CN-122001639-A - Lightweight unmanned aerial vehicle network intrusion detection method and system based on residual neural network

CN122001639ACN 122001639 ACN122001639 ACN 122001639ACN-122001639-A

Abstract

The invention discloses a lightweight unmanned aerial vehicle network intrusion detection method based on a residual neural network, which comprises the steps of acquiring unmanned aerial vehicle network flow in real time and inputting the unmanned aerial vehicle network flow into a trained residual multilayer perception model to obtain an attack discrimination result, wherein training the model comprises the steps of constructing the residual multilayer perception model, namely an input layer, mapping low-dimensional flow characteristics into high-dimensional flow characteristics, a plurality of hidden layers, carrying out depth extraction on the high-dimensional flow characteristics to obtain depth flow characteristics, an output layer, outputting the attack discrimination result based on the depth flow characteristics, realizing characteristic interaction between all layers through cross-layer jump connection, wherein each hidden layer comprises a batch normalization module, a rectification linear module and a random inactivation module, and carrying out iterative training on the residual multilayer perception model by adopting a projection gradient descent countermeasure training mechanism based on an unmanned aerial vehicle network flow data set. Based on the method, the collaborative optimization of low resource consumption, high robust detection and high response speed is realized.

Inventors

LI JINYU
CAO YUE
Gao Junjiao

Assignees

武汉大学

Dates

Publication Date: 20260508
Application Date: 20260128

Claims (10)

1. A lightweight unmanned aerial vehicle network intrusion detection method based on a residual neural network is characterized by comprising the following steps: Step S1, acquiring network traffic of an unmanned aerial vehicle in real time; Step S2, inputting the network traffic of the unmanned aerial vehicle into a trained residual multi-layer perception model to obtain an attack discrimination result, wherein the training of the residual multi-layer perception model comprises the following steps: acquiring a network flow data set of the unmanned aerial vehicle and preprocessing data; The method comprises the steps of constructing a residual multi-layer perception model, wherein the residual multi-layer perception model comprises an input layer, a plurality of hidden layers and an output layer, the input layer is used for mapping low-dimensional flow characteristics to a high-dimensional space to obtain high-dimensional flow characteristics, the hidden layers are used for carrying out depth extraction on the high-dimensional flow characteristics to obtain depth flow characteristics, the output layer is used for outputting attack discrimination results based on the depth flow characteristics, characteristic interaction is realized among the layers through cross-layer jump connection, each hidden layer comprises a batch normalization module, a rectification linear module and a random inactivation module, the batch normalization module is used for eliminating scale differences of different flow characteristics, the rectification linear module is used for capturing complex associated flow characteristics, and the random inactivation module is used for learning essential flow characteristics of unmanned aerial vehicle attack; and carrying out iterative training on the residual multi-layer perception model by adopting a projection gradient descent countermeasure training mechanism based on the preprocessed unmanned aerial vehicle network flow data set so as to obtain a trained residual multi-layer perception model.
2. The method for detecting the intrusion of the lightweight unmanned aerial vehicle network based on the residual neural network according to claim 1, wherein the steps of obtaining the unmanned aerial vehicle network flow data set and preprocessing the data comprise the following steps: Acquiring an unmanned aerial vehicle network traffic data set, wherein the unmanned aerial vehicle network traffic data set comprises a plurality of network traffic samples and corresponding text labels, and each network traffic sample comprises a plurality of original traffic characteristics; screening key cross-layer characteristics from a plurality of original flow characteristics by an information gain technology; the Z-score standardization technology is adopted to eliminate the scale difference among the key cross-layer characteristics; and converting the text label into a numerical label by using a label encoder, and dividing the training set and the testing set according to a first preset proportion.
3. The method for detecting the intrusion of the lightweight unmanned aerial vehicle network based on the residual neural network according to claim 2, wherein the key cross-layer characteristics are screened from a plurality of original flow characteristics by an information gain technology, and the method comprises the following steps: Calculating the total information entropy of all original flow characteristics; Calculating the conditional entropy of each original flow characteristic; calculating the information gain of each original flow characteristic one by one based on the total information entropy and the conditional entropy of each original flow characteristic; And screening out the original flow characteristics of which the information gain is greater than or equal to a preset threshold value so as to obtain key cross-layer characteristics.
4. The method for detecting the intrusion of the lightweight unmanned aerial vehicle network based on the residual neural network according to claim 2, wherein the scale difference among key cross-layer features is eliminated by adopting a Z-score standardization technology, and the corresponding calculation formula is as follows: , Wherein, the The average of all values for the key cross-layer feature, Standard deviation of all values for the key cross-layer feature, As the original feature value of the key cross-layer feature, Is the characteristic value of the key cross-layer characteristic after standardization.
5. The method for detecting the intrusion of the lightweight unmanned aerial vehicle network based on the residual neural network is characterized in that in the step S2, the plurality of hidden layers comprise a first hidden layer, a second hidden layer, a third hidden layer and a fourth hidden layer, the first hidden layer comprises a linear transformation module, a batch normalization module, a correction linear module and a random inactivation module and is used for carrying out primary nonlinear feature extraction, the second hidden layer comprises a linear transformation module, a batch normalization module, a correction linear module, a random inactivation module and residual connection and is used for fusing shallow layer features output by the first hidden layer, the third hidden layer comprises a linear transformation module, a batch normalization module, a correction linear module, a random inactivation module and residual connection and is used for carrying out secondary nonlinear feature enhancement, and the fourth hidden layer comprises a linear transformation module, a batch normalization module, a correction linear module, a random inactivation module and residual connection and is used for carrying out feature compression.
6. The method for detecting the intrusion of the lightweight unmanned aerial vehicle network based on the residual neural network according to claim 2, wherein the iterative training of the residual multi-layer perception model by adopting a projection gradient descent countermeasure training mechanism based on the preprocessed unmanned aerial vehicle network flow data set comprises the following steps: initializing an challenge sample with clean samples in the training set; at each iteration step, the challenge sample is updated by varying the amplitude of the disturbance; mixing the clean sample and the countermeasure sample according to a second preset proportion and inputting the mixture into a residual multi-layer perception model so as to complete the mixed countermeasure training of the residual multi-layer perception model; and verifying the network intrusion detection performance of the residual multi-layer perception model by using the clean samples in the test set.
7. The method for detecting the intrusion of the lightweight unmanned aerial vehicle network based on the residual neural network according to claim 1, wherein after the attack discrimination result is obtained through the residual multi-layer perception model output, the method further comprises the following steps: if the attack discrimination result is greater than or equal to a preset threshold value, judging that the current unmanned aerial vehicle network flow is attack flow, and triggering a response mechanism, wherein the response mechanism comprises the steps of sending an alarm to a ground station, blocking an abnormal link or recording an attack log; and if the attack discrimination result is smaller than a preset threshold value, judging that the current unmanned aerial vehicle network flow is normal flow, and allowing communication to continue.
8. Lightweight unmanned aerial vehicle network intrusion detection system based on residual neural network, characterized by comprising: the network flow acquisition module acquires the network flow of the unmanned aerial vehicle in real time; The network intrusion detection module is used for inputting network traffic of the unmanned aerial vehicle to a trained residual multi-layer perception model to obtain an attack discrimination result, wherein the training of the residual multi-layer perception model comprises the steps of obtaining a network traffic data set of the unmanned aerial vehicle and carrying out data preprocessing, constructing a residual multi-layer perception model, comprising an input layer used for mapping low-dimensional traffic characteristics to a high-dimensional space to obtain high-dimensional traffic characteristics, a plurality of hidden layers used for carrying out depth extraction on the high-dimensional traffic characteristics to obtain depth traffic characteristics, an output layer used for outputting the attack discrimination result based on the depth traffic characteristics, and realizing characteristic interaction between the layers through cross-layer jump connection, wherein each hidden layer comprises a batch normalization module, a rectification linear module and a random inactivation module, the batch normalization module is used for eliminating scale difference of different traffic characteristics, the rectification linear module is used for capturing complex associated traffic characteristics, the random inactivation module is used for learning essential traffic characteristics of unmanned aerial vehicle attack, and the residual multi-layer perception model is iteratively trained by adopting a projection gradient descent countermeasure training mechanism based on the preprocessed network traffic data set of the unmanned aerial vehicle so as to obtain the trained multi-layer perception model.
9. An electronic device comprising a memory and a processor, the memory storing program instructions for execution by the processor, the processor invoking the program instructions to perform a lightweight unmanned aerial vehicle network intrusion detection method based on a residual neural network as claimed in any one of claims 1 to 7.
10. A non-transitory computer readable storage medium storing computer instructions that cause the computer to perform a lightweight unmanned aerial vehicle network intrusion detection method based on a residual neural network according to any one of claims 1 to 7.

Description

Lightweight unmanned aerial vehicle network intrusion detection method and system based on residual neural network Technical Field The invention relates to the technical field of unmanned aerial vehicle network security and intrusion detection, in particular to a lightweight unmanned aerial vehicle network intrusion detection method and system based on a residual neural network. Background Unmanned aerial vehicle realizes scale application in fields such as safety monitoring, disaster relief, logistics distribution, military reconnaissance and the like, and promotes industry to advance to trillion level markets. However, unmanned aerial vehicle networks are subject to electromagnetic interference due to limited hardware resources and open communication environment caused by low computing power, limited power consumption and the like, and face various composite attack threats mainly including denial of service (DoS) attacks (service interruption caused by exhaustion of system resources), GPS spoofing attacks (falsification of navigation signal misleading tracks), communication interference attacks (blocking of unmanned aerial vehicle links with ground stations), identity masquerading attacks (cloning of legal device identifiers into the network) and the like. The traditional Intrusion Detection System (IDS) is difficult to adapt to the characteristics of the unmanned aerial vehicle network, and has three major core defects: 1. The traditional IDS based on the deep Convolutional Neural Network (CNN) generally has huge parameter quantity ranging from millions to tens of millions, and unmanned aerial vehicle edge equipment cannot bear real-time reasoning; 2. The dynamic adaptability is weak, namely the unmanned plane network topology dynamic change (node movement and link switching) can not be dealt with by a detection scheme based on static signature; 3. The robustness against attack such as physical layer interference and protocol layer spoofing is insufficient, and the traditional model is prone to misjudgment due to characteristic disturbance, so that defense failure is caused. Disclosure of Invention In order to solve the technical problems of high computing resource consumption, weak dynamic adaptability and insufficient robustness countermeasure of the traditional intrusion detection system in the unmanned aerial vehicle dynamic networking environment, the invention provides a lightweight unmanned aerial vehicle network intrusion detection method and system based on a residual neural network, and the cooperative optimization of low resource consumption, high robust detection and fast response speed is realized by adopting a lightweight residual multi-layer perception model and a projection gradient descent countermeasure training mechanism. According to the method, S1, unmanned aerial vehicle network flow is obtained in real time, S2, the unmanned aerial vehicle network flow is input into a trained residual multi-layer perception model to obtain an attack judging result, training of the residual multi-layer perception model comprises the steps of obtaining an unmanned aerial vehicle network flow data set and carrying out data preprocessing, constructing a residual multi-layer perception model, the residual multi-layer perception model comprises an input layer, a plurality of hidden layers and an output layer, wherein the input layer is used for mapping low-dimensional flow characteristics into a high-dimensional space to obtain high-dimensional flow characteristics, the hidden layers are used for carrying out depth extraction on the high-dimensional flow characteristics to obtain depth flow characteristics, the output layer is used for outputting an attack judging result based on the depth flow characteristics, characteristic interaction is achieved between all the hidden layers through cross-layer jump connection, each hidden layer comprises a batch normalization module, a rectification linear module and a random inactivation module, the batch normalization module is used for eliminating the scale of different flow characteristics, the rectification linear module is used for capturing essential flow characteristics of the complex unmanned aerial vehicle, the random module is used for learning the flow characteristics, the random inactivation module is used for carrying out the preprocessing on the flow characteristics, the residual multi-layer interaction model is used for carrying out the iteration training on the unmanned aerial vehicle, and the multi-layer perception model is used for achieving the multi-layer iteration perception of the residual gradient perception model based on the high-dimensional flow characteristics. The method comprises the steps of obtaining an unmanned aerial vehicle network flow data set and preprocessing data, wherein the unmanned aerial vehicle network flow data set comprises a plurality of network flow samples and corresponding text labels, each network flow sample compr