A kind of recognition methods of unmanned plane flight control data
Technical field
The present invention relates to unmanned plane field, specially a kind of recognition methods of unmanned plane flight control data.
Background technique
Unmanned plane has very big purposes in dual-use field, but current laws and regulations are incomplete, very much
Unmanned plane seriously endangers country and public safety in sensitive military zone, the flight of the place such as airport, such as: April 14 in 2017
In day to short week age on the 30th, Sichuan Province Chengdu Chengdu Shuangliu International Airport just successively occurs 8 unmanned planes and disturbs boat thing
Part causes to amount to hundred frame flights and makes preparation for dropping, makes a return voyage or be delayed;The big boundary unmanned plane of a frame in 2015 crashes in White House, causes
The fears of US authorities.
Therefore, in order to reinforce supervising unmanned plane, it is also necessary to necessary technological means, it is necessary to it is inverse to carry out agreement to it
To its only reverse protocol format could capture unmanned aerial vehicle from technological means, realize the control to unmanned plane.
However, the signal of generation not only includes that controller control unmanned plane flies during the communication of remote controler and unmanned plane
The signal of row state since unmanned plane may need to be implemented certain tasks, such as is taken photo by plane, plant protection etc., so can be along with generation
Other kinds of signal, such as unmanned plane during flying attitude signal, gps signal etc. are among these to our parts of most worthy
It is flight control signal, completes to the reverse of flight control signal, control can be kidnapped in real time unmanned plane by just having.
In black conference in 2016, Nils implements abduction to UAV targets by forging remote controller signal, captures
The control of unmanned plane;In 3.15 parties in 2016, safe team, Tencent is by believing big boundary spirit 3s no-manned machine distant control
Number forgery, captured the control of UAV targets.This technology can also be used in unmanned plane control, once discovery has unmanned plane
Into no-fly zone, the control of UAV targets can be captured by forging the control signal of unmanned plane, complete the control to it.
The realization of above-mentioned technical proposal all relies on the dismantling to hardware, studies the chip in hardware, the side of dynamic debugging
Method obtains flight control data, but this method has certain limitation, such as big boundary of new generation by the core in remote controler
Piece model is handled, and can not be identified and be studied chip, and is strongly depend on the model of unmanned plane, is needed for every
A kind of unmanned plane of model, which is done, particularly to be researched and analysed, time-consuming and laborious.Present invention is generally directed to the limitations of the prior art, propose
A kind of recognition methods of novel unmanned plane flight control data, this method do not depend on hardware dismantling and high degree of automation.
Summary of the invention
It is an object of the invention to: in order to solve the limitation of traditional approach, can not identify and study chip, and
It is strongly depend on the model of unmanned plane, needs the unmanned plane for each model to do and particularly researchs and analyses, it is time-consuming and laborious
Problem provides a kind of recognition methods of unmanned plane flight control data.
To achieve the above object, the invention provides the following technical scheme: a kind of recognition methods of unmanned plane flight control data, packet
Include the following steps:
Step 1: keeping unmanned plane hanging, grabs the data packet between unmanned plane-controller using packet catcher, at this time data packet
It is binary data stream;
Step 2: by binary data stream at displayable hexadecimal character;
Step 3: using n-gram model in natural language processing, the feature of each data packet is extracted;
Step 4: logical to the unmanned plane under vacant state using feature vector extracted in step 3 using k-means++ algorithm
Letter data packet cluster;
Step 5: model training is carried out using One-Class-SVM to each class cluster of cluster, is obtained under multiple vacant states
UAV Communication data model;
Step 6: using the random control unmanned plane during flying of controller, using between packet catcher crawl unmanned plane-controller
The binary data stream of capture is displayable hexadecimal string by data packet;
Step 7: feature vector is extracted to every communication data under random state of flight using n-gram model;
Step 8: the feature vector of every data is passed sequentially through to the One-Class-SVM of training under vacant state in step 5
It is detected in model, can be by model labeled as 1 if belonging to same class cluster with the class cluster of training pattern, on the contrary label is
1;
Step 9: the data generated under artificial state of a control due to unmanned plane, can be by institute not in the class cluster under vacant state
Some models are labeled as -1, carry out screening to the data for being marked as -1 entirely and form set to be selected;
Step 10: it is obtained using the similitude that Needleman-Wunsch algorithm calculates in set to be selected between any two sequences
Point, form a score matrix;
Step 11: the sequence of wrong identification and the similarity score of the other sequences in similarity score matrix are relatively low, root
According to the sequence of score size removal wrong identification, finally obtains and fly control protocol data.
5. preferably, the feature vector in the step 3 extracts in the following manner:
(1) every data in the data packet of n=1,2,3,4,5,6 pair is enabled to do n-gram participle respectively;
(2) frequency of the corresponding participle under each n value is counted;
(3) frequency occurred for all participles under each n value is done to small big sequence and sorts, what each word occurred
Frequency is denoted as y, and rank order is denoted as x, is gone to analyze the fitting for doing (logy)=1/ (logx), digital simulation with regression analysis
Coefficient chooses n when fitting coefficient maximum;
(4) participle that length is n is done to data every in data packet using the n value calculated in step 3, counts all length
The frequency that the subsequence that degree is n occurs calculates the percentage that the subsequence that every kind of length is n type occurs according to frequency, by hundred
Divide than one vector of composition, the feature vector as current sequence.
Preferably, model is to train to come in this way in the step 8:
(1) to each cluster for completing cluster, feature vector is extracted using the feature extraction mode of step 3;
(2) select the kernel function of One-Class-SVM for gaussian kernel function;
(3) as unit of cluster, the feature vector of each every data of cluster is mapped that as input using gaussian kernel function
In higher dimensional space;
(4) a high n-dimensional sphere n is found in higher dimensional space so that it is more as far as possible the data of input include in ball, and
The radius of ball is small as far as possible.
Preferably, the error exception in the step 11 is such that
(1) screening is labeled as -1 sequence by all models;
(2) similarity score between the sequence of any two screenings is calculated using Needleman-Wunsch algorithm, forms one
A score matrix;
(3) score matrix is progressively scanned, if the score that current line n-th arranges is far smaller than the score of other column, investigates line n
Score, if the whole score of line n is far smaller than other rows, the element of the n-th position is wrong identification element, is deleted.
Compared with prior art, the beneficial effects of the present invention are: the present invention is by being applied to unmanned plane for n-gram model
It is clustered in the feature extraction of communication data, to the UAV Communication data of vacant state, and to the data of each type
One-Class-SVM model is established, with the flight control data of the thought identification of malicious traffic stream detection under control of the controller, for mistake
The exclusion of misrecognition, we used Needleman-Wunsch algorithm calculate any two by all models be labeled as -1 number
According to the similarity score of sequence, a score matrix is formed, according to the data that score matrix goes debug to identify, to identify
Fly control agreement.The prior art relies primarily on remote controler dismantling, and control terminal software conversed analysis flies control agreement to identify, time-consuming to take
Power, without versatility, the present invention is applied widely, and the method for relying on machine learning, recognition speed is fast, and accuracy rate is high.
Detailed description of the invention
Fig. 1 is system flow chart of the invention;
The position Fig. 2 feature extraction flow chart of the invention.
Specific embodiment
Following will be combined with the drawings in the embodiments of the present invention, and technical solution in the embodiment of the present invention carries out clear, complete
Site preparation description, it is clear that described embodiments are only a part of the embodiments of the present invention, instead of all the embodiments.It is based on
Embodiment in the present invention, it is obtained by those of ordinary skill in the art without making creative efforts every other
Embodiment shall fall within the protection scope of the present invention.
Referring to Fig. 1, a kind of recognition methods of unmanned plane flight control data, including the following steps:
Step 1: keeping unmanned plane hanging, grabs the data packet between unmanned plane-controller using packet catcher, at this time data packet
It is binary data stream;
Step 2: by binary data stream at displayable hexadecimal character;
Step 3: using n-gram model in natural language processing, the feature of each data packet is extracted;
Step 4: logical to the unmanned plane under vacant state using feature vector extracted in step 3 using k-means++ algorithm
Letter data packet cluster;
Step 5: model training is carried out using One-Class-SVM to each class cluster of cluster, is obtained under multiple vacant states
UAV Communication data model;
Step 6: using the random control unmanned plane during flying of controller, using between packet catcher crawl unmanned plane-controller
The binary data stream of capture is displayable hexadecimal string by data packet;
Step 7: feature vector is extracted to every communication data under random state of flight using n-gram model;
Step 8: the feature vector of every data is passed sequentially through to the One-Class-SVM of training under vacant state in step 5
It is detected in model, can be by model labeled as 1 if belonging to same class cluster with the class cluster of training pattern, on the contrary label is
1;
Step 9: the data generated under artificial state of a control due to unmanned plane, can be by institute not in the class cluster under vacant state
Some models are labeled as -1, carry out screening to the data for being marked as -1 entirely and form set to be selected;
Step 10: it is obtained using the similitude that Needleman-Wunsch algorithm calculates in set to be selected between any two sequences
Point, form a score matrix;
Step 11: the sequence of wrong identification and the similarity score of the other sequences in similarity score matrix are relatively low, root
According to the sequence of score size removal wrong identification, finally obtains and fly control protocol data.
Embodiment 1
As the preferred embodiment of the present invention: the feature vector in step 3 extracts in the following manner:
(1) every data in the data packet of n=1,2,3,4,5,6 pair is enabled to do n-gram participle respectively;
(2) frequency of the corresponding participle under each n value is counted;
(3) frequency occurred for all participles under each n value is done to small big sequence and sorts, what each word occurred
Frequency is denoted as y, and rank order is denoted as x, is gone to analyze the fitting for doing (logy)=1/ (logx), digital simulation with regression analysis
Coefficient chooses n when fitting coefficient maximum;
(4) participle that length is n is done to data every in data packet using the n value calculated in step 3, counts all length
The frequency that the subsequence that degree is n occurs calculates the percentage that the subsequence that every kind of length is n type occurs according to frequency, by hundred
Divide than one vector of composition, as the feature vector of current sequence, convenient for quickly and reliably extracting feature vector.
Embodiment 2
As the preferred embodiment of the present invention: model is to train to come in this way in the step 8:
(1) to each cluster for completing cluster, feature vector is extracted using the feature extraction mode of step 3;
(2) select the kernel function of One-Class-SVM for gaussian kernel function;
(3) as unit of cluster, the feature vector of each every data of cluster is mapped that as input using gaussian kernel function
In higher dimensional space;
(4) a high n-dimensional sphere n is found in higher dimensional space so that it is more as far as possible the data of input include in ball, and
The radius of ball is small as far as possible.
Embodiment 3
As the preferred embodiment of the present invention: the error exception in the step 11 is such that
(4) screening is labeled as -1 sequence by all models;
(5) similarity score between the sequence of any two screenings is calculated using Needleman-Wunsch algorithm, forms one
A score matrix;
(6) score matrix is progressively scanned, if the score that current line n-th arranges is far smaller than the score of other column, investigates line n
Score, if the whole score of line n is far smaller than other rows, the element of the n-th position is wrong identification element, is deleted.
It is obvious to a person skilled in the art that invention is not limited to the details of the above exemplary embodiments, Er Qie
In the case where without departing substantially from spirit or essential attributes of the invention, the present invention can be realized in other specific forms.Therefore, no matter
From the point of view of which point, the present embodiments are to be considered as illustrative and not restrictive, and the scope of the present invention is by appended power
Benefit requires rather than above description limits, it is intended that all by what is fallen within the meaning and scope of the equivalent elements of the claims
Variation is included within the present invention.Any reference signs in the claims should not be construed as limiting the involved claims.