| 引用本文： |
-
白猛,李维皓,邓琬巾,王思尧.面向无人机网络的解耦式双流入侵检测系统[J].信息安全学报,已采用 [点击复制]
- baimeng,LI Weihao,DENG Wanjin,WANG Siyao.A Decoupled Dual-Stream Intrusion Detection System for UAV Networks[J].Journal of Cyber Security,Accept [点击复制]
|
|
| 摘要: |
| 无人机网络流量在本质上属于表格型数据，各特征字段间无固定的空间或时序依赖关系。现有基于Transformer的深度模型虽能有效捕获字段间的全局交互，但多层特征聚合易引发过度平滑，导致端口号、包长度等对攻击识别至关重要的精确边界信息在深层表征中逐渐模糊。与此同时，无人机机载计算平台算力有限且实时性要求严苛，端到端深度学习架构中的重型分类头在单核CPU上存在显著访存瓶颈，难以满足部署需求。针对上述表征平滑与推理延迟的双重矛盾，本文提出一种面向无人机网络的解耦式双流入侵检测系统（Dual-Stream Fusion Intrusion Detection System, DSF-IDS）。在特征表征层面，系统引入全局残差直连通道，将FT-Transformer提取的高阶全局交叉语义与高保真原始特征在潜空间中直接拼接，有效缓解过度平滑问题，保留离散特征的精确分类边界。在分类决策层面，采用轻量级梯度提升机（LightGBM）替代重型神经网络分类头，实现特征提取与决策的分类解耦；进一步通过模型量化与计算图编译优化，将异构组件统一为高效的端到端推理流水线。基于UAV-NIDD数据集的微批次流式实验结果表明，在严格单核CPU约束下，DSF-IDS的平衡准确率达0.9895，宏平均F1分数达0.9829，经INT8动态量化与JIT编译优化后每包均摊时延仅为0.0598 ms。消融实验进一步验证，该解耦架构在低精度部署场景下表现出较强鲁棒性，在x86单核模拟条件下展现出显著的低延迟优势，为资源受限的空域信息物理系统提供了边缘部署的相对效率参考。 |
| 关键词: 入侵检测 双流融合 梯度提升树 边缘计算 |
| DOI： |
| 投稿时间：2026-05-07修订日期：2026-07-08 |
| 基金项目: |
|
| A Decoupled Dual-Stream Intrusion Detection System for UAV Networks |
|
baimeng1, LI Weihao1, DENG Wanjin1, WANG Siyao2
|
| (1.North China Computer System Engineering Research Institute;2.China Information Security Research Institute Co., Ltd.) |
| Abstract: |
| UAV network traffic is inherently tabular data, with no fixed spatial or temporal dependencies among its feature fields. Although existing Transformer-based deep models can effectively capture global interactions across fields, multi-layer feature aggregation tends to cause over-smoothing, which progressively blurs the precise boundary information—such as port numbers and packet lengths that are critical for attack identification—in deep representations. Meanwhile, UAV onboard computing platforms possess limited computational resources and impose strict real-time requirements; the heavy classification head in end-to-end deep learning architectures suffers from significant memory-access bottlenecks on a single-core CPU, making it difficult to meet deployment demands. To address the dual contradictions of repre-sentation smoothing and inference latency, this paper proposes a decoupled dual-stream intrusion detection system for UAV networks, termed Dual-Stream Fusion Intrusion Detection System (DSF-IDS). At the feature representation level, the system introduces a global residual direct-connection pathway, concatenating the high-order global cross-semantics extracted by the FT-Transformer with high-fidelity original features directly in the latent space, thereby effectively alleviating the over-smoothing problem and preserving the precise classification boundaries of discrete features. At the classification decision level, a lightweight gradient boosting machine (LightGBM) replaces the heavy neural network classification head, achieving decoupling of feature extraction and decision making; fur-thermore, through model quantization and computation graph compilation optimization, the heterogeneous compo-nents are unified into an efficient end-to-end inference pipeline. Micro-batch streaming experimental results on the UAV-NIDD dataset demonstrate that, under a strict single-core CPU constraint, DSF-IDS achieves a balanced ac-curacy of 0.9895 and a macro-averaged F1 score of 0.9829, with the per-packet amortized latency reduced to only 0.0598 ms after INT8 dynamic quantization and JIT compilation optimization. Ablation studies further verify that the proposed decoupled architecture exhibits strong robustness in low-precision deployment scenarios and shows a sig-nificant low-latency advantage under x86 single-core simulation conditions, providing a relative efficiency reference for edge deployment in resource-constrained aerial cyber-physical systems. |
| Key words: intrusion detection dual-stream fusion gradient boosting edge computing |
