areas with signal strength exceeding the preset alarm threshold are differentiated according to the preset alarm threshold to generate a visual situation map;

[0016] Output steps: Output the inspection results including the visualized situation map.

[0017] Furthermore, in the construction step, the correlation between spatial coordinates and RSSI values ​​is verified for consistency based on a logarithmic distance path loss model. The verification formula is as follows:

[0018]

[0019] in, For the signal strength at the reference distance, This is the path loss index. The spatial distance between the sampling point and the signal source. This is a noise term; when the deviation between the measured RSSI value of a sampling point and the predicted value based on this model exceeds a preset threshold, the sampling point is marked as abnormal and removed.

[0020] Furthermore, in the generation step, a spatial interpolation algorithm is used to perform gridded signal strength estimation on the inspection area. The signal strength of unsampled grid points is estimated using the RSSI values ​​of the sampled points, forming a continuous signal strength distribution surface covering the entire inspection area.

[0021] Furthermore, the spatial interpolation algorithm is Kriging interpolation, and its estimation formula is:

[0022]

[0023] in, Unsampled points Signal strength estimate at [location] For the first sampling points Measured RSSI value at the location, To give the first The weighting coefficients for each sampling point The number of sampling points involved in the estimation; the weighting coefficients The solution is found by minimizing the variance of the estimation error.

[0024] Furthermore, in the overlay step, the heat map data of different signal standards are overlaid on the same GIS map as independent layers on the visualized situation map. Users can view the spatial distribution of WiFi, LoRa, and 5G signals respectively by switching layers or using a semi-transparent overlay method.

[0025] Furthermore, the output step also includes identification of spatial clustering areas of suspicious signal sources: continuous regions in the risk heatmap where the signal intensity exceeds the alarm threshold are marked as connected components, the spatial range and geometric center of each connected component are extracted, and abnormal signal clustering areas are identified and alarm labels are generated based on density clustering algorithm.

[0026] Furthermore, the density clustering algorithm is the DBSCAN algorithm, and its clustering basis is:

[0027]

[0028] in, For the alarm sampling point set, For any alarm sampling point, for Sampling points in the neighborhood of The spatial distance between two points. The threshold value is the spatial neighborhood radius. This is the threshold for signal strength difference.

[0029] Furthermore, the output step is followed by a secondary fine positioning step: in response to the triggering operation of the alarm area on the visualized situation map, the secondary evidence collection drone is called to go to the corresponding spatial coordinates to perform high-density gridded resampling, and the signal attenuation surface is fitted based on the least squares method to reconstruct the spatial position of the signal source.

[0030] Furthermore, the specific formula for fitting the signal attenuation surface and reconstructing the spatial location of the signal source based on the least squares method is as follows:

[0031] Let the coordinates of the unknown signal source be... Then the first The predicted RSSI value for each sampling point is:

[0032]

[0033] The location of the signal source is estimated by minimizing the sum of squared errors:

[0034]

[0035] make , The estimated coordinates of the signal source are obtained by solving the problem. The precise positioning results will be sent back and the risk heatmap data will be refreshed.

[0036] Furthermore, the spatial visualization system for UAV network security inspection based on signal heatmaps is characterized by comprising:

[0037] The aerial inspection module consists of a cluster of drones equipped with multi-mode radio frequency acquisition units and positioning modules. It is used to perform inspection flights on preset tracks and collect multi-point signal data in real time.

[0038] The data processing module is used to associate the spatial coordinates of multiple sampling points belonging to the same signal source with RSSI values, construct a spatial signal strength dataset, and generate heat map data reflecting the spatial distribution of signal strength based on the dataset.

[0039] The GIS map fusion module is used to overlay the heat map data onto the GIS electronic map to generate a visual situation map, and to differentiate high-risk areas according to a preset alarm threshold.

[0040] The interactive display module is used to display the visualized situation map on the user interface, and supports track playback, heat map layer switching and inspection report generation.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. This invention aggregates the RSSI values ​​of multiple spatially discrete sampling points belonging to the same signal source and reconstructs the continuous intensity distribution surface of the signal source in the entire inspection airspace using a spatial interpolation algorithm. This transforms the traditional "point reading" into a "surface state potential map". Maintenance personnel can intuitively judge the spatial attenuation trend and extreme value region of the signal intensity through the color gradient of the heat map, overcoming the shortcomings of the existing technology where discrete sampling points are presented in isolation and the spatial distribution is not visible.

[0043] 2. This invention performs spatial coordinate registration and overlay display of the reconstructed signal strength distribution surface with a GIS electronic map, enabling maintenance personnel to intuitively view the spatial distribution range, clustering area, and relative positional relationship with surrounding buildings, roads, and other geographical elements on a real geographical background, significantly improving the physical locatability of abnormal signals and the efficiency of on-site handling.

[0044] 3. This invention marks the continuous regions in the heat map where the signal intensity exceeds the alarm threshold as connected components, and uses the DBSCAN clustering algorithm to cluster in both the spatial and signal intensity domains. This can automatically discover the clustering patterns of abnormal signals and generate alarm labels, avoiding the inefficient pattern interpretation of massive discrete data points by relying on human experience in traditional methods. This achieves a leap from "manual map reading" to "automatic map recognition".

[0045] 4. Based on the initial location of the heat map, this invention responds to the user's trigger operation on the alarm area, automatically dispatches a secondary evidence collection drone to perform high-density gridded resampling, fits the signal attenuation surface through the least squares method and inverts the precise coordinates of the signal source, transmits the precise location results back and refreshes the heat map layer, forming a complete technical closed loop of "wide-area initial screening of heat map - clustering labeling - precise location - map refresh", effectively solving the technical bottleneck of traditional heat maps that can only present distribution and cannot accurately trace the source.

[0046] 5. This invention supports the generation and overlay display of heat maps of different signal standards such as WiFi, LoRa, and 5G in the form of independent layers. Users can switch or overlay the heat maps in a semi-transparent manner to view the spatial distribution of signals of different standards according to their analysis needs, avoiding visual confusion caused by the mixing of multiple signal standards. This provides a flexible visualization analysis tool for classification and safety detection in complex electromagnetic environments. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of the overall process of the spatial visualization method for UAV network security inspection based on signal heatmaps according to the present invention;

[0048] Figure 2 This is a schematic diagram of the multi-drone collaborative flight path and sampling point distribution during the multi-point signal acquisition phase of the UAV swarm in this invention;

[0049] Figure 3 This is a system module architecture diagram of the present invention. Detailed Implementation

[0050] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solution of the present invention and should not be construed as limiting the scope of protection of the present invention.

[0051] Example 1: Spatial Visualization Method for UAV Network Security Inspection Based on Signal Heatmap

[0052] This embodiment provides a spatial visualization method for UAV network security inspection based on signal heatmaps, including the following steps:

[0053] S1: Acquire multi-point signal data

[0054] By using a swarm of drones to fly along a preset track within the target inspection airspace, the drones can capture wireless communication signals in real time using an onboard multi-mode radio frequency acquisition module, and obtain multi-point signal data including signal source identification information, received signal strength index (RSSI), and corresponding spatial coordinates.

[0055] Specifically, this embodiment uses a patrol swarm consisting of three quadcopter drones. Each drone is equipped with a USB wireless network card supporting monitoring mode (for WiFi signal acquisition), an SX1278 LoRa module (for LoRa signal acquisition), and a GPS / RTK positioning module. The drone swarm's trajectory planning uses a combination of rectangular scanning and path search: taking the target inspection area (e.g., a 100m×100m park) as the operating range, the ground station first generates a gridded waypoint matrix covering the entire area, with the waypoint spacing set according to the required spatial resolution (set to 10m in this embodiment); the three drones fly along serpentine paths from different starting positions to achieve full coverage scanning of the area.

[0056] During flight, the onboard data acquisition system uses the airodump-ng tool from the aircrack-ng suite to put the wireless network card into Monitor mode, continuously capturing 802.11 management frames (including Beacon frames, Probe Response frames, etc.). From the captured frame structure, it parses information such as ESSID (network name), BSSID (MAC address), encryption method (ENC / CIPHER / AUTH), channel (CH), and RSSI (i.e., the PWR field in the airodump-ng output). The data format recorded at each signal sampling point is as follows:

[0057]

[0058] in The three-dimensional spatial coordinates of the UAV at the sampling time (provided by onboard GPS / RTK, with horizontal positioning accuracy down to the centimeter level). This is the sampling timestamp. The LoRa signal is acquired by reading the LoRa frames received by the SX1278 module using the PySX27x library, from which the source device address, payload, and RSSI information are parsed.

[0059] In a single inspection mission, the three drones collected approximately 300 valid sampling points within a 100m×100m area, covering all grid nodes.

[0060] S2: Construct spatial signal intensity datasets for each signal source

[0061] The spatial coordinates of multiple sampling points belonging to the same signal source are associated with RSSI values ​​to construct a spatial signal intensity dataset for each signal source.

[0062] The system uses BSSID (WiFi) or device address (LoRa) as the unique identifier for the signal source and groups and aggregates all sampling points. For example, the BSSID of a certain fishing hotspot is "6C:1F:F7:90:3D:CE", which was detected by drone 1 during the inspection process. The RSSI measured at this location was -55dBm, which was observed by UAV 2 at this location. The RSSI measured at this location was -48 dBm, which was observed by UAV 1 at this location. If the RSSI measured at point 3 is -62 dBm, then these three sampling points are associated with the same signal source, constituting the spatial signal strength dataset of that signal source:

[0063]

[0064] Subscript Identify the signal source number. This represents the total number of sampling points for the signal source.

[0065] As a preferred implementation, during the dataset construction process, a consistency check is also performed on the sampling points based on the logarithmic distance path loss model to remove abnormal sampling points caused by occlusion, multipath effects, or measurement noise. The logarithmic distance path loss model is expressed as:

[0066]

[0067] in The signal strength value is taken at a reference distance (usually 1m). The path loss index is 2-3 for indoor environments and 1.6-2.2 for outdoor open environments. The spatial distance between the sampling point and the signal source. This is a Gaussian noise term.

[0068] Since the precise location of the signal source is still unknown, this embodiment adopts an iterative verification method: First, the geometric center of each sampling point in the dataset is used as the initial estimated location of the signal source, and the distance from each sampling point to the geometric center is calculated. Then sample all points Perform linear regression (with) (where RSSI_i is the independent variable and RSSI_i is the dependent variable), thus obtaining the reference path loss model parameters of the signal source under this environment. and Based on this, the residual between the measured RSSI value and the model prediction value is calculated for each sampling point:

[0069]

[0070] when Exceeding a preset threshold (in this embodiment, the threshold is set to...) ,in When the standard deviation of the residuals of all sampling points is given, the sampling point is marked as an anomaly and removed to ensure the data quality upon which the subsequent heatmap generation depends.

[0071] S3: Generate risk heatmap data

[0072] Based on the aforementioned spatial signal strength dataset, gridded signal strength estimation is performed on the inspection area to generate risk heat map data reflecting the spatial distribution of signal strength.

[0073] This embodiment uses Kriging interpolation to estimate the signal strength of the inspection area using a gridded method. The target inspection area (100m × 100m) is divided into a 1m × 1m grid, with a total of 10,000 grid nodes. For each unsampled grid node... Its signal strength estimate The result is obtained by weighted summation of the RSSI values ​​of known sampling points:

[0074]

[0075] in For the first sampling points Measured RSSI value at the location, To give the first The weighting coefficients for each sampling point The number of sampling points involved in the estimation (in this embodiment, distance is taken as the distance). (The 12 most recent sampling points).

[0076] Weighting coefficient Determining the value of is the core of Kriging interpolation. This embodiment uses the Ordinary Kriging method, which solves the problem by minimizing the estimation error variance and satisfying the unbiased estimation condition.

[0077]

[0078] During the solution process, a semivariogram model needs to be fitted based on the sampled data. This embodiment uses a spherical model to fit the semivariogram:

[0079]

[0080] in The spatial distance between two points This is the nugget effect (variance caused by measurement error). For sill values, The range is variable (spatial autocorrelation disappears beyond this distance). By substituting the distance between sampling point pairs and the signal intensity difference into Equation 4 for fitting, the semi-variogram parameters of the inspection area are obtained. Then, Equation 3 is solved to obtain the optimal weight coefficients for each sampling point. .

[0081] By estimating each of the 10,000 grid nodes, a continuous signal intensity distribution surface is obtained for the entire inspection area.

[0082] A continuous signal strength distribution surface is projected onto a two-dimensional plane, and color gradient mapping is performed according to the signal strength values ​​to generate risk heatmap grid data. This embodiment uses a color mapping scheme from red to green to blue: areas with signal strength above -30dBm are mapped to red (high risk), areas with signal strength between -50dBm and -30dBm are mapped to orange to yellow (medium risk), areas with signal strength between -70dBm and -50dBm are mapped to light green (low risk), and areas with signal strength below -70dBm are mapped to dark blue (safe). Each grid node stores its spatial coordinates. The corresponding RGB color values ​​are used to form raster layer data that can be directly loaded by GIS systems.

[0083] S4: Generate a visual situation map

[0084] The risk heat map data is overlaid on the corresponding spatial coordinates of the GIS electronic map, and areas with signal strength exceeding the preset alarm threshold are differentiated according to the preset alarm threshold to generate a visual situation map.

[0085] This embodiment uses the open-source Leaflet or Cesium GIS engine as the map rendering platform. Before overlaying the heatmap data, spatial coordinate registration is required: the coordinate system of the grid nodes in step S3 is converted to the WGS-84 geographic coordinate system (latitude and longitude) to ensure consistency with the spatial reference system of the GIS base map. In this embodiment, the GPS coordinates used by the UAV for data collection are latitude and longitude in the WGS-84 coordinate system, so no additional coordinate conversion is required.

[0086] The overlay process is as follows: The heatmap raster data generated in step S3 is converted into a GeoJSON or GeoTIFF format layer file. This file is then overlaid onto the GIS base map using the GIS engine's layer management interface, with the transparency set to 70% to allow simultaneous observation of geographic features such as roads, building outlines, and area boundaries on the base map. After overlay, the GIS engine renders the data based on the RGB values ​​of each grid node, creating a visualized situational map.

[0087] For areas where the signal strength exceeds the preset alarm threshold (in this embodiment, the threshold is set to -80dBm for the controlled network environment, meaning any signal higher than -80dBm will trigger an alarm), the system overlays a red dashed boundary box on the heat map for differentiation and adds a flashing alarm icon at the geometric center of the area.

[0088] Furthermore, this embodiment also supports multi-signal standard layered heatmap display. The system generates separate heatmaps for WiFi, LoRa, and 5G signals on independent layers, each using a different color scheme (red for WiFi, blue for LoRa, and green for 5G). Users can independently control the display / hiding of each layer or adjust the layer overlay transparency through the layer panel on the left side of the interface, enabling individual viewing of a single standard or semi-transparent overlay comparison of multiple standards. When WiFi and LoRa heatmaps are overlaid, if the high-value areas of the two standards overlap spatially, the overlay area will display a mixed red and blue purple hue, alerting maintenance personnel to the abnormal coexistence of multiple standard signals in that area.

[0089] S5: Outputs a visualized situation map and inspection results.

[0090] The output includes the inspection results containing the visualized situation map.

[0091] This embodiment, in addition to outputting a visualized situational map, also automatically identifies and labels spatially clustered areas of abnormal signals. Specifically, the system first marks the connected components of continuous grid regions in the heatmap where the signal strength exceeds the alarm threshold: using a four-neighbor scanning algorithm, the connectivity of all grid nodes with signal strength exceeding the threshold is determined, marking multiple non-connected continuous regions. The spatial extent (minimum bounding rectangle) and geometric center coordinates of each connected component are then extracted.

[0092] Subsequently, the alarm sampling points were clustered using the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) clustering algorithm, with the following clustering conditions:

[0093]

[0094] in The set of all sampling points that exceed the alarm threshold. For any alarm sampling point, for Sampling points in the neighborhood, Let be the Euclidean distance between two points. The threshold value for the spatial neighborhood radius is 5m in this embodiment. The threshold for signal strength difference is 5 dBm (in this embodiment, it is set to 5 dBm). Sampling points that satisfy Equation 5 are grouped into the same cluster. In this embodiment, multiple alarm sampling points collected near a signal source are determined by DBSCAN to be in the same cluster because the spatial distance between them is less than 5 m and the RSSI difference is less than 5 dBm, corresponding to the spatial clustering area where the signal source is located.

[0095] The geometric center of each cluster serves as the alarm label location. The system determines the alarm level based on the average RSSI value of the sampled points within that cluster: an average RSSI above -40dBm is marked with a red high-risk icon, between -55dBm and -40dBm with a yellow medium-risk icon, and between -70dBm and -55dBm with an orange low-risk icon. Simultaneously, an inspection report is output, including the location coordinates of each alarm area, the signal strength range, the alarm level, and a corresponding heatmap screenshot.

[0096] S6: Secondary fine positioning (preferred step)

[0097] In response to the triggering operation of the alarm area on the visualized situation map (such as when a user clicks on the alarm icon), the secondary evidence collection drone is called to go to the corresponding spatial coordinates to perform high-density gridded resampling. Based on the least squares method, the signal attenuation surface is fitted to reconstruct the spatial location of the signal source, and the precise positioning results are sent back and the risk heat map data is refreshed.

[0098] Specifically, when a user clicks on an alarm marker on the visualized situation map, the system automatically generates a secondary inspection command, including the geometric center coordinates of the alarm area and the inspection radius (10m in this embodiment), and sends it to the flight control system of the secondary evidence collection drone via UDP communication. After arriving at the designated area, the secondary evidence collection drone performs high-density sampling (sampling interval of 0.5m) within the radius using a spiral search path, acquiring RSSI and coordinate data of no less than 50 sampling points.

[0099] Let the coordinates of the unknown signal source be... Then the first The predicted RSSI value for each sampling point is expressed based on the logarithmic distance path loss model in Equation 1 as follows:

[0100]

[0101] The location of the signal source is estimated by minimizing the sum of squared prediction errors at all sampling points:

[0102]

[0103] make , The Levenberg-Marquardt algorithm is used for nonlinear least squares iterative solution to obtain the estimated coordinates of the signal source. Simultaneously calculate location reliability:

[0104]

[0105] In this embodiment, during three tests in a controlled network environment, the average positioning error of the secondary fine positioning was 0.30m (the Euclidean distance between the actual and estimated positions of the signal source), with a confidence level higher than 0.92. After the fine positioning was completed, the secondary evidence-gathering UAV captured on-site images and transmitted them back to the ground station via push stream. The system updated the fine positioning coordinates and on-site images to the alarm information in the GIS map and triggered step S3 to regenerate the heat map data of the local area (at this time, due to the increased sampling density, the spatial resolution of the heat map was significantly improved), refreshing the visualization situation map display.

[0106] Example 2: Spatial Visualization System for Unmanned Aerial Vehicle (UAV) Network Security Inspection Based on Signal Heatmap

[0107] This embodiment provides a spatial visualization system for UAV network security inspection based on signal heatmaps, including an aerial inspection module 100, a data processing module 200, a GIS map fusion module 300, and an interactive display module 400.

[0108] Aerial Inspection Module 100

[0109] The aerial inspection module 100 consists of a swarm of drones equipped with multi-mode radio frequency acquisition units and positioning modules. It is used to perform inspection flights along preset paths and collect multi-point signal data in real time. Each drone includes: a PX4 flight control system, a Jetson onboard computing board, a USB wireless network card supporting Monitor mode (WiFi signal acquisition), an SX1278 LoRa module (LoRa signal acquisition), a GPS / RTK positioning module, and a 5G communication module. The onboard computing board runs the ROS2 system and communicates with the flight control system via Mavros to achieve parallel execution of path control, signal acquisition, and data upload. During a single inspection mission, the drone swarm is networked through high-power communication modules, enabling full connectivity between all aerial nodes and the ground-based edge layer industrial control computer, supporting real-time data reporting and dynamic mission adjustments.

[0110] Data processing module 200

[0111] The data processing module 200 is used to associate the spatial coordinates of multiple sampling points belonging to the same signal source with RSSI values, construct a spatial signal strength dataset, and generate heat map data reflecting the spatial distribution of signal strength based on the dataset.

[0112] In this embodiment, the data processing module 200 adopts a layered architecture of edge computing node 210 and cloud server 220.

[0113] Edge computing node 210, deployed at the inspection site, is an industrial control computer equipped with a GPU and includes a data access unit, a time alignment unit, a spatial interpolation unit, and a clustering analysis unit. The data access unit receives signal sampling data packets from multiple drones in real time via a 5G / LoRa gateway. The data packets are in JSON format, containing BSSID, ESSID, RSSI, coordinates, and timestamps. The time alignment unit synchronizes the data from multiple drones based on the timestamps of each sampling point (allowing a synchronization error of ±100ms) to ensure the comparability of data collected by different drones during subsequent spatial interpolation. The spatial interpolation unit uses the Kriging interpolation method described in Example 1 to perform gridded signal strength estimation in the inspection area, generating initial risk heatmap data. The clustering analysis unit performs dual-domain clustering of alarm sampling points based on the DBSCAN algorithm, automatically identifying areas of abnormal signal aggregation. After the edge computing node generates the initial heat map data, it is displayed in real time through a visual situation map (processed by the GIS map fusion module). At the same time, the data is backed up to the local cache to ensure that it can still run independently when the cloud connection is interrupted. The entire edge analysis process of a single inspection task can be completed within 60 seconds.

[0114] The cloud server 220 receives data uploaded by edge nodes, performs long-term trend analysis and detection strategy optimization, and updates heatmap generation parameters. A large-scale deep learning platform and GIS data storage cluster are deployed in the cloud, running an LSTM-based time-series anomaly detection model and a CNN signal classifier. It performs offline data mining on historical data, identifies covert attack patterns (such as periodic broadcasting by fake base stations and packet replay attacks), and dynamically adjusts alarm thresholds, path loss model parameters, and interpolation algorithm configurations based on the analysis results. The updated parameters are then distributed to the edge computing node 210 via OTA (Over-The-Air).

[0115] GIS map fusion module 300

[0116] The GIS map fusion module 300 is used to overlay the heatmap data onto the GIS electronic map to generate a visualized situation map, and to differentiate high-risk areas based on preset alarm thresholds. This embodiment uses the Cesium 3D GIS engine or the Leaflet 2D GIS engine as the map rendering platform, supporting mixed rendering of heatmap raster data (GeoTIFF format) and vector geographic data (GeoJSON format). Spatial coordinate registration uses the WGS-84 coordinate system, and the heatmap grid coordinates are precisely aligned with the GIS base map coordinates through a spatial reference system conversion interface. During overlay display, the heatmap layer is overlaid on the GIS base map with a specified transparency, and alarm areas are automatically extracted by the system and overlaid with a red semi-transparent filled bounding box on top of the heatmap.

[0117] Interactive display module 400

[0118] The interactive display module 400 is used to display the visualized situation map on the user interface, supporting flight track playback, heat map layer switching, and inspection report generation. The user interface is developed using a web front-end framework and includes a main view area, a layer panel, an alarm list, and a timeline control bar. The main view area displays a GIS map with overlaid heat map layers; the layer panel lists WiFi, LoRa, and 5G signal standard layers, as well as the historical flight track layers of each drone. Users can control the display and hiding of each layer via checkboxes and adjust the transparency of each heat map layer via sliders; the alarm list displays the time, location, type, and level of all alarm events in tabular form. Clicking on any item in the list triggers the main view area to automatically focus on the corresponding alarm location; the timeline control bar supports time-rewind playback of historical inspection data, allowing users to view the dynamic evolution of the heat map at different times by dragging the slider. The inspection report generation function supports one-click export of standardized PDF reports containing heat map screenshots, alarm statistics, and location information.

[0119] Example 3: Preferred Implementation Methods Based on Different Application Scenarios

[0120] This embodiment provides preferred implementations of the method of the present invention in different application scenarios.

[0121] Scenario 1: Controlled Network Environment

[0122] In controlled network environments (such as power plant dispatch centers, railway communication bureaus, and military industrial zones), the number of legitimate hotspots is fixed, and the network policy is "zero openness." Any WiFi signal not registered in the whitelist is considered a security event. In this scenario, during the dataset construction phase of step S2, the system loads the "legitimate AP directory" for the area, containing the BSSID, ESSID, and deployment location of each legitimate hotspot. After generating the heatmap in step S3, the system additionally performs a whitelist comparison: if a signal source (uniquely identified by its BSSID) is not in the legitimate directory, its heatmap area is automatically marked as a high-risk alarm (with a flashing red border), triggering a secondary evidence collection process. In this scenario, the alarm threshold is set to -80dBm, meaning any unregistered signal exceeding this strength will trigger an alarm.

[0123] In this embodiment, three illegal WiFi hotspots were simulated in a controlled test area of ​​100m×100m. The system detected all of them in a single inspection. The average time from the drone's takeoff to the final generation of the visualized situation map was about 8 minutes, and the average error of the secondary precision positioning was 0.30m.

[0124] Scenario 2: Semi-controlled network environment

[0125] In semi-controlled network environments (such as hotels, conference centers, and shopping malls), legitimate WiFi services exist, but hidden illegal signal sources such as hidden cameras and phishing hotspots may also exist. A key characteristic of this scenario is that the illegal signal sources may operate intermittently (e.g., only after the room lights are turned off or during specific time periods). In this scenario, step S1, in addition to performing routine inspections, also executes a "time-series scan" mode: the system controls a drone to perform inspections at multiple time periods (e.g., daytime, evening, and late night), recording the occurrence of the same signal source and changes in RSSI at different times. After generating heatmaps for each time period in step S3, the signal sources are analyzed for their time-series characteristics: if a signal source only appears during late night and its signal strength fluctuations are temporally correlated with the room's power usage (determined through light sensors or power line detection), its risk level is increased.

[0126] In this embodiment, during the hotel scenario test, the system successfully identified a hidden camera WiFi hotspot that was activated during the lights-out period (23:00-02:00). This hotspot was not seen during daytime inspections but was captured during nighttime inspections and located to a certain room area via a heat map, with a precise positioning error of 0.45m.

[0127] Scenario 3: Emergency Communication and Disaster Scenarios

[0128] In emergency communication and disaster scenarios, when ground communication facilities are damaged, a temporary mesh network needs to be quickly established by a swarm of drones. The heatmap visualization method of this invention serves a dual purpose in this scenario: firstly, by monitoring the uniformity of signal coverage and the distribution of blind spots in the temporary communication network through heatmaps, it assists the command center in adjusting the hovering positions and power configurations of aerial nodes to optimize network coverage; secondly, by identifying potential illegal relays, interference sources, or fake base station signals at the disaster site through heatmaps, it prevents secondary security incidents. In this scenario, the system reduces spatial resolution (grid spacing increased from 1m to 5m) to achieve faster interpolation calculation speed (<10 seconds / time), enabling real-time updates of the heatmap (refreshed once per second) and supporting rapid decision-making in dynamically adjusted scenarios.

[0129] Example 4: Performance Testing

[0130] Test 1: Controlled Environment Testing

[0131] In a controlled test airspace of 100m × 100m, illegal WiFi hotspots were placed at three different locations, and three drones were used to execute the complete process of this invention. The test was repeated 10 times, and the results are as follows: the average computation time for generating the heatmap was 42 seconds (completed at the edge node); the illegal hotspot detection rate was 100% (detected in all 10 tests); the average positioning error for secondary fine positioning was 0.30m, and the maximum positioning error was 0.41m. The visualized situation map clearly shows the three heat concentration areas, and maintenance personnel can directly read the spatial coordinates of each area through the map.

[0132] Test 2: Comparison Test with Fixed Probe Solution

[0133] In the same test site, seven fixed WiFi probes (costing roughly the same as three drones) were deployed and compared with the drone swarm solution of this invention. Control variables were: same area, same number of legal nodes, same number of illegal nodes (three), and same data processing algorithm. Test results showed that the fixed probe solution had a detection blind spot beyond 25m from the farthest probe, and one of the three illegal hotspots (located at the edge of the site) was never detected; the drone inspection solution detected and located all three hotspots. In the test of detection rate varying with signal source distance, the detection rate of the fixed probes decreased from 100% to approximately 60% at 10m (at 15m), and further to approximately 30% at 20m; while the drone solution, due to its dynamic flight, could complete data collection within 5m of the signal source, maintaining a detection rate above 95% throughout.

[0134] Furthermore, in the test on the impact of sampling number on detection rate, under the same cost budget, the average number of samplings of the same signal source by the drone swarm is 3.2 times that of the fixed probe scheme, corresponding to an increase in detection rate of about 38 percentage points.

[0135] Test 3: Semi-controlled environment timing test

[0136] In a simulated hotel scenario (10 rooms, 100m x 20m corridor area), a concealed WiFi hotspot was set up that was only active at night (22:00-06:00). The system performed one inspection during the day and one at night: the hotspot signal was not detected in the heat map during the daytime inspection; the heat map during the nighttime inspection showed a heat accumulation area with a signal strength of -52dBm in the corresponding room area, and the signal source was confirmed to be inside the room by secondary precise positioning, with a positioning error of 0.42m. The average false negative rate of 10 repeated experiments was 0% (all hotspots active at night were detected), and the average positioning error was 0.45m.

[0137] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A spatial visualization method for UAV network security inspection based on signal heatmaps, characterized in that, include: Acquisition steps: The drone swarm flies along a preset track within the target inspection airspace and uses an onboard multi-mode radio frequency acquisition module to capture wireless communication signals in real time, acquiring multi-point signal data including signal source identification information, received signal strength index (RSSI), and corresponding spatial coordinates. Construction steps: Associate the spatial coordinates of multiple sampling points belonging to the same signal source with RSSI values ​​to construct a spatial signal intensity dataset for each signal source; Generation steps: Based on the spatial signal strength dataset, perform gridded signal strength estimation on the inspection area to generate risk heat map data reflecting the spatial distribution of signal strength; Overlay step: The risk heat map data is overlaid on the corresponding spatial coordinates of the GIS electronic map, and areas with signal strength exceeding the preset alarm threshold are differentiated according to the preset alarm threshold to generate a visual situation map; Output steps: Output the inspection results including the visualized situation map.

2. The method according to claim 1, characterized in that, In the construction step, the correlation between spatial coordinates and RSSI values ​​is verified for consistency based on a logarithmic distance path loss model. The verification formula is as follows: in, For the signal strength at the reference distance, This is the path loss index. The spatial distance between the sampling point and the signal source. This is a noise term; when the deviation between the measured RSSI value of a sampling point and the predicted value based on this model exceeds a preset threshold, the sampling point is marked as abnormal and removed.

3. The method according to claim 1, characterized in that, In the generation step, a spatial interpolation algorithm is used to perform gridded signal strength estimation on the inspection area. The signal strength of unsampled grid points is estimated by using the RSSI values ​​of the sampled points, forming a continuous signal strength distribution surface covering the entire inspection area.

4. The method according to claim 3, characterized in that, The spatial interpolation algorithm is Kriging interpolation, and its estimation formula is as follows: in, Unsampled points Signal strength estimate at [location] For the first sampling points Measured RSSI value at the location, To give the first The weighting coefficients for each sampling point The number of sampling points involved in the estimation; the weighting coefficients The solution is found by minimizing the variance of the estimation error.

5. The method according to claim 1, characterized in that, In the overlay step, heat map data of different signal standards are overlaid on the same GIS map as independent layers on the visualized situation map. Users can view the spatial distribution of WiFi, LoRa and 5G signals by switching layers or using semi-transparent overlay.

6. The method according to claim 1, characterized in that, The output step also includes identifying spatial clustering areas of suspicious signal sources: marking connected components in continuous areas where the signal intensity in the risk heatmap exceeds the alarm threshold, extracting the spatial range and geometric center of each connected component, identifying abnormal signal clustering areas based on density clustering algorithm, and generating alarm labels.

7. The method according to claim 6, characterized in that, The density clustering algorithm is the DBSCAN algorithm, and its clustering basis is as follows: in, For the alarm sampling point set, For any alarm sampling point, for Sampling points in the neighborhood of The spatial distance between two points. The threshold value is the spatial neighborhood radius. This is the threshold for signal strength difference.

8. The method according to claim 1, characterized in that, The output step is followed by a secondary fine positioning step: in response to the triggering operation of the alarm area on the visualized situation map, the secondary evidence collection drone is called to go to the corresponding spatial coordinates to perform high-density gridded resampling, and the signal attenuation surface is fitted based on the least squares method to reconstruct the spatial position of the signal source.

9. The method according to claim 8, characterized in that, The specific formula for fitting the signal attenuation surface and reconstructing the spatial location of the signal source based on the least squares method is as follows: Let the coordinates of the unknown signal source be... Then the first The predicted RSSI values ​​for each sampling point are: The location of the signal source is estimated by minimizing the sum of squared errors: make , The estimated coordinates of the signal source are obtained by solving the problem. The precise positioning results will be sent back and the risk heatmap data will be refreshed.

10. A spatial visualization system for UAV network security inspection based on signal heatmaps, characterized in that, include: The aerial inspection module consists of a cluster of drones equipped with multi-mode radio frequency acquisition units and positioning modules. It is used to perform inspection flights on preset tracks and collect multi-point signal data in real time. The data processing module is used to associate the spatial coordinates of multiple sampling points belonging to the same signal source with RSSI values, construct a spatial signal strength dataset, and generate heat map data reflecting the spatial distribution of signal strength based on the dataset. The GIS map fusion module is used to overlay the heat map data onto the GIS electronic map to generate a visual situation map, and to differentiate high-risk areas according to a preset alarm threshold. The interactive display module is used to display the visualized situation map on the user interface, and supports track playback, heat map layer switching and inspection report generation.

Images