Federal learning defense method against vehicle networking false client non-aware poisoning

Abstract

The application discloses a federal learning defense method resisting false client non-aware poisoning of Internet of Vehicles, CBS issues the received initial model to RSU, each CBS node performs local model training with a vehicle node, and the data set of the CBS is a clean data set by default. The RSU takes the trusted gradient issued by the CBS as a benchmark, compresses the difference between the uploaded gradient and the trust gradient in the overall value through normal distribution, calculates the cosine similarity between the trusted gradient and the vehicle uploaded gradient, accumulates the similarity score into a vehicle score list, calculates the proportion of the score of the vehicle in the vehicle score list in the overall score, and aggregates as a weight. After the server receives the CBS uploaded gradient, the higher the score, the proportion of the score in the total score is taken as a weight for aggregation. The method can relieve the calculation pressure of each layer node, prevent the poisoning attack of malicious nodes, and ensure the individualization of the model formed by different regional non-iid data sets and the generalization ability of the overall model in the Internet of Vehicles.

Description

Technical Field

[0001] This invention relates to a federated learning defense method for resisting undetected poisoning attacks from fake clients in the Internet of Vehicles (IoV), belonging to the field of IoV security information technology. In particular, it designs a robust aggregation method for personalized models of multiple malicious nodes and undetected poisoning attacks in the IoV based on hierarchical federated learning. Background Technology

[0002] The Internet of Vehicles (IoV) combines vehicle networks with the internet, enabling data exchange between people, vehicles, roads, and the cloud. Ultimately, this achieves intelligent transportation, intelligent vehicles, and intelligent driving, improving traffic efficiency. As an indispensable part of future smart cities, IoV can play a crucial role in alleviating traffic congestion and reducing traffic accidents. With increasing awareness of the overall comfort, safety, and convenience of connected cars, they will become increasingly popular and mainstream.

[0003] However, once cars are connected to the internet, the complex external environment generates a large amount of driving data. Cars need to quickly analyze this massive amount of data while ensuring its privacy is protected to prevent external attacks from posing a serious threat to vehicle network security. Federated learning, as an excellent privacy-preserving solution, allows model training without disclosing local datasets. Each car only needs to contribute a local model trained on its local dataset. The server receives model updates from different vehicles, aggregates them to generate a global model, and then distributes it to each vehicle. Through iteration, the global model tends towards the optimal model. While federated learning effectively protects data privacy, it cannot distinguish malicious data, making it vulnerable to data poisoning attacks. Malicious clients may manipulate local datasets or model updates, thereby corrupting the global model and significantly reducing its detection accuracy or rendering it unusable. In the Internet of Vehicles (IoV) scenario, the consequences of such attacks are even more severe; malicious control of car behavior can pose a serious threat to human life and property.

[0004] Traditional federated learning employs a two-tier architecture: a server-side layer and a client-side layer. However, in the Internet of Vehicles (IoV), the massive amounts of data uploaded by numerous vehicles place extremely high demands on the server's throughput and computing power. A single server clearly cannot meet the needs of IoV. Therefore, a multi-tiered vehicle-to-everything (V2X) architecture is required. This architecture comprises numerous nodes, including servers, Road Side Units (RSUs), Cellular Base Stations (CBSs), and vehicles. A server hosts several CBSs, each CBS hosts several RSUs, and each RSU covers a range of vehicles. This multi-tiered architecture solves the problems of extremely high throughput and communication latency caused by vehicles transmitting data. Furthermore, the multiple nodes allow for a divide-and-conquer approach to computational problems, significantly reducing the server's workload.

[0005] Currently, the hierarchical federated learning architecture for connected vehicles mainly suffers from the following three problems: 1) Most existing federated learning defense research assumes that malicious attackers account for a small proportion of all users. When malicious parties account for more than half, these defense methods will completely fail; 2) Current data poisoning defense methods are difficult to identify behaviors that disguise themselves as benign users and destroy the overall model by accumulating malicious gradients; 3) Existing federated learning aggregation models are single large models. However, in real-world connected vehicle scenarios, the types and proportions of data in different datasets may vary greatly. The global model cannot become the best local model for each location, and if the dataset in a certain location changes, the large model will have difficulty fitting and converging quickly. Summary of the Invention

[0006] The purpose of this invention is to provide a robust aggregation method for personalized models in vehicular networks (V2V) against multiple malicious nodes and imperceptible poisoning attacks, based on hierarchical federated learning. This method alleviates the computational burden on nodes at each layer while defending against poisoning attacks from malicious nodes, ensuring that the V2V model possesses both the personalization of models formed from non-iid datasets from different regions and the generalization ability of the overall model across the entire region. Furthermore, the personalized models in this invention achieve higher accuracy in fewer rounds compared to single models formed by other methods.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] A federated learning defense method to resist the undetected poisoning of fake clients in the Internet of Vehicles includes the following steps:

[0009] Step 1: The server in the Server layer distributes the initialized global model to all CBSs in the CBS layer.

[0010] Step two, CBS sends the received initial model to RSU.

[0011] Step 3: The RSU sends the received initial model to the vehicle.

[0012] Step 4: Each CBS node and vehicle node performs local model training.

[0013] Step 5: Each CBS sends its own different model gradients after training as reliable gradients to the RSU.

[0014] Step 6: The vehicle uploads the model gradient to the RSU.

[0015] Step 7: Each RSU uses the trusted gradient issued by CBS as a benchmark to perform robust aggregation of vehicle-to-everything (V2X) multi-malicious node data based on cumulative similarity on the gradient uploaded by the vehicle.

[0016] Step 8: RSU uploads the aggregated gradients.

[0017] Step 9: CBS uses its own trusted gradient as a benchmark to perform robust aggregation of multiple malicious nodes in the vehicle network based on cumulative similarity on the gradient uploaded by RSU.

[0018] Step 10: After each specified number of aggregation rounds, CBS uploads the accumulated gradient after aggregation.

[0019] Step 11: The server performs personalized model anti-similarity aggregation on the gradients uploaded by CBS.

[0020] Step 12: The server sends the aggregated gradients to the corresponding CBS.

[0021] In step one, the server is responsible for distributing the initial model to all CBSs below it.

[0022] In step two, CBS sends the received initial model to RSU, initializes the RSU score list, and prepares to start training using its own clean dataset (trust root data).

[0023] In step three, RSU sends the received initial model to the vehicles, prepares to receive the reliable gradients sent by CBS, and initializes the vehicle score list.

[0024] In step four, each CBS node and vehicle node performs local model training. The CBS dataset is a clean dataset by default, and the CBS dataset and its subordinate vehicle dataset are both non-iid datasets, with the same proportion of samples of different data types.

[0025] In step five, CBS sends out a reliable gradient.

[0026] In step six, the vehicle uploads the local gradient to the RSU.

[0027] In step seven, RSU uses the trusted gradient issued by CBS as a benchmark. First, it compresses the difference between the uploaded gradient and the trusted gradient in the overall value using a normal distribution. Then, it calculates the cosine similarity between the trusted gradient and the vehicle's uploaded gradient. The similarity score is accumulated into the vehicle score list. The proportion of a vehicle's own score in the vehicle score list to the total score is calculated and used as a weight for aggregation.

[0028] In step eight, RSU uploads the aggregated gradients.

[0029] In step nine, CBS uses its own trusted gradient as a benchmark. First, it compresses the difference between the uploaded gradient and the trusted gradient in the overall value using a normal distribution. Then, it calculates the cosine similarity between the trusted gradient and the RSU uploaded gradient. The similarity score is accumulated into the RSU score list. The proportion of RSU's own score in the RSU score list to the total score is calculated and used as a weight for aggregation.

[0030] In step ten, after a certain number of rounds, CBS uploads its own personalized gradient to the server.

[0031] In step eleven, after receiving the CBS uploaded gradient, the server performs personalized model anti-similarity aggregation of the number of CBS. Each time, the selected CBS personalized gradient is used as the benchmark. The lower the similarity between the other CBS gradients and this gradient, the higher the score. The aggregation is performed using the proportion of the score in the total score as the weight.

[0032] In step 12, the gradient generated from the aggregated individual gradients of the selected CBS will be sent to the selected CBS.

[0033] Compared with existing technologies, this method has the following advantages:

[0034] a. Layered federated learning based on vehicle-to-everything (V2X) can significantly reduce the computational burden on nodes compared to traditional two-layer federated learning;

[0035] b. A robust aggregation method for multiple malicious nodes in vehicle-to-everything (V2X) networks based on cumulative similarity can reduce malicious attacks by more than half.

[0036] The effects of RSU and vehicle-initiated attacks and undetectable poisoning attacks;

[0037] c. The personalized model formed in the CBS layer can achieve a higher recognition accuracy faster on the non-iid dataset compared to the single model formed by other methods. The anti-similarity aggregation method of the personalized model in the server layer can enable the CBS model to make up for the part that cannot be learned or is poorly learned due to the insufficient amount of certain types of data in the dataset.

[0038] d. When a new category appears in the local dataset, it will not immediately affect other CBS personality models. Other CBS will gradually learn the new category as the server layer aggregates. Attached Figure Description

[0039] Figure 1 This is a flowchart of the multi-layer architecture (MTHFL) of a personalized vehicle network model: 1. The server distributes the model to the CBS; 2. The CBS distributes the model to the RSU; 3. The RSU distributes the model to the vehicle; 4. Each CBS node and vehicle node perform local model training; 5. Each CBS distributes its different model gradients after training to the RSU; 6. The vehicle uploads the model gradient to the RSU; 7. Each RSU aggregates the gradients; 8. The RSU uploads the aggregated gradients; 9. The CBS aggregates the collected gradients; 10. After every t rounds of aggregation, the CBS uploads the aggregated gradients; 11. The server aggregates and uploads the gradients; 12. The server distributes the gradients.

[0040] Figure 2 This is a diagram of the malicious node attack path. Detailed Implementation

[0041] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0042] Figure 1 This is a flowchart of the multi-root trusted vehicle network personalized model multi-layer architecture (MTHFL).

[0043] MTHFL divides the vehicle-to-everything (V2X) network into four layers. The first layer is the Server layer, responsible for aggregating personalized models. The second layer is the CBS layer, which uses clean datasets as trust roots and is responsible for providing trust gradients and aggregating model gradients. The third layer is the RSU layer, which is responsible for aggregating model gradients. The fourth layer is the Vehicle layer, which consists of vehicle nodes. Vehicles collect data, train the model, and upload it to the nodes in the previous layer. The complete process is as follows: In MTHFL, the server distributes the initial model to the CBS, the CBS further distributes the model to the RSU, and the RSU then distributes the model to the vehicle. The CBS uses the pre-collected clean dataset to train the model and obtain trust gradients, then distributes the trust gradients to the RSU. At the same time, the vehicle uses its local dataset to train the model and uploads the model gradients to the RSU. Each RSU node aggregates the received gradients using trust root similarity and uploads the aggregated gradients to the CBS. The CBS then aggregates the collected gradients in the same way. Every 10 rounds of aggregation, the CBS uploads the accumulated aggregated gradients to the server, which performs the final aggregation. Through this sequence, the model gradient is passed and aggregated multiple times, ultimately forming the individual model required by each CBS. Figure 2 The overall process of a malicious node attack:

[0044] 1) When the malicious node is a vehicle, several malicious vehicles will upload poisoned gradients to RSU. After RSU aggregates the uploaded gradients, the RSU aggregated gradients are contaminated. RSU uploads the contaminated gradients to CBS for aggregation, and the individual models on CBS are contaminated. CBS uploads the contaminated individual gradients. After the Server model aggregates and distributes the gradients, the uploaded CBS contaminated individual gradients contaminate other clean CBS individual models. Then, when the gradients are distributed, the benign RSU and vehicle gradients are contaminated.

[0045] 2) When the malicious node is RSU, after RSU aggregates and uploads the gradient, it tampers with the gradient and then uploads the poisoned gradient to CBS. After CBS aggregates, the individual models on CBS are polluted. CBS uploads the polluted individual gradient. After the Server model is aggregated and distributed, the uploaded CBS polluted individual gradient causes other clean CBS individual models to be polluted. Then, when the gradient is distributed, it causes benign RSU and vehicle gradients to be polluted.

Claims

1. A federated learning defense method to resist the undetected poisoning of fake clients in the Internet of Vehicles, characterized in that, Includes the following steps: Step 1: The server in the Server layer distributes the initialized global model to all CBSs in the CBS layer; Step two, CBS sends the received initial model to RSU; Step 3: The RSU sends the received initial model to the vehicle; Step 4: Each CBS node and vehicle node performs local model training; Step 5: Each CBS sends its own different model gradients after training as reliable gradients to the RSU; Step 6: The vehicle uploads the model gradient to the RSU; Step 7: Each RSU uses the trusted gradient issued by CBS as a benchmark to perform robust aggregation of vehicle-to-everything (V2X) multi-malicious node aggregation based on cumulative similarity on the gradient uploaded by the vehicle. Step 8: RSU uploads the aggregated gradients; Step 9: CBS uses its own trusted gradient as a benchmark to perform robust aggregation of multiple malicious nodes in the vehicle network based on cumulative similarity on the gradient uploaded by RSU. Step 10: After each specified number of aggregation rounds, CBS uploads the accumulated gradient after aggregation. Step 11: The server performs personalized model anti-similarity aggregation on the gradients uploaded by CBS; Step 12: The server sends the aggregated gradients to the corresponding CBSs. In step seven, RSU uses the trusted gradient issued by CBS as a benchmark, compresses the difference between the uploaded gradient and the trusted gradient in the overall value through normal distribution, then calculates the cosine similarity between the trusted gradient and the vehicle uploaded gradient, accumulates the similarity score into the vehicle score list, calculates the proportion of the vehicle's own score in the vehicle score list to the total score, and uses it as a weight for aggregation. In step nine, CBS uses its own trusted gradient as a benchmark. First, it compresses the difference between the uploaded gradient and the trusted gradient in the overall value using a normal distribution. Then, it calculates the cosine similarity between the trusted gradient and the RSU uploaded gradient. The similarity score is accumulated into the RSU score list. The proportion of RSU's own score in the RSU score list to the total score is calculated and used as a weight for aggregation. In step eleven, after receiving the CBS uploaded gradient, the server performs personalized model anti-similarity aggregation of the number of CBS. Each time, the selected CBS personalized gradient is used as the benchmark. The lower the similarity between the other CBS gradients and this gradient, the higher the score. The aggregation is performed using the proportion of the score in the total score as the weight.

2. The federated learning defense method for resisting the undetected poisoning of fake clients in the Internet of Vehicles according to claim 1, characterized in that, In step one, the server distributes the initial model to all CBSs below it; In step two, CBS sends the received initial model to RSU, initializes the RSU score list, and prepares to start training using its own clean dataset, i.e., the root trust data.

3. The federated learning defense method for resisting the undetected poisoning of fake clients in the Internet of Vehicles according to claim 2, characterized in that, In step three, RSU sends the received initial model to the vehicles, prepares to receive the reliable gradients sent by CBS, and initializes the vehicle score list.

4. The federated learning defense method for resisting the undetected poisoning of fake clients in the Internet of Vehicles (IoV) according to claim 3, characterized in that, In step four, each CBS node and vehicle node performs local model training. The CBS dataset is a clean dataset by default. At the same time, the CBS dataset and its subordinate vehicle dataset are both non-iid datasets, and the proportion of samples of different data types is the same. In step five, CBS sends out a reliable gradient; In step six, the vehicle uploads the local gradient to the RSU.

5. The federated learning defense method for resisting the undetected poisoning of fake clients in the Internet of Vehicles according to claim 1, characterized in that, In step 12, the gradient generated from the aggregated individual gradients of the selected CBS will be sent to the selected CBS.

6. The federated learning defense method for resisting the undetected poisoning of fake clients in the Internet of Vehicles according to claim 1, characterized in that, The multi-layer architecture of the multi-credible root vehicle network personalized model MTHFL divides the vehicle network into four layers. The first layer is the Server layer, which is responsible for the aggregation of personalized models. The second layer is the CBS layer, which has a clean dataset as a credible root and provides credible gradient and model gradient aggregation. The third layer is the RSU layer, which is responsible for model gradient aggregation. The fourth layer is the Vehicle layer, which is the vehicle node. The vehicle collects data, trains the data and uploads it to the node of the previous layer. In MTHFL, the server sends the initial model to CBS, CBS then sends the model to RSU, and RSU then passes the model to the vehicle. CBS uses a pre-collected clean dataset to train the model and obtain trust gradients. The trust gradients are then sent to RSU. At the same time, vehicles use their local datasets to train the model and upload the model gradients to RSU. Each RSU node aggregates the received gradients using trust root similarity and uploads the aggregated gradients to CBS. CBS then aggregates the collected gradients in the same way. Every 10 rounds of aggregation, CBS uploads the accumulated aggregated gradients to the server. The server performs the final aggregation to form the personalized model required by each CBS.

7. The federated learning defense method for resisting the undetected poisoning of fake clients in the Internet of Vehicles according to claim 1, characterized in that, Overall process of malicious node attack: 1) When the malicious node is a vehicle, several malicious vehicles will upload poisoned gradients to RSU. After RSU aggregates and uploads the gradients, the RSU aggregated gradients are contaminated. RSU uploads the contaminated gradients to CBS for aggregation, and the individual models on CBS are contaminated. CBS uploads the contaminated individual gradients. After the Server model aggregates and distributes the gradients, the uploaded CBS contaminated individual gradients contaminate other clean CBS individual models. Then, when the gradients are distributed, the benign RSU and vehicle gradients are contaminated. 2) When the malicious node is RSU, after RSU aggregates and uploads the gradient, it tampers with the gradient and then uploads the poisoned gradient to CBS. After CBS aggregates, the individual models on CBS are polluted. CBS uploads the polluted individual gradient. After the Server model is aggregated and distributed, the uploaded CBS polluted individual gradient causes other clean CBS individual models to be polluted. Then, when the gradient is distributed, it causes benign RSU and vehicle gradients to be polluted.

Images