An internet of vehicles intrusion detection method based on a graph neural network

Abstract

This invention discloses a method for intrusion detection in the Internet of Vehicles (IoV) based on graph neural networks. The method includes: collecting IoV traffic data and preprocessing the raw traffic data; constructing a graph generation module to transform the preprocessed traffic data into graph-structured data; constructing a graph neural network model GraphSAGE as a graph feature extractor to extract structural and attribute features of the traffic; and using the extracted features as input to a Softmax layer to output a probability value indicating whether the traffic is attacking, thereby detecting intrusion. This invention demonstrates significant potential for IoV intrusion detection tasks, effectively improving the accuracy of intrusion detection.

Description

Technical Field

[0001] This invention belongs to the field of vehicle network security technology, specifically relating to a vehicle network intrusion detection method based on graph neural networks. Background Technology

[0002] With the practical application of emerging technologies such as 5G and artificial intelligence in intelligent transportation systems, the Internet of Vehicles (IoV) can truly achieve comprehensive network connectivity between vehicles, between vehicles and infrastructure, and between vehicles and people, thereby avoiding traffic accidents and improving transportation safety and efficiency. The relatively high speed of vehicles results in a highly dynamic network topology for IoVs, and the openness of wireless communication channels can lead to unstable network connections. These characteristics pose significant risks to IoV network security. Intrusion detection systems (IDS) can efficiently identify various malicious attacks by analyzing the large amounts of traffic information within the IoV network, making it a solution for ensuring IoV security.

[0003] To mitigate security risks in connected vehicles (V2X), many scholars have proposed intrusion detection methods for V2X using deep learning techniques. These methods primarily utilize deep learning to capture the high-dimensional features of raw V2X traffic data and the complex nonlinear relationship between this data and whether it represents malicious traffic, thereby identifying various attack behaviors in V2X. Dr. Wyk from the University of Tennessee proposed combining convolutional neural networks with... Anomaly detection methods combining Kalman filtering with detectors are used to detect abnormal behavior in connected vehicles. Dr. Zeng from Peking University proposed first extracting spatial features of traffic using a convolutional neural network, then inputting it into a long short-term memory network to learn a model of time-related features. Dr. Alladi from the Birla Institute of Science and Technology in India proposed first processing raw traffic into time-series data, then converting the time-series data into grayscale images for input into a convolutional neural network, thus transforming the problem into image classification. Subsequently, Dr. Alladi proposed using a deep learning model for sequence reconstruction, classifying the sequences by calculating the error between the original and reconstructed sequences to detect unknown network attacks.

[0004] However, the aforementioned deep learning techniques, which model vehicle network traffic as image or sequence data, have significant limitations. Ignoring the fact that vehicle networks are essentially graph-structured data leads to a high false positive rate. Discovering anomalous elements within graph-structured data is a challenging problem. Graph neural networks, as a deep learning technique for processing graph-structured data, have demonstrated powerful graph data fitting capabilities. Therefore, to address the vehicle network intrusion detection problem, this invention combines the network structure characteristics of vehicle networks with the attribute characteristics of traffic nodes, proposing a vehicle network intrusion detection method based on graph neural networks. Summary of the Invention

[0005] To address the problems existing in the prior art, the purpose of this invention is to provide a vehicle network intrusion detection method based on graph neural networks, so as to improve the accuracy of vehicle network intrusion detection and solve the network security problem of vehicle network communication.

[0006] To achieve the above objectives, the main steps of the method of the present invention include the following:

[0007] Step S1: Collect vehicle network traffic data and preprocess the raw traffic data;

[0008] Step S2: Construct a graph generation module to transform the preprocessed traffic data into graph structure data;

[0009] The graph generation module specifically includes:

[0010] S2.1: Constructing the vehicle communication graph G: Traffic data is identified by vehicle IDs and annotated by a set of fields that provide detailed flow information. The traffic data is represented in the form of a graph: G = (V, E), where the set of nodes V represents vehicles and the set of edges E represents the communication flow between vehicles; the vehicle network intrusion detection problem is modeled as an edge classification problem;

[0011] Introducing a line graph, a corresponding flow connectivity graph G is generated based on the vehicle communication graph G. L ;

[0012] S2.2: Construct the flow connectivity graph G L :G L =(V L E L ) represents the corresponding flow connectivity graph, E L G represents L The edge set represents the correlation between traffic flows, then G L The set of nodes of V is the set of edges of G, i.e., V L ={(v i ,v j )∈E}and|V L If |=|E|, then G is a node that shares a common node. L There exists an edge in G; L The edge set is represented by the adjacency matrix. express

[0013]

[0014] The attribute characteristics of a flow-connected graph are defined as follows: Where N represents the number of traffic flows, F represents the feature dimension of the traffic, and the traffic connectivity graph G is used. L The problem of intrusion detection in the Internet of Vehicles is transformed into a node classification problem;

[0015] Step S3: Construct a graph neural network module. Input the graph structure data mentioned above into the graph neural network module to extract the structural and attribute features of the traffic.

[0016] Step S4: Output the probability distribution of the extracted feature information through the Softmax layer, and evaluate the performance of the model based on relevant metrics.

[0017] Preferably, the preprocessing step S1 includes:

[0018] S1.1: Data cleaning: Eliminate redundant features, replace Nan with the average value, and replace Inf with the maximum value;

[0019] S1.2: Feature Numericalization: Use the get dummies function in Python to convert categorical features into numerical features;

[0020] S1.3: Feature Standardization: Since the scales of the various features in the data are different, the features are standardized in order to eliminate the influence of scale differences between features.

[0021] Preferably, the graph neural network module is a GraphSAGE module.

[0022] Preferably, the specific steps for constructing the GraphSAGE module are as follows:

[0023] S3.1: Based on the structural characteristics A of the constructed flow connectivity graph L and attribute features X L For each traffic node From its set of neighboring nodes A fixed number of nodes are randomly and uniformly sampled for feature aggregation, with the number of neighbors sampled being S. k If the actual number of neighbors is less than S k Then, a sampling method with replay is used if the actual number of neighbors is greater than S. k If so, then use a sampling method without playback;

[0024] S3.2: Select a pooling aggregation function to aggregate the features of adjacent nodes. The pooling function is symmetric because it is necessary to ensure that the output does not change with the order of the nodes, i.e., AGG(v1,v2) = AGG(v2,v1).

[0025] The pooling aggregation function for the k-th layer is defined as:

[0026]

[0027] in Representative node v i Neighbor set In the (k-1)th layer of aggregated features extracted by GraphSAGE, σ represents the non-linear activation function, W represents the weight matrix to be trained, and b represents the bias. The formula is explained as follows: first, the aggregated features of all adjacent nodes in the previous layer are passed through a fully connected layer, then the non-linear activation function is used, and finally max pooling is used for aggregation.

[0028] Then the adjacent nodes of the kth layer The aggregated information is represented as:

[0029]

[0030] S3.3: The representation vector of the neighboring nodes generated by aggregation Features of the layer preceding the central node The data is merged and finally fed into a fully connected layer to update the central node v. i The feature vectors are then normalized:

[0031]

[0032] After performing K-layer GraphSAGE aggregation on all traffic nodes in the vehicle-to-everything (V2X) network, for each traffic node v i Obtain the aggregation features of this node. This indicates that information from its K-hop neighborhood has been captured.

[0033] Preferably, the extracted feature information is output as a probability distribution through a Softmax layer, and the model performance is evaluated based on relevant metrics, specifically as follows:

[0034] The Softmax layer transforms the output of the GraphSAGE module into a probability distribution, with the class with the highest probability considered as the model's predicted class. After multiple iterations of training, backpropagation and weight updates are performed by calculating the cross-entropy loss between the model's predicted values ​​and the true labels. The Adam model optimizer is used to continuously optimize the model parameters, minimizing the loss and converging the weights to obtain the optimal model parameters. The model is then tested on a test set to obtain the predicted traffic categories, and its performance is evaluated based on relevant metrics, calculated as follows:

[0035]

[0036] Where TP represents the number of correctly predicted attack traffic, FN represents the number of attack traffic incorrectly identified as normal, and FP represents the number of normal traffic incorrectly identified as attacks.

[0037] The advantages of the intrusion detection method for vehicle network based on graph neural network of the present invention are as follows: (1) Considering that the essence of vehicle network is graph structure data, the present invention introduces graph neural network, a deep learning algorithm, to the intrusion detection task of vehicle network, which can fully capture the dependency relationship between vehicles, thereby improving the accuracy of intrusion detection and reducing the false alarm rate; (2) The present invention can detect abnormal traffic in the vehicle network communication process with relatively high accuracy even when there is only a small amount of abnormal data, which has practical application value; (3) The graph feature extraction module GraphSAGE designed in the present invention can be replaced by other graph neural network models, which has good scalability and applicability. Attached Figure Description

[0038] Figure 1 This is a flowchart of the vehicle network intrusion detection method based on graph neural networks of the present invention.

[0039] Figure 2 This is an example of the vehicle communication diagram and the corresponding traffic connectivity diagram of the present invention.

[0040] Figure 3 This is a schematic diagram of the GraphSAGE neural network structure of the present invention.

[0041] Figure 4 This is a comparison chart of the F1 score of the present invention and some existing methods.

[0042] Figure 5 This is a comparison chart of the recall rates of the present invention and some existing methods. Detailed Implementation

[0043] The technical solutions in the examples of this invention will now be described in detail with reference to the accompanying drawings:

[0044] like Figure 1 As shown, a vehicle network intrusion detection method based on graph neural networks includes the following steps:

[0045] Step S1: Collect vehicle network traffic data and preprocess the raw traffic data;

[0046] Due to the limited availability of intrusion detection datasets for connected vehicle networks, this embodiment utilizes the traditional network intrusion detection dataset UNSW-NB15, created by the University of New South Wales. This dataset is used to generate a hybrid of realistic modern normal activity and synthetic contemporary attack behavior. It includes nine attack types: Analysis, Backdoors, DoS, Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, and Worms. The Bro-IDS and Argus tools are used to extract desired features from the pcap files of the network data; these features help to construct both normal and attack behaviors of the traffic.

[0047] In this embodiment, the dataset is preprocessed as follows:

[0048] S1.1: Data cleaning: Eliminate redundant features. When the numerical type of the sample feature value is Nan, replace it with the average value of the feature value. When the numerical type of the sample feature value is Inf, replace it with the maximum value of the feature value.

[0049] S1.2: Feature Numericalization: Use the get dummies function in Python to convert categorical features into numerical features;

[0050] S1.3: Feature Standardization: Since the scales of the various features in the data are different, in order to eliminate the impact of scale differences between features on model performance, the features are standardized.

[0051] This embodiment uses the MinMaxScaler function from the sklearn library to scale each feature value, normalizing the data to the range [0,1]. The calculation formula is as follows:

[0052]

[0053] Where max(x(j)) represents the maximum value from feature j, and min(x(j)) represents the minimum value from feature j.

[0054] Step S2: Construct a graph generation module to transform the preprocessed traffic data into graph structure data;

[0055] The diagram generation module in step S2 specifically includes:

[0056] S2.1: Constructing the host communication graph G: Traffic data is identified by communication endpoints (IP address, port number) and annotated by a set of fields providing detailed flow information, such as packet count, byte count, and flow duration. Traffic data can naturally be represented as a graph: G = (V, E), where the set of nodes V represents the communication endpoints, and the set of edges E represents the communication flow between the endpoints. The vehicular network intrusion detection problem, i.e., determining whether a communication flow is attack traffic, is modeled as an edge classification problem in this embodiment.

[0057] Modeling nodes in graph neural networks is relatively easy, but modeling edges is much more complex. Therefore, we consider introducing line graphs to generate a corresponding traffic connectivity graph G based on the host communication graph G. L .

[0058] S2.2: Construct the flow connectivity graph G L :like Figure 2 The diagram illustrates an example of a flow connectivity graph derived from a host communication graph. Define G. L =(V L E L This represents the corresponding traffic connectivity graph, where the traffic format is [ID number, traffic characteristic, label], where the ID number is mapped from the communication endpoints (IP address, port number), and node v i Let G represent the i-th flow. L The set of nodes of V is the set of edges of G, i.e., V L ={(v i ,v j )∈E}and|V L If |=|E|, then if two edges in G share a node, that is, if two flows originate from the same communication endpoint, then G L There exists an edge in G that represents the correlation of traffic. L The edge set is represented by the adjacency matrix. express

[0059]

[0060] The attribute characteristics of a flow-connected graph are defined as follows: Where N represents the number of traffic flows, and F represents the feature dimension of the traffic. This is achieved using the traffic connectivity graph G. L The problem of intrusion detection in the Internet of Vehicles is transformed into a node classification problem.

[0061] Step S3: Construct the GraphSAGE module by inputting the above graph structure data into the graph neural network GraphSAGE module to extract the structural and attribute features of the flow.

[0062] In step S3, the GraphSAGE module is constructed. In this embodiment, the GraphSAGE module contains three GraphSAGE layers, such as... Figure 3 As shown, each layer includes a SAGEConv layer and an AGG layer, which are respectively the sampling neighbor convolution and the aggregation neighbor convolution. The specific operations are as follows:

[0063] S3.1: Based on the structural characteristics A of the constructed flow connectivity graph L and attribute features X L For each traffic node From its set of neighboring nodes A fixed number of nodes are randomly and uniformly sampled for feature aggregation. The number of neighbors sampled is S. k If the actual number of neighbors is less than S k Then, a sampling method with replay is used if the actual number of neighbors is greater than S. k If the sampling method is not replayable, then a sampling method without replay is used. In this embodiment, the sampling neighborhood range is different for each GraphSAGE layer. For a certain node v i The first layer samples its first-order neighbor S k =15, the second layer samples its second-order neighbor S k =10, the third layer samples its third-order neighbor S k =5.

[0064] S3.2: Select a pooling aggregation function to aggregate the features of adjacent nodes. The pooling function is symmetric because it is necessary to ensure that the output does not change with the order of the nodes, i.e., AGG(v1,v2) = AGG(v2,v1).

[0065] The pooling aggregation function for the k-th layer is defined as:

[0066]

[0067] in Representative node v i Neighbor set In the aggregated features extracted by GraphSAGE at layer k-1, σ represents the non-linear activation function, W represents the weight matrix to be trained, and b represents the bias. The formula is interpreted as follows: first, the aggregated features of all neighboring nodes from the previous layer are passed through a fully connected layer, then a non-linear activation function is used, and finally max pooling is applied for aggregation. Then, the neighboring nodes at layer k... The aggregated information can be represented as:

[0068]

[0069] S3.3: The representation vector of the neighboring nodes generated by aggregation Features of the layer preceding the central node The data is merged and finally fed into a fully connected layer to update the central node v. i The feature vectors are then normalized:

[0070]

[0071] After performing 3-layer GraphSAGE aggregation on all traffic nodes in the vehicle-to-everything (V2X) network, for each traffic node v i Obtain the aggregation features of this node. This indicates that information in its 3-hop neighborhood has been captured.

[0072] Step S4: The feature information extracted by GraphSAGE is output as a probability distribution through the Softmax layer, and the model performance is evaluated based on relevant metrics;

[0073] The Softmax layer transforms the output of the GraphSAGE module into a probability distribution, and the class with the highest probability is considered as the model's predicted class.

[0074] This example uses the PyTorch and DGL libraries. The performance of the GraphSAGE module largely depends on the optimal hyperparameters; therefore, Microsoft's AutoML platform NNI is used to automate hyperparameter tuning. The optimal hyperparameters are set to a learning rate of 0.0001, 500 training iterations, and a batch size of 1024. Glorot is used to initialize the weights of each layer, while the biases are initialized using a zero-mean Gaussian function.

[0075] After multiple iterations of training, backpropagation and weight updates are performed by calculating the cross-entropy loss between the model's predicted values ​​and the true labels. In this embodiment, the Adam model optimizer is used to continuously optimize the model parameters to minimize the loss and achieve weight convergence, thus obtaining the optimal model parameters. Then, the model is tested using a test set to obtain the predicted traffic categories, and the model performance is evaluated based on relevant metrics.

[0076] This embodiment includes a control group experiment, which compares and analyzes the results with four existing deep learning-based intrusion detection methods on the UNSW-NB15 dataset. The F1 score results are as follows: Figure 4 As shown, the recall rate results are as follows: Figure 5 As shown, the method of the present invention outperforms other deep learning models in the overall performance of vehicle network intrusion detection tasks.

[0077] In the specific embodiments of the present invention, any descriptions not covered herein are known in the art and may be implemented with reference to such known techniques.

[0078] The above specific embodiments are not intended to limit the scope of protection of this invention. Any equivalent changes or modifications made based on the technical concept of this invention shall still fall within the scope of protection of this invention.

Claims

1. A graph neural network-based vehicle networking intrusion detection method, characterized in that, The method specifically comprises the following steps: Step S1: collecting vehicle networking traffic data, and preprocessing original traffic data; Step S2: constructing a graph generation module to convert the pretreated traffic data into graph structure data; The graph generation module specifically comprises: S2.1: constructing a vehicle communication graph G: the traffic data is identified by a vehicle ID and is annotated by a set of fields providing flow details, and the traffic data is represented in the form of a graph: G=(V, E), wherein a node set V represents a vehicle, and an edge set E represents a communication flow between vehicles; the vehicle networking intrusion detection problem is modeled as an edge classification problem; introducing a line graph, generating a corresponding flow connectivity graph G based on the vehicle communication graph G L ; S2.2: Constructing the flow connectivity graph G L : G L = (V L , E L ) denotes the corresponding flow connectivity graph, E L denotes the edge set of G L , representing the correlation between flows, then the node set of G L is the edge set of G, i.e. V L = {(v i , v j ) ∈ E} and |V L | = |E|, there is an edge in G L if two edges in G share a node; the edge set of G L is represented by the adjacency matrix ​ The attribute feature of the flow connectivity graph is defined as Wherein N represents the number of flows, F represents the feature dimension of the flow, and the flow connectivity graph G L The vehicle networking intrusion detection problem is converted into a node classification problem; Step S3: constructing a graph neural network module, inputting the traffic connectivity graph G L to the graph neural network module to obtain the aggregated features of the traffic nodes; Step S4: outputting a probability distribution through a Softmax layer.

2. The vehicle networking intrusion detection method based on a graph neural network according to claim 1, characterized in that: The preprocessing in step S1 comprises: S1.1: data cleaning: eliminating redundant features, replacing Nan with an average value, and replacing Inf with a maximum value; S1.2: feature numericalization: converting classification features into numerical features by using a get dummies function in python; S1.3: feature standardization: since the scales of various features of the data are different, in order to eliminate the influence of the scale difference between features, the features are standardized.

3. The graph neural network-based intrusion detection method for Internet of Vehicles according to claim 1, characterized in that: The graph neural network module is a GraphSAGE module.

4. The graph neural network-based intrusion detection method for Internet of Vehicles according to claim 3, characterized in that: The graph neural network module specifically operates as follows: S3.1: According to the adjacency matrix A of the constructed traffic connectivity graph L and attribute features X L , for each traffic node From its adjacent node set Randomly uniformly sample a fixed number of nodes to aggregate features, and the number of sampled neighbors is S k If the actual number of neighbors is less than S k , use the sampling method with playback, and if the actual number of neighbors is greater than S k , use the sampling method without playback; S3.2: selecting a pooling aggregation function to aggregate the features of adjacent nodes, and the pooling function is symmetrical because it is necessary to ensure that the output does not change with the order of nodes, i.e., AGG(v1, v2) = AGG(v2, v1); The pooling aggregation function of the kth layer is defined as: wherein representative node v i a neighbor set of the aggregated features of the k-1 layer extracted by GraphSAGE, σ represents a nonlinear activation function, W represents a weight matrix to be trained, and b represents a bias quantity; the formula is analyzed as follows: first, the aggregated features of all adjacent nodes of the previous layer are passed through a fully connected layer, then a nonlinear activation function is used, and finally, maximum pooling is used for aggregation; then the neighboring nodes of the kth layer The aggregated information of the neighboring nodes of the kth layer is represented as: S3.3: aggregate the generated representation vectors of neighboring nodes features of the previous layer of center nodes merge, and finally input to a fully connected layer, updating the center node v i the feature vector of the center node v and normalize it: After K-layer GraphSAGE aggregation on all traffic nodes in the Internet of Vehicles, for each traffic node v i Get the aggregated features of this node represents capturing information in its K-hop neighborhood.

5. The graph neural network-based intrusion detection method for Internet of Vehicles according to claim 3, characterized in that: The output probability distribution of the extracted feature information through the Softmax layer is specifically as follows: According to the Softmax layer, the output result of the graph neural network module is converted into a probability distribution, and the class to which the class with the highest probability belongs is regarded as the predicted class of the graph neural network module; After multiple iterations of training, the cross-entropy loss of the predicted value and the true label is calculated to perform back propagation and update the weights, the Adam model optimizer is used to continuously optimize the parameters of the graph neural network module, so that the loss reaches a minimum, the weights converge, and the optimal parameters of the graph neural network module are obtained.

Images