A vehicle networking collaborative security defense method and system against poisoning attacks

Abstract

The application discloses an anti-poisoning attack cooperative security defense method and system for Internet of Vehicles, and relates to the technical field of Internet of Vehicles security. The method comprises the following steps: an initial model is issued by a cloud end to all vehicles at a vehicle end, vehicle end synchronously acquires in-vehicle network data and off-vehicle communication data, and performs preprocessing; the vehicle end trains and fine-tunes the received initial model with the minimum reconstruction error or feature space compactness loss as the target, and encrypts and updates the fine-tuned model based on privacy protection processing; the cloud end performs security screening on the encrypted and updated model parameters based on a multi-stage robust aggregation mechanism and a dynamic trust management model to obtain a global model; and the cloud end issues the global model and corresponding data to the vehicle end for real-time monitoring and feedback. The application can effectively resist malicious vehicle end attacks while guaranteeing vehicle data privacy and system real-time performance, and has strong cross-domain generalization capability.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, and in particular to a collaborative security defense method and system for vehicle networks against poisoning attacks. Background Technology

[0002] Intelligent connected vehicles have expanded from traditional in-vehicle networks (such as CAN bus) to wireless V2X communication, OTA upgrade channels, and even mobile app interfaces. Intrusion detection systems (IDS) targeting these attack surfaces have become essential components for ensuring vehicle functional safety and user privacy. To address the data privacy, communication bandwidth, and storage cost issues arising from traditional learning methods, Federated Learning (FL), as a privacy-preserving distributed machine learning paradigm, has been introduced into connected vehicle IDS. While Federated Learning provides a new approach to privacy protection for connected vehicle IDS, its direct application to complex, open, and adversarial connected vehicle environments still suffers from deficiencies in trust management within dynamic heterogeneous environments and insufficient defense against malicious poisoning attacks. Summary of the Invention

[0003] In view of the shortcomings of existing technologies, the purpose of this invention is to provide a collaborative security defense method and system for vehicle networking that resists poisoning attacks. While ensuring vehicle data privacy and system real-time performance, it effectively resists malicious vehicle-side attacks and has strong cross-domain generalization capabilities.

[0004] To achieve the above objectives, the present invention is implemented through the following technical solution: The first aspect of this invention provides a collaborative security defense method for vehicle-to-everything (V2X) networks against poisoning attacks, comprising the following steps: The initial model is distributed from the cloud to all vehicles. The vehicles simultaneously acquire in-vehicle network data and external communication data and perform preprocessing. The vehicle-side trains and fine-tunes the received initial model with the goal of minimizing reconstruction error or feature space compactness loss, and then performs encrypted updates on the fine-tuned model based on privacy protection processing. The cloud-based system uses a multi-stage robust aggregation mechanism and a dynamic trust management model to perform security screening on the encrypted and updated model parameters to obtain the global model. The cloud sends the global model and corresponding data to the vehicle for real-time monitoring and feedback.

[0005] Furthermore, the specific steps for preprocessing on the vehicle side are as follows: The data stream is segmented using a sliding time window; Extract multidimensional feature vectors for each window; Standardize all feature vectors.

[0006] Furthermore, the specific steps for the vehicle-side to perform encrypted updates on the fine-tuned model based on privacy protection are as follows: Calculate the update vector of the fine-tuned model and perform gradient clipping; Inject differential privacy noise into the cropping result; The update vector after injecting differential privacy noise is subjected to dual compression and error compensation.

[0007] Furthermore, the vehicle-side employs a dual compression method based on Top-K sparsity and low-bit quantization to compress the update vector after injecting differential privacy noise.

[0008] Furthermore, the specific steps for the cloud-based multi-stage robust aggregation mechanism to perform security screening on the encrypted and updated model parameters are as follows: The first stage involves fast similarity filtering based on locality-sensitive hashing; The second stage involves clustering and elimination operations based on Mahalanobis distance; The third stage combines trust weights for robust aggregation.

[0009] The second aspect of this invention provides a vehicle-to-everything (V2X) collaborative security defense system resistant to poisoning attacks, comprising a cloud and vehicle terminals. The cloud distributes an initial model to all vehicles on the vehicle terminals. The vehicle terminals simultaneously acquire in-vehicle network data and external communication data and perform preprocessing. The vehicle terminals train and fine-tune the received initial model with the goal of minimizing reconstruction error or feature space compactness loss, and encrypt and update the fine-tuned model based on privacy protection processing. The cloud performs security screening on the encrypted and updated model parameters based on a multi-stage robust aggregation mechanism and a dynamic trust management model to obtain a global model. The cloud distributes the global model and corresponding data to the vehicle terminals for real-time monitoring and feedback.

[0010] Furthermore, the specific steps for preprocessing on the vehicle side are as follows: The data stream is segmented using a sliding time window; Extract multidimensional feature vectors for each window; Standardize all feature vectors.

[0011] Furthermore, the specific steps for the vehicle-side to perform encrypted updates on the fine-tuned model based on privacy protection are as follows: Calculate the update vector of the fine-tuned model and perform gradient clipping; The update vector after injecting differential privacy noise is subjected to dual compression and error compensation.

[0012] Furthermore, the vehicle-side employs a dual compression method based on Top-K sparsity and low-bit quantization to compress the update vector after injecting differential privacy noise.

[0013] Furthermore, the specific steps for the cloud-based multi-stage robust aggregation mechanism to perform security screening on the encrypted and updated model parameters are as follows: The first stage involves fast similarity filtering based on locality-sensitive hashing; The second stage involves clustering and elimination operations based on Mahalanobis distance; The third stage combines trust weights for robust aggregation.

[0014] The above one or more technical solutions have the following beneficial effects: This invention discloses a collaborative security defense method and system for vehicle-to-everything (V2X) networks that resists poisoning attacks. Targeting the internal and external security threats faced by in-vehicle networks (such as CAN FD and in-vehicle Ethernet) and V2X communication in intelligent connected vehicle environments, this invention constructs a continuously evolving, malicious attack-resistant, and cross-vehicle generalization distributed intrusion detection system while protecting vehicle data privacy. The system consists of a local detection agent deployed on the vehicle and a federated aggregation and trust management center deployed in the cloud.

[0015] This invention effectively identifies and isolates some malicious vehicle terminals through a multi-stage robust aggregation mechanism (LSH initial screening and Mahalanobis distance clustering).

[0016] The dynamic trust management model of this invention can promptly detect vehicle ends that exhibit "behavioral drift" (i.e., nodes that change from good to bad).

[0017] Personalized fine-tuning strategies at the vehicle level significantly mitigate the performance degradation caused by Non-IID data distribution. Dynamic trust weights and alarm consistency assessments enable the system to leverage collective intelligence to quickly identify new attack patterns.

[0018] The method proposed in this invention achieves comprehensive breakthroughs in multiple dimensions such as privacy protection, bandwidth optimization, robust aggregation, generalized detection, real-time response, and traceability. It can provide an efficient, reliable, and practical intrusion detection and defense system in the intelligent connected vehicle environment, and has outstanding technological advancements and industrial application value.

[0019] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is an overall flowchart of the vehicle network collaborative security defense method against poisoning attacks in Embodiment 1 of the present invention; Figure 2 This is a complete closed-loop flowchart of the process of collecting data from the vehicle end to the cloud, aggregating it, and then distributing it in Embodiment 1 of the present invention; Figure 3 This is a flowchart of vehicle-side data processing and local training in Embodiment 1 of the present invention; Figure 4 This is a flowchart of cloud-based robust aggregation and trust management in Embodiment 1 of the present invention; Figure 5 This is a schematic diagram of real-time vehicle-side detection and collaborative defense in Embodiment 1 of the present invention. Detailed Implementation

[0022] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0023] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof. The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0024] Currently, when federated learning is applied to complex, open, and adversarial connected vehicle environments, there are still a series of key technical shortcomings that urgently need to be addressed: Existing federated IDS schemes typically only employ basic differential privacy (DP) to add noise. However, research shows that even without access to the original data, attackers can still infer membership information from the training data and even reconstruct some sensitive features by analyzing shared gradient updates. Simply adding noise may not be sufficient to fully defend against such inference attacks, and there is an irreconcilable conflict between model utility (detection accuracy) and the strength of privacy protection.

[0025] In the Internet of Vehicles (IoV), there may be malicious vehicles controlled by attackers. These vehicles can disrupt the convergence of the global model or implant backdoors by uploading carefully crafted malicious model updates (i.e., model poisoning attacks). Most existing solutions use simple cosine similarity filtering or the Krum algorithm, but under large-scale, high-dimensional model updates, the discrimination accuracy of these methods decreases, and they are easily bypassed by adaptive attacks.

[0026] Vehicles communicate with the cloud via cellular networks (such as 4G / 5G), which are bandwidth-limited and costly. Deep IDS models have a large number of parameters, and even after conventional compression, the communication overhead of multiple iterations remains enormous, resulting in long training cycles and difficulty in quickly responding to new threats.

[0027] Vehicle behavior is dynamic, and a normal vehicle endpoint can become a malicious node due to intrusion. Existing solutions lack a mechanism for continuously and adaptively assessing the trustworthiness of vehicle endpoints, and cannot respond promptly to dynamic changes in vehicle endpoint behavior, resulting in the aggregation process being contaminated by potential malicious updates over a long period of time.

[0028] The data distribution varies greatly across different vehicle models and driving environments, exhibiting non-independent and identically distributed (Non-IID) characteristics. Existing federal IDS global models experience a significant performance drop when processing this out-of-distribution (OOD) data. Furthermore, these models lack the ability to continuously learn from unknown attacks and cannot adapt to rapidly evolving attack methods.

[0029] To address the vulnerabilities and limitations of existing vehicle-to-everything (V2X) privacy protection methods, insufficient robustness against model poisoning attacks, bottlenecks in communication efficiency and model convergence speed, lack of trust management in dynamic heterogeneous environments, and limited generalization and adaptive capabilities of detection models, this invention provides a collaborative security defense method and system for V2X to resist poisoning attacks. This method effectively defends against malicious vehicle-side attacks while ensuring vehicle data privacy and system real-time performance, and possesses strong cross-domain generalization capabilities. Specific details are shown in the embodiments.

[0030] Example 1: Embodiment 1 of the present invention provides a collaborative security defense method for vehicle-to-everything (V2X) networks against poisoning attacks, such as... Figures 1 to 5 As shown, it includes the following steps: S1: The initial model is distributed from the cloud to all vehicles. The vehicles simultaneously acquire in-vehicle network data and external communication data and perform preprocessing.

[0031] S1.1: The initial model is distributed from the cloud to all vehicles on the vehicle side.

[0032] In one specific implementation, the initial model in this embodiment can be pre-trained from publicly available vehicle network intrusion detection datasets (such as Car-Hacking, OTIDS, etc.), or pre-trained in the cloud based on a small amount of unlabeled normal vehicle data (such as autoencoder reconstruction training) to obtain an initial model that can initially represent normal communication patterns.

[0033] S1.2: The vehicle side synchronously acquires in-vehicle network data and external communication data.

[0034] In one specific implementation, in-vehicle network data (CAN / CAN FD messages, AutoSARCP / AP logs) and external V2X communication data (BSM, CAM, DENM) are collected simultaneously.

[0035] Specifically, the vehicle collects the following multi-source heterogeneous data in real time through its built-in CAN bus interface, OBD-II port, and V2X communication module: In-vehicle network data: including all messages (ID, data field, timestamp) on the CAN / CAN FD bus.

[0036] Electronic Control Unit (ECU) operating status data: operating logs and status parameters obtained from the gateway or key ECUs (such as engine controllers and brake controllers).

[0037] V2X communication data: Basic safety messages (BSM), map data (MAP), and traffic light status (SPaT) received from other vehicles or roadside units (RSUs).

[0038] All raw data is encrypted locally in the vehicle and then temporarily stored in a secure cache with a circular overwrite mechanism, ensuring that the raw data never leaves the vehicle.

[0039] S1.3: Preprocessing is performed on the vehicle side.

[0040] S1.3.1: Use a sliding time window to segment the data stream.

[0041] In one specific implementation, a configurable time window length T (e.g., 1 second or 5 seconds, the length T can be adaptively adjusted) is set, and a sliding time window is used to segment the data stream, resulting in a window set { , ,..., } Where N is the number of windows. Automatically identify and remove obviously erroneous packets (such as CRC check failures or format mismatches). Align data from different sources by timestamp; for minor gaps caused by network jitter, use linear interpolation or previous value padding to complete them.

[0042] This process ensures the consistency and integrity of the input data.

[0043] S1.3.2: Extract multidimensional feature vectors for each window.

[0044] In one specific implementation, for each time window The data within the dataset is processed in parallel to extract four types of features: statistical features, entropy features, time-series features, and frequency domain features, which together form the original feature vector. .

[0045] Specifically, statistical characteristics such as the frequency of message IDs appearing within the window. Mean of interval time , and standard deviation skewness, etc.

[0046] Entropy features include information entropy to measure data uncertainty: .

[0047] in, Entropy features Let be a random variable representing the distribution of message IDs. The total number of possible values ​​for the message ID. For value indexing, in this embodiment it refers to the vehicle end. For the first The specific value of the message ID, for The probability (frequency) of occurrence within the current time window.

[0048] By calculating autocorrelation coefficients and simple moving averages (SMA) using data within the window, temporal dependencies are captured, and temporal features are extracted using LSTNet or Transformer encoders. .

[0049] Perform a Fast Fourier Transform (FFT) on the message interval sequence or a specific data field sequence to extract the energy values ​​of the main frequency components.

[0050] S1.3.3: Standardize all feature vectors.

[0051] In one specific implementation, subsequently, for Z-score standardization is performed to obtain the standardized feature vector.

[0052] .

[0053] in, The standardized feature vector, Original feature vector The mean vector of the features of the training set. is the standard deviation vector of the features in the training set.

[0054] S2: The vehicle-side trains and fine-tunes the received initial model with the goal of minimizing reconstruction error or feature space compactness loss, and performs encrypted updates on the fine-tuned model based on privacy protection processing.

[0055] S2.1: The vehicle-side trains and fine-tunes the received initial model with the goal of minimizing reconstruction error or feature space compactness loss.

[0056] In one specific implementation, each vehicle end Local data The model is trained using a lightweight autoencoder or a deep one-class classification (Deep SVDD) model. This model consists of an encoder (Enc) and a decoder (Dec). The local optimization objective is to minimize either the reconstruction error or the feature space compactness loss.

[0057] This invention uses an autoencoder as an anomaly detector. Alternatively, one or a combination of the following models may be used: Deep Support Vector Data Description (Deep SVDD): Learns a minimum hypersphere that encloses all normal data, and classifies samples that fall outside the hypersphere as anomalous.

[0058] Graph Neural Networks (GNNs): If the vehicle network topology and communication relationships are modeled as a graph, GNNs can be used to learn the normal patterns of nodes (ECUs) and edges (communication links), which can effectively detect attacks based on topology relationships.

[0059] Transformer model: Utilizes its self-attention mechanism to better capture complex long-term dependencies and contextual information in connected vehicle data.

[0060] Taking an autoencoder as an example, the loss function is: .

[0061] in, Let i be the local loss function of vehicle i. and For autoencoder parameters ( For encoder parameters, (For decoder parameters) For local datasets, For the input feature vector, is the regularization coefficient. and These represent the forward computation functions of the encoder and decoder, respectively.

[0062] The vehicle receives the initial model parameters from the cloud. Afterwards, a personalized fine-tuning process of 1 to 3 epochs will be performed using local data to obtain a local model that is more suitable for its own data distribution. The vehicle-side personalized fine-tuning strategy in this embodiment significantly alleviates the performance degradation problem caused by Non-IID data distribution.

[0063] S2.2: The vehicle-side performs encrypted updates to the fine-tuned model based on privacy protection processing.

[0064] S2.2.1: Calculate the update vector of the fine-tuned model and perform gradient clipping.

[0065] In one specific implementation, the formula for updating the computational model is: .

[0066] in, This is the parameter difference vector between the local model and the global model.

[0067] Gradient clipping is then performed. Norm constraints are applied to the update vector. : .

[0068] in, This represents the cropping result, where C is the preset cropping threshold.

[0069] S2.2.2: Inject differential privacy noise into the cropping result.

[0070] In one specific implementation, in the cropping result Add Gaussian noise to achieve differential privacy: .

[0071] in, This represents the update vector after injecting differential privacy noise. This indicates that the mean is zero and the covariance matrix is... Gaussian noise function, It is the identity matrix. The noise scale parameter is calculated based on a preset privacy budget.

[0072] This embodiment combines differential privacy noise injection with gradient pruning to theoretically and strictly satisfy differential privacy, effectively defending against member inference attacks.

[0073] It is important to note that in this embodiment of the invention, a differential privacy protection mechanism is used when the vehicle uploads parameters. Local Differential Privacy (LDP) can be selected: each vehicle adds noise during data preprocessing or feature extraction, achieving more thorough privacy localization. Secure Multi-Party Computation (MPC) can also be chosen: multiple vehicles or servers collaborate, completing model aggregation through secret sharing and protocol computation, ensuring that no single party can obtain plaintext updates from other parties. In some other implementations, homomorphic encryption can be used instead of differential privacy. The vehicle uses a public key from the cloud for updates. Upload after encryption [ The cloud performs an aggregation operation in encrypted form to obtain [ The data is then sent out again and decrypted by an authorized party with the private key. This method provides stronger privacy protection.

[0074] S2.2.3: Perform double compression and error compensation on the update vector after injecting differential privacy noise.

[0075] In one specific implementation, to reduce communication overhead, the noisy updates are compressed. The vehicle-side employs a dual compression method based on Top-K sparsity and low-bit quantization to compress the update vector after injecting differential privacy noise. The dual compression technique (Top-K and low-bit quantization) reduces the amount of communication data per round by 90-95%, making large-scale federated training possible under limited bandwidth.

[0076] Specifically, Top-k sparsity: only retain The top k% of updated parameters with the largest absolute values , Given a binary mask with all other parameters set to zero, we obtain a sparsely updated mask vector. .

[0077] This embodiment further reduces the risk of leaking complete feature information from a single parameter update by using Top-K sparsity. Experiments show that, under the same privacy budget, the accuracy of this embodiment is more than 15% lower than the benchmark scheme under member inference attacks.

[0078] It is worth noting that in some other implementations, when uploading model updates, the vehicle can use stochastic sparsity: discarding gradients with random probabilities instead of selecting Top-K. Alternatively, low-rank decomposition can be used: decomposing the model update matrix into the product of two low-rank matrices, and only transmitting these two smaller matrices.

[0079] Low-bit quantization: The non-zero parameters are uniformly quantized from 32-bit floating-point numbers to b-bit integers (such as 2-bit or 4-bit). The quantization formula is: .

[0080] in, Indicates parameters Quantized b-bit integer value; This is the rounding function; for One of the non-zero parameter values; and They are respectively The minimum and maximum values ​​of all non-zero parameters in the quantization; b is the number of quantization bits.

[0081] Error compensation is then performed. An error feedback mechanism is used to accumulate the error generated in this round of quantization into the next round of local update to ensure convergence. Let the quantization error in round t be . The calculation method is as follows: .

[0082] in This is an approximation obtained by dequantizing the quantized integer value (restoring it to a floating-point number). This error... It will be cached and added to the original gradient before the next round of training begins.

[0083] The error feedback mechanism ensures the convergence of the compressed model. Experiments on the standard vehicle networking IDS dataset show that the number of communication rounds required to achieve the target detection accuracy in this embodiment is only 10-15% more than that in the uncompressed scheme, but the total communication cost is reduced by more than 85%.

[0084] S2.2.4: Finally, the quantized non-zero parameters and their corresponding indices (from the mask) are... (Generation) and necessary metadata (such as data volume | |) Package into an upload package It is then encrypted and sent to the cloud.

[0085] S3: The cloud uses a multi-stage robust aggregation mechanism and dynamic trust management model to perform security screening on the encrypted and updated model parameters to obtain the global model.

[0086] S3.1: The cloud uses a multi-stage robust aggregation mechanism to perform secure screening of the encrypted and updated model parameters.

[0087] S3.1.1: The first stage involves fast similarity screening based on Locality Sensitive Hash (LSH).

[0088] In one specific implementation, the cloud receives data from each vehicle terminal. The sparse update vector is reconstructed based on the index and quantization parameters. Using LSH to update high-dimensional vectors Mapping to low-dimensional signatures, we quickly calculate approximate cosine similarity, filter out outliers that are significantly dissimilar to most updates, and perform initial isolation.

[0089] S3.1.2: The second stage involves clustering and elimination operations based on Mahalanobis distance.

[0090] In one specific implementation, for updates that pass the initial screening, the Mahalanobis distance between them and the update distribution center is calculated: .

[0091] in, The calculated Mahalanobis distance is given by μ and Σ, which are the mean and covariance matrices of the current update set, respectively. Updates exceeding a preset threshold are deemed suspicious and removed, resulting in a set of trustworthy vehicle endpoints. .

[0092] It is worth noting that in some other implementations, the Bulyan algorithm can be used instead of the combination of LSH and Mahalanobis distance during cloud aggregation: first, a set of candidate updates is selected through multiple Krum algorithms, and then the median of the coordinate dimensions of these candidate updates is taken, combining the robustness of Krum and the stability of Median. Alternatively, aggregation based on reinforcement learning can be used: an agent is trained to dynamically learn and assign appropriate aggregation weights based on the historical behavior of the vehicle and the current update features.

[0093] S3.1.3: The third stage combines trust weights for robust aggregation.

[0094] In one specific implementation, a dynamically weighted aggregation strategy is adopted, and the global model update formula is: .

[0095] in: , These are the global model parameters before and after the t-th round of aggregation, respectively; Let be the learning rate in round t; Let t be the set of trusted vehicle terminals in round t; Let i be the dynamic trust weight of vehicle i in round t. The number of samples in the local dataset of vehicle i, ( Represents the local dataset. (representing the cardinality of a set); This is the model update vector uploaded by vehicle i, after gradient clipping, differential privacy noise addition, and compression.

[0096] It should be noted that in the molecule Since the update vectors differ depending on the vehicle i, the denominator cannot be reduced to the numerator. This formula achieves an aggregation method that weights each vehicle i by trust weight and data volume, effectively suppressing the impact of malicious updates on the global model.

[0097] This embodiment can effectively identify and isolate up to 20% of malicious vehicle endpoints through a multi-stage robust aggregation mechanism (LSH initial screening and Mahalanobis distance clustering), while the benchmark Krum or Trimmed-mean method has begun to fail at this ratio.

[0098] S3.2: The cloud-based system performs dynamic trust weight calculation on the encrypted and updated model parameters based on the dynamic trust management model.

[0099] In one specific implementation, for a set The vehicle end in the middle, based on its dynamic trust score Calculate aggregate weights Dynamic trust score for each vehicle i Updated dynamically based on its historical behavior: .

[0100] in, The cosine similarity between the current model update direction and the global update direction. The cosine similarity between the previous model update and the global update direction; To ensure performance consistency of the local vehicle model on a clean validation set maintained in the cloud; This represents the deviation between the frequency of alarms triggered on this vehicle and the global alarm trend.

[0101] Trust weight Then by =Sigmoid( - ) calculate, where This is the activation threshold.

[0102] The dynamic trust management model in this embodiment can promptly detect vehicles that exhibit "behavioral drift" (i.e., nodes that change from good to bad). Compared to the static trust mechanism, it can reduce the impact of poisoning attacks on the global model performance by 30% in simulation experiments.

[0103] It should be noted that the embodiments of the present invention use a linearly weighted trust score with multiple indicators. In some other implementations, a trust model based on Bayesian inference can be used: the trustworthiness of the vehicle is treated as a random variable, and its posterior probability distribution is dynamically updated based on the behavioral evidence (such as similarity) uploaded each time. Alternatively, a blockchain-based trust record can be used: the trust score and key behaviors of the vehicle are recorded on an immutable blockchain to achieve transparency and traceability of trust history and prevent tampering with the central server.

[0104] S4: The cloud sends the global model and corresponding data to the vehicle for real-time monitoring and feedback.

[0105] In one specific implementation, the cloud will aggregate the new global model. The necessary metadata (such as new detection thresholds) is then distributed to all vehicles. After the vehicles load the new model, they perform detection on the real-time data stream, i.e., on the feature vectors generated in real time. Perform forward propagation and calculate the anomaly score. (e.g., reconstruction error): .

[0106] in: The feature vector is obtained by real-time collection from the vehicle end and after feature extraction and standardization. and These are the encoder and decoder functions of the local autoencoder (the same model structure used in the training phase). The calculated anomaly score indicates that the higher the value, the greater the deviation of the input sample from the normal pattern.

[0107] like > ( If the anomaly detection threshold is dynamically adjusted and can be adaptively updated based on historical detection results, a local alarm is triggered, and predefined mitigation strategies are executed (such as logging security events, restricting communication of specific ECUs, and issuing visual / auditory warnings to the driver). Simultaneously, an anonymous alarm summary (containing timestamps, anomaly type, and hashed feature fingerprints) is uploaded to the cloud for updating global threat intelligence and vehicle-side trust assessments.

[0108] It should be noted that the embodiments of the present invention aggregate alarm summaries through the cloud. In some other implementations, a vehicle-side collaborative defense can be constructed: when a vehicle detects a threat, it first broadcasts an encrypted threat fingerprint to nearby vehicles or roadside units (RSUs) via V2V or V2I communication, achieving localized early warning with extremely low latency. Alternatively, federated threat intelligence generation can be used: instead of uploading specific alarms, each vehicle uploads a "threat detection sub-model" trained based on local alarm data. These sub-models are aggregated in the cloud to form a more powerful global threat intelligence model, which is then distributed to enhance the detection capabilities of each vehicle.

[0109] In cross-vehicle testing, this solution achieved an F1 score approximately 12% higher than the standard FedAvg. Dynamic trust weights and alarm consistency assessment enable the system to leverage collective intelligence to quickly identify new attack patterns, improving the detection rate of unknown attacks by approximately 20%.

[0110] For large fleets, edge servers can be introduced. Vehicles first send updates to nearby edge servers for intermediate aggregation, and then the edge servers upload the aggregated models to the cloud for global aggregation, thereby reducing cloud load and communication latency.

[0111] Example 2: Embodiment 2 of the present invention provides a vehicle network collaborative security defense system against poisoning attacks, including cloud and vehicle terminals.

[0112] The initial model is distributed from the cloud to all vehicles. The vehicles simultaneously acquire in-vehicle network data and external communication data and perform preprocessing.

[0113] The initial model is distributed from the cloud to all vehicles on the vehicle side.

[0114] In one specific implementation, the initial model in this embodiment can be pre-trained from publicly available vehicle network intrusion detection datasets (such as Car-Hacking, OTIDS, etc.), or pre-trained in the cloud based on a small amount of unlabeled normal vehicle data (such as autoencoder reconstruction training) to obtain an initial model that can initially represent normal communication patterns.

[0115] The vehicle simultaneously acquires in-vehicle network data and external communication data.

[0116] In one specific implementation, in-vehicle network data (CAN / CAN FD messages, AutoSARCP / AP logs) and external V2X communication data (BSM, CAM, DENM) are collected simultaneously.

[0117] Specifically, the vehicle collects the following multi-source heterogeneous data in real time through its built-in CAN bus interface, OBD-II port, and V2X communication module: In-vehicle network data: including all messages (ID, data field, timestamp) on the CAN / CAN FD bus.

[0118] Electronic Control Unit (ECU) operating status data: operating logs and status parameters obtained from the gateway or key ECUs (such as engine controllers and brake controllers).

[0119] V2X communication data: Basic safety messages (BSM), map data (MAP), and traffic light status (SPaT) received from other vehicles or roadside units (RSUs).

[0120] All raw data is encrypted locally in the vehicle and then temporarily stored in a secure cache with a circular overwrite mechanism, ensuring that the raw data never leaves the vehicle.

[0121] Preprocessing is performed on the vehicle side.

[0122] A sliding time window is used to segment the data stream.

[0123] In one specific implementation, a configurable time window length T (e.g., 1 second or 5 seconds, the length T can be adaptively adjusted) is set, and a sliding time window is used to segment the data stream, resulting in a window set { , ,..., } Where N is the number of windows. Automatically identify and remove obviously erroneous packets (such as CRC check failures or format mismatches). Align data from different sources by timestamp; for minor gaps caused by network jitter, use linear interpolation or previous value padding to complete them.

[0124] This process ensures the consistency and integrity of the input data.

[0125] Extract multidimensional feature vectors for each window.

[0126] In one specific implementation, for each time window The data within the dataset is processed in parallel to extract four types of features: statistical features, entropy features, time-series features, and frequency domain features, which together form the original feature vector. .

[0127] Specifically, statistical characteristics such as the frequency of message IDs appearing within the window. Mean of interval time , and standard deviation skewness, etc.

[0128] Entropy features include information entropy to measure data uncertainty: .

[0129] in, Entropy features Let be a random variable representing the distribution of message IDs. The total number of possible values ​​for the message ID. For value indexing, in this embodiment it refers to the vehicle end. For the first The specific value of the message ID, for The probability (frequency) of occurrence within the current time window.

[0130] By calculating autocorrelation coefficients and simple moving averages (SMA) using data within the window, temporal dependencies are captured, and temporal features are extracted using LSTNet or Transformer encoders. .

[0131] Perform a Fast Fourier Transform (FFT) on the message interval sequence or a specific data field sequence to extract the energy values ​​of the main frequency components.

[0132] Standardize all feature vectors.

[0133] In one specific implementation, subsequently, for Z-score standardization is performed to obtain the standardized feature vector.

[0134] .

[0135] in, The standardized feature vector, Original feature vector The mean vector of the features of the training set. is the standard deviation vector of the features in the training set.

[0136] The vehicle-side trains and fine-tunes the received initial model with the goal of minimizing reconstruction error or feature space compactness loss, and then performs encrypted updates on the fine-tuned model based on privacy protection processing.

[0137] The vehicle-side trains and fine-tunes the received initial model with the goal of minimizing reconstruction error or feature space compactness loss.

[0138] In one specific implementation, each vehicle end Local data The model is trained using a lightweight autoencoder or a deep one-class classification (Deep SVDD) model. This model consists of an encoder (Enc) and a decoder (Dec). The local optimization objective is to minimize either the reconstruction error or the feature space compactness loss.

[0139] This invention uses an autoencoder as an anomaly detector. Alternatively, one or a combination of the following models may be used: Deep Support Vector Data Description (Deep SVDD): Learns a minimum hypersphere that encloses all normal data, and classifies samples that fall outside the hypersphere as anomalous.

[0140] Graph Neural Networks (GNNs): If the vehicle network topology and communication relationships are modeled as a graph, GNNs can be used to learn the normal patterns of nodes (ECUs) and edges (communication links), which can effectively detect attacks based on topology relationships.

[0141] Transformer model: Utilizes its self-attention mechanism to better capture complex long-term dependencies and contextual information in connected vehicle data.

[0142] Taking an autoencoder as an example, the loss function is: .

[0143] in, Let i be the local loss function of vehicle i. and For autoencoder parameters ( For encoder parameters, (For decoder parameters) For local datasets, For the input feature vector, is the regularization coefficient. and These represent the forward computation functions of the encoder and decoder, respectively.

[0144] The vehicle receives the initial model parameters from the cloud. Afterwards, a personalized fine-tuning process of 1 to 3 epochs will be performed using local data to obtain a local model that is more suitable for its own data distribution. The vehicle-side personalized fine-tuning strategy in this embodiment significantly alleviates the performance degradation problem caused by Non-IID data distribution.

[0145] The vehicle-side uses privacy protection measures to encrypt and update the finely tuned model.

[0146] Calculate the update vector of the fine-tuned model and perform gradient clipping.

[0147] In one specific implementation, the formula for updating the computational model is: .

[0148] in, This is the parameter difference vector between the local model and the global model.

[0149] Gradient clipping is then performed. Norm constraints are applied to the update vector. : .

[0150] in, This represents the cropping result, where C is the preset cropping threshold.

[0151] Inject differential privacy noise into the cropping result.

[0152] In one specific implementation, in the cropping result Add Gaussian noise to achieve differential privacy: .

[0153] in, This represents the update vector after injecting differential privacy noise. This indicates that the mean is zero and the covariance matrix is... Gaussian noise function, It is the identity matrix. The noise scale parameter is calculated based on a preset privacy budget.

[0154] This embodiment combines differential privacy noise injection with gradient pruning to theoretically and strictly satisfy differential privacy, effectively defending against member inference attacks.

[0155] It is important to note that in this embodiment of the invention, a differential privacy protection mechanism is used when the vehicle uploads parameters. Local Differential Privacy (LDP) can be selected: each vehicle adds noise during data preprocessing or feature extraction, achieving more thorough privacy localization. Secure Multi-Party Computation (MPC) can also be chosen: multiple vehicles or servers collaborate, completing model aggregation through secret sharing and protocol computation, ensuring that no single party can obtain plaintext updates from other parties. In some other implementations, homomorphic encryption can be used instead of differential privacy. The vehicle uses a public key from the cloud for updates. Upload after encryption [ The cloud performs an aggregation operation in encrypted form to obtain [ The data is then sent out again and decrypted by an authorized party with the private key. This method provides stronger privacy protection.

[0156] The update vector after injecting differential privacy noise is subjected to dual compression and error compensation.

[0157] In one specific implementation, to reduce communication overhead, the noisy updates are compressed. The vehicle-side employs a dual compression method based on Top-K sparsity and low-bit quantization to compress the update vector after injecting differential privacy noise. The dual compression technique (Top-K and low-bit quantization) reduces the amount of communication data per round by 90-95%, making large-scale federated training possible under limited bandwidth.

[0158] Specifically, Top-k sparsity: only retain The top k% of updated parameters with the largest absolute values , Given a binary mask with all other parameters set to zero, we obtain a sparsely updated mask vector. .

[0159] This embodiment further reduces the risk of leaking complete feature information from a single parameter update by using Top-K sparsity. Experiments show that, under the same privacy budget, the accuracy of this embodiment is more than 15% lower than the benchmark scheme under member inference attacks.

[0160] It is worth noting that in some other implementations, when uploading model updates, the vehicle can use stochastic sparsity: discarding gradients with random probabilities instead of selecting Top-K. Alternatively, low-rank decomposition can be used: decomposing the model update matrix into the product of two low-rank matrices, and only transmitting these two smaller matrices.

[0161] Low-bit quantization: The non-zero parameters are uniformly quantized from 32-bit floating-point numbers to b-bit integers (such as 2-bit or 4-bit). The quantization formula is: .

[0162] in, Indicates parameters Quantized b-bit integer value; This is the rounding function; for One of the non-zero parameter values; and They are respectively The minimum and maximum values ​​of all non-zero parameters in the quantization; b is the number of quantization bits.

[0163] Error compensation is then performed. An error feedback mechanism is used to compensate for the error caused by this round of quantization. Accumulate this to the next round of local updates to ensure convergence: .

[0164] in This is an approximation obtained by dequantizing the quantized integer value (restoring it to a floating-point number). This error... It will be cached and added to the original gradient before the next round of training begins.

[0165] The error feedback mechanism ensures the convergence of the compressed model. Experiments on the standard vehicle networking IDS dataset show that the number of communication rounds required to achieve the target detection accuracy in this embodiment is only 10-15% more than that in the uncompressed scheme, but the total communication cost is reduced by more than 85%.

[0166] Finally, the quantized non-zero parameters and their corresponding indices (obtained by a mask) are... (Generation) and necessary metadata (such as data volume | |) Package into an upload package It is then encrypted and sent to the cloud.

[0167] The cloud-based system uses a multi-stage robust aggregation mechanism and a dynamic trust management model to perform security screening on the encrypted and updated model parameters to obtain the global model.

[0168] The cloud-based system uses a multi-stage robust aggregation mechanism to securely filter the encrypted and updated model parameters.

[0169] The first stage involves rapid similarity screening based on Locality Sensitive Hash (LSH).

[0170] In one specific implementation, the cloud receives data from each vehicle terminal. The sparse update vector is reconstructed based on the index and quantization parameters. Using LSH to update high-dimensional vectors Mapping to low-dimensional signatures, we quickly calculate approximate cosine similarity, filter out outliers that are significantly dissimilar to most updates, and perform initial isolation.

[0171] The second stage involves clustering and elimination operations based on Mahalanobis distance.

[0172] In one specific implementation, for updates that pass the initial screening, the Mahalanobis distance between them and the update distribution center is calculated: .

[0173] in, The calculated Mahalanobis distance is given by μ and Σ, which are the mean and covariance matrices of the current update set, respectively. Updates exceeding a preset threshold are deemed suspicious and removed, resulting in a set of trustworthy vehicle endpoints. .

[0174] It is worth noting that in some other implementations, the Bulyan algorithm can be used instead of the combination of LSH and Mahalanobis distance during cloud aggregation: first, a set of candidate updates is selected through multiple Krum algorithms, and then the median of the coordinate dimensions of these candidate updates is taken, combining the robustness of Krum and the stability of Median. Alternatively, aggregation based on reinforcement learning can be used: an agent is trained to dynamically learn and assign appropriate aggregation weights based on the historical behavior of the vehicle and the current update features.

[0175] The third stage combines trust weights for robust aggregation.

[0176] In one specific implementation, a dynamically weighted aggregation strategy is adopted, and the global model update formula is: .

[0177] in: , These are the global model parameters before and after the t-th round of aggregation, respectively; Let be the learning rate in round t; Let t be the set of trusted vehicle terminals in round t; Let i be the dynamic trust weight of vehicle i in round t. The number of samples in the local dataset of vehicle i, ( Represents the local dataset. (representing the cardinality of a set); This is the model update vector uploaded by vehicle i, after gradient clipping, differential privacy noise addition, and compression.

[0178] It should be noted that in the molecule Since the update vectors differ depending on the vehicle i, the denominator cannot be reduced to the numerator. This formula achieves an aggregation method that weights each vehicle i by trust weight and data volume, effectively suppressing the impact of malicious updates on the global model.

[0179] This embodiment can effectively identify and isolate up to 20% of malicious vehicle endpoints through a multi-stage robust aggregation mechanism (LSH initial screening and Mahalanobis distance clustering), while the benchmark Krum or Trimmed-mean method has begun to fail at this ratio.

[0180] The cloud-based system performs dynamic trust weight calculations on the encrypted and updated model parameters based on a dynamic trust management model.

[0181] In one specific implementation, for a set The vehicle end in the middle, based on its dynamic trust score Calculate aggregate weights Dynamic trust score for each vehicle i Updated dynamically based on its historical behavior: .

[0182] in, The cosine similarity between the current model update direction and the global update direction. The cosine similarity between the previous model update and the global update direction; To ensure performance consistency of the local vehicle model on a clean validation set maintained in the cloud; This represents the deviation between the frequency of alarms triggered on this vehicle and the global alarm trend.

[0183] Trust weight Then by =Sigmoid( - ) calculate, where This is the activation threshold.

[0184] The dynamic trust management model in this embodiment can promptly detect vehicles that exhibit "behavioral drift" (i.e., nodes that change from good to bad). Compared to the static trust mechanism, it can reduce the impact of poisoning attacks on the global model performance by 30% in simulation experiments.

[0185] It should be noted that the embodiments of the present invention use a linearly weighted trust score with multiple indicators. In some other implementations, a trust model based on Bayesian inference can be used: the trustworthiness of the vehicle is treated as a random variable, and its posterior probability distribution is dynamically updated based on the behavioral evidence (such as similarity) uploaded each time. Alternatively, a blockchain-based trust record can be used: the trust score and key behaviors of the vehicle are recorded on an immutable blockchain to achieve transparency and traceability of trust history and prevent tampering with the central server.

[0186] The cloud sends the global model and corresponding data to the vehicle for real-time monitoring and feedback.

[0187] In one specific implementation, the cloud will aggregate the new global model. The necessary metadata (such as new detection thresholds) is then distributed to all vehicles. After the vehicles load the new model, they perform detection on the real-time data stream, i.e., on the feature vectors generated in real time. Perform forward propagation and calculate the anomaly score. (e.g., reconstruction error): .

[0188] in: The feature vector is obtained by real-time collection from the vehicle end and after feature extraction and standardization. and These are the encoder and decoder functions of the local autoencoder (the same model structure used in the training phase). The calculated anomaly score indicates that the higher the value, the greater the deviation of the input sample from the normal pattern.

[0189] like > ( If the anomaly detection threshold is dynamically adjusted and can be adaptively updated based on historical detection results, a local alarm is triggered, and predefined mitigation strategies are executed (such as logging security events, restricting communication of specific ECUs, and issuing visual / auditory warnings to the driver). Simultaneously, an anonymous alarm summary (containing timestamps, anomaly type, and hashed feature fingerprints) is uploaded to the cloud for updating global threat intelligence and vehicle-side trust assessments.

[0190] It should be noted that the embodiments of the present invention aggregate alarm summaries through the cloud. In some other implementations, a vehicle-side collaborative defense can be constructed: when a vehicle detects a threat, it first broadcasts an encrypted threat fingerprint to nearby vehicles or roadside units (RSUs) via V2V or V2I communication, achieving localized early warning with extremely low latency. Alternatively, federated threat intelligence generation can be used: instead of uploading specific alarms, each vehicle uploads a "threat detection sub-model" trained based on local alarm data. These sub-models are aggregated in the cloud to form a more powerful global threat intelligence model, which is then distributed to enhance the detection capabilities of each vehicle.

[0191] In cross-vehicle testing, this solution achieved an F1 score approximately 12% higher than the standard FedAvg. Dynamic trust weights and alarm consistency assessment enable the system to leverage collective intelligence to quickly identify new attack patterns, improving the detection rate of unknown attacks by approximately 20%.

[0192] For large-scale fleets, edge servers can be introduced. Vehicles first send updates to a nearby edge server for intermediate aggregation, and then the edge server uploads the aggregated model to the cloud for global aggregation, thereby reducing cloud load and communication latency. The steps and methods involved in Embodiment 2 correspond to those in Embodiment 1, and specific implementation details can be found in the relevant descriptions of Embodiment 1.

[0193] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0194] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in or transmitted through a computer-readable storage medium. The computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data processing device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium, an optical medium, or a semiconductor medium, etc.

[0195] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A collaborative security defense method for vehicle-to-everything (V2X) networks against poisoning attacks, characterized in that, Includes the following steps: The initial model is distributed from the cloud to all vehicles. The vehicles simultaneously acquire in-vehicle network data and external communication data and perform preprocessing. The vehicle-side trains and fine-tunes the received initial model with the goal of minimizing reconstruction error or feature space compactness loss, and then performs encrypted updates on the fine-tuned model based on privacy protection processing. The cloud-based system uses a multi-stage robust aggregation mechanism and a dynamic trust management model to perform security screening on the encrypted and updated model parameters to obtain the global model. The cloud sends the global model and corresponding data to the vehicle for real-time monitoring and feedback.

2. The vehicle network collaborative security defense method against poisoning attacks as described in claim 1, characterized in that, The specific steps for preprocessing on the vehicle side are as follows: The data stream is segmented using a sliding time window; Extract multidimensional feature vectors for each window; Standardize all feature vectors.

3. The vehicle network collaborative security defense method against poisoning attacks as described in claim 1, characterized in that, The specific steps for the vehicle-side to perform encrypted updates on the fine-tuned model based on privacy protection are as follows: Calculate the update vector of the fine-tuned model and perform gradient clipping; Inject differential privacy noise into the cropping result; The update vector after injecting differential privacy noise is subjected to dual compression and error compensation.

4. The vehicle network collaborative security defense method against poisoning attacks as described in claim 1, characterized in that, The vehicle side employs a dual compression method based on Top-K sparsity and low-bit quantization to compress the update vector after injecting differential privacy noise.

5. The vehicle network collaborative security defense method against poisoning attacks as described in claim 1, characterized in that, The specific steps for the cloud-based, multi-stage robust aggregation mechanism to securely screen the encrypted and updated model parameters are as follows: The first stage involves fast similarity filtering based on locality-sensitive hashing; The second stage involves clustering and elimination operations based on Mahalanobis distance; The third stage combines trust weights for robust aggregation.

6. A vehicle-to-everything (V2X) collaborative security defense system resistant to poisoning attacks, characterized in that, Including the cloud and vehicle terminals, the cloud distributes the initial model to all vehicles. The vehicles simultaneously acquire in-vehicle network data and external communication data and perform preprocessing. The vehicles train and fine-tune the received initial model with the goal of minimizing reconstruction error or feature space compactness loss. Based on privacy protection, the fine-tuned model is encrypted and updated. The cloud uses a multi-stage robust aggregation mechanism and dynamic trust management model to securely filter the encrypted updated model parameters to obtain the global model. The cloud then distributes the global model and corresponding data to the vehicles for real-time monitoring and feedback.

7. The vehicle network collaborative security defense system against poisoning attacks as described in claim 6, characterized in that, The specific steps for preprocessing on the vehicle side are as follows: The data stream is segmented using a sliding time window; Extract multidimensional feature vectors for each window; Standardize all feature vectors.

8. The vehicle network collaborative security defense system against poisoning attacks as described in claim 6, characterized in that, The specific steps for the vehicle-side to perform encrypted updates on the fine-tuned model based on privacy protection are as follows: Calculate the update vector of the fine-tuned model and perform gradient clipping; Inject differential privacy noise into the cropping result; The update vector after injecting differential privacy noise is subjected to dual compression and error compensation.

9. The vehicle network collaborative security defense system against poisoning attacks as described in claim 6, characterized in that, The vehicle side employs a dual compression method based on Top-K sparsity and low-bit quantization to compress the update vector after injecting differential privacy noise.

10. The vehicle network collaborative security defense system against poisoning attacks as described in claim 6, characterized in that, The specific steps for the cloud-based, multi-stage robust aggregation mechanism to securely screen the encrypted and updated model parameters are as follows: The first stage involves fast similarity filtering based on locality-sensitive hashing; The second stage involves clustering and elimination operations based on Mahalanobis distance; The third stage combines trust weights for robust aggregation.

Images