KR20220071841A - Anomaly detection model using message id sequence on unmanned moving objects - Google Patents

Abstract

A method for detecting an anomaly in an unmanned mobile vehicle using a message ID sequence comprises steps of: collecting packet data generated from an unmanned mobile vehicle; preprocessing the collected packet data; and inputting the preprocessed packet data into a pre-trained neural network model and detecting an anomaly of the unmanned mobile vehicle based on a message ID pattern of the packet data. An object of the present invention is to provide an anomaly detection method for unmanned mobile vehicles including a deep learning framework for detecting anomalies occurring in unmanned mobile vehicles.

Description

Unmanned moving object anomaly detection model using message ID sequence {ANOMALY DETECTION MODEL USING MESSAGE ID SEQUENCE ON UNMANNED MOVING OBJECTS}

The present invention relates to a method for detecting anomaly of an unmanned moving object, and more particularly, to a method for detecting anomaly of an unmanned moving object using a message ID sequence.

In general, an unmanned moving vehicle refers to an aircraft that performs a specific task by judging the current situation by a human being wirelessly controlling the aircraft in a remote environment such as a drone or by judging the current situation with minimal human intervention, such as an autonomous vehicle. Today, as unmanned mobile technology develops, unmanned mobile vehicles are being used in various fields such as courier service, driving, local surveillance, and military weapons.

The unmanned moving object is configured through networking of various components due to the nature of the system. It recognizes the environment by using sensor data collected by GPS, camera, LiDAR, and IMU sensors, and uses this information to control or manipulate the posture and position. As it is a collection of various hardware and software components, various risks and threats exist.

Since there is little human intervention, when an abnormality is detected in an unmanned moving vehicle, there are many cases in which a human cannot immediately recognize and respond. Therefore, when an anomaly is detected by an anomaly detection system, it is necessary to immediately notify a person.

However, in the case of anomaly detection using sensor data like the existing method, there is a limitation in that the overhead is large because various sensor data must be processed and used and integrated. Therefore, there is a demand for a new unmanned moving object anomaly detection method utilizing the message ID sequence.

US Patent Publication 2019/0260768 (2019.08.22) (US Application No. 15/899903)

The present disclosure has been devised in response to the above-described background technology, and an object of the present disclosure is to provide a method for detecting anomalies in an unmanned moving object including a deep learning framework for detecting anomalies occurring in the unmanned moving object.

The technical problems of the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

According to an embodiment of the present disclosure for realizing the above-described problem, a new unmanned moving object anomaly detection model using a message ID sequence is disclosed.

An unmanned moving object anomaly detection method according to an embodiment of the present disclosure for solving the above-described problems includes collecting packet data generated in the unmanned moving object, pre-processing the collected packet data, and the pre-processing The method may include inputting one packet data into a pre-trained neural network model and detecting abnormal symptoms of the unmanned moving object based on a message ID pattern of the packet data.

In an alternative embodiment of the method for detecting an anomaly of an unmanned moving object, the collecting of the packet data includes collecting packet data generated from the unmanned moving object through communication between the unmanned moving object and a ground control system (GCS). can do.

In an alternative embodiment of the unmanned moving object anomaly detection method, the pre-processing of the collected packet data includes extracting a message ID from the collected packet data, assigning an integer value to the extracted message ID, and the It may include normalizing the integer value assigned to the message ID.

In an alternative embodiment of the unmanned moving object anomaly detection method, in the step of assigning an integer value to the extracted message ID, different integer values may be assigned according to the type of the message ID.

In an alternative embodiment of the unmanned moving object anomaly detection method, in the step of assigning an integer value to the extracted message ID, if there are a total of N types of the message ID, an integer from 1 to N is assigned to each message ID can be

In an alternative embodiment of the unmanned moving object anomaly detection method, the step of normalizing the integer value assigned to the message ID may normalize the integer value assigned to the message ID to a range of 0 to 1 in order to adjust the size of the message ID. have.

In an alternative embodiment of the unmanned moving object anomaly detection method, the step of normalizing the integer value assigned to the message ID is calculated by dividing the integer value assigned to each message ID by n when the number of types of the message ID is n in total. The result can be normalized.

In an alternative embodiment of the method for detecting anomaly of an unmanned moving object, the step of detecting anomalies of the unmanned moving object includes: inputting the preprocessed packet data into a pre-trained neural network model; packet data input to the neural network model predicting a message ID following the current message ID sequence of It may include detecting an abnormal symptom of the unmanned moving object.

In an alternative embodiment of the unmanned moving object anomaly detection method, the calculating of the message ID pattern prediction success rate includes calculating an average value of the message ID pattern prediction success rates for a predetermined time when the message ID pattern prediction success rate is calculated , and comparing the calculated average value of the message ID pattern prediction success rates with a preset threshold to detect an abnormal symptom of the unmanned moving object.

In an alternative embodiment of the method for detecting anomaly of an unmanned moving object, the detecting of the abnormal symptom of the unmanned moving object may include, when the average value of the calculated message ID pattern prediction success rates is lower than the threshold value, the abnormal symptom of the unmanned moving object can be considered to have been detected.

In an alternative embodiment of the method for detecting anomaly of an unmanned moving object, the step of detecting anomalies of the unmanned moving object includes: inputting the preprocessed packet data into a pre-trained neural network model; packet data input to the neural network model predicting a message ID following the current message ID sequence of It may include detecting an abnormal symptom of the unmanned moving object.

In an alternative embodiment of the unmanned moving object anomaly detection method, the calculating of the message ID pattern loss value includes calculating an average value of message ID pattern loss values for a predetermined time when the message ID pattern loss value is calculated , and comparing the calculated average value of the message ID pattern loss values with a preset threshold value to detect an abnormal symptom of the unmanned moving object.

In an alternative embodiment of the method for detecting anomaly of an unmanned moving object, the step of detecting anomalies of the unmanned moving object may include: if the average value of the calculated message ID pattern loss values is higher than the threshold value, can be considered to have been detected.

In an alternative embodiment of the method for detecting anomaly of an unmanned moving object, the pre-learning of the neural network model includes: collecting normal packet data generated in a normal communication state by the unmanned moving object; pre-processing the collected normal packet data; and inputting the pre-processed normal packet data into the neural network model to predict and learn a message ID following a current message ID sequence of the normal packet data.

As a computer program stored in a computer readable storage medium according to an embodiment of the present disclosure for realizing the above-described problem, the computer program is the following for detecting abnormal symptoms of an unmanned moving object when the computer program is executed in one or more processors. The operations are performed by collecting packet data generated by the unmanned moving object, pre-processing the collected packet data, and inputting the pre-processed packet data into a pre-trained neural network model. It may include the operation of detecting an abnormal symptom of the unmanned moving object based on the message ID pattern of the packet data.

A computing device for providing an unmanned moving object anomaly detection method according to an embodiment of the present disclosure for realizing the above-described problems, including a processor including one or more cores, and a memory, wherein the processor comprises: Collect packet data generated in the mobile device, pre-process the collected packet data, and input the pre-processed packet data into a pre-trained neural network model to determine the abnormality of the unmanned mobile device based on the message ID pattern of the packet data. signs can be detected.

According to the present disclosure, an abnormal symptom of an unmanned moving object can be detected by using a message ID sequence.

Effects obtainable in the present disclosure are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those of ordinary skill in the art to which the present disclosure belongs from the description below. .

BRIEF DESCRIPTION OF THE DRAWINGS So that the above-mentioned features of the present disclosure may be understood in detail, with a more specific description, with reference to the following embodiments, some of the embodiments are shown in the accompanying drawings. Also, like reference numerals in the drawings are intended to refer to the same or similar functions throughout the various aspects. However, it should be noted that the appended drawings show only certain typical embodiments of the present disclosure and are not to be considered as limiting the scope of the present disclosure, and other embodiments having the same effect may be sufficiently recognized. Be careful.
1 is a diagram illustrating a block diagram of a computing device that performs an operation for providing an unmanned moving object anomaly detection method according to an embodiment of the present disclosure.
FIG. 2 is a diagram illustrating a block diagram of a processor for explaining a method for detecting anomaly of an unmanned moving object according to an embodiment of the present disclosure.
3 is a diagram illustrating packet data including a message ID according to an embodiment of the present disclosure.
4 is a diagram illustrating a block diagram for explaining a pre-processing unit according to an embodiment of the present disclosure.
5 is a diagram illustrating a block diagram for explaining a neural network model, according to an embodiment of the present disclosure.
6 is a diagram illustrating a flowchart for explaining a method for detecting anomaly of an unmanned moving object according to an embodiment of the present disclosure.
7 depicts a general schematic diagram of an example computing environment in which embodiments of the present disclosure may be implemented.

Various embodiments are now described with reference to the drawings. In this specification, various descriptions are presented to provide an understanding of the present disclosure. However, it is apparent that these embodiments may be practiced without these specific descriptions.

The terms “component,” “module,” “system,” and the like, as used herein, refer to a computer-related entity, hardware, firmware, software, a combination of software and hardware, or execution of software. For example, a component can be, but is not limited to being, a process running on a processor, a processor, an object, a thread of execution, a program, and/or a computer. For example, both an application running on a server and a server can be components. One or more components may reside within a processor and/or thread of execution. A component may be localized within one computer. A component may be distributed between two or more computers. In addition, these components can execute from various computer readable media having various data structures stored therein. Components may communicate via a network such as the Internet with another system, for example via a signal having one or more data packets (eg, data and/or signals from one component interacting with another component in a local system, distributed system, etc.) may communicate via local and/or remote processes depending on the data being transmitted).

In addition, the term “or” is intended to mean an inclusive “or” rather than an exclusive “or.” That is, unless otherwise specified or clear from context, "X employs A or B" is intended to mean one of the natural implicit substitutions. That is, X employs A; X employs B; or when X employs both A and B, "X employs A or B" may apply to either of these cases. It should also be understood that the term “and/or” as used herein refers to and includes all possible combinations of one or more of the listed related items.

Also, the terms "comprises" and/or "comprising" should be understood to mean that the feature and/or element in question is present. However, it should be understood that the terms "comprises" and/or "comprising" do not exclude the presence or addition of one or more other features, elements and/or groups thereof. Also, unless otherwise specified or unless it is clear from context to refer to a singular form, the singular in the specification and claims should generally be construed to mean “one or more”.

And, the term "at least one of A or B" should be interpreted as meaning "when including only A", "when including only B", and "when combined with the configuration of A and B".

Those skilled in the art will further appreciate that the various illustrative logical blocks, configurations, modules, circuits, means, logics, and algorithm steps described in connection with the embodiments disclosed herein may be implemented in electronic hardware, computer software, or combinations of both. It should be recognized that they can be implemented with To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, configurations, means, logics, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application. However, such implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.

Descriptions of the presented embodiments are provided to enable those skilled in the art to use or practice the present invention. Various modifications to these embodiments will be apparent to those skilled in the art of the present disclosure. The generic principles defined herein may be applied to other embodiments without departing from the scope of the present disclosure. Therefore, the present invention is not limited to the embodiments presented herein. This invention is to be interpreted in its widest scope consistent with the principles and novel features presented herein.

Describes the contents for detecting anomaly of an unmanned moving object using the message ID sequence of the present inventor. An unmanned aerial vehicle belonging to an unmanned moving object is described as an embodiment, and it is not limited to an unmanned aerial vehicle, and any device belonging to an unmanned moving object may be applied.

1 is a diagram illustrating a block diagram of a computing device performing an operation for providing an unmanned moving object anomaly detection method according to an embodiment of the present disclosure.

The configuration of the computing device 100 shown in FIG. 1 is only a simplified example. In an embodiment of the present disclosure, the computing device 100 may include other components for performing the computing environment of the computing device 100 , and only some of the disclosed components may configure the computing device 100 .

The computing device 100 may include a processor 110 , a memory 130 , and a network unit 150 .

In the present disclosure, the processor 110 may detect an abnormal symptom of the unmanned moving object by using the message ID sequence.

According to an embodiment of the present disclosure, the processor 110 collects packet data generated from an unmanned moving object, pre-processes the collected packet data, and inputs the pre-processed packet data to a pre-trained neural network model to provide packet data Anomalies of unmanned moving objects can be detected based on the message ID pattern of

According to an embodiment of the present disclosure, when collecting packet data, the processor 110 collects packet data generated from the unmanned mobile body through communication between the unmanned mobile body and a ground control system (GCS). can For example, the unmanned mobile vehicle and the ground control system may perform communication using the MAVLink (Micro Air Vehicle Link) protocol. The foregoing is merely an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the processor 110, when pre-processing the collected packet data, extracts a message ID from the collected packet data, assigns an integer value to the extracted message ID, and assigns an integer to the message ID Values can be normalized.

According to an embodiment of the present disclosure, when extracting the message ID, the processor 110 may extract only the message ID from the collected packet data. Here, the extracted message ID may include an identifier for determining the type of message transmitted/received in a protocol used by the unmanned mobile unit for communication. The foregoing is merely an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the processor 110, when assigning an integer value to the extracted message ID, assigns the same integer value to the same message ID, and assigns different integer values to different message IDs. have. When the processor 110 assigns an integer value to the extracted message ID, different integer values may be assigned according to the type of the message ID. For example, when the processor 110 assigns an integer value to the extracted message ID, if there are a total of N types of message IDs, any one integer from 1 to N may be assigned to each message ID.

According to an embodiment of the present disclosure, when normalizing the integer value assigned to the message ID, the processor 110 may normalize the integer value assigned to the message ID to a range of 0 to 1 in order to adjust the size of the message ID. . For example, when there are a total of n message ID types, the processor 110 may normalize the result by dividing n by an integer value assigned to each message ID.

According to an embodiment of the present disclosure, when detecting an abnormal symptom of an unmanned moving object, the processor 110 inputs the pre-processed packet data to the pre-trained neural network model, and the current status of the packet data input to the neural network model Predict the message ID following the message ID sequence, calculate the message ID pattern prediction success rate by comparing the predicted message ID and the actual message ID, and detect anomalies of the unmanned moving object based on the calculated message ID pattern prediction success rate can do.

According to an embodiment of the present disclosure, when calculating the message ID pattern prediction success rate, the processor 110 calculates an average value of the message ID pattern prediction success rates for a certain time when the message ID pattern prediction success rate is calculated, Anomalies of the unmanned moving object can be detected by comparing the calculated average value of the message ID pattern prediction success rates with a preset threshold value. Here, when the processor 110 detects an abnormal symptom of the unmanned moving object, if the average value of the calculated message ID pattern prediction success rates is lower than the threshold value, the processor 110 may determine that the abnormal symptom of the unmanned moving object is detected. As an example, the threshold value may vary according to the structure of the neural network model or the environment to which the neural network model is applied, and may be determined through an experiment. The foregoing is merely an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, when detecting an abnormal symptom of an unmanned moving object, the processor 110 inputs the pre-processed packet data to the pre-trained neural network model, and the current status of the packet data input to the neural network model Predict the message ID following the message ID sequence, calculate the message ID pattern loss value by comparing the predicted message ID and the actual message ID, and detect anomalies of the unmanned moving object based on the calculated message ID pattern loss value can do.

According to an embodiment of the present disclosure, when calculating the message ID pattern loss value, the processor 110 calculates an average value of the message ID pattern loss values for a predetermined time when the message ID pattern loss value is calculated, Anomalies of the unmanned moving object can be detected by comparing the calculated average value of the message ID pattern loss values with a preset threshold value. Here, when the processor 110 detects an abnormal symptom of the unmanned moving object, if the average value of the calculated message ID pattern loss values is higher than the threshold value, the processor 110 may determine that the abnormal symptom of the unmanned moving object is detected. As an example, the threshold value may vary according to the structure of the neural network model or the environment to which the neural network model is applied, and may be determined through an experiment. In addition, the average value of the message ID pattern loss values for a certain time is calculated by the formula consisting of the average of the loss values for N frames = (Loss _T + Loss _T-1 + ... Loss _T-N+1 )/N can be calculated. The foregoing is merely an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the processor 110 may pre-train the neural network model. Here, in the prior learning of the neural network model, the unmanned mobile unit collects normal packet data generated in a normal communication state, pre-processes the collected normal packet data, and inputs the pre-processed normal packet data into the neural network model to obtain normal packet data. It can learn by predicting the message ID following the current message ID sequence of . As an example, the neural network model may have a hierarchical structure including a one-dimensional convolutional layer, a Gated Recurrent Units (GRU) layer, and a dense layer. The foregoing is merely an example, and the present disclosure is not limited thereto.

As such, the processor 110 may include one or more cores, and a central processing unit (CPU), a general purpose graphics processing unit (GPGPU), and a tensor of the computing device 100 . It may include a processor for deep learning, such as a tensor processing unit (TPU). The processor 110 may read a computer program stored in the memory 130 to detect anomalies of the unmanned moving object according to an embodiment of the present disclosure. According to an embodiment of the present disclosure, the processor 110 may perform an operation for detecting abnormal symptoms of an unmanned moving object. The processor 110 performs learning of the neural network such as processing of input data for learning in deep learning (DL), extraction of features from input data, calculation of errors, and weight update of the neural network using backpropagation. calculations can be performed for The processor 110, at least one of a CPU, a GPGPU, and a TPU may process learning of a network function. For example, the CPU and GPGPU can process learning of a network function and detection of anomalies of an unmanned moving object using the network function. In addition, in an embodiment of the present disclosure, learning of a network function and detection of anomalies of an unmanned moving object using the network function may be processed by using the processors of a plurality of computing devices together. In addition, the computer program executed in the computing device according to an embodiment of the present disclosure may be a CPU, GPGPU or TPU executable program.

According to an embodiment of the present disclosure, the memory 130 may store any type of information generated or determined by the processor 110 and any type of information received by the network unit 150 .

According to an embodiment of the present disclosure, the memory 130 includes a flash memory type, a hard disk type, a multimedia card micro type, and a card type memory (eg, SD or XD memory, etc.), Random Access Memory (RAM), Static Random Access Memory (SRAM), Read-Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Programmable Memory (PROM) read-only memory), a magnetic memory, a magnetic disk, and an optical disk may include at least one type of storage medium. The computing device 100 may operate in relation to a web storage that performs a storage function of the memory 130 on the Internet. The description of the above-described memory is only an example, and the present disclosure is not limited thereto.

According to an embodiment of the present disclosure, the network unit 150 may transmit/receive data for performing abnormal symptom detection of an unmanned moving object to/from other computing devices, servers, and the like. The network unit 150 may transmit/receive data to and from other computing devices, servers, and the like in order to detect anomalies of the unmanned moving object. In addition, the network unit 150 may enable communication between a plurality of computing devices so that learning of a network function is performed in a distributed manner in each of the plurality of computing devices. The network unit 150 may enable communication between a plurality of computing devices to distribute analysis data generation using a network function.

According to an embodiment of the present disclosure, the network unit 150 may be configured regardless of its communication mode, such as wired and wireless, and may include a personal area network (PAN) and a wide area network (WAN). ), etc., may be composed of various communication networks. In addition, the network unit 150 may be a known World Wide Web (WWW), and may use a wireless transmission technology used for short-range communication such as infrared (IrDA) or Bluetooth (Bluetooth). may be The techniques described herein may be used in the networks mentioned above, as well as in other networks.

As such, the present disclosure can detect an abnormal symptom of an unmanned moving object by using a message ID sequence.

In the case of an anomaly detection model using a sequence of multiple sensor values, a lot of overhead occurs because various sensor values must be processed and utilized and integrated. However, the present disclosure provides an unmanned moving object anomaly detection method using a message ID sequence, Because only the message ID sequence is used for anomaly detection, there is an advantage in data processing and utilization.

FIG. 2 is a diagram illustrating a block diagram of a processor for explaining a method for detecting anomaly of an unmanned moving object according to an embodiment of the present disclosure.

As shown in FIG. 2 , the processor of the present disclosure may include a packet collection unit 200 , a preprocessor 300 , and an anomaly detection unit 400 .

The packet collection unit 200 may collect packets generated by an unmanned moving object. For example, a Ground Control System (GCS) may be utilized to collect packets generated by the unmanned aerial vehicle, and in this case, the GCS may be the packet collection unit 200 .

And, the preprocessor 300 may extract a message ID from the collected packet so that the deep learning model can use it. Here, the message ID may be an identifier used to determine the type of message transmitted and received in a protocol used by an unmanned mobile device for communication. For example, a communication protocol widely used in an unmanned aerial vehicle may include the MAVLink protocol and the like. The message ID may be included in the protocol format as shown in FIG. 3 .

3 is a diagram showing packet data including a message ID according to an embodiment of the present disclosure. As shown in FIG. 3 , a communication protocol used in an unmanned aerial vehicle may be a MAVLink protocol, which is version 1 MAVLink 1 The packet data 510 transmitted/received in the protocol may include a message ID 512 , and the packet data 520 transmitted/received in the version 2 MAVLink 2 protocol may include a message ID 522 . Here, the message ID may be an identifier used to determine the type of message transmitted and received in a protocol used by the unmanned mobile device for communication.

Next, the preprocessor 300 may preprocess the extracted message ID. In this case, the preprocessing method may vary depending on the deep learning model used. Data output from the preprocessor 300 may be a preprocessed message ID sequence.

4 is a diagram illustrating a block diagram for explaining a pre-processing unit, according to an embodiment of the present disclosure.

As shown in FIG. 4 , the preprocessor 300 may include a message ID extraction unit 310 , an integer value assignment unit 320 , and a normalization unit 330 .

The message ID extraction unit 310 may extract a message ID from a protocol packet used by an unmanned mobile device.

The integer value assigning unit 320 may assign a new integer value to the extracted message ID. For example, in the MAVLink 2 protocol, if the message ID is 0x00008D, it indicates a packet containing the altitude information of the drone, and if the message ID is 0x000000, the heartbeat to check whether the drone or GCS are communicating normally It may indicate that it is a (heartbeat) packet. Message IDs of 0x00008D may be converted into all 1 by giving an integer 1, and all message IDs of 0x000000 may be converted into all integers 2 and converted into 2. The reason for converting to another integer is to make it easier for deep learning models to use through regularization.

As an embodiment, the integer value assigning unit 320 may assign the same integer value to the same message ID and may assign different integer values to different message IDs. In addition, the integer value assigning unit 320 may be assigned different integer values according to the type of the message ID. For example, when the processor 110 assigns an integer value to the extracted message ID, if there are a total of N types of message IDs, any one integer from 1 to N may be assigned to each message ID.

The normalizer 330 may scale the size of the message ID converted into a new integer. For example, if the integer assigned by the integer value assigning unit 320 is 1 to 24, that is, there are 24 message ID types, each integer value may be divided by 24. The message ID converted to the integer 1 may finally have a value of 1/24, and the message ID converted to the integer 24 may finally have a value of 1.

As an embodiment, the normalizer 330 may normalize the integer value given to the message ID to a range of 0 to 1 in order to adjust the size of the message ID. For example, when there are a total of n message ID types, the normalizer 330 may normalize the result by dividing n by an integer value given to each message ID.

Next, the anomaly detection unit 400 may be a deep learning model that receives an actual message ID sequence output by the preprocessor 300 and detects whether there is an abnormality. The abnormality detection unit 400 may learn a message ID pattern transmitted and received in a normal state. That is, when a message ID sequence of a certain length is input, the anomaly detection unit 400 may learn to predict a message ID that will appear immediately after the corresponding sequence. If an attack occurs on an unmanned moving object, the transmitted and received message ID pattern will be different from the normal pattern. The index for determining whether there is an abnormality may be an average of prediction success rates or an average of loss values for a certain period of time.

For example, the average of the loss values may be calculated as in Equation 1 below. Here, the frame means a time unit for receiving one message.

Accordingly, the pre-learned anomaly detection unit 400 may determine that an anomaly is detected when the average of the prediction success rates is lower than a threshold or the average of the loss values is higher than the threshold. In this case, the threshold value may vary greatly depending on the structure of the anomaly detection model or the environment to which the detection model is applied, so it should be determined through experimentation.

As an embodiment, the anomaly detection unit 400 inputs the pre-processed packet data to the pre-trained neural network model, and predicts the message ID following the current message ID sequence of the packet data input to the neural network model, , it is possible to calculate a message ID pattern prediction success rate by comparing the predicted message ID with the actual message ID, and detect anomalies of the unmanned moving object based on the calculated message ID pattern prediction success rate.

When the message ID pattern prediction success rate is calculated, the anomaly detection unit 400 calculates an average value for the message ID pattern prediction success rates for a predetermined time, and sets the average value for the calculated message ID pattern prediction success rates with a preset threshold value By comparison, anomalies of unmanned moving objects can be detected. Here, when the average value of the calculated message ID pattern prediction success rates is lower than the threshold value, the anomaly detection unit 400 may determine that an abnormal symptom of the unmanned moving object is detected. As an example, the threshold value may vary according to the structure of the neural network model or the environment to which the neural network model is applied, and may be determined through an experiment. The foregoing is merely an example, and the present disclosure is not limited thereto.

As another embodiment, the anomaly detection unit 400 inputs the pre-processed packet data to the pre-trained neural network model, and predicts the message ID following the current message ID sequence of the packet data input to the neural network model, , it is possible to calculate a message ID pattern loss value by comparing the predicted message ID with the actual message ID, and detect abnormal symptoms of the unmanned moving object based on the calculated message ID pattern loss value.

When the message ID pattern loss value is calculated, the anomaly detection unit 400 calculates an average value of the message ID pattern loss values for a predetermined time, and sets the average value of the calculated message ID pattern loss values with a preset threshold value. By comparison, anomalies of unmanned moving objects can be detected. Here, when the average value of the calculated message ID pattern loss values is higher than the threshold value, the abnormality detection unit 400 may determine that an abnormal symptom of the unmanned moving object is detected. As an example, the threshold value may vary according to the structure of the neural network model or the environment to which the neural network model is applied, and may be determined through an experiment. In addition, the average value of the message ID pattern loss values for a certain time is calculated by the formula consisting of the average of the loss values for N frames = (Loss _T + Loss _T-1 + ... Loss _T-N+1 )/N can be calculated. The foregoing is merely an example, and the present disclosure is not limited thereto.

5 is a diagram illustrating a block configuration diagram for explaining a neural network model, according to an embodiment of the present disclosure.

As shown in FIG. 5 , the neural network model of the anomaly detection unit 400 may receive the message ID sequence output by the preprocessor 200 and predict the message ID immediately following the sequence. Here, the neural network model of the anomaly detection unit 400 may have a hierarchical structure including a one-dimensional convolutional layer 410 , a Gated Recurrent Units (GRU) layer 420 , and a dense layer 430 . . The foregoing is merely an example, and the present disclosure is not limited thereto. The hierarchical structure of the neural network model can be changed as long as its function is maintained as long as it receives a message ID sequence and has a function of predicting the message ID.

Pre-learning of the neural network model is performed by collecting normal packet data generated in a normal communication state by an unmanned mobile unit, pre-processing the collected normal packet data, and inputting the pre-processed normal packet data into the neural network model to determine the current status of normal packet data. It can learn by predicting the message ID following the message ID sequence.

Throughout this specification, computational model, neural network, network function, and neural network may be used interchangeably. A neural network may be composed of a set of interconnected computational units, which may generally be referred to as nodes. These nodes may also be referred to as neurons. A neural network is configured to include at least one or more nodes. Nodes (or neurons) constituting the neural networks may be interconnected by one or more links.

In the neural network, one or more nodes connected through a link may relatively form a relationship between an input node and an output node. The concepts of an input node and an output node are relative, and any node in an output node relationship with respect to one node may be in an input node relationship in a relationship with another node, and vice versa. As described above, an input node-to-output node relationship may be created around a link. One or more output nodes may be connected to one input node through a link, and vice versa.

In the relationship between the input node and the output node connected through one link, the value of the output node may be determined based on data input to the input node. Here, a node interconnecting the input node and the output node may have a parameter. The parameters may be variable, and may be changed by the user or algorithm in order for the neural network to perform a desired function. For example, when one or more input nodes are interconnected to one output node by respective links, the output node sets values input to input nodes connected to the output node and links corresponding to the respective input nodes. An output node value may be determined based on the parameter.

As described above, in a neural network, one or more nodes are interconnected through one or more links to form an input node and an output node relationship in the neural network. The characteristics of the neural network may be determined according to the number of nodes and links in the neural network, correlations between nodes and links, and parameter values assigned to each of the links. For example, when two neural networks having the same number of nodes and links and having different parameter values between the links exist, the two neural networks may be recognized as different from each other.

A neural network may include one or more nodes. Some of the nodes constituting the neural network may configure one layer based on distances from the initial input node. For example, a set of nodes having a distance of n from the initial input node may constitute n layers. The distance from the initial input node may be defined by the minimum number of links that must be passed to reach the corresponding node from the initial input node. However, the definition of such a layer is arbitrary for description, and the order of the layer in the neural network may be defined in a different way from the above. For example, a layer of nodes may be defined by a distance from the final output node.

The initial input node may mean one or more nodes to which data is directly input without going through a link in a relationship with other nodes among nodes in the neural network. Alternatively, in a relationship between nodes based on a link in a neural network, it may mean nodes that do not have other input nodes connected by a link. Similarly, the final output node may refer to one or more nodes that do not have an output node in relation to other nodes among nodes in the neural network. In addition, the hidden node may mean nodes constituting the neural network other than the first input node and the last output node. The neural network according to an embodiment of the present disclosure may be a neural network in which the number of nodes in the input layer may be the same as the number of nodes in the output layer, and the number of nodes decreases and then increases again as progresses from the input layer to the hidden layer. can Also, in the neural network according to another embodiment of the present disclosure, the number of nodes in the input layer may be less than the number of nodes in the output layer, and the number of nodes may be reduced as the number of nodes progresses from the input layer to the hidden layer. have. In addition, the neural network according to another embodiment of the present disclosure may be a neural network in which the number of nodes in the input layer may be greater than the number of nodes in the output layer, and the number of nodes increases as the number of nodes progresses from the input layer to the hidden layer. can The neural network according to another embodiment of the present disclosure may be a neural network in a combined form of the aforementioned neural networks.

A deep neural network (DNN) may refer to a neural network including a plurality of hidden layers in addition to an input layer and an output layer. Deep neural networks can be used to identify the latent structures of data. In other words, it can identify the potential structure of photos, texts, videos, voices, and music (e.g., what objects are in the photos, what the text and emotions are, what the texts and emotions are, etc.) . Deep neural networks include convolutional neural networks (CNNs), recurrent neural networks (RNNs), auto encoders, generative adversarial networks (GANs), and restricted Boltzmann machines (RBMs). boltzmann machine), a deep belief network (DBN), a Q network, a U network, a Siamese network, and the like. The description of the deep neural network described above is only an example, and the present disclosure is not limited thereto.

6 is a diagram illustrating a flowchart for explaining a method for detecting anomaly of an unmanned moving object according to an embodiment of the present disclosure.

As shown in FIG. 6 , the computing device of the present disclosure may collect packet data generated from an unmanned moving object ( S10 ). Here, the computing device may collect packet data generated from the unmanned mobile body through communication between the unmanned mobile body and a ground control system (GCS). For example, the unmanned mobile vehicle and the ground control system may perform communication using the MAVLink (Micro Air Vehicle Link) protocol.

And, the computing device of the present disclosure may pre-process the collected packet data (S20). Here, the computing device may extract a message ID from the collected packet data, assign an integer value to the extracted message ID, and normalize the integer value assigned to the message ID.

When extracting the message ID, the computing device may extract only the message ID from the collected packet data. As an example, the extracted message ID may include an identifier for determining the type of message transmitted/received in a protocol used by the unmanned mobile device for communication. Also, when assigning an integer value to the extracted message ID, the computing device may assign the same integer value to the same message ID and may assign different integer values to different message IDs. Here, when the computing device assigns an integer value to the extracted message ID, different integer values may be assigned according to the type of the message ID. For example, when the processor 110 assigns an integer value to the extracted message ID, if there are a total of N types of message IDs, any one integer from 1 to N may be assigned to each message ID. Also, when normalizing the integer value assigned to the message ID, the computing device may normalize the integer value assigned to the message ID to a range of 0 to 1 in order to adjust the size of the message ID. For example, when there are a total of n message ID types, the processor 110 may normalize the result by dividing n by an integer value assigned to each message ID.

Next, the computing device of the present disclosure may input the pre-processed packet data into the pre-trained neural network model to detect abnormal symptoms of the unmanned moving object based on the message ID pattern of the packet data ( S30 ).

In one embodiment, the computing device inputs the preprocessed packet data to the pre-trained neural network model, predicts a message ID following the current message ID sequence of the packet data input to the neural network model, and predicts the predicted message The message ID pattern prediction success rate is calculated by comparing the ID with the actual message ID, and abnormal symptoms of the unmanned moving object can be detected based on the calculated message ID pattern prediction success rate. When calculating the message ID pattern prediction success rate, the computing device calculates an average value of the message ID pattern prediction success rates for a predetermined time when the message ID pattern prediction success rate is calculated, and the average value of the calculated message ID pattern prediction success rates can be compared with a preset threshold to detect anomalies of the unmanned moving object. Here, when the computing device detects an abnormal symptom of the unmanned moving object, if the average value of the calculated message ID pattern prediction success rates is lower than the threshold value, the computing device may determine that the abnormal symptom of the unmanned moving object is detected. As an example, the threshold value may vary according to a structure of the neural network model or an application environment of the neural network model and may be determined through an experiment. The foregoing is merely an example, and the present disclosure is not limited thereto.

In another embodiment, the computing device inputs the pre-processed packet data to the pre-trained neural network model, predicts a message ID following the current message ID sequence of the packet data input to the neural network model, and predicts the predicted message A message ID pattern loss value can be calculated by comparing the ID with the actual message ID, and abnormal symptoms of the unmanned moving object can be detected based on the calculated message ID pattern loss value. When calculating the message ID pattern loss value, when the message ID pattern loss value is calculated, the computing device calculates an average value for the message ID pattern loss values for a predetermined time, and an average value for the calculated message ID pattern loss values can be compared with a preset threshold to detect anomalies of the unmanned moving object. Here, when the computing device detects the abnormal symptom of the unmanned moving object, if the average value of the calculated message ID pattern loss values is higher than the threshold value, the computing device may determine that the abnormal symptom of the unmanned moving object is detected. As an example, the threshold value may vary according to the structure of the neural network model or the environment to which the neural network model is applied, and may be determined through an experiment. In addition, the average value of the message ID pattern loss values for a certain time is calculated by the formula consisting of the average of the loss values for N frames = (Loss _T + Loss _T-1 + ... Loss _T-N+1 )/N can be calculated.

Also, the computing device of the present disclosure may pre-train the neural network model. Here, in the prior learning of the neural network model, the unmanned mobile unit collects normal packet data generated in a normal communication state, pre-processes the collected normal packet data, and inputs the pre-processed normal packet data into the neural network model to obtain normal packet data. It can learn by predicting the message ID following the current message ID sequence of .

As such, the present disclosure can detect an abnormal symptom of an unmanned moving object by using a message ID sequence.

In the case of an anomaly detection model using a sequence of multiple sensor values, a lot of overhead occurs because various sensor values must be processed and utilized and integrated. However, the present disclosure provides an unmanned moving object anomaly detection method using a message ID sequence, Because only the message ID sequence is used for anomaly detection, there is an advantage in data processing and utilization.

7 depicts a general schematic diagram of an example computing environment in which embodiments of the present disclosure may be implemented.

Although the present disclosure has been described above generally in the context of computer-executable instructions that may be executed on one or more computers, those skilled in the art will appreciate that the present disclosure may be implemented as a combination of hardware and software and/or in combination with other program modules. you will know

Generally, modules herein include routines, procedures, programs, components, data structures, etc. that perform particular tasks or implement particular abstract data types. In addition, those skilled in the art will appreciate that the methods of the present disclosure can be applied to single-processor or multiprocessor computer systems, minicomputers, mainframe computers as well as personal computers, handheld computing devices, microprocessor-based or programmable consumer electronics, etc. (each of which is It will be appreciated that other computer system configurations may be implemented, including those that may operate in connection with one or more associated devices.

The described embodiments of the present disclosure may also be practiced in distributed computing environments where certain tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

Computers typically include a variety of computer-readable media. Media accessible by a computer includes volatile and nonvolatile media, transitory and non-transitory media, removable and non-removable media. By way of example, and not limitation, computer-readable media may include computer-readable storage media and computer-readable transmission media.

Computer readable storage media includes volatile and nonvolatile media, temporary and non-transitory media, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. includes media. A computer-readable storage medium may be RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital video disk (DVD) or other optical disk storage device, magnetic cassette, magnetic tape, magnetic disk storage device, or other magnetic storage device. device, or any other medium that can be accessed by a computer and used to store the desired information.

A computer readable transmission medium typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and the like. Includes all information delivery media. The term modulated data signal means a signal in which one or more of the characteristics of the signal is set or changed so as to encode information in the signal. By way of example, and not limitation, computer-readable transmission media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above are also intended to be included within the scope of computer-readable transmission media.

An example environment 1100 implementing various aspects of the disclosure is shown including a computer 1102 , the computer 1102 including a processing unit 1104 , a system memory 1106 , and a system bus 1108 . do. A system bus 1108 couples system components, including but not limited to system memory 1106 , to the processing device 1104 . The processing device 1104 may be any of a variety of commercially available processors. Dual processor and other multiprocessor architectures may also be used as processing unit 1104 .

The system bus 1108 may be any of several types of bus structures that may be further interconnected to a memory bus, a peripheral bus, and a local bus using any of a variety of commercial bus architectures. System memory 1106 includes read only memory (ROM) 1110 and random access memory (RAM) 1112 . A basic input/output system (BIOS) is stored in non-volatile memory 1110, such as ROM, EPROM, EEPROM, etc., which BIOS provides basic input/output systems (BIOS) that help transfer information between components within computer 1102, such as during startup. contains routines. RAM 1112 may also include high-speed RAM, such as static RAM, for caching data.

The computer 1102 may also include an internal hard disk drive (HDD) 1114 (eg, EIDE, SATA) - this internal hard disk drive 1114 may also be configured for external use within a suitable chassis (not shown). Yes—a magnetic floppy disk drive (FDD) 1116 (eg, for reading from or writing to removable diskette 1118), and an optical disk drive 1120 (eg, a CD-ROM) for reading from, or writing to, disk 1122, or other high capacity optical media, such as DVD. The hard disk drive 1114 , the magnetic disk drive 1116 , and the optical disk drive 1120 are connected to the system bus 1108 by the hard disk drive interface 1124 , the magnetic disk drive interface 1126 , and the optical drive interface 1128 , respectively. ) can be connected to The interface 1124 for external drive implementation includes, for example, at least one or both of Universal Serial Bus (USB) and IEEE 1394 interface technologies.

These drives and their associated computer-readable media provide non-volatile storage of data, data structures, computer-executable instructions, and the like. For computer 1102, drives and media correspond to storing any data in a suitable digital format. Although the description of computer readable storage media above refers to HDDs, removable magnetic disks, and removable optical media such as CDs or DVDs, those skilled in the art will use zip drives, magnetic cassettes, flash memory cards, cartridges, It will be appreciated that other tangible computer-readable storage media and the like may also be used in the exemplary operating environment and any such media may include computer-executable instructions for performing the methods of the present disclosure. .

A number of program modules may be stored in the drive and RAM 1112 , including an operating system 1130 , one or more application programs 1132 , other program modules 1134 , and program data 1136 . All or portions of the operating system, applications, modules, and/or data may also be cached in RAM 1112 . It will be appreciated that the present disclosure may be implemented in various commercially available operating systems or combinations of operating systems.

A user may enter commands and information into the computer 1102 via one or more wired/wireless input devices, for example, a pointing device such as a keyboard 1138 and a mouse 1140 . Other input devices (not shown) may include a microphone, IR remote control, joystick, game pad, stylus pen, touch screen, and the like. Although these and other input devices are connected to the processing unit 1104 through an input device interface 1142 that is often connected to the system bus 1108, parallel ports, IEEE 1394 serial ports, game ports, USB ports, IR interfaces, It may be connected by other interfaces, etc.

A monitor 1144 or other type of display device is also coupled to the system bus 1108 via an interface, such as a video adapter 1146 . In addition to the monitor 1144, the computer typically includes other peripheral output devices (not shown) such as speakers, printers, and the like.

Computer 1102 may operate in a networked environment using logical connections to one or more remote computers, such as remote computer(s) 1148 via wired and/or wireless communications. Remote computer(s) 1148 may be workstations, server computers, routers, personal computers, portable computers, microprocessor-based entertainment devices, peer devices, or other common network nodes, and are generally Although including many or all of the components described, only memory storage device 1150 is shown for simplicity. The logical connections shown include wired/wireless connections to a local area network (LAN) 1152 and/or a larger network, eg, a wide area network (WAN) 1154 . Such LAN and WAN networking environments are common in offices and companies, and facilitate enterprise-wide computer networks, such as intranets, all of which can be connected to a worldwide computer network, for example, the Internet.

When used in a LAN networking environment, the computer 1102 is coupled to the local network 1152 through a wired and/or wireless communication network interface or adapter 1156 . Adapter 1156 may facilitate wired or wireless communication to LAN 1152 , which LAN 1152 also includes a wireless access point installed therein for communicating with wireless adapter 1156 . When used in a WAN networking environment, the computer 1102 may include a modem 1158 , connected to a communication server on the WAN 1154 , or otherwise establishing communications over the WAN 1154 , such as over the Internet. have the means A modem 1158 , which may be internal or external and a wired or wireless device, is coupled to the system bus 1108 via a serial port interface 1142 . In a networked environment, program modules described for computer 1102 , or portions thereof, may be stored in remote memory/storage device 1150 . It will be appreciated that the network connections shown are exemplary and other means of establishing a communication link between the computers may be used.

The computer 1102 may be associated with any wireless device or object that is deployed and operates in wireless communication, for example, a printer, scanner, desktop and/or portable computer, portable data assistant (PDA), communication satellite, wireless detectable tag. It operates to communicate with any device or place, and phone. This includes at least Wi-Fi and Bluetooth wireless technologies. Accordingly, the communication may be a predefined structure as in a conventional network or may simply be an ad hoc communication between at least two devices.

Wi-Fi (Wireless Fidelity) makes it possible to connect to the Internet, etc. without a wired connection. Wi-Fi is a wireless technology such as cell phones that allows these devices, eg, computers, to transmit and receive data indoors and outdoors, ie anywhere within range of a base station. Wi-Fi networks use a radio technology called IEEE 802.11 (a, b, g, etc.) to provide secure, reliable, and high-speed wireless connections. Wi-Fi can be used to connect computers to each other, to the Internet, and to wired networks (using IEEE 802.3 or Ethernet). Wi-Fi networks may operate in unlicensed 2.4 and 5 GHz radio bands, for example, at 11 Mbps (802.11a) or 54 Mbps (802.11b) data rates, or in products that include both bands (dual band). have.

Those of ordinary skill in the art of the present disclosure will recognize that the various illustrative logical blocks, modules, processors, means, circuits, and algorithm steps described in connection with the embodiments disclosed herein include electronic hardware, (convenience For this purpose, it will be understood that it may be implemented by various forms of program or design code (referred to herein as "software") or a combination of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. A person skilled in the art of the present disclosure may implement the described functionality in various ways for each specific application, but such implementation decisions should not be interpreted as a departure from the scope of the present disclosure.

The various embodiments presented herein may be implemented as methods, apparatus, or articles of manufacture using standard programming and/or engineering techniques. The term “article of manufacture” includes a computer program or media accessible from any computer-readable device. For example, computer-readable storage media include magnetic storage devices (eg, hard disks, floppy disks, magnetic strips, etc.), optical disks (eg, CDs, DVDs, etc.), smart cards, and flash drives. memory devices (eg, EEPROMs, cards, sticks, key drives, etc.). The term “machine-readable medium” includes, but is not limited to, wireless channels and various other media that can store, hold, and/or convey instruction(s) and/or data.

The description of the presented embodiments is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the embodiments presented herein, but is to be construed in the widest scope consistent with the principles and novel features presented herein.

Claims (15)

An unmanned moving object anomaly detection method, comprising:
collecting packet data generated by the unmanned moving object;
pre-processing the collected packet data; and
inputting the pre-processed packet data into a pre-trained neural network model and detecting anomalies of the unmanned moving object based on a message ID pattern of the packet data;
containing,
Unmanned moving object anomaly detection method.
According to claim 1,
Collecting the packet data includes:
Collecting packet data generated from the unmanned mobile body through communication between the unmanned mobile body and a ground control system (GCS),
Unmanned moving object anomaly detection method.
According to claim 1,
The pre-processing of the collected packet data includes:
extracting a message ID from the collected packet data;
assigning an integer value to the extracted message ID; and
normalizing an integer value assigned to the message ID;
containing,
Unmanned moving object anomaly detection method.
4. The method of claim 3,
The step of assigning an integer value to the extracted message ID comprises:
Different integer values are given according to the type of the message ID,
Unmanned moving object anomaly detection method.
4. The method of claim 3,
Normalizing the integer value given to the message ID comprises:
Normalizing the integer value given to the message ID to a range of 0 to 1 in order to adjust the size of the message ID,
Unmanned moving object anomaly detection method.
4. The method of claim 3,
Normalizing the integer value given to the message ID comprises:
When there are a total of n types of message IDs, normalizing to a result value calculated by dividing n by the integer value given to each message ID,
Unmanned moving object anomaly detection method.
According to claim 1,
The step of detecting an abnormal symptom of the unmanned moving object,
inputting the pre-processed packet data into a pre-trained neural network model;
predicting a message ID following a current message ID sequence of packet data input to the neural network model;
calculating a message ID pattern prediction success rate by comparing the predicted message ID with the actual message ID; and
detecting abnormal signs of the unmanned moving object based on the calculated message ID pattern prediction success rate;
containing,
Unmanned moving object anomaly detection method.
8. The method of claim 7,
Calculating the message ID pattern prediction success rate comprises:
calculating an average value of message ID pattern prediction success rates for a predetermined time when the message ID pattern prediction success rate is calculated; and
detecting an abnormal symptom of the unmanned moving object by comparing the calculated average value of the message ID pattern prediction success rates with a preset threshold value;
containing,
Unmanned moving object anomaly detection method.
9. The method of claim 8,
The step of detecting an abnormal symptom of the unmanned moving object,
If the average value of the calculated message ID pattern prediction success rates is lower than the threshold value, it is determined that an abnormal symptom of the unmanned moving object is detected,
Unmanned moving object anomaly detection method.
According to claim 1,
The step of detecting an abnormal symptom of the unmanned moving object,
inputting the pre-processed packet data into a pre-trained neural network model;
predicting a message ID following a current message ID sequence of packet data input to the neural network model;
calculating a message ID pattern loss value by comparing the predicted message ID with the actual message ID; and
detecting abnormal signs of the unmanned moving object based on the calculated message ID pattern loss value;
containing,
Unmanned moving object anomaly detection method.
11. The method of claim 10,
Calculating the message ID pattern loss value comprises:
calculating an average value of message ID pattern loss values for a predetermined time when the message ID pattern loss value is calculated; and
detecting an abnormal symptom of the unmanned moving object by comparing the calculated average value of the message ID pattern loss values with a preset threshold value;
containing,
Unmanned moving object anomaly detection method.
12. The method of claim 11,
The step of detecting an abnormal symptom of the unmanned moving object,
If the average value of the calculated message ID pattern loss values is higher than the threshold value, it is determined that an abnormal symptom of the unmanned moving object is detected,
Unmanned moving object anomaly detection method.
According to claim 1,
The prior learning of the neural network model is,
collecting normal packet data generated in a normal communication state by the unmanned mobile unit;
pre-processing the collected normal packet data; and
inputting the preprocessed normal packet data into the neural network model to predict and learn a message ID following a current message ID sequence of the normal packet data;
containing,
Unmanned moving object anomaly detection method.
A computer program stored in a computer readable storage medium, wherein the computer program, when executed on one or more processors, performs the following operations for detecting an abnormal symptom of an unmanned moving object, the operations comprising:
collecting packet data generated by the unmanned moving object;
pre-processing the collected packet data; and
inputting the pre-processed packet data into a pre-trained neural network model to detect anomalies of the unmanned moving object based on a message ID pattern of the packet data;
containing,
A computer program stored on a computer-readable storage medium.
A computing device for providing an unmanned moving object anomaly detection method,
a processor including one or more cores; and
Memory;
including,
The processor is
Collecting packet data generated by the unmanned moving object,
pre-processing the collected packet data, and
Inputting the pre-processed packet data into a pre-trained neural network model to detect abnormal symptoms of the unmanned moving object based on the message ID pattern of the packet data,
computing device.

Images