A hybrid intrusion detection method and system for vehicle-to-everything intersection communication security

Abstract

This invention discloses a hybrid intrusion detection method and system for V2X communication security at vehicle-to-everything (V2X) intersections. The system employs a two-level detection architecture. The first level is a rule-based rationality check module (RPCM), which uses a predefined set of rules to quickly filter received messages, eliminating obviously malicious or forged messages. Messages that successfully pass the RPCM check are then sent to a data fusion and decision-making module (DADM). The DADM dynamically models the vehicles and their interactions within the intersection as a graph structure. By learning the complex spatiotemporal interaction patterns of vehicle groups under normal conditions, it identifies more covert and coordinated attacks. The fusion and decision-making module makes a final judgment on each message according to a preset fusion strategy. This invention aims to operate with low latency on onboard or roadside units, effectively addressing the complex V2X security threats unique to signalized intersections and providing a reliable data foundation for advanced V2X applications.

Description

Technical Field

[0001] This invention belongs to the field of vehicle network communication security technology, and in particular relates to a hybrid intrusion detection method and system for vehicle network intersection communication security. Background Technology

[0002] Signalized intersections are critical nodes in urban transportation networks and convergence points for V2X information exchange. In such environments, signal phase and timing (SPaT) messages and map (MAP) messages from roadside units (RSUs) converge with basic safety messages (BSM) from surrounding vehicles, creating a complex and dynamic communication scenario. This intensive exchange of information is crucial for improving traffic safety and efficiency, but it also makes intersections high-value targets for cyber attackers. Common attack vectors include, but are not limited to: attacks targeting SPaT messages (such as spoofed green light attacks, green light extension / shortening attacks, and logic disruption attacks), and attacks targeting BSM messages (location spoofing attacks, ghost vehicle attacks, Sybil attacks, and trajectory tampering attacks). The ultimate goal of these attacks is often to cause traffic accidents, traffic congestion, or disrupt the overall stability of the transportation system.

[0003] Many existing solutions suffer from limitations when applied to the specific and complex scenario of signalized intersections, including a lack of scenario specificity, insufficient physical-information integration, and limited ability to detect coordinated and complex attacks. For example, many existing IDS exhibit a "contextual blind spot" when facing intersection environments. They may analyze a BSM message in isolation or check an SPaT message according to general rules, but fail to place this information within the dynamic, structured, and physically rule-constrained environment of an intersection, and fail to fully consider the complex interactions between multiple agents (vehicles, RSUs). Furthermore, network attack techniques themselves are constantly evolving; attackers are designing increasingly covert and "intelligent" attack methods that can cleverly bypass single, simple detection mechanisms. This continuous upgrading of attack and defense technologies requires defense systems to possess multi-layered and multi-faceted detection capabilities. Relying solely on a single type of detection method (e.g., pure rule detection or pure statistical anomaly detection) is insufficient to meet current challenges. Therefore, a new type of intrusion detection system is urgently needed, which should overcome the above limitations, be specifically designed for signalized intersections, and integrate multiple detection mechanisms to effectively ensure the security of V2X communication. Summary of the Invention

[0004] Purpose of the invention: In order to solve the problems existing in the prior art, the present invention provides a hybrid intrusion detection method and system for communication security at vehicle-to-everything (V2X) intersections.

[0005] Technical Solution: This invention provides a hybrid intrusion detection method for communication security at vehicle-to-everything (V2X) intersections, characterized in that:

[0006] Receive V2X message streams from the cross-section environment;

[0007] Level 1 detection: Perform a rule-based validity check on the i-th V2X message received at the current moment; filter out attack messages;

[0008] Level 2 Detection: Receives V2X messages that have passed Level 1 detection, constructs a dynamic graph model of the vehicles at the intersection, uses vehicles as nodes, and employs a neural network to analyze the dynamic graph model, calculating the anomaly score s of the i-th vehicle corresponding to the i-th V2X message. i ;

[0009] Level 3 inspection: Based on the results of Level 1 inspection or the anomaly score of each vehicle. i And based on the preset fusion strategy, it makes a final judgment on the security of V2X messages.

[0010] Furthermore, when using the first-level detection, if a message does not meet the following rules, it will be directly identified as a malicious message.

[0011] Kinematic consistency rule: The position, velocity, and acceleration sequence of a vehicle at a specified time must conform to the physical kinematic laws;

[0012] Map matching rules: The location reported by the vehicle should be within the area specified on the digital map of the intersection;

[0013] Traffic light logic rules: The phase transitions between the traffic light phase and the phase transitions in the timing message should conform to logic;

[0014] Message freshness rules: Based on the timestamp of V2X messages, messages that are delayed beyond a preset time threshold or whose timestamp is in the future are rejected.

[0015] Furthermore, each vehicle in a V2X message is treated as a node. When the i-th V2X message is received, the vehicle corresponding to that message is treated as the i-th node. The spatial distance between the i-th node and all vehicles in the previous i V2X messages is calculated. Nodes whose spatial distance is less than a preset distance threshold are treated as the neighbor nodes of the i-th node. An edge is established between node i and the neighbor nodes of node i, and then a dynamic graph model is constructed.

[0016] The dynamic graph model is analyzed using the GAT graph neural network, specifically as follows:

[0017] For node v i and any of its neighbor nodes v jThe correlation score e between the two is calculated using a learnable attention function a. ij :

[0018]

[0019] Where W is the weight matrix; Let be the feature vector of the i-th node, including velocity, acceleration, and heading angle;

[0020] Using the softmax function to evaluate e ij After normalization, the corresponding attention coefficient α is obtained. ij ;

[0021] Update the feature vector of node i and the feature vectors of its neighboring nodes:

[0022]

[0023] Where y represents node i and its neighboring nodes. This represents the updated feature vector of node y. Let v represent the set of neighboring nodes of node y; σ is a non-linear activation function; the updated feature vector of node y is substituted into the next layer to recalculate node v. i and any of its neighbor nodes v j Relevance score;

[0024] The feature vector of the i-th node output from the last layer is sequentially fed into the fully connected layer and the sigmoid function to obtain the anomaly score s of the i-th node. i .

[0025] Furthermore, the distance threshold is 50m.

[0026] Furthermore, the fusion strategy specifically includes:

[0027] The first-level detection has the highest priority. If the i-th V2X message fails the first-level detection, it is directly identified as an attack message; if the V2X message passes the first-level detection, the anomaly score s of the i-th vehicle is determined. i If the value is greater than a preset threshold τ, then the i-th V2X message is considered a malicious message; otherwise, the i-th V2X message is considered a trustworthy message.

[0028] Furthermore, the threshold τ is determined using the following formula:

[0029] τ=μ normal +k·σ normal

[0030] Where, μ normal σ is the average value.normal Standard deviation:

[0031]

[0032] Where N represents the total number of V2X messages received by the receiving device at the current moment.

[0033] A system for a hybrid intrusion detection method for communication security at vehicle-to-everything (V2X) intersections, comprising:

[0034] The rule-based rationality check module is used to perform rule-based rationality checks on the i-th V2X message received at the current time, and to filter out attack messages.

[0035] The data-driven anomaly detection module constructs a dynamic graph model of vehicles at an intersection. Using vehicles as nodes, a neural network analyzes the dynamic graph model to calculate the anomaly score *s* of the *i*th vehicle corresponding to the *i*th V2X message. i

[0036] The fusion decision module is used to integrate the results from the first-level detection and the anomaly score for each vehicle. i And based on the preset fusion strategy, it makes a final judgment on the security of V2X messages.

[0037] Furthermore, the system is deployed and operated on vehicle-mounted units or roadside units at intersections.

[0038] A computer device includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that the processor executes the computer program to implement the steps of the hybrid intrusion detection method.

[0039] A computer-readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the steps of the hybrid intrusion detection method.

[0040] Beneficial effects:

[0041] 1. Enhanced detection accuracy and coverage: By combining deterministic rules and adaptive learning models, it can effectively identify a wider range of attack types, including simple spoofing and logic disruption targeting intersection scenarios, as well as complex collaborative attacks (such as Sybil attacks and group location spoofing).

[0042] 2. Enhanced robustness: Deterministic rules provide the system with a solid foundation for defense, while data-driven modules give the system the potential to adapt to new and unknown attack patterns.

[0043] 3. Deep customization and context awareness for intersection scenarios: The system design fully considers the structured characteristics of signalized intersections (such as fixed RSU locations, known traffic light logic, and map information) and the dynamic interaction characteristics of vehicle groups, achieving a high degree of scenario adaptability and context awareness.

[0044] 4. Low latency and real-time performance: One of the design goals of the system is to achieve millisecond-level detection latency on the on-board computing unit to meet the real-time requirements of V2X safety-critical applications. Attached Figure Description

[0045] Figure 1 This is a system architecture diagram of the present invention.

[0046] Figure 2 This is a schematic diagram of a typical signalized intersection V2X communication environment.

[0047] Figure 3 This is an example of a finite state machine (FSM) state transition diagram for the RPCM module used for SPAT message semaphore logic verification.

[0048] Figure 4 This is the overall architecture diagram of the DADM module.

[0049] Figure 5 This is a flowchart of the DADM module's workflow.

[0050] Figure 6 This is a schematic diagram of the system deployment of the present invention.

[0051] Figure 7 This is the overall flowchart of the present invention. Detailed Implementation

[0052] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0053] This invention proposes a hybrid intrusion detection system and method for V2X cross-section communication security. For example... Figure 1 As shown, the intrusion detection system provided by this invention has a core architecture including: a rule-based rationality check module (RPCM), a data-driven anomaly detection module (DADM), and a fusion decision module (FDM). A typical signalized crossroads V2X communication environment diagram is shown below. Figure 2As shown, the system receives raw V2X messages, mainly including signal light phase and timing (SPaT) messages and map (MAP) messages from roadside units (RSUs), as well as basic safety messages (BSM) from other vehicles. The input V2X messages can be processed in parallel by the RPCM and DADM. The core objective of the system is to perform real-time and reliable safety assessments of V2X data while meeting the extremely low latency (millisecond level) requirements of safety-critical applications, with a particular focus on the complex and high-risk scenario of signalized intersections.

[0054] The rule-based reasonableness check module (RPCM) is the system's first line of defense. It aims to leverage deterministic prior knowledge of the intersection environment and predefined rules to perform fast, low-overhead reasonableness checks on received single V2X messages, filtering out malicious messages that clearly violate physical laws or traffic logic. For example... Figure 3 As shown, the predefined rule base of RPCM includes at least:

[0055] 1. Kinematic Consistency Rule: Based on methods such as Kalman filtering, verify whether the position, velocity, and acceleration sequence of a vehicle (in V2X messages) in a short period of time conforms to the physical kinematic laws.

[0056] 2. Map matching rules: Compare the location reported by the vehicle with the digital map (MAP message) of the intersection to determine whether it is in a legal lane or area.

[0057] 3. Traffic light logic rules: Based on a preset traffic light logic state machine, verify whether the traffic light phase and the phase transition order in the timing (SPaT) message are logical (e.g., the green light must be followed by the yellow light, and cannot directly turn into the red light).

[0058] 4. Message freshness rules: Check the timestamp of V2X messages and reject messages that are too delayed or have a future timestamp to prevent replay attacks.

[0059] The effectiveness of RPCM stems from the determinism and high confidence of its rule foundation. Physical laws (such as kinematics), established logic (such as traffic light FSM), geospatial constraints (such as map matching), and the message standards themselves all provide a basis for identifying false information. Judgments based on these hard constraints enable RPCM to quickly and accurately filter out poorly designed or blatantly illogical attack messages without requiring complex probabilistic inference or pattern learning. This not only improves detection efficiency but also lays a solid foundation for the reliability of the entire system.

[0060] The Data-Driven Anomaly Detection Module (DADM) serves as the system's second line of defense, focusing on detecting complex, coordinated attacks (such as Sybil attacks and group location spoofing) that appear plausible at the individual data packet level but exhibit anomalous behavior in group interactions. Graph Neural Networks (GNNs) were chosen because the vehicles at an intersection naturally form a dynamic graph, where vehicles are nodes and spatial proximity and interaction relationships between vehicles are edges. GNNs can aggregate information from neighboring nodes through message passing, thereby learning contextual / environmental features that a single vehicle lacks. This is crucial for identifying Sybil attacks or group location spoofing attacks that require the coordination of multiple fake vehicles. Therefore, the DADM module employs Graph Neural Network (GNN) technology, preferably Graph Attention Network (GAT), and its overall architecture and workflow are as follows: Figure 4 , Figure 5 As shown:

[0061] Step 1: Constructing the dynamic graph

[0062] Vehicles (or other vehicles) inspected by RPCM are used as nodes in the graph model. When the i-th V2X message is received, the vehicle corresponding to that message is designated as the i-th node. The characteristics of a node are composed of dynamic information (such as speed, acceleration, and heading angle) from its Basic Safety Message (BSM). The spatial distance between the i-th node and all vehicles in the previous i V2X messages is calculated. Nodes with a spatial distance less than a preset distance threshold are designated as neighbors of the i-th node. An edge is established between node i and its neighbors. The specific construction method is as follows:

[0063] At any timestamp t, DADM abstracts the vehicles and their interactions within the intersection into a dynamic graph Gt.

[0064] Node: Each vehicle v i As a node.

[0065] Node Feature: The feature vector of each node. It consists of key dynamic parameters in its BSM messages:

[0066]

[0067] Edge: When any two vehicles v i and v j If the distance between them is less than a preset threshold, an edge is created between them.

[0068] Step 2: GAT Model Analysis

[0069] The GAT model uses a self-attention mechanism to assign different importance weights to the neighbors of the i-th node, thereby more accurately aggregating neighborhood information and learning complex spatiotemporal interaction patterns between vehicles. The specific calculation method is as follows:

[0070] 1. Attention score calculation: For node v i and any of its neighbor nodes v j The system calculates its correlation score e using a learnable attention function a. ij .

[0071]

[0072] Here, W is a shared, trainable weight matrix used to perform a linear transformation on the original features.

[0073] Attention coefficient normalization: The attention score is normalized using the softmax function to obtain the final attention coefficient α. ij

[0074] α ij =softmax j (e ij )

[0075] α ij The higher the value, the stronger the neighbor node v j For node v i The greater the impact.

[0076] 2. Feature aggregation and updating: Node v i Updated feature vector It is obtained by weighting and summing the transformed features of all its neighboring nodes according to the attention coefficients, and then passing them through a non-linear activation function σ (any neighboring nodes of node i are also updated based on the following formula).

[0077]

[0078] Step 3: Output of Abnormal Scores

[0079] After one or more layers of GAT calculation, the final feature of node i is obtained. This feature is then passed through a fully connected layer and a sigmoid function to output an anomaly score s between [0,1]. i The higher the score, the more suspicious the behavioral pattern. This score (s) i This involves the DADM module quantitatively assessing the degree of abnormality in the vehicle node's behavior, which is then sent to the FDM module for final decision-making.

[0080] The FDM is the final decision-making unit of the "Intersection Guardian" system. Its responsibility is to integrate the detection results of RPCM and DADM and make the final decision. The specific fusion strategy is as follows:

[0081] 1. Rule priority: If RPCM determines a message as "non-compliant", FDM will directly determine it as "malicious" and the detection process will end.

[0082] 2. Threshold Decision: If the message passes through RPCM, FDM compares it with the anomaly score s calculated by DADM. i With a preset decision threshold τ. If s i If the threshold value is greater than τ, the message is considered "malicious"; otherwise, it is considered "trustworthy." The threshold τ can be determined during the system calibration phase through statistical analysis of the "normal score set" under normal traffic conditions. The specific calculation method is as follows:

[0083] First, calculate the mean μ of the normal fraction set. normal and standard deviation σ normal .

[0084]

[0085]

[0086] Where N represents the total number of V2X messages received by the receiving device at the current moment.

[0087] Then, the threshold τ is set above the average value, with an added safety margin controlled by the standard deviation.

[0088] τ=μ normal +k·σ normal

[0089] Where, μ normal and σ normal It is an objective value obtained through statistical analysis of normal sample data.

[0090] k is an adjustable sensitivity coefficient (or confidence coefficient), a constant greater than 0 (usually an integer, such as 2, 3, or 4). This coefficient is set by the system designer based on the security requirements of the actual application scenario, and it directly determines the system's level of "alertness."

[0091] A larger k value (e.g., k=4) results in a higher threshold τ. This means the system has a higher tolerance for anomalies; a message will only be considered malicious if its anomaly score significantly deviates from the normal range. A smaller k value (e.g., k=2) results in a lower threshold τ. This means the system is more "sensitive," and may be considered malicious even if a message's anomaly score only slightly deviates from the normal range. By adjusting the k value, this invention can strike a balance between the stringency (low false negatives) and reliability (low false positives) of detection to adapt to the needs of different traffic environments and security levels.

[0092] like Figure 6 As shown, the system can be deployed in the vehicle's onboard unit (OBU) or the roadside unit (RSU) at an intersection.

[0093] See Figure 7 The specific process of the hybrid intrusion detection method provided by this invention is summarized as follows:

[0094] Step 201: The system receives V2X message streams from the cross-section environment.

[0095] Step 202: RPCM 110 performs a first-level inspection of the message. If the message is determined to be non-compliant (e.g., violating the laws of physics), the process proceeds directly to step 204, where the message is classified as malicious.

[0096] Step 203: If the message passes the first level of detection, DADM 120 will perform the second level of detection, and calculate the anomaly score of the vehicle corresponding to the message by constructing and analyzing the dynamic graph model.

[0097] Step 204: FDM 130 performs a fusion decision, outputting the final malicious or trustworthy decision based on the direct decision result of RPCM or the comparison result of the abnormal score and threshold of DADM.

[0098] This invention organically integrates modules tailored for signalized intersection environments into a highly efficient and collaborative whole through a meticulously designed system architecture and an intelligent fusion decision-making mechanism (FDM priority logic). It's not simply a matter of piling up rule engines and GNN models, but rather a complete, end-to-end solution tailored to specific problems (diverse V2X attacks) within a specific scenario (signaled intersections). RPCM, acting as a highly efficient front-end "sentinel," utilizes its low-overhead, high-confidence judgment capability against obvious false information to filter out a large number of "easily identifiable" attacks, thereby reducing the computational burden on the subsequent DADM module and decreasing data noise input to DADM. DADM, on the other hand, focuses on processing the more deceptive messages that have passed the RPCM filter, leveraging its powerful graph pattern learning capabilities to uncover anomalies hidden in group behavior. This synergy improves both the breadth and depth of the system's detection capabilities. The FDM module's priority adoption strategy for RPCM malicious judgments also reflects a high degree of trust in deterministic judgments based on "hard rules." This system-level integrated innovation, and the resulting significant performance improvement in specific application scenarios, contributes to this system-level innovation.

[0099] Furthermore, this invention, by providing a "trusted data foundation," transcends mere passive defense. An IDS capable of effectively purifying V2X data streams and eliminating malicious information is the prerequisite and cornerstone for the safe and reliable operation of future, more advanced and intelligent intersection collaborative applications (such as accurate driver intent recognition, vehicle trajectory prediction, dynamic risk assessment, and adaptive signal control optimization). These advanced applications are extremely sensitive to the quality of input data; any contaminated or manipulated data can lead to catastrophic decision-making errors. Therefore, the "Intersection Guardian" system not only addresses current security threats but also paves the way for the future in-depth application of V2X technology in intersection scenarios, transforming it from a passive security component into a proactive value enabler.

[0100] This invention aims to operate with low latency on vehicle-mounted or roadside units, effectively addressing the complex V2X security threats unique to signalized intersections, and providing a reliable data foundation for advanced V2X applications.

[0101] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, the present invention will not describe the various possible combinations separately.

Claims

1. A hybrid intrusion detection method for communication security at vehicle-to-everything (V2X) intersections, characterized in that, Specifically: Receive V2X message streams from the cross-section environment; Level 1 detection: Perform a rule-based validity check on the i-th V2X message received at the current moment; filter out attack messages; Level 2 Detection: Receives V2X messages that have passed Level 1 detection, constructs a dynamic graph model of the vehicles at the intersection, uses vehicles as nodes, and employs a neural network to analyze the dynamic graph model, calculating the anomaly score of the i-th vehicle corresponding to the i-th V2X message. ; Level 3 inspection: Based on the results of Level 1 inspection or the anomaly score of each vehicle. And based on the preset fusion strategy, make a final judgment on the security of V2X messages; When using the first level of detection, the following rules apply. If a message does not meet the following rules, the message is directly identified as a malicious message. Kinematic consistency rule: The position, velocity, and acceleration sequence of a vehicle at a specified time must conform to the physical kinematic laws; Map matching rules: The location reported by the vehicle should be within the area specified on the digital map of the intersection; Traffic light logic rules: The phase transitions between the traffic light phase and the phase transitions in the timing message should conform to logic; Message freshness rules: Based on the timestamp of V2X messages, messages that are delayed beyond a preset time threshold or whose timestamps are in the future are rejected; Each vehicle in a V2X message is treated as a node. When the i-th V2X message is received, the vehicle corresponding to that message is treated as the i-th node. The spatial distance between the i-th node and all vehicles in the previous i V2X messages is calculated. Nodes whose spatial distance is less than a preset distance threshold are treated as neighbors of the i-th node. An edge is established between node i and its neighbors. Then, a dynamic graph model is constructed. The dynamic graph model is analyzed using the GAT graph neural network, specifically as follows: For nodes and any of its neighboring nodes Through a learnable attention function Calculate the correlation score between the two : ； in, It is a weight matrix; Let be the feature vector of the i-th node, including velocity, acceleration, and heading angle; Using the softmax function Normalization is performed to obtain the corresponding attention coefficients. ; Update the feature vector of node i and the feature vectors of its neighboring nodes: ； Where y represents node i and its neighboring nodes. This represents the updated feature vector of node y. Represents the set of neighboring nodes of node y; It is a non-linear activation function; the updated node's feature vector is substituted into the next layer to recalculate the node. and any of its neighboring nodes Relevance score; The feature vector of the i-th node output from the last layer is sequentially fed into the fully connected layer and the sigmoid function to obtain the anomaly score of the i-th node. .

2. The hybrid intrusion detection method for communication security at vehicle-to-everything (V2X) intersections according to claim 1, characterized in that, The distance threshold is 50m.

3. The hybrid intrusion detection method for communication security at vehicle-to-everything (V2X) intersections according to claim 1, characterized in that, The fusion strategy is specifically as follows: The first-level detection has the highest priority. If the i-th V2X message fails the first-level detection, it is directly identified as an attack message; if the V2X message passes the first-level detection, the anomaly score of the i-th vehicle is determined. Is it greater than the preset threshold? If so, the i-th V2X message is considered a malicious message; otherwise, the i-th V2X message is considered a trustworthy message.

4. A hybrid intrusion detection method for communication security at vehicle-to-everything (V2X) intersections according to claim 3, characterized in that, The threshold is determined using the following formula. : ； in, This is the average value. Standard deviation, It is an adjustable sensitivity coefficient: ； ； N represents the total number of V2X messages received by the receiving device at the current moment.

5. A system applied to the hybrid intrusion detection method for communication security at vehicle-to-everything (V2X) intersections as described in claim 1, characterized in that, include The rule-based rationality check module is used to perform rule-based rationality checks on the i-th V2X message received at the current time, and to filter out attack messages. The data-driven anomaly detection module constructs a dynamic graph model of vehicles at an intersection. Using vehicles as nodes, a neural network analyzes the dynamic graph model to calculate the anomaly score of the i-th vehicle corresponding to the i-th V2X message. ; The fusion decision module is used to integrate the results from the first-level detection and the anomaly score for each vehicle. And based on the preset fusion strategy, it makes a final judgment on the security of V2X messages.

6. A hybrid intrusion detection system for communication security at vehicle-to-everything (V2X) intersections according to claim 5, characterized in that, The system is deployed and operates on vehicle-mounted units or roadside units at intersections.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the hybrid intrusion detection method as described in any one of claims 1 to 4.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the hybrid intrusion detection method as described in any one of claims 1 to 4.

Images