Deep learning-based method for detecting anomalies in electromagnetic environment situation

Wei-lin Hu,Lun-wen Wang,Chuang Peng,Ran-gang Zhu,Meng-bo Zhang

College of Electronic Engineering,National University of Defense Technology,Hefei,230001,China

Keywords:Electromagnetic environment situation(EMES)Anomaly detection (AD)Regional features integration LSTM CNN

ABSTRACT The anomaly detection of electromagnetic environment situation (EMES) has essential reference value for electromagnetic equipment behavior cognition and battlefield threat assessment.In this paper,we proposed a deep learning-based method for detecting anomalies in EMES to address the problem of relatively low efficiency of electromagnetic environment situation anomaly detection(EMES-AD).Firstly,the convolutional kernel extracts the static features of different regions of the EMES.Secondly,the dynamic features of the region are obtained by using a recurrent neural network (LSTM).Thirdly,the Spatio-temporal features of the region are recovered by using a de-convolutional network and then fused to predict the EMES.The structural similarity algorithm (SSIM) is used to determine whether it is anomalous.We developed the detection framework,de-signed the network parameters,simulated the data sets containing different anomalous types of EMES,and carried out the detection experiments.The experimental results show that the proposed method is effective.

1.Introduction

With the progress of science and technology,radio communication equipment is increasingly widely used,making the electromagnetic environment more and more complex.The electromagnetic environment is a manifestation of the physical space composed of various electric fields,magnetic fields,and electromagnetic waves and is the sum of all electromagnetic phenomena existing in the electromagnetic space.The electromagnetic environment situation(EMES)is the current state and situation and development trend of the electromagnetic environment in a specific area,a specific period,and a specific frequency band [1].Electromagnetic environment situation anomaly detection(EMESAD) refers to the detection of problems in electromagnetic environment data that do not conform to the expected behavior pattern[2,3].Suppose there is a significant change in electromagnetic activity in a specific area,period,or frequency band,and the magnitude of the change exceeds a given threshold.In that case,the electromagnetic environment situation can be considered abnormal,which can also be interpreted as the occurrence of unknown radiation source behavior in the normal situation,including radiation source movement,switching,power adjustment,etc.For example,during the Iraq war,the U.S.military the attacked on the eve of the Iraq war,the implementation of large-scale electromagnetic interference,there is a dense interference signal,and the state and trend of the electromagnetic environment have changed significantly,resulting in the Iraqi communications equipment cannot work correctly,when the electromagnetic environment situation has anomalies.The battlefield electromagnetic environment situation,to a certain extent,reflects the situation of the military struggle,and the ability to detect abnormal electromagnetic environment situation can provide assistance and reference for it and provide a basis for threat estimation.Therefore,the study of anomalous electromagnetic environment situation and their detection method has important theoretical significance and practical military value.

Regarding literature search,the current research on electromagnetic environment complexity is more,and the research on electromagnetic environment situation is on the low side.The existing related studies focus on electromagnetic environment situation generation [4-6],while there are only a few studies on electromagnetic environment situation anomaly detection.The literature [7]implemented anomaly detection of electromagnetic environment situation based on fuzzy neural networks,but the ANFIS algorithm relies on rules and has insufficient self-learning capability.The literature [8]studied electromagnetic situation analysis and judgment based on deep learning and simulated redblue confrontation.However,the article mainly used reinforcement learning methods for electromagnetic situation data processing,extracted fewer features,and did not have enough depth for mining the electromagnetic environment,and the algorithm was not efficient.In recent years,deep learning technology has achieved more significant development,and certain research has been conducted on anomaly detection technology.

Anomaly detection techniques based on deep learning can be broadly divided into coding reconstruction and prediction classes.The former mainly extracts deep features of data and achieves anomaly detection by reconstruction without temporal characteristics.The latter extracts primarily temporal data features and performs anomaly detection by prediction,and can be applied to multidimensional data and images.In practical studies,the literature [9,10]used coded reconstruction to reconstruct spectrum maps using adversarial self-encoder (AEE) and generative adversarial network (GAN),respectively and achieved anomalous behavior detection in the electromagnetic spectrum using reconstruction errors.The literature [11,12]used prediction,the former applied RNN to anomaly detection of dam cracks,and the latter used LSTM to predict meteorological data and indoor temperature changes and achieve better prediction and anomaly detection results.

For Electromagnetic environment situation anomaly detection,if it is for static situation anomaly detection,most of the coded reconstruction networks such as CNN and GAN are used to extract the data features of standard samples and then determine the anomaly.If the focus is on dynamic anomalies,networks combining CNN and LSTM can meet the requirements of Electromagnetic environment situation feature extraction [13].This class of algorithms exploits the ability of CNN to extract deep-level features on each frame of an Electromagnetic environment situation [14,15]and also takes into account the ability of LSTM to extract temporal features of an electromagnetic environment situation [16].In a similar application,the literature [17]is a better example,which uses a bidirectional LSTM as a feature extraction module for the generator and discriminator and introduces an attention mechanism to improve the anomaly detection accuracy of industrial multidimensional time-series data.

In recent years,deep learning techniques have made great developments and have been studied to some extent in anomaly detection techniques.Under this framework,many variants of ConvLSTM [18],and CNN replacement by GAN [19,20]schemes have been derived.

In spectrum anomaly detection,the literature [21]combined CNN and LSTM based frameworks to detect spectrum usage anomalies,flexibly used LSTM and DAE networks and used migration learning to minimize the time and data training amount for unsupervised anomaly detection through data-driven,demonstrating the feasibility of the technique on the spectrum domain.However,LSTM is more suitable for anomaly detection of sequence data,and the complexity is usually too high when applied to image anomaly detection.The literature [22]detects anomalies in temporal images of medical systems and uses ConvLSTM as the base network to jointly learn 3D context temporal dynamics.It extended ConvLSTM to the Spatio-temporal domain(ST-ConvLSTM)based on the overall image and integrates an end-to-end training deep learning framework,but the network cannot avoid the problem of blurred predicted images due to the loss function,which is a safety concern in medical applications that require high accuracy.The literature [19]improved the basic framework of CNN-LSTM by replacing CNNs with GANs and LSTMs with bi-directional LSTM,while introducing attention mechanisms to improve accuracy and overcome the drawbacks of weak LSTM modeling and long dependency times.H However,in the electromagnetic environment situation,the evolution of the electromagnetic environment has unidirectional nature,and despite the improvement of bidirectional LSTM in terms of Seq2Seq,it does not conform to the physical laws of the electromagnetic environment situation.It is essential to consider the physical meaning of the electromagnetic environment situation itself,and it is crucial to extract interpretable physical features and build an interpretable network model.References [23,24]applied a similar approach;literature [23]used multi-task learning to extract spatial features and motion features of temporal images and implemented prediction functions by feature fusion strategy.Although the algorithm gave specific tasks to the network module,it did not reflect the inherent physical meaning of the images.Literature[24]modeled time,and the paper analyzed the taxi resources in time and space.The paper analyzes the physical characteristics of cab resources in time and space,fuses cab demand,weather data,and regional functions,and distinguishes three temporal attributes,thus assisting cab resource preallocation and achieving better results.However,the algorithm can deeply consider the functional links between different regions to achieve cab deployment nearby and thus reduce cost loss.

Synthesizing the limitations of the above literature and the complexity of the current electromagnetic environment,we recognize that purely extracted physical indicators can no longer fully express the electromagnetic environment situation,much less achieve the anomaly detection of the situation in the complex electromagnetic environment.Therefore,we take advantage of the excellent performance of deep learning technology in big data processing and apply deep learning technology to the anomaly detection of electromagnetic environment situation for the first time.Considering the rapid changes in the electromagnetic environment,we adopt the most basic CNN-LSTM framework to ensure its real-time performance and achieve both spatial and temporal feature extraction.We mainly address the problem of anomaly detection in EMES and verify the feasibility of currently popular deep learning methods in situation anomaly detection,for which our main contributions are threefold.

Firstly,according to the physical characteristics of the electromagnetic environment situation,we propose a mathematical model for the EMES-AD method,building the situation prediction and anomaly detection modules' physical framework.

Secondly,simulating the emission law and movement law of natural radiation sources,under the consideration of terrain conditions,various software is used to generate an EMES dataset based on the electromagnetic spectrum map.The data set distinguishes two types of anomalies,point anomalies and context anomalies,covering various of abnormal behaviors,such as radio station movement,power adjustment,and noise interference,in line with the electromagnetic environment situation change law.

Thirdly,we propose a deep learning-based EMES-AD method,which uses different combinations of the field of view domains to achieve the extraction and fusion of different local area features.The effectiveness of this network in EMES-AD is verified through comparison experiments with other deep learning algorithms.

A detailed discussion of our work is presented in the subsequent sections.Section 2 analyses the mathematical model for EMES-AD,gives the algorithmic framework,and designs the network parameters;Section 3 simulates the EMES dataset;Section 4 carries out the experimental validation.We conclude with an experimental summary and an analysis of the topics that need urgent research in EMES-AD.

2.Anomaly detection model for electromagnetic environment situation

The anomaly detection model for the EMES consists of two main components: a situation prediction module and an anomaly detection module.The prediction module predicts future data by creating a sample space of normal situation and combining it with data from past moments.The anomaly detection module compares the real data with the predicted data to achieve the purpose of anomaly detection.

2.1.Prediction module

Define XMis the electromagnetic spectrum map temporal source data for a given period,i.e.,the EMES,whereXiis the electromagnetic spectrum map at momentiin that period,Xi∈XM,i＝1,2,…,m.Also assume that the normal EMES sample data is XNand its sample space isp(XN).Suppose the sampleXiin the EMES data originates from the sample spacep(XN),it is determined thatXiis a normal EMES under the current conditions.IfXidoes not belong to the sample spacep(XN),it is determined thatXiis an abnormal EMES that does not meet the current conditions.This paper aims to extract the potential data distribution or feature parameters of normal EMES in the normal training dataset XNby deep learning algorithm,and detect the abnormal EMES in XMby anomaly detection mechanism.

Assume thatMis a deep learning-based electromagnetic environment situation prediction model,andsis the prediction step,i.e.,the electromagnetic spectrum map of the next moment is predicted from the data ofspast moments.The normal EMES data XNis divided into the past moment data set Xformand the predicted moment data set Xpred,andMis trained by all data sets,where the target data and training data of thekgroup areXpred＝Xk+sand Xform,k＝｛Xk,Xk+1,…,Xk+s-2,Xk+s-1},respectively.The training process follows the objective function as in Eq.(1).

whereXp,kis the predicted data obtained after thekth set of training data passes throughM.The completed training modelMconforms top(XN).Then the electromagnetic spectrum map data generated afterMprediction can be expressed as

Under the above framework,we design a prediction model of EMES fusing multi-region spatio-temporal features.First,we purposefully select spatial local regions of EMES according to the field of view and extract initial features,then extract spatial deep features of different regions,and then extract corresponding spatiotemporal features by combining time series relationship,then recover the situation of specified local regions by using spatiotemporal features,and finally fuse the situation of all local regions to predict and generate accurate electromagnetic environment situation.

Therefore,we assume that the spatial feature extraction module isMF,the temporal feature extraction module isMT,the input EMES data is Xform＝[t,c,w,h],t is the temporal vector,t ＝[1,2,…,S]T,c,w,h denote the number of channels,width,and height of all electromagnetic spectrum maps in the EMES,respectively.We purposely select spatial local regions by setting different convolution kernels and convolution methods.Suppose we define the convolution kernel of theqth local region asKq,then the initial features of theqth region can be expressed as Eq.(3).

whereFin Eq.(9) denotes the length of a single feature vector.According to the extraction of spatio-temporal features,we perform the overall spatio-temporal extraction of Xfeat,qin the temporal feature moduleMTto obtain the prediction feature Xpred,fqunder this temporal feature law,as shown in Eq.(6).

So far,we have obtained the spatio-temporal feature vector of EMES at the predicted moment in the specified region.In order to achieve the purpose of overall judgment,identification and cognition of electromagnetic environment situation anomaly,we also need to recover the electromagnetic spectrum map of the specified region according to the predicted spatio-temporal features,fully fuse them and generate an accurate and spatiotemporally regular electromagnetic spectrum map.To this end,we define the feature recovery module asMRand the regional feature fusion module asMmixto recover the spatio-temporal features of each region into an electromagnetic spectrum map of sizew×h,as shown in Eq.(7).

Finally,the electromagnetic spectrum map is generated by fusing the prediction results of all regions according to Eq.(8).

2.2.Anomaly detection module

We next establish a mathematical model for anomaly detection.The main means to achieve anomaly detection is to determine whether the data at the future moment conforms to the data distribution of a normal sample,i.e.,to determineXfur～p(XN).Considering the strong temporal and spatial correlation of EMES,the traditional quality assessment methods based on error sensitivity belong to the comparison between individual pixel points and lack spatial structural measures such as mean square error(MSE) and peak signal-to-noise ratio (PSNR).Considering the deficiencies of the above commonly used algorithms and the strong spatial correlation of the EMES,we use the structural similarity algorithm (SSIM) to compare the predicted and collected data in the EMES-AD to determine whether the EMES is anomalous at the next moment [25].

SSIM measures the similarity of the two images data from the three modules of luminance,contrast and structure.The similarity between the predicted dataXp,kand the target dataXk+sofMat thekth time is measured by the SSIM calculation method.The luminance comparison,contrast comparison and structure comparison are shown in Eq.(9)-Eq.(11),respectively.

where μx+sand μp,krepresent the means ofXk+sandXp,k,respectively,σx+sand σp,krepresent the standard deviations ofXk+sandXp,k,respectively,and σ(x+s)(p,k)denotes the covariance ofXk+sandXp,k,whilec1,c2andc3are constants to avoid systematic errors when the denominator is zero.Knowing the expressions of the three modules,the similarity of the two images data can be expressed as

α,β and γ are set values,which are generally taken as 1.A larger SSIM indicates that the predicted and target data are more similar and the target data obeys the data distribution characteristics of normal samples more.Therefore,assuming that the threshold value of anomaly detection isth,the anomaly is judged as follows in Eq.(13).

2.3.Algorithm implementation

As few studies apply studies that apply deep learning to the field of EMES-AD,this paper refers to relevant literature and the definition of EMES to design an EMES-AD network under the framework of combined CNN and LSTM.The network uses the selectivity of the field of view of the convolutional kernel to extract the Spatiotemporal features of different regions of the EMES in a targeted manner,and through subsequent operations such as feature fusion,to predict the electromagnetic spectrum map at the next moment in order to determine the anomaly.

2.3.1.Model framework

We use the selectivity of the field of view of the convolutional kernel to design a convolutional kernel that perceives a specific region and extracts the spatial features of different regions of the electromagnetic environmental situation,respectively.Assume that the width and height of the electromagnetic spectrum map at timetin the electromagnetic environmental situation arelwandlh,respectively,and the convolution kernels of two different fields of view areKsandKa,lKa＜lw,lh.TheKsis tightly connected and fully spread over theXt,dividing theXtintokfixed regions,k＝1,2,…,lw·lh/lKs2,and theKacovers the junction of adjacentKs.

After extracting the initial features of the region onXtbyKsandKa,respectively,the network is then divided into 2 different feature extraction layers,which are processed separately to obtain the features of the electromagnetic environment situation.The network structure framework is shown in Fig.1.Taking one of the layers as an example,firstly,the initial features obtained by convolutional kernel selection are input,and after 4 convolutional layers,4 pooling layers and normalization,they are compressed into a feature sequence of lengthFthrough a fixed-length fullyconnected layer to obtain the spatial deep features of the region.Then the feature sequence of time lengthSis input into the temporal feature extraction module LSTM to obtain the predicted moment feature sequence that conforms to the spatio-temporal feature pattern.Finally,the predicted sequence is fed into the feature recovery module.After adjusting the sequence length by a fully connected layer,it is then passed through five deconvolutional layers and five convolutional layers to output the situation information under the specified region.The convolution layer acts in the latter layer of each deconvolution layer to mitigate the checkerboard artifacts caused by too many deconvolution layers [26].

Fig.1.Network framework.

And then the output information of the two area feature extraction networks ahead is fused by the area feature fusion module,and the two spatio-temporal characteristics are fully fused by 4 convolutional layers and 1×1 convolutional kernel is added to obtain the electromagnetic spectrum map at the prediction moment.Finally,the SSIM algorithm is applied to calculate the similarity between the EM spectrum map generated in normal sample space and the real EM spectrum map,and determine the anomaly according to the threshold value.

2.3.2.Network parameter setting

The electromagnetic environment situation anomaly detection network is mainly structured by CNN and LSTM,with an overall symmetric structure.This subsection briefly describes the network parameter settings of the spatial feature extraction mod-ule,feature recovery module,regional feature fusion module,and temporal feature ex-traction module according to the modules divided by the network,as shown in Table 1.

They drank their coffee and had a chat together, and then AnneLisbeth went away towards the little town where she was to meet thecarrier, who was to drive her back to her own home. But when shecame to him she found that he would not be ready to start till theevening of the next day. Then she began to think of the expense, andwhat the distance would be to walk. She remembered that the route by the sea-shore was two miles shorter than by the high road; and asthe weather was clear, and there would be moonlight, she determined to make her way on foot, and to start at once, that she might reachhome the next day.

Table 1Network parameters.

Table 2Train set 2.

Table 3Test set 4-6.

Table 4Test set 1.

Table 5Test set 3.

Our proposed network is to distinguish different feature extraction modules by different field of view domains to form a feature extraction layer with a specific physical significance.The electromagnetic spectrum map data in this paper has a channel number of 1 and a length and width of 80,which represents a battlefield area of 8× 8 km2,and each pixel length represents 100 m.In the test,we define the normal position fluctuation of the radiation source in one direction as 200 m,so the field of view domain is just enough to detect whether the position fluctuation of the radiation source is normal or not when a convolution kernel of size 5×5 is used.The electromagnetic spectrum map is also divided into 16×16 feature maps,and the size of the feature maps is chosen between 15 and 17 depending on the location of the actual field of view domain.And the number of channels is inferred from the optimal number of channels designed for the LSTM module.We verify the prediction efficiency problem when the hidden layers of LSTM are 32,64,128,and 256 in pre-experiments,and finally select the LSTM with 128 hidden layers as the temporal feature extraction module,and then refer to the traditional feature extraction framework of deep learning,and use the power of 2 as a step to infer the layers of the number of channels.To keep the overall harmony of the system,the feature extraction module and the feature recovery module are designed as symmetric structures.Finally,the recovered feature maps are fused using the feature fusion module with 1×1 convolution kernel as the main component,and the number of convolution channels is set to 16,32 and 1,respectively,to ensure the feature fusion without overcomplicating the whole model.Then a final layer of 1×1 convolution is added to adjusting the EM spectrum map output.

This section derives a mathematical model for EMES-AD,builds a deep learning network framework for the model,and gives detailed parameter descriptions.The subsequent sections will demonstrate the feasibility of the proposed algorithm for EMES-AD around data simulation and experimental validation.

3.Data emulation

Numerous researchers have used sensing nodes in the terrain to collect electromagnetic environment information and synthesize electromagnetic spectrum maps under time series by interpolation and other means,thus representing the EMES[27].The EMES data in this paper are synthesized based on electromagnetic spectrum maps,and the experimental data are generated through three software simulations,Wireless Insite,LocaSpace 4,and MATLAB 2018b.Firstly,we selected a local area of the Taklamakan Desert with longitude 87.7753298691E-87.8692208574E,latitude 40.2132687192 N-40.2849404708 N and an area 64 km in Loca-Space 4,and evenly extract 6400 geographic elevations at intervals of 100 m.The geographical data was introduced into Wireless Insite,with the constant dielectric set to 4,the conductivity set to 0.01,and no vegetation cover,while four communication radios with a transmitting power of 50dBW and a frequency of 15 MHz were set up.The electric field strength values for the area were calculated by the simulation to form a map of the electromagnetic spectrum at a single moment in time [27].

The experiments were set up with two datasets,consisting of 1 training set and 3 test sets for different application scenarios.We show some of the data from the training and test sets shown in Fig.2,and the datasets were constructed along the following lines as illustrated in Tables 2-6.

Fig.2.Partial data plots of the training set and test set:(a)Training Set 1,t ＝3;(b)Test Set 1,t ＝142;(c)Test Set 2,t ＝490;(d)Test Set 3,t ＝140;(e)Training Set 2,t ＝1190;(f)Test Set 4, t ＝280;(g) Test Set 5, t ＝500;(h) Test Set 6, t ＝220.

Dataset 1: The EMES dataset is generated according to the method of constructing electromagnetic spectrum map data for a single moment as described above.In practical application,due to the significant error in the method of constructing electromagnetic spectrum maps and the complexity of electromagnetic environment changes,we define that under the standard normal electromagnetic spectrum map,the electromagnetic spectrum map with the same number of radio radiation sources,the noise of-15dB or less,fluctuation of radiation source location within 200 m,and fluctuation of radio transmitting power within 10% are all normal EMES data.Based on this principle,we simulated and generated 3000 frames of normal electromagnetic spectrum maps as the sample data of normal EMES,named training set 1,to build a model to learn the potential data distribution and characteristic parameters of normal EMES.

Dataset 1 contains three test data,named test set 1,test set 2,and test set 3.All three test sets have 500 frames of electromagnetic spectrum maps,using the movement and disappearance of electromagnetic radiation sources and changes in emitted power to simulate the tactical behavior of electromagnetic radiation sources on the battlefield,such as position changes and power adjustments.Test set 1 focus on the movement and disappearance of a single source,with the ratio of normal to abnormal close to 3:2;test set 2 focuses on the movement and disappearance of multiple sources,with the ratio of normal to abnormal close to 3.5:1.5;test set 3 focuses on the variation of the emitted power and quantity of sources,with the ratio of normal to abnormal close to 3:2.The above three test sets identify anomalous data as being outside the range defined by the normal EMES.

Dataset 2: Unlike data set 1,this data is not a single determination of whether the electromagnetic spectrum map conforms to a fixed distribution but incorporates the temporal dimension into the data set,mainly used to identify contextual anomalies.The training data are spaced 1 min per frame of electromagnetic spectrum map data.The dataset has 2880 frames of electromagnetic spectrum map data,i.e.,the normal EMES of the region during 48 h,named training set 2.Training set 2 conceptualizes the fixed time switching on and off of radiation sources in the region,the regular adjustment of emission power,and the inclusion of traditional resting time into the design scope during 48 h.The data in Table 6 represent the percentage change in the emitted power of the radiating source.Therefore,in dataset 2,we define test samples that do not conform to their variation patterns as anomalous EMES.Based on this definition,we try to train models that conform to the objective life pattern and can determine the contextual anomalies.

Table 6Test set 3.

Dataset 2 includes three test sets: test set 4,test set 5,and test set 6.The anomaly of the test set 4 is based on the addition of total domain noise.Gaussian white noise with three grades of low,medium,and high interference intensity is added in three different periods to test the model's ability to judge the noise anomaly.Test set 5 simulates the regular energy adjustment of the fixed radiation source,and the radiation source location is kept unchanged;test set 6 simulates the regular disappearance of the fixed radiation source,and the radiation source location is kept unchanged.Test set 5 and 6 are used to test the model's ability to detect contextual anomalies.

4.Experiment

The experiments in this paper focus on setting up four comparison algorithms running in a hardware environment with processor AMD R7-4800H,2.90 GHz,RAM of 16 GB,GeForce RTX 2060,and in a Pycharm 2019.3.3 (Community Edition),torch1.6.0,cuda10.1 software environment.The experimental evaluation uses commonly used anomaly evaluation metrics to examine the detection effectiveness of the algorithms,compares the performance of various algorithms in different anomaly types,analyzes the possible reasons behind the differences in the algorithms,and finally also compares the complexity between the algorithms and gives the applicable algorithms under different conditions.

4.1.Contrast algorithm and hyperparameter settings

In order to compare the prediction effect and anomaly detection ability of the algorithms proposed in this paper,we have selected four additional algorithms as comparison algorithms,and the algorithms and reasons for their selection are as follows.The first is LSTM and its deformation algorithm GRU.LSTM is also the base module of the algorithm proposed in this paper.These two algorithms belong to the classical algorithms in time series prediction,which have temporal solid feature extraction and forecasting ability and are widely used in various disciplines.Therefore,we verified the efficiency of the LSTM network with the number of hidden layers of 1,2,3 and the number of hidden neurons of 32,64,128,and 256 for the problem described in this paper,and finally decided to use the LSTM and GRU algorithms with the number of network layers set to 1 and the number of hidden neurons set to 128 as the comparison algorithms,adding a fully connected layer before and after each of the two algorithms,thus converting the images into one-dimensional sequences to obtain the correct sequence length.The second is ConvLSTM.We con-sider that each electromagnetic spectrum map of the EMES has a strong spatial correlation.Moreover,LSTM and GRU,although they are classical algorithms in time series prediction,do not contain spatial information.Therefore,in this paper,ConvLSTM is used as one of the comparison algorithms.A total of three layers of networks are set up,with the size of the convolution kernel of each layer being 3×3,5 × 5,and 7 × 7,respectively.The third is an Encoder-LSTMDecoder network,which is similar to the structure of the algorithm proposed in this paper,is the current popular framework for temporal image prediction,and all the hidden layer parameters of this network are the same as the proposed network.The difference is that the comparison algorithm has only one layer of the network,which is the conventional feature extraction and recovery,unlike the way of fusing features from different regions through the field of view domain in this paper.This comparison network is set up to verify that fusing the spatial features of different regions has a facilitating effect on the prediction efficiency.

The training process of all five algorithms uses the Adam optimizer,the loss function uses the mean square error (MSE) loss function,the initial learning rate is 0.001,the prediction step size is set to 4,the batch size is set to 32,and the epoch is taken as 100.

4.2.Anomaly evaluation metrics and ROC curve performance

Traditional anomaly evaluation metrics include precision,recall,and accuracy rate.Precision rate is the ratio of the number of positive and predicted positive samples.Recall rate is the ratio of the number of positive and actual positive samples.The accuracy rate is the ratio of the number of samples with the same test result to the total number of samples [28].However,theoretically,the accuracy and recall will not improve simultaneously,and the accuracy is influenced by the distribution of the number of samples,so we introduce the F1 score to evaluate the detection effect.As described in the data simulation,dataset 1 represents the point anomaly type.We substitute the test set into the trained model for testing,and based on the analysis of the results of deep learning on the two datasets,the performance of individual models varies widely on the task of contextual anomaly detection,and it is not appropriate to analyze the accuracy of all models using a fixed threshold.Therefore,we use the anomaly evaluation metric only for dataset 1.Considering that test set 1 and test set 3 cover all types of anomalous behaviors,we present only the anomaly detection performance of test set 1 and test set 3 for the electromagnetic environment situation in the article.In fact,in practical applications,the threshold value of the anomaly assessment index needs to be determined by repeated debugging.However,to compare the performance of the algorithm in this paper under the same with,we take the threshold value of 0.8 on both test sets,assuming that more significant than 0.8 is average and less than 0.8 is abnormal,and carry out the calculation of their anomaly assessment indexes respectively,and the detailed results are shown in Table 7.

Table 7The anomaly evaluation metrics of different models in test set 1 and test set 3.

Table 7 shows the detection levels of the algorithms in this paper in the two test datasets.The precision rate is used to assess the ability to predict the normal electromagnetic environment situation correctly,the recall rate is used to test the accuracy of the prediction results,and the accuracy measures the overall prediction ability.In test set 1 and test set 3,when the judgment threshold is set to 0.8,this paper's algorithm's precision rate and accuracy are higher than other algorithms.The accuracy rate is at least 16.59% and 19.04% higher than different algorithms,respectively,proving that this paper's algorithm is more capable of predicting normal electromagnetic environment situation under the current threshold.The recall rate is slightly lower than other algorithms,mainly because of the high detection probability of the accuracy rate,which pulls down the recall rate.The two should be viewed together by F1 scores,and the F1 scores of the algorithm in this paper are at least 7.88% and 8.90% higher than the other algorithms on the two data sets,respectively,proving the strong ability of the model to predict the normal electromagnetic environment situation correctly.At the same time,the algorithm's accuracy is at least 37.41% and 14.98% higher than other algorithms,respectively,which also indicates that the algorithm in this paper also has a higher ability to predict the overall electromagnetic environment situation under this threshold.When we examined Test Set 2,we found that the F1 score and accuracy of the algorithm were at least 0.6% and 1.07% higher when the threshold value was equal to 0.75,indicating that a suitable threshold value has an important impact on anomaly detection.

Since the anomaly assessment metric cannot compare the results of models with significant differences in performance in a unified data set,resulting in our inability to compare the performance of models in data set 2 by it,we introduce the ROC curve and AUC area to judge the performance of each model comprehensively.ROC curve,i.e.,the receiver operating characteristic curve,is used to measure the dichotomous classification performance,with false alarm probability as the horizontal coordinate and recall rate as the vertical coordinate.And AUC area refers to the area under the ROC curve,which is a quantitative comparison of the ROC curve,and the point of both is that they do not need to be influenced by the threshold value.The anomaly detection capability based on the anomaly assessment index can analyze the capability of anomaly detection using multiple index data such as precision rate and recall rate,and the evaluation is more detailed.But it changes with the specified threshold value.The anomaly detection capability based on the ROC curve and AUC area does not change with the threshold value,and it mainly reflects the algorithm's overall performance but cannot analyze more detailed detection results such as precision rate and recall rate.When using ROC curve for evaluation,we continuously adjusted the SSIM threshold for anomaly determination to plot the ROC curve,and the larger the area under the curve,the better the network performance[29].In the selection of data sets,considering that test set 2 simulates the mobile behavior of multiple radiation sources and covers the anomalous behavior of test set 1 and test set 3;test set 4 simulates the battlefield electromagnetic environment with different degrees of interference,i.e.,the robustness of the side detection model.Therefore,to show the results of all test sets as much as possible in the paper,we present the similarity changes between the predicted and actual data in test set 2 and test set 4,shown in Fig.3.In addition,we also tested the performance of the network models in each of the six test datasets to examine the effectiveness of different models applied under other conditions,as shown in Fig.4.Also,we provide the AUC areas of each test set shown in Table 8 to compare each algorithm's performance jointly.The boldface in Table 8 represents the maximum AUC area achieved by the model in this dataset.

Table 8The AUC area of different models in test sets 1-6.

Fig.3.Results of some test set:(a)Similarity between the predicted data and the real data for each frame in test set 2;(b)Similarity between the predicted data and the real data for each frame in test set 4.

The(a)and (b)plots in Fig.3 show the comparative changes of similarity between predicted and real data for each frame in dataset 2 and dataset 4,respectively,representing the detection effects of various types of algorithms in point anomalies and contextual anomalies,and between the vertical blue are the time regions in the test set where the anomalous behavior of the electromagnetic devices is predetermined,and the legend of Fig.3(b) is consistent with that of Fig.3(a).As can be seen from the figure,the performance of our algorithms differs greatly in the two data sets.The left figure is for the detection of point anomalies of EMES,and it is found that the detection effect of each type of algorithm is better for point anomaly,the distinction between normal and abnormal data is obvious,and each algorithm can be adjusted to the appropriate threshold for anomaly detection.The right is for the detection of contextual anomalies.Compared with the left figure,the performance of the five algorithms is more variable,and the algorithm in this paper is more sensitive to anomalies and distinguishes between normal and abnormal data more clearly in this dataset.

In summary,we completed all models on all test sets using anomaly assessment metrics,ROC curves and AUC values.Firstly,we analyze the six sets of ROC curves.We compare the effectiveness of the algorithms under the two data sets.It can be demonstrated that the deep learning algorithms can be applied to the EMES-AD problem and can achieve good results.It can be visually seen on the ROC curves that the five algorithms participating in the comparison can detect the vast majority of the anomalies caused by behaviors such as movement of radiation sources,energy changes,and disappearing appearances.

Secondly,comparing a single dataset,the first row of images in Fig.4 indicates the performance of the three test sets in dataset 1.Except for ConvLSTM,the AUC area of the remaining four algorithms is higher and combined with the AUC area comparison calculated in Table 8.It shows that the point anomalies of EMES represented by dataset 1 can achieve practical results among numerous deep learning algorithms.In contrast,the performance of all algorithms in dataset 2 is significantly lower than that of the same model under dataset 1.The reason is that,compared to point anomaly detection,the regularity of contextual anomalies in the EMES is complex and requires the network to learn the changes in the situation,and the anomalies that appear also require the network to judge whether they conform to the laws of changes in the EMES,and the judgment effect is more related to whether the model learns the pattern of the sample or not.

Finally,a comparative analysis of the algorithms proposed in this paper is performed.In dataset 1,by and large,all algorithms have comparable performance,and the maximum difference in the AUC area is 0.33%,with no significant difference.The key lies in the detection effect of dataset 2,and it is obvious from the corresponding data of the ROC curve that the performance of this paper's algorithm is better than other comparative algorithms.The AUC of this paper's algorithm achieves the best results in test set 4 and test set 6,with a minimum improvement of 0.32% and a maximum improvement of 23% compared with other algorithms.In test set 5,the performance of this paper's algorithm differs from that of ConvLSTM by only 0.44%.In test set 6,all the algorithms except LSTM achieve a high level of detection results,and the algorithm and ConvLSTM even reach 1.0.The reason for this is that the point anomaly type represented by dataset 1 is a “black-or-white”problem with a small variation of normal samples in the training set,insufficient spatial dynamics,and a smaller number of parameters required,so all algorithms have comparable learning effects and better anomaly detection performance.When the algorithm is applied to the contextual anomaly type represented by dataset 2,we need to consider the anomaly problem existing in the scenario.The normal sample data in the training set has a large range of variation and many spatial characteristics,so the network needs to learn more features and the number of required parameters is learned.Therefore,similar to LSTM,GRU such algorithms targeting pixel processing have a significantly reduced effect,algorithms with spatial feature extraction have a better implementation,while this paper's sub-regional extraction of Spatiotemporal characteristics is clearly more relevant and sensitive to the anomaly detection problem of EMES.Test set 6 is designed for the disappearance of the radiation source,which itself causes the difference between images to become larger,and the (f) plot in Fig.4 proves that whatever detection algorithm has a high detection performance for the behavior of the disappearance of the radiation source.

4.3.Complexity comparison

At the end of the experiment,we analyzed the time and space complexity of the five models in the paper.In deep learning,the number of parameters of the model is used as a measure of space complexity,and the number of floating-point operations per second(FLOPS)is used as a measure of time complexity.The time and space complexities of the five models are shown in Table 9.

Table 9The number of parameters and FLOPS for different models.

Combined with the model ROC curves in subsection 4.2,since the detection results of each algorithm are comparable in the EMES point anomalies detection,the LSTM and GRU algorithms are preferred if the model complexity is considered,and the algorithm proposed in this paper is more comprehensive if the running time and effect are considered comprehensively.In contextual anomaly detection,the comprehensive detection performance curve shows that the algorithm proposed in this paper has advantages in time and space complexity,and the comprehensive effect is better in this problem.

5.Conclusions

For the problem of EMES-AD,this paper applies deep learning techniques to this field for the first time.It generates two datasets for point anomalies and contextual anomalies detection methods according to the regular characteristics of EMES,respectively.Meanwhile,we propose an anomaly detection model for EMES with the fusion of Spatio-temporal features in different regions.The network extracts Spatio-temporal features on the specified regions according to the differences in the field of view domain and finally fuses them to generate predicted images.We examine the anomaly detection effect of five deep learning models on six different datasets and prove that the deep learning technique performs well in electromagnetic environment situation anomaly detection.And it can detect the electromagnetic environment situation changes caused by various anomalous behaviors such as radiation source movement,power change,and different intensity noise interference.The performance of the contextual anomaly detection approach is slightly lower than that of the point anomaly detection approach.The proposed algorithm in this paper performs better in comparison to the performance of the former algorithms.

In this paper,the current exploratory proposed network model for the characteristics of electromagnetic environment situation can initially realize the anomaly detection of electromagnetic environment situation and further strengthen the application of electromagnetic environment situation.In the subsequent research,the anomaly detection of electromagnetic environment situation is extended.It can focus on two aspects:first,the anomaly cognition of electromagnetic environment situation,based on anomaly detection,with anomaly localization and analysis,and the study of algorithmic models that can fuse terrain conditions and apply to the physical characteristics of the electromagnetic environment[30,31];second,the anomaly detection based on big data processing,using multi-task learning and multidimensional data fusion methods to improve the loss function and anomaly judgment function to improve the efficiency of anomaly detection[32-34].

Declaration of competing interest

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Acknowledgements

This research was funded by the National Natural Science Foundation of China,grant number 11975307,and the National Defense Science and Technology Innovation Special Zone Project,grant number 19-H863-01-ZT-003-003-12.