An information-physical fusion cyber attack detection method for multi-robot systems

Abstract

The present invention discloses an information-physical fusion network attack detection method for a multi-robot system, the detection method comprising: constructing a multi-robot system experimental platform; conducting a network attack on the multi-robot system experimental platform; collecting network traffic information and physical state information of the multi-robot system experimental platform after network intrusion; constructing an initial detection model using a convolutional neural network, training the initial detection model using a data set, and using the trained initial detection model as a target detection model; and realizing attack detection of the multi-robot system using the target detection model. The present invention uses a classification module constructed based on a convolutional neural network, which can quickly collect and classify network data and robot motion state data when the constructed Leader-Follower multi-robot system is subjected to different types of network attacks. The detection model not only improves the detection efficiency, but also has an accuracy rate of over 90% for abnormal data detection.

Description

Technical Field

[0001] The present invention relates to network attack security detection and computer deep learning technology, and in particular to an information-physical fusion network attack detection method for a multi-robot system. Background Art

[0002] In recent years, due to the rapid development of computing technology and wireless communication technology, multi-robot technology has made significant progress. Multi-robot systems have a wide range of applications and development prospects in healthcare, education, military security, culture and entertainment, industrial manufacturing, and service industries. Compared with a single robot, multi-robots can effectively complement multiple sensor information through information transmission. Even if the processing capacity of a single robot is limited, it can still coordinate with other robots. This collaborative method allows each robot to work autonomously while exchanging information for collaborative control, which brings strong robustness and scalability to the system. Multi-robot systems rely on networked communication technology to make them larger in scale, more complex in structure, and richer in functions. However, while networked communication technology has improved multi-robot systems, it has also exposed multi-robot systems to a more open and uncertain environment, and network security issues have increased accordingly.

[0003] Wireless communications between robots are easily intercepted, posing the risk of information leakage. In addition, robots acting as relay communications are vulnerable to malicious interference attacks, hindering the completion of designated tasks. Existing attacks against multi-robot systems mainly target their reliability, availability, and integrity. For example, a risk assessment of the PeopleBot mobile robot platform revealed two types of DoS attacks: flooding attacks and deauthentication attacks, which cut off the connection between the control end and the robot end. Another attack involves data injection, where nodes publish unauthorized data or commands, disrupting normal operations and potentially causing harm to individuals and equipment. In addition, stealth attacks on classic multi-robot formation systems are designed to achieve target-to-formation control protocols without destabilizing the system.

[0004] Various security solutions have been proposed, including firewalls, data encryption, and detection systems. Among active security protection technologies, network attack detection stands out. Many detection methods have been developed, such as a network attack detection model based on support vector machines, which uses the network traffic characteristics of robot operating systems to effectively identify system anomalies. In addition, intrusion network control systems are able to detect abnormal data based on the physical state information of the system. Although attack detection methods are constantly evolving, most of the existing methods only focus on physical or network characteristics, and there is little research on the deployment of attack detection algorithms on real platforms, especially attack detection algorithms based on deep learning. Summary of the invention

[0005] Purpose of the invention: In view of the above problems, the purpose of the present invention is to provide an information-physical fusion network attack detection method for a multi-robot system.

[0006] Technical solution: A method for detecting cyberattacks of a multi-robot system using information-physical fusion technology includes the following steps:

[0007] Step 1, constructing a multi-robot system experimental platform; the multi-robot system experimental platform includes a leader host and at least one follower host;

[0008] Step 2: Conduct a network attack on the multi-robot system experimental platform;

[0009] Step 3, collecting network traffic information and physical state information of the multi-robot system experimental platform after network intrusion, and constructing a data set using normal data, attack data, physical state information, and network traffic information;

[0010] Step 4: Use a convolutional neural network to build an initial detection model, use the data set to train the initial detection model, and use the trained initial detection model as the target detection model;

[0011] Step 5: Use the target detection model to implement attack detection of the multi-robot system.

[0012] Furthermore, the implementation process of step 1 includes:

[0013] Connect each communication node including the leader host and the follower host to the internal LAN for distributed communication configuration; build the simulation environment required for multi-robot operation on the leader host, and use the leader host to send the odometer information of the leader and follower to the follower host through the communication protocol; use the follower host to obtain the follower's speed and posture information data, and send the speed and posture information data to the leader host.

[0014] Furthermore, the implementation process of step 2 includes:

[0015] The attacker host is used to invade the internal LAN where the leader host is located, and the host information of all hosts in the internal LAN is scanned. The attacker host conducts false data injection attack, replay attack and DoS attack on the multi-robot system experimental platform.

[0016] Furthermore, the implementation process of step 3 includes:

[0017] Use network monitoring software to collect statistics about TCP and UDP network protocol communication traffic, including bandwidth, bits per second, packets per second, and ICMP packets per second;

[0018] The physical status information of the leader host and the follower host is obtained by using topic subscription, including the number of ARPs per second, the number of packets per second, and the average packet size. The network traffic data and physical status information of the attacked experimental platform are collected and summarized.

[0019] Furthermore, the initial detection model includes a preprocessing module, an effective feature self-learning module and a classification module, wherein the network traffic information and the physical status information are aligned and normalized by the preprocessing module to form information-physical data, the effective feature self-learning module is used to extract effective information of the information-physical data, and the classification module is used to classify the attack data.

[0020] Furthermore, the effective feature self-learning module includes an input layer, a convolutional layer, a ReLU layer, a pooling layer, a residual block, a linear layer and an output layer which are arranged in sequence.

[0021] Furthermore, the classification module is a softmax classifier.

[0022] Furthermore, the implementation process of the false data injection attack includes:

[0023] The attacker installs a network sniffing tool on the host, uses it to perform two-way deception on the leader host and the follower host, and intercepts the control information data transmitted between the leader host and the follower host;

[0024] The attacker host then injects attack values ​​into the control information data and uses the modified control information data to disrupt the coordinated movement between the leader host and the follower host.

[0025] Furthermore, the implementation process of the replay attack includes:

[0026] The attacker host saves any section of control information sent by the leader host to the follower host, and at some point the attacker host replays the control information back to the leader host.

[0027] Furthermore, the implementation process of DoS attack includes:

[0028] The attacker host continuously sends connection requests to the leader host to consume the leader host's bandwidth and prevent the leader host from receiving data information sent by the follower host.

[0029] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages:

[0030] The present invention is a network attack detection experiment conducted on the basis of constructing a Leader-Follower multi-robot system experimental platform. After the Leader-Follower multi-robot system suffers from false data injection attack, replay attack and DoS attack implemented by attackers, the coordinated motion process of the entire multi-robot system is destroyed. A network attack data set is constructed for this purpose, and classification detection is performed using a detection method based on physical features, a detection method based on network traffic characteristics and a detection method integrating information-physical features. The classification module based on convolutional neural network proposed in the present invention can quickly collect network data and robot motion state data and classify them when the constructed Leader-Follower multi-robot system is subjected to different types of network attacks. The network attack detection method not only improves the detection efficiency, but also has an accuracy rate of over 90% for abnormal data detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a flow chart of a method for detecting cyber-physical fusion network attacks on a multi-robot system of the present invention;

[0032] Figure 2 It is a flowchart of a method for detecting cyber attacks of a multi-robot system using information-physics fusion;

[0033] Figure 3 is a schematic diagram of the structure of a multi-robot system experimental platform in an embodiment;

[0034] Figure 4 is a structural diagram of a data acquisition effective feature self-learning module of an embodiment;

[0035] Figure 5 is an F-score histogram of the embodiment. DETAILED DESCRIPTION

[0036] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments.

[0037] The information-physical fusion network attack detection method for a multi-robot system described in this embodiment is as follows: Figure 1 and Figure 2 As shown, the detection method comprises the following steps:

[0038] Step 1, constructing a multi-robot system experimental platform; the multi-robot system experimental platform includes a leader host and at least one follower host;

[0039] Step 2: Conduct a network attack on the multi-robot system experimental platform;

[0040] Step 3, collecting network traffic information and physical state information of the multi-robot system experimental platform after network intrusion, and constructing a data set using normal data, attack data, physical state information, and network traffic information;

[0041] Step 4: Use a convolutional neural network to build an initial detection model, use the data set to train the initial detection model, and use the trained initial detection model as the target detection model;

[0042] Step 5: Use the target detection model to implement attack detection of the multi-robot system.

[0043] Specifically, the implementation process of step 1 includes:

[0044] Connect each communication node including the leader host and the follower host to the internal LAN for distributed communication configuration; build the simulation environment required for multi-robot operation on the leader host, and use the leader host to send the odometer information of the leader and follower to the follower host through the communication protocol; use the follower host to obtain the follower's speed and posture information data, and send the speed and posture information data to the leader host.

[0045] Specifically, the implementation process of step 2 includes:

[0046] The attacker host is used to invade the internal LAN where the leader host is located, and the host information of all hosts in the internal LAN is scanned. The attacker host conducts false data injection attack, replay attack and DoS attack on the multi-robot system experimental platform.

[0047] In one example, if Figure 3 As shown in the figure, according to the characteristics of the communication structure under the robot operating system, a Leader-Follower multi-robot system experimental platform is constructed. The multi-robot system experimental platform includes a leader host 1, a follower host 2, and experimental equipment such as a wireless router. All experimental equipment are connected to the internal LAN. The wireless router assigns IP addresses to the leader host 1 and the follower host 2. The Gazebo simulation environment where multiple robots are located is constructed on the leader host 1. The leader host 1 sends the leader and follower odometer information to the follower host 2 through the TCPROS communication protocol; the follower host 2 returns the follower speed and related data obtained by the control algorithm to the leader host 1. The attacker host 3 uses a WIFI cracking tool such as Aircrack-ng to obtain the WIFI password and then invades the internal LAN, and scans the internal LAN for host information to obtain the information sent by each node host.

[0048] Furthermore, the implementation process of the false data injection attack includes:

[0049] The attacker installs the network sniffing tool ettercap on the host, uses ettercap to perform two-way deception on the leader host and the follower host, and intercepts the control information data transmitted between the leader host and the follower host;

[0050] The attacker host then injects attack values ​​into the control information data and uses the modified control information data to disrupt the coordinated movement between the leader host and the follower host.

[0051] Furthermore, the implementation process of the replay attack includes:

[0052] The attacker host uses Lua language to intercept and save any section of control information sent by the leader host to the follower host, and at some point the attacker host replays the control information back to the leader host.

[0053] Furthermore, the implementation process of DoS attack includes:

[0054] The attacker host continuously sends connection requests to the leader host to consume the leader host's bandwidth and prevent the leader host from receiving data information sent by the follower host.

[0055] Specifically, the implementation process of step 3 includes:

[0056] Use the network monitoring software TCPSTAT to collect statistics about TCP and UDP network protocol communication traffic, including bandwidth, bits per second, number of packets per second, and number of ICMP packets per second; TCPSTAT monitors specific interfaces or reads data captured by the Tcpdump packet capture tool from a file.

[0057] Use topic subscription to obtain the physical status information of the leader host and follower host, including the number of ARPs per second, the number of packets per second, and the average packet size.

[0058] Specifically, the initial detection model includes a preprocessing module, an effective feature self-learning module and a classification module. The preprocessing module aligns and normalizes the network traffic information and the physical status information to form information-physical data. The effective feature self-learning module is used to extract effective information from the information-physical data. The classification module is used to classify the attack data.

[0059] In one example, the physical state information (i.e., physical data) and the network traffic information (i.e., network data) are first aligned and normalized through a preprocessing module. Twenty consecutive data in each time period after preprocessing are formed into a sample to form two-dimensional data containing physical data and network data. The data is used as label data to train the initial detection model.

[0060] like Figure 4 As shown, the effective feature self-learning module includes an input layer, a convolutional layer, a ReLU layer, a pooling layer, a residual block, a linear layer and an output layer arranged in sequence. The deep convolutional neural network is used to extract effective information from the original data to improve the accuracy.

[0061] The classification module uses a softmax classifier. Based on the features obtained by the effective feature self-learning module, such as the number of ARPs per second and bits per second, the classification module uses the softmax classifier that is most combined with CNN as the classification module. The mathematical model expression of the classifier is shown in the following formula:

[0062]

[0063] Among them, y j represents the probability of the jth category, θ j represents the jth weight vector, x (i) Represents the i-th data sample, k represents the category, Represents j categories scaled to the range of 0 to 1. The feature vector output by the effective feature self-learning module is input into the classification module to obtain whether the current multi-robot system experimental platform is in normal operation or under network attack, including false data injection attack, replay attack and DoS attack.

[0064] In order to further verify the effectiveness and detection effect of the information-physical fusion network attack detection method of the multi-robot system in this embodiment, PyTorch is used to implement the CNN model code, and the network attack detection method is evaluated through a four-classification experiment. The network attack detection method in this embodiment is compared with the detection method based on pure physical state and pure network traffic characteristics. The measurement indicators include accuracy, recall, and F-score. The accuracy rate represents the proportion of correctly classified samples to all samples; the recall rate represents the ratio of predicted real cases to all actual real cases; the F-score is an evaluation indicator that balances the above two indicators. The performance is compared using the accuracy rate, the recall rate, and the F-score measurement indicators. The results of the final experimental comparison are shown in Table 1.

[0065] Table 1 Comparison of evaluation index results

[0066]

[0067] Table 1 shows the data set constructed after preprocessing, including normal data (Normal in the table), false data injection attack data (FDI in the table), replay attack data (Replay in the table) and DoS attack data (Dos in the table). They are classified and detected using the detection method based on physical features (Physics in the table), the detection method based on network traffic characteristics (Net in the table) and the detection method based on fusion information physical features (Fusion in the table). The final data list is formed. Figure 5 It is a relatively compromise evaluation of the results in Table 1, using the F-score evaluation method. Figure 5 It better reflects that the data used by the fusion information physical detection method is richer. The horizontal axis represents various types of data, including normal data, replay attack data, FDI attack data, and DoS attack data. The vertical axis is the F-score evaluation index. It can be seen Figure 5 The detection method based on data fusion has better fitting ability and higher accuracy than the detection method based on pure physical state and pure network traffic characteristics.

[0068] The classification module based on convolutional neural network proposed in the present invention can quickly collect network data and robot motion state data and classify them when the constructed Leader-Follower multi-robot system is subjected to different types of network attacks. The network attack detection method not only improves the detection efficiency, but also has an accuracy rate of over 90% for abnormal data detection.

Claims

1. A cyber-physical fusion network attack detection method for a multi-robot system, characterized in that: The steps include: Step 1, constructing a multi-robot system experimental platform; the multi-robot system experimental platform includes a leader host and at least one follower host; Step 2: Conduct a network attack on the multi-robot system experimental platform; Step 3, collecting network traffic information and physical state information of the multi-robot system experimental platform after network intrusion, and constructing a data set using normal data, attack data, physical state information, and network traffic information; Step 4: Use a convolutional neural network to build an initial detection model, use the data set to train the initial detection model, and use the trained initial detection model as the target detection model; Step 5: Use the target detection model to implement attack detection of the multi-robot system; The implementation process of step 1 includes: Connect each communication node including the leader host and the follower host to the internal LAN to configure distributed communication; build the simulation environment required for multi-robot operation on the leader host, and use the leader host to send the odometer information of the leader and follower to the follower host through the communication protocol; use the follower host to obtain the speed and posture information data of the follower, and send the speed and posture information data to the leader host; The implementation process of step 2 includes: The attacker host is used to invade the internal LAN where the leader host is located, and the host information of all hosts in the internal LAN is scanned. The attacker host conducts false data injection attack, replay attack and DoS attack on the multi-robot system experimental platform respectively; The initial detection model includes a preprocessing module, an effective feature self-learning module and a classification module. The preprocessing module aligns and normalizes network traffic information and physical status information to form cyber-physical data. The effective feature self-learning module extracts effective information from cyber-physical data. The classification module classifies attack data. The effective feature self-learning module includes an input layer, a convolutional layer, a ReLU layer, a pooling layer, a residual block, a linear layer, and an output layer arranged in sequence; The classification module is a softmax classifier.

2. The method for detecting cyber-physical fusion network attacks of a multi-robot system according to claim 1, characterized in that: The implementation process of step 3 includes: Use network monitoring software to collect statistics about TCP and UDP network protocol communication traffic, including bandwidth, bits per second, packets per second, and ICMP packets per second; Use topic subscription to obtain the physical status information of the leader host and follower host, including the number of ARPs per second, the number of packets per second, and the average packet size.

3. The method for detecting cyber-physical fusion network attacks of a multi-robot system according to claim 2 is characterized in that: The implementation process of false data injection attack includes: The attacker installs a network sniffing tool on the host, uses it to perform two-way deception on the leader host and the follower host, and intercepts the control information data transmitted between the leader host and the follower host; The attacker host then injects attack values ​​into the control information data and uses the modified control information data to disrupt the coordinated movement between the leader host and the follower host.

4. The method for detecting cyber-physical fusion network attacks of a multi-robot system according to claim 3 is characterized in that: The implementation process of the replay attack includes: The attacker host saves any section of control information sent by the leader host to the follower host, and at some point the attacker host replays the control information back to the leader host.

5. The method for detecting cyber-physical fusion network attacks of a multi-robot system according to claim 4 is characterized in that: The implementation process of DoS attack includes: The attacker host continuously sends connection requests to the leader host to consume the leader host's bandwidth and prevent the leader host from receiving data information sent by the follower host.

Images