CN109885092B - Unmanned aerial vehicle flight control data identification method - Google Patents

Abstract

The invention discloses a method for identifying flight control data of an unmanned aerial vehicle, and relates to the field of unmanned aerial vehicle communication. The method is that the communication data packet between the unmanned aerial vehicle and the control terminal is captured under the suspension state of the unmanned aerial vehicle, after preprocessing the data packet, extracting a characteristic vector by using an n-gram model in a natural language, then clustering the characteristic vector by using a K-means + + algorithm, performing model training on each clustered cluster by using an One-Class-SVM model, so as to generate a spherical surface of a high-dimensional space, then, the traffic generated by the unmanned aerial vehicle under the artificial control is marked as abnormal traffic by using a malicious traffic detection method, each data traffic under the artificial control state is detected by using each model trained before, because the flight control data generated under artificial control is not in the model in the suspension state and can be marked as abnormal flow by all the models, the flight control data is identified according to the marks of all the models.

Description

A method for identifying UAV flight control data

technical field

The invention relates to the field of unmanned aerial vehicles, in particular to a method for identifying the flight control data of unmanned aerial vehicles.

Background technique

UAVs have great uses in both military and civilian fields, but the current laws and regulations are not perfect. Many UAVs fly in sensitive military areas, airports and other places, seriously endangering national and public security.

Therefore, in order to strengthen the supervision of UAVs, necessary technical means are also needed, and the protocol must be reversed. Only by reversing its protocol format can the UAVs be captured technically and realize the detection of UAVs. Control. However, in the process of communication between the remote control and the UAV, the generated signal not only includes the signal of the controller to control the flight status of the UAV, because the UAV may need to perform certain tasks, such as aerial photography, plant protection, etc., Therefore, other types of signals will be generated, such as drone flight attitude signals, gps signals, etc. The most valuable part to us is the flight control signal. After completing the reverse of the flight control signal, it is possible to Human-machine real-time hijacking control.

At the 2016 black conference, Nils hijacked the target drone by falsifying the remote control signal and seized control of the drone; at the 3.15 party in 2016, the security team of Tencent passed the remote control of the DJI Phantom 3s drone. The falsification of the signal took control of the target drone. This technology can also be used for drone control. Once it is found that a drone has entered the no-fly zone, the control of the target drone can be seized by forging the control signal of the drone to complete its control.

The realization of the above technical solutions all rely on the disassembly of the hardware, the study of the chips in the hardware, and the dynamic debugging method to obtain the flight control data, but this method has certain limitations. The model of the chip has been processed, and the research on the chip cannot be identified, and it is strongly dependent on the model of the drone. It is necessary to do special research and analysis for each type of drone, which is time-consuming and labor-intensive. The present invention mainly aims at the limitation of the prior art, and proposes a novel identification method of UAV flight control data, which does not rely on hardware disassembly and has a high degree of automation.

SUMMARY OF THE INVENTION

The purpose of the present invention is: in order to solve the limitations of the traditional method, can not identify the research on the chip, and strongly depends on the model of the drone, it is necessary to do special research and analysis for each type of drone, which is time-consuming and labor-intensive. The problem is to provide a method for identifying UAV flight control data.

To achieve the above purpose, the present invention provides the following technical solutions: a method for identifying UAV flight control data, comprising the following steps:

Step 1: Hang the drone in the air, and use the packet capture tool to capture the data packets between the drone and the controller. At this time, the data packets are binary data streams;

Step 2: Convert the binary data stream into displayable hexadecimal characters;

Step 3: Use the n-gram model in natural language processing to extract the features of each data packet;

Step 4: Use the k-means++ algorithm to use the feature vector extracted in step 3 to cluster the UAV communication data packets in the suspended state;

Step 5: Use One-Class-SVM for model training for each cluster of the cluster, and obtain multiple UAV communication data models in the suspended state;

Step 6: Use the controller to control the drone flight randomly, use the packet capture tool to capture the data packets between the drone and the controller, and convert the captured binary data stream into a displayable hexadecimal string;

Step 7: Use the n-gram model to extract feature vectors for each communication data in the irregular flight state;

Step 8: The feature vector of each piece of data is tested in the One-Class-SVM model trained in the suspended state in step 5. If it belongs to the same cluster as the training model, it will be marked as 1 by the model, otherwise marked as -1;

Step 9: Since the data generated by the drone under human control is not in the cluster in the suspended state, it will be marked as -1 by all models, and the data marked as -1 will be screened to form a candidate set;

Step 10: Use the Needleman-Wunsch algorithm to calculate the similarity score between any two sequences in the candidate set to form a score matrix;

Step 11: The similarity score of the wrongly identified sequence and other sequences in the similarity score matrix is relatively low, and the wrongly identified sequence is removed according to the score, and finally the flight control protocol data is obtained;

The feature vector in the third step is extracted in the following ways:

(1) Let n=1, 2, 3, 4, 5, and 6 respectively perform n-gram segmentation for each piece of data in the data packet;

(2) Count the frequency of the corresponding word segmentation under each n value;

(3) Sort the frequency of occurrence of all word segments under each value of n in ascending order. The frequency of occurrence of each word is recorded as y, and its ranking order is recorded as x. Use regression analysis to do (logy)=1 /(logx) fitting, calculate the fitting coefficient, and select n when the fitting coefficient is the largest;

(4) Use the n value calculated by the above method to segment each piece of data in the data packet into a word of length n, count the frequency of occurrence of all subsequences of length n, and calculate the occurrence of each type of subsequence of length n according to the frequency The percentage of the percentage, the percentage into a vector, as the feature vector of the current sequence.

Preferably, the model in the eighth step is trained as follows:

(1) For each cluster that has completed the clustering, use the feature extraction method of step 3 to extract the feature vector;

(2) Select the kernel function of One-Class-SVM as the Gaussian kernel function;

(3) Taking the cluster as the unit, the feature vector of each data in each cluster is used as the input, and the Gaussian kernel function is used to map it into the high-dimensional space;

(4) Find a high-dimensional sphere in the high-dimensional space, so that the input data is included in the sphere as much as possible, and the radius of the sphere is as small as possible.

Preferably, the error elimination in the eleventh step is carried out as follows:

(a) Screening sequences marked as -1 by all models;

(2) Use the Needleman-Wunsch algorithm to calculate the similarity score between any two selected sequences to form a score matrix;

(3) Scan the score matrix row by row. If the score of the nth column of the current row is much smaller than the scores of other columns, examine the score of the nth row. If the overall score of the nth row is much smaller than other rows, then the nth position of the score The element is a misidentified element, delete it.

Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention performs clustering on the UAV communication data in the suspended state by applying the n-gram model to the feature extraction of the UAV communication data, and analyzes each A One-Class-SVM model is established for one type of data, and the flight control data under the control of the controller is identified with the idea of malicious traffic detection. For the exclusion of wrong identification, we use the Needleman-Wunsch algorithm to calculate any two models that are used by all models. The similarity scores of the data sequences marked as -1 form a score matrix, and according to the score matrix, the misidentified data are excluded, so as to identify the flight control protocol. The prior art mainly relies on the disassembly of the remote controller and reverse analysis of the control terminal software to identify the flight control protocol, which is time-consuming and labor-intensive, and has no generality.

Description of drawings

Fig. 1 is the system flow chart of the present invention;

Figure 2 is a flow chart of feature extraction of the present invention.

Detailed ways

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

Please refer to Figure 1, a method for identifying UAV flight control data, including the following steps:

Step 1: Hang the drone in the air, and use the packet capture tool to capture the data packets between the drone and the controller. At this time, the data packets are binary data streams;

Step 2: Convert the binary data stream into displayable hexadecimal characters;

Step 3: Use the n-gram model in natural language processing to extract the features of each data packet;

Step 4: Use the k-means++ algorithm to use the feature vector extracted in step 3 to cluster the UAV communication data packets in the suspended state;

Step 5: Use One-Class-SVM for model training for each cluster of the cluster, and obtain multiple UAV communication data models in the suspended state;

Step 6: Use the controller to control the drone flight randomly, use the packet capture tool to capture the data packets between the drone and the controller, and convert the captured binary data stream into a displayable hexadecimal string;

Step 7: Use the n-gram model to extract feature vectors for each communication data in the irregular flight state;

Step 8: The feature vector of each piece of data is tested in the One-Class-SVM model trained in the suspended state in step 5. If it belongs to the same cluster as the training model, it will be marked as 1 by the model, otherwise marked as -1;

Step 9: Since the data generated by the drone under human control is not in the cluster in the suspended state, it will be marked as -1 by all models, and the data marked as -1 will be screened to form a candidate set;

Step 10: Use the Needleman-Wunsch algorithm to calculate the similarity score between any two sequences in the candidate set to form a score matrix;

Step 11: The similarity score of the misidentified sequence and other sequences in the similarity score matrix is relatively low, and the misidentified sequence is removed according to the size of the score, and finally the flight control protocol data is obtained.

Example 1

As a preferred embodiment of the present invention: the feature vector in step 3 is extracted by the following methods:

(1) Let n=1, 2, 3, 4, 5, and 6 respectively perform n-gram segmentation for each piece of data in the data packet;

(2) Count the frequency of the corresponding word segmentation under each n value;

(3) Sort the frequency of occurrence of all word segments under each value of n in ascending order, the frequency of occurrence of each word is recorded as y, the ranking order is recorded as x, and regression analysis is used to do (logy)=1 /(logx) fitting, calculate the fitting coefficient, and select n when the fitting coefficient is the largest;

(4) Use the n value calculated by the above method to segment each piece of data in the data packet into a word of length n, count the frequency of occurrence of all subsequences of length n, and calculate the occurrence of each type of subsequence of length n according to the frequency The percentage is composed of a vector, which is used as the feature vector of the current sequence, which is convenient to extract the feature vector quickly and reliably.

Example 2

As a preferred embodiment of the present invention: the model in the eighth step is trained as follows:

(1) For each cluster that has completed the clustering, use the feature extraction method of step 3 to extract the feature vector;

(2) Select the kernel function of One-Class-SVM as the Gaussian kernel function;

(3) Taking the cluster as the unit, the feature vector of each data in each cluster is used as the input, and the Gaussian kernel function is used to map it into the high-dimensional space;

(4) Find a high-dimensional sphere in the high-dimensional space, so that the input data is included in the sphere as much as possible, and the radius of the sphere is as small as possible.

Example 3

As a preferred embodiment of the present invention: the error elimination in the eleventh step is carried out as follows:

(a) Screening sequences marked as -1 by all models;

(2) Use the Needleman-Wunsch algorithm to calculate the similarity score between any two selected sequences to form a score matrix;

(3) Scan the score matrix row by row. If the score of the nth column of the current row is much smaller than the scores of other columns, examine the score of the nth row. If the overall score of the nth row is much smaller than other rows, then the nth position of the score The element is a misidentified element, delete it.

It will be apparent to those skilled in the art that the present invention is not limited to the details of the above-described exemplary embodiments, but that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments are to be regarded in all respects as illustrative and not restrictive, and the scope of the invention is to be defined by the appended claims rather than the foregoing description, which are therefore intended to fall within the scope of the claims. All changes within the meaning and scope of the equivalents of , are included in the present invention. Any reference signs in the claims shall not be construed as limiting the involved claim.

Claims (3)

1. an identification method of unmanned aerial vehicle flight control data is characterized in that: comprise the following steps: Step 1: Hang the drone in the air, and use the packet capture tool to capture the data packets between the drone and the controller. At this time, the data packets are binary data streams; Step 2: Convert the binary data stream into displayable hexadecimal characters; Step 3: Use the n-gram model in natural language processing to extract the features of each data packet; Step 4: Use the k-means++ algorithm to use the feature vector extracted in step 3 to cluster the UAV communication data packets under static conditions; Step 5: Use One-Class_SVM for model training for each cluster of the cluster, and obtain multiple UAV communication data models in the suspended state; Step 6: Use the controller to control the drone flight randomly, use the packet capture tool to capture the data packets between the drone and the controller, and convert the captured binary data stream into a displayable hexadecimal string; Step 7: Use the n-gram model to extract feature vectors for each communication data in the irregular flight state; Step 8: The feature vector of each piece of data is tested in the One-Class-SVM model trained in the suspended state in step 5. If it belongs to the same cluster as the training model, it will be marked as 1 by the model, otherwise marked as -1; Step 9: Since the data generated by the drone under human control is not in the cluster in the suspended state, it will be marked as -1 by all models, and the data marked as -1 will be screened to form a candidate set; Step 10: Use the Needleman-Wunsch algorithm to calculate the similarity score between any two sequences in the candidate set to form a score matrix; Step 11: The similarity score of the wrongly identified sequence and other sequences in the similarity score matrix is relatively low, and the wrongly identified sequence is removed according to the score, and finally the flight control protocol data is obtained; The feature vector in the third step is extracted in the following ways: (1) Let n=1, 2, 3, 4, 5, and 6 respectively perform n-gram segmentation for each piece of data in the data packet; (2) Count the frequency of the corresponding word segmentation under each n value; (3) Sort the frequency of occurrence of all word segments under each value of n in ascending order, the frequency of occurrence of each word is recorded as y, the ranking order is recorded as x, and regression analysis is used to do (logy)=1 /(logx) fitting, calculate the fitting coefficient, and select n when the fitting coefficient is the largest; (4) Use the n value calculated in the above method to segment each piece of data in the data packet into a word of length n, count the frequency of occurrence of all subsequences of length n, and calculate each type of subsequence of length n according to the frequency The percentage of occurrences, and the percentages are formed into a vector as the feature vector of the current sequence. 2. the identification method of a kind of UAV flight control data according to claim 1, is characterized in that: the model training in described step 8 is trained by following way: (1) Cluster the UAV data in the suspended state and divide it into n clusters; (2) For each cluster, use the same feature extraction method used in clustering to extract feature vectors; (3) Input the feature vector of each cluster into the One-Class-SVM model for training, and obtain the high-dimensional space sphere of the normal data of each model. The data located inside the sphere is marked as 1, and the external data is marked as -1. 3. the identification method of a kind of UAV flight control data according to claim 1 is characterized in that: the abnormal point of the wrong identification in the described step eleven is eliminated by the following means: Use the Needleman-Wunsch algorithm to calculate the scores between any two sequences marked with -1 by all models, forming a matrix; The similarity score between misidentified sequences and correctly identified sequences is significantly smaller than that between normal sequences, and outliers are excluded based on this difference.

Images