Detection and Classification on Amateur Drones Based on Cepstrum of Radio Frequency Signal

，，

1.Key Laboratory of General Aviation Operation，Civil Aviation Management Institute of China，Beijing 100102，P.R.China；

2.Zhejiang Key Laboratory of General Aviation Operation Technology，General Aviation Institute of Zhejiang Jiande，Jiande 311612，P.R.China；

3.Innovation Institute（Chengdu），Beihang University，Chengdu 611930，P.R.China；

4.School of Electronic and Information Engineering，Beihang University，Beijing 100191，P.R.China

Abstract:As a prospective component of the future air transportation system，unmanned aerial vehicles（UAVs）have attracted enormous interest in both academia and industry.However，small UAVs are barely supervised in the current situation.Crash accidents or illegal airspace invading caused by these small drones affect public security negatively.To solve this security problem，we use the back-propagation neural network（BPNN），the support-vector machine（SVM），and the k-nearest neighbors（KNN）method to detect and classify the non-cooperative drones at the edge of the flight restriction zone based on the cepstrum of the radio frequency（RF）signal of the drone’s downlink.The signal from five various amateur drones and ambient wireless devices are sampled in an electromagnetic clean environment.The detection and classification algorithm based on the cepstrum properties is conducted.Results of the outdoor experiments suggest the proposed workflow and methods are sufficient to detect non-cooperative drones with an average accuracy of around 90%.The mainstream downlink protocols of amateur drones can be classified effectively as well.

Key words：drone detection；radio frequency signal；cepstrum；machine learning

0 Introduction

Nowadays，civil unmanned aerial vehicles（UAVs）have played important roles in a wide range of fields thanks to their remarkable operation abilities under different working conditions and the booming of the UAVs industry［1］.However，the unregulated small UAVs operations also cause more problems especially in air traffic management（ATM）due to the lack of standards and regulations in the industry.The easy assembling processes of consumer drones made of open-source components worsen the situation.Meanwhile，very few users are well-trained before their first flight.To address those issues，the UAV traffic management（UTM）system developed by FAA and NASA established the framework aiming for amateur and industrial drones to achieve flight management functions［2］.Europe is also working on the drone management in the U-space Project［3］and researching the regulatory framework for drone operations［4］.However，it remains a challenge to implement effective detection，classification，tracking，and countermeasures on the unauthorized drones.The detection and classification techniques for those drones are required urgently，especially at the edge of the restricted areas such as airports，military bases，and sensitive facilities［5］.

Several methods have been proposed for drone detection summarized as the visual recognition，the acoustic sensor，the active radar，and the RF signal sniffing［6］.The computer-vision-based method mainly uses optical sensors，such as cameras and infrared sensors，to capture the image of drones.This method is implanted by lots of drone defense companies into their products［7］.However，the visual recognition highly relies on the visibility thus is only suitable for the line of sight（LOS）scenarios.The idea of the acoustic-based method is to establish a database of the acoustic characteristics of various drones and adopt machine learning algorithms for pattern match［8］.However，the acoustic method can be interfered by the environmental noise and can be hardly applied in noisy urban environment.Unlike the visual recognition，the active radar method relies on the radar cross-section（RCS）to detect drones［9］.The radar-based method is unstable due to the small RCS of most drones.The RF signal sniffing using low-cost RF sensors is applicable in the LOS environment［10］.Considering most drones transmit their data through the downlink，the RF-based method is a promising method for detecting and classifying unauthorized drones at the edge of the flight restriction areas in complex environments.

This paper focuses on the detection and classification of drones based on the RF signal using machine learning methods.Unlike existing research，this work concentrates on the properties of the downlink signal from drones.The detection and classification experiments are conducted by using the software-defined radio（SDR）based equipment to collect real-time drone signals.Then the cepstrum feature engineering of the signal combined with machine learning algorithms is conducted.The signal from five drones under various signal-to-noiseratio（SNR）is used for detection and classification.The environmental electromagnetic noise is specified as a WiFi signal collected from wireless devices.Results in this test can hopefully provide insights into a more comprehensive UTM system.

This paper is organized as follows.The typical study configuration and the signal model of the drone downlink are introduced in the first part of Section 1.Its second part explains the cepstrum and statistical features analysis on both the downlink signal of drones and environmental WiFi signals.In Section 2，the experiments using collected outdoor RF signals to validate the proposed method for drone detection and classification are presented.At last，in Section 3，concluding remarks and potential future work are given.

1 Methods

1.1 Typical study configur ations and signal model

To detect and classify non-cooperative drones based on the RF signal，their downlink signal needs to be analyzed.Therefore，this section introduces the communication system of drones，the typical study configurations and further explains the model of the downlink signal.The study configuration in this paper focuses on passive detection，as shown in Fig.1.The SDR-based equipment deployed at the edge of an airport is a broadband receiver for monitoring the 2.4/5.8 GHz ISM frequency band.If a drone is approaching the flight restricted area，the broadcasting downlink signal would be captured by this receiver.Afterward，the signal is processed and analyzed to determine whether the drone is cooperative or not.Once the signal of non-cooperative drones is identified，the defense part of the UTM system would issue an alert immediately.Further，the classification of drone signals is conducted to identify the downlink protocol of drones.

Fig.1 Typical study configuration

At present，there are two types of downlink protocol for drones.Part of drones build downlinkcommunication through a wireless local area network（WLAN）directly using IEEE 802.11 protocol.In other words，drones with WLAN served as an access point（AP）to connect the mobile station and remote controller through WiFi.The other part of the downlink protocols of drones are self-developed encrypted transmission protocol represented by the DJI Lightbridge series and the DJI OcuSync series.The main difference between these two downlink protocols is that the WLAN-based downlink uses the 802.11 protocol，which is a TCP connection process with a three-way handshake［11］.For airborne drones，the instability of communication links is undesirable.If the connection is lost，the reconnection through another three-way handshake may take about 5—10 s.During the reconnection both the ground station and the remote controller lose the status information of drones，which can lead to accidents.As comparison，drones using the DJI Lightbridge or the OcuSync protocols can be treated as APs with the UDP-like broadcasting connection.To support real-time video streaming，this downlink signal commonly chooses orthogonal frequency division multiplexing（OFDM）modulation to achieve a high-speed transmission in a 2.4/5.8 GHz frequency band［12］.Considering the sampling rate of the receiver isFs，downlink signals（t）of drones can be regarded as the sum ofNpoints within theFs/2 band and expressed as

wheref0，Δf，TsandA nare the starting frequency，the frequency interval，the sampling period，and the signal amplitude at the corresponding frequency，respectively.The time of one signal collection by the receiverlkcan be computed bylk=kTs，wherekis the number of the sampling periods.The downlink signal of the drones uses the OFDM modulation and the received signal in one symbol period can be expressed as

whereD nis the data carried by the sub-carrier，and rect（t）the rectangular window function with length equal to symbol period timeTsig.

The initial time of symbol and data corresponding to the sub-carrier aret0andDn，respectively.To minimize the effect of the inter-symbol interference（ISI）caused by channel delay，the guard interval（GI）is plugged in between every two neighboring symbols in the OFDM signal［13］.If the length of GI is greater than the maximum delay in the communication channel，the ISI issue would not appear.Normally，GI is formed using the cyclic prefix（CP）by copying the lastLedata points to the front of the data block with the length ofL.Here，Lerefers to the lenght of the end data.The downlink signal of drones with CP during one symbol can be obtained as

where｛x p，x p-1，… ，xp-L+1｝is the original data of one symbol，｛d p，d p-1，… ，d p-L+1｝the output data，｛h0，h1，…，h Le｝the channel impulse，and｛np，np-1，…，np-L+1｝the noise.

The downlink signal of drones adopting CP shows strong periodic characteristics.The total duration of a complete symbol is noted byTsig.The total symbol duration noted byTuis the sum of the useful data duration，and the CP length isTcp.In the spectrum phase，the downlink signal of drones has multiple orthogonal sub-carriers since the OFDM is a multi-carrier modulation.The channel of each subcarrier can be approximated as a flat fading channel.Hence，the signal indicates strong flatness property in the spectrum domain to resist the multipath fading.Based on the analysis of the downlink signal，the characteristics of the signal structure can be extracted for detecting and classifying amateur drones.

1.2 Cepstrum and statistical featur e analysis

In this work，the chosen drones for downlink signal collecting are the DJI Phantom3，the Mavic Pro，the Mavic2 Pro，the Phantom4 Pro，and the Mavic Air.The WiFi signal collected from wireless devices is regarded as environmental noise.Table 1 shows all the corresponding downlink protocols.The signal types used in this study are given in Fig.2.Feature engineering based on the above-collected signal is conducted in this section.

Table 1 Protocol of signal

Fig.2 Signal of drones and environmental WiFi

1.2.1 Cepstrum analysis

According to Eq.（2），we can assume that the received signal in the SDR-based equipment under a typical scenario can be estimated using

wheren（t），tdandfdare the Gaussian white noise，the clock deviation，and the frequency deviation，respectively.

The data blockD nin thekth modulated symbol at thenth sub-carrier can be obtained from the sum of the datad n.kin thekth modulated symbol at thenth sub-carrier，noted asD n=∑k d n.k.We can supposeD nis independent and identically distributed with zero mean value andσc2variance.It is suggested the received multi-carrier modulated drone signal with noise can approximately conform to the complex Gaussian distribution which isr（n）～N c（0，σs2+）.The Gaussian feature is strongly correlated to the periodicity of the signal.Thus，the cepstrum is defined as the inverse Fourier transform of the logarithmic signal spectrum and can be expressed as

whereMis the length of the sampled signal by the data points，R(k)the discrete signal spectrum，andr（n）the signal spectrum［14］.

According to the central limit theorem［15］，the distribution ofc（n）converges to the Gaussian distribution if the length of the Fourier transform is longenough.Consequently，the mean and the variance of the cepstrum are the main concern in this analysis.Cepstrum is a sequence of complex numbers.For effective analysis，the real part of the cepstrum denoted by Real｛c（n）｝is used in the subsequent experiments.Here the correlation coefficient of the received signal is defined as

whereNuandNsigare the data points of the useful symbol and the total symbol.The mean function of the real part of the cepstrum can be derived in the view of Appendix A.1 and A.2 of Ref.［14］，shown as

whereSyis the number of symbols within the single signal frame，andγthe Euler constant.The experimental results show that，as the subscript of the cepstrum data sequence increases，the peak value decreases gradually and cannot be searched effectively.Thus，the theoretical value of real cepstrum is processed as approximately zero whennis a larger integer multiple of the useful symbol data points.Based on Eq（.7），the mean function of the real part of the cepstrum only peaks at the origin when the signal is Gaussian noise.Once the collected signals contain the downlink signal from drones，the mean function of real cepstrum is supposed to be discrete peaks at multiples ofNuafter the maximum peak at starting index.Fig.3 demonstrates the cepstrum and spectrum details of the framed signal from the Mavic Pro.It is found in Fig.3（a）that the real cepstrum peaks at 0 and around 67 of the time index.Then，we can simply estimate the useful data length of the Mavic Pro is 67μs.Discrete peaks after the straining index are correlated to the periodic structure of the drone signal which is shown in Fig.3（b）.Details of the Mavic Pro in the frequency domain demonstrate a strong periodicity.

Fig.3 Cepstrum and spectrum details of drone signal

1.2.2 Statistical feature analysis

The previous description indicates that the downlink signal of drones contains multiple sub-carriers presenting orthogonality with each other.Therefore，each sub-carrier can be treated as a random process with independent and equal distribution from the perspective of random variables，which follows Gaussian distribution in the time domain.Since the value of the high-order cumulant extracted from the signal is supposed to be near to zero，the more sub-carriers be contained，the stronger flatness characteristic appearing within the spectrum band and the smaller high-order cumulant should be.The fourth order cumulant is studied in this paper.

Assume that｛x1，…，xk｝is a random sequence consisting ofkcontinuous variables and its joint probability density function is denoted byf（x1，… ，xk）.The first joint characteristic function can be ex-pressed as

Thesth-order moment can be obtained based on the characteristic function，shown as

Thesth-order cumulant of the random sequence is given as

Accordingly，the（p+q）th-order moment and the cumulant are obtained by extending Eqs.（9，10）to generalize zero-mean stationary random signal｛x｝t.The moment and the cumulant can be computed using

The fourth order cumulant of signalX（t）=｛x｝tcan be computed by using

whereτrefers to the delay of the signal［16］.In the frequency domain，the statistical features property is also investigated.The power spectrum is estimated by the periodogram expressed as

wherex（k）is thekth data points of the framed signal，andthe estimated power spectrum.By using the bandwidth estimation，the bandwidthBcan be obtained byB=fH-fL，where［fL，fH］is the effective frequency band.Then the normalization is conducted using

Based on Eq（.15），the Kurtosis coefficient representing the flatness within the band can be expressed as

whereσnormis the variance of the spectrum within the band［17］.

According to the properties mentioned above，the collected signal of drones and the WiFi signal is split into a single frame to form the corresponding characteristic vector（CV），shown as

whereT uis the total symbol duration，Δfthe frequency interval，Bthe bandwidth，andKuthe Kurtosis coefficient.

With statistical features analysis mentioned above，the collected signal of drones and WiFi signal are split into single frame to form the corresponding characteristic vector.Afterwards，the training and test are conducted using different machine learning algorithms for drone detection and classification.

2 Experiment and Result

To validate the proposed method，the detection and classification experiment on identifying five different drones from ambient WiFi signals is conducted.The goal of the detection experiment is to determine whether an unknown drone exists in the current environment and whether the non-cooperative drone is trying to approach the flight restriction zone.At the experiment site，a passive receiver with monitor bandwidth of 2.4/5.8 GHz frequency is placed at the edge of the restriction area.The overall workflow in this study is shown in Fig.4.The signal samples for training are collected in an ISM-free environment.The signal samples for the detection and classification experiment are captured in the outdoor environment which is demonstrated in Fig.5.For each type of drones，we have collected about 500 GB of data for training.Depending on the length of the signal frame，the number of single frame signal varies from 60 000 to 110 000.The total amount of WiFi signals is around 10 000.Thennoise under various SNR is added into the received signal samples to generate the test vectors.With the well-trained discriminant model，drone signals are detected to issue an alert of the non-cooperative drone invading.Then the classification for drones is done by identifying the downlink protocols.

Fig.4 Workflow of detection and classification on drones

Fig.5 Outdoor experiment

We use three machine learning methods for the drone classification.The configurations of each method are as follows.The back-propagation neural network（BPNN）has four layers：One input layer，two hidden layers and one output layer.The number of the neural unit of hidden layer is three.We select the ReLu function as the activation function and the softmax function to process the output.For the support-vector machine（SVM）method，the penalty termCis 10，the radial basis function（RBF）is selected as the kernel function，and the weight factor is set to be balanced.The setting of the SVM method can be summarized as SVM（C=10，RBF，balanced）.As for thek-nearest neighbors（KNN）method，the number of nearest neighborskis 5，the Minkowski distance factor is 2，and the weight factor equals to the reciprocal distance.The selected parameters can be summarized as KNN（k=5，Minkowskip=2，σ/Dist）.

2.1 Drone detection experiment

Suppose thatSt=［Nt，Dt］represents testing sets whereNtare the labels for noise andDtthe signal of drones，respectively.Fig.6 manifests the detection results based on the captured signal samples in the outdoor environment with SNR from-5 d B to 5 d B.The accuracy of each machine learning method is defined as the percentage of the signal of drones being correctly classified and can be expressed as Accuracy=Num（Dr）/Num（Dt） ，where Num（·）is the number of the label for the property vectors andDrthe signal of all drones determined by the discriminant model.

Fig.6 Detection results of three models

Results show that the proposed scheme can ef-fectively identify the five types of signals of drones out of the environmental WiFi signals.Especially for the Phantom3 drone which uses WLAN as the downlink transmission protocol，the average detection accuracy rate is around 90%.Since the Mavic Air with enhanced WLAN uses a signal-relay device in the remote controller that converts the WLAN signal to DJI’s self-developed protocol，its signal can be identified efficiently too.Among all the algorithms，the BPNN performs better than others.This is due to the lazy learning strategy that both the KNN and the SVM are adopted.The SVM has a better accuracy than the KNN method，because the KNN makes decisions based on global samples.However，the number of samples of different drone signals is unbalanced in this paper，which means that the accuracy of the SVM is supposed to be higher than that of the KNN.

2.2 Drone classification experiment

The classification phase aims to recognize the type of drones by identifying downlink protocol after detecting noncooperative drones.As mentioned above，DtandDrare the sampled and the recognized labels of the drone signals.We can assume that vectorDconsists of all the five types of label vector of drone signals and is expressed asD=［dph3，dp4p，dmp，dm2p，dmair］.The classification rate is defined as

wheredt_dronerepresents the true type of label vector of drones，anddr_dronethe recognized type of label vector of drones.

The classification results are demonstrated in Figs.7—9.Results show that the drones can be identified from each other in most cases.The only exception is to distinguish between the Mavic2 Pro and the Mavic Pro.The reason is that different OcuSync protocol versions only have minor changes from structure to modulation of the downlink signal.The classification accuracy of the BPNN is supposed to be the best since it is a more advanced learning method.

Fig.7 Classification results of KNN

Fig.8 Classification results of SVM

Fig.9 Classification results of BPNN

3 Conclusions

This paper presents a method of detection and classification of amateur drones based on their cepstrum and features properties of the downlink signal.Outdoor experiments are conducted to validate the effectiveness of the proposed method.Analysis of the experimental results suggests that the test of detection and classification using the BPNN outperforms the KNN and the SVM.All the three machine learning algorithms achieve overall average detection accuracy about 90%and work well in theclassification phase.For future work，analysis on the comprehensive modeling of the noise signal is necessary.

AcknowledgementsThis study was co-supported by the National Natural Science Foundation of China（Nos.U 1933130，71731001，1433203，U1533119），and the Research Project of Chinese Academy of Sciences（No.ZDRW-KT-2020-21-2）.

AuthorsDr.GUAN Xiangmin received the Ph.D.degree from Beihang University,China,in 2014.He is an associate professor at Civil Aviation Management Institute of China.His research interests include air traffic management,general aviation and UAV operation technology.

Author contributionsDr.GUAN Xiangmin designed the study，complied the models and wrote the manuscript.Mr.MA Jianxiang contributed to data analysis， result interpretation and manuscript revision. Mr. ZHANG Weidong contributed to the design and discussion of the study.All authors commented on the manuscript draft and approved the submission.

Competing interestsThe authors declare no competing interests.