The number of Unmanned Aerial Vehicles (UAVs) used in various industries has increased exponentially, and abnormal detection of UAVs is one of the primary technical means to ensure that UAVs can work normally. Currently, most anomaly detection models are trained using on-board logs from drones. However, in some cases, using these logs can be problematic due to data encryption, inconsistent descriptions of characteristics, and imbalanced positive and negative samples. Consequently, the on-board logs of UAVs may not be directly usable for training anomaly detection models. Given the above problems, this paper proposes a Time Line Modeling (TLM) method based on the UAV software-in-the-loop (SITL) simulation environment to obtain and process the on-board failure logs of drones. The Time Line Modeling method includes two stages: the Fault Time Point Anchoring Method and Fault Time Window Stretching Method. First, based on the SITL simulation environment, multiple flight missions were constructed. Failures of several common components of UAVs are designed. Secondly, the fault’s initial location and end location are determined by the method of Fault Time Point Anchoring, and the original collection of tagged UAV’s on-board data is realized. Then, in terms of data processing, the features that are not universal are removed, and the flight data of the UAV is optimized by using the data balance method of Time Window Stretching to achieve the balance of normal data and abnormal data. Finally, use of algorithms such as Sequential Minimal Optimization (SMO), Random Forest (RF), and Convolutional Neural Network (CNN) were used to experiment with the processed data. The experimental results showed that the data set obtained based on this method can be effectively applied to the training of machine learning-based anomaly detection models.

With the rapid development of UAVs (Unmanned Aerial Vehicles), abnormal state detection has become a critical technology to ensure the flight safety of UAVs. The position and orientation system (POS) data, etc., used to evaluate UAV flight status are from different sensors. The traditional abnormal state detection model ignores the difference of POS data in the frequency domain during feature learning, which leads to the loss of key feature information and limits the further improvement of detection performance. To deal with this and improve UAV flight safety, this paper presents a method for detecting the abnormal state of a UAV based on a timestamp slice and multi-separable convolutional neural network (TS-MSCNN). Firstly, TS-MSCNN divides the POS data reasonably in the time domain by setting a set of specific timestamps and then extracts and fuses the key features to avoid the loss of feature information. Secondly, TS-MSCNN converts these feature data into grayscale images by data reconstruction. Lastly, TS-MSCNN utilizes a multi-separable convolution neural network (MSCNN) to learn key features more effectively. The binary and multi-classification experiments conducted on the real flight data, Air Lab Fault and Anomaly (ALFA), demonstrate that the TS-MSCNN outperforms traditional machine learning (ML) and the latest deep learning methods in terms of accuracy.

Network intrusion detection system provides a better network security solution than other traditional network defense technologies. Aiming at the increasingly serious problem of Internet security in the big data environment, a network intrusion detection model based on autoencoder network model and improved genetic algorithm BP (IGA‐BP) network is constructed. In order to reduce the data dimension and eliminate redundant information, the autoencoder network model is firstly used to denoise and dedimension. A new population was formed by selecting some of the best parent individuals for cross mutation and replacing the worst parent individuals. The improved genetic algorithm and new population generation model will provide more reasonable initial parameters for BP network, namely, IGA‐BP network model. Based on IGA‐BP network model, the problems of slow detection rate and easy to get into local optimality in BP network are solved. The experiments were performed on KDD CUP99 dataset, which simulated different types of user organizations and different types of network intrusion. Compared with the existing intrusion detection methods, the experimental results show that the proposed method has a great effect on classification accuracy, false positives, and detection rate.

With the continuous expansion of the darknet and the increase in various criminal activities in the darknet, darknet traffic identification has become increasingly essential. However, existing darknet traffic identification methods rely on all traffic characteristics, which require a long computing time and a large amount of system resources, resulting in low identification efficiency. To this end, this paper proposes an autoencoder-based darknet traffic identification method (AE-DTI). First, AE-DTI maps the feature values to pixels of a two-dimensional grayscale image after deduplication and denoising of the darknet traffic dataset. Then, AE-DTI designs a new feature selection algorithm (AE-FS) to downscale the grayscale graph, and AE-FS trains a feature scoring network, which globally scores all the features based on the reconstruction error to select the features with scores greater than or equal to a set threshold value. Finally, AE-DTI uses a one-dimensional convolutional neural network with a dropout layer to identify darknet traffic on the basis of alleviating overfitting. Experimental results on the ISCXTor2016 dataset show that, compared with other dimensionality reduction methods (PCA, LLE, ISOMAP, and autoencoder), the classification model trained with the data obtained from AE-FS has a significant improvement in classification accuracy and classification efficiency. Moreover, AE-DTI also shows significant improvement in recognition accuracy compared with other models. Experimental results on the CSE-CIC-IDS2018 dataset and CIC-Darknet2020 dataset show that AE-DTI has strong generalization.