Lightweight VANET black hole attack and grey hole attack detection method

Abstract

The invention discloses a lightweight VANET black hole attack and gray hole attack detection method, relates to the technical field of vehicle-mounted ad hoc network communication security, and provides a lightweight black hole attack and gray hole attack detection scheme, so that vehicles and vehicles as well as vehicles and RSUs can cooperate to detect malicious vehicles. Meanwhile, calculation is unloaded to an upper-layer network, the calculation amount of resource-limited vehicles is reduced, the timeliness of data communication is realized on the premise of ensuring safe establishment of a route, three detection algorithms are designed, different types of malicious vehicles can be effectively detected, and the calculation amount of the vehicles is reduced.

Description

Technical Field

[0001] The invention relates to the technical field of vehicle-mounted self-organizing network communication security, and in particular to a lightweight VANET black hole attack and gray hole attack detection method. Background Art

[0002] The network of physical devices through which physical objects can exchange data with other devices is called the Internet of Things. The Internet of Vehicles (IoV) is a subset of the Internet of Things (IoT). IoV involves interconnected vehicle networks that communicate with each other and with the surrounding infrastructure to enhance traffic management, safety, and efficiency. Mobile ad hoc networks (MANETs) are self-organizing networks of mobile devices that can be connected without fixed infrastructure, enabling direct communication between devices and allowing the network to be dynamically formed and reconfigured as the devices move. Vehicular ad hoc networks (VANETs) are a special type of mobile ad hoc networks designed to facilitate communication between vehicles and roadside infrastructure, improve road safety, traffic management, and driving efficiency. AODV and DSR are commonly used routing protocols in ad hoc networks. DSR requires maintaining a large amount of routing information, which may bring greater overhead in highly dynamic networks, so the AODV protocol is adopted by most studies. AODV uses three types of control packets: route request (RREQ), route reply (RREP), and route error (RERR).

[0003] There are two kinds of malicious attacks in the Internet of Vehicles network, namely black hole attack and gray hole attack. Black hole attack can be divided into routing black hole attack and intelligent black hole attack. The former deceives neighboring vehicles by forging high sequence numbers or hop counts during the routing establishment process, so that other vehicles send data packets to the black hole vehicle, and then the black hole vehicle discards these data packets without passing them to the destination vehicle. This will lead to serious communication interruption, data loss and network performance degradation. The latter refers to the malicious vehicle being honest in the routing establishment stage and then discarding all data packets passing through it. The detection of intelligent black hole attack is more difficult than black hole attack because it is difficult to distinguish whether the reason for data packet loss is malicious discarding or packet loss caused by network failure. Gray hole attack is a variant of black hole attack. The malicious vehicle behaves honestly in the routing stage and then selectively discards some data packets or discards data packets at a specific time during the data transmission process, which makes it very difficult to detect gray hole vehicles. Gray hole attack has its own unique behavioral characteristics. It also discards DATA packets, but the malicious activities of the vehicle are limited to certain conditions or triggers. The two most common behaviors:

[0004] (1) Node-dependent attack: discarding packets directed to or from a certain victim node, while for other nodes, it operates normally by correctly routing packets to the target node.

[0005] (2) Time-dependent attacks - packets are dropped based on some predetermined / triggered times, while behaving normally in other instances. In a rapidly changing intelligent transportation network, if errors occur in packet delivery at a critical moment, it may cause serious traffic hazards.

[0006] However, due to the limited computing power of vehicles, similar intrusion detection system solutions are not applicable to the Internet of Vehicles. Therefore, we need to study a lightweight detection solution that can detect both black hole vehicles and gray hole vehicles at the same time, which is of great significance to the network communication security of the Internet of Vehicles. Summary of the invention

[0007] In view of the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a lightweight VANET black hole attack and gray hole attack detection method, a lightweight detection scheme for the known black hole attacks and gray hole attacks in the Internet of Vehicles network, and the detection is divided into three stages. Through the collaboration of vehicles and vehicles, vehicles and roadside units RSU, the proposed routing detection algorithm, intersection algorithm and mean algorithm are used for detection. The present invention has better performance overhead than the existing scheme.

[0008] To achieve the above object, the present invention provides the following technical solution: a lightweight VANET black hole attack and gray hole attack detection method, comprising the following steps:

[0009] Step 1: First, in order to ensure security during the route establishment phase and effectively identify specific types of black hole nodes, the roadside unit (RSU) is configured in promiscuous mode and continuously monitors the network activities of all vehicles within its communication range. The content monitored by the RSU covers the number of route request (RREQ) and route reply (RREP) control packets generated by each vehicle. The monitoring process starts from the time the vehicle enters the communication edge of the RSU until the vehicle leaves the communication range of the RSU. The RSU collects the RREQ and RREP control packet data of vehicles in its coverage area. Based on the collected information, a threshold parameter RRall is defined to evaluate and identify potential black hole behaviors.

[0010]

[0011] Among them, RREPall represents the number of all RREP control packets responded by vehicles within the communication range, RREQall represents the total number of RREQ control packets sent by vehicles within the communication range, and when vehicle i enters the communication range of RSU, RSU starts to monitor the ratio of RREQ control packets and RREP control packets generated by the vehicle RRi;

[0012]

[0013] The roadside unit (RSU) identifies black hole nodes by comparing the relative route request and response ratio (RRi) of a specific vehicle with a preset global threshold (RRall). If the RRi value of a vehicle exceeds the limit set by RRall, the vehicle is determined to be a potential black hole node and is automatically marked. The identification information of the vehicle will be included in the blacklist and notified to neighboring roadside units and vehicles through the network broadcast mechanism. The vehicle will be excluded from network communication to maintain the overall security of the network and the integrity of communication;

[0014] Step 2: The intelligent black hole and the gray hole nodes that the nodes depend on will discard all or part of the data packets passing through it. This type of malicious node behaves honestly in the route establishment phase and causes serious harm to the network. Redundant transmission is designed to achieve timely communication. In the route establishment phase, the vehicle selects multiple paths to the destination vehicle and sets the priority according to the path consumption. The data packet will be transmitted by the high-priority path. When the data packet transmission fails, the low-priority path will be used immediately for redundant transmission, and so on.

[0015] Step 3: The detection of intelligent black holes and node-dependent gray hole nodes requires recording the failure of sending data packets when the source vehicle sends data packets. The records include timestamp, source vehicle ID, intermediate vehicle ID, and destination vehicle ID, as shown below:

[0016] {timestamp|sourceID;IntermediateID i ,...,IntermediateID n ;DestinationID;}

[0017] The vehicle sends the record to the RSU, which executes the Classification algorithm to classify and aggregate it into a matrix, where the first column is the source ID, the last column is the destination vehicle ID, and the middle column is the forwarding vehicle ID. The RSUs share the matrix data through the secure channel between each other; when the number of records reaches the threshold, the RSU executes the intersection algorithm to detect malicious vehicles and add the malicious vehicle ID to the blacklist;

[0018] Step 4: Time-dependent gray hole nodes discard all data packets passing through them at specific or random times. This type of malicious vehicle detection is very difficult, and a detection algorithm based on real-time forwarding rate is proposed. Specifically, when the vehicle is driving and transmitting data, according to our definition, the real-time forwarding rate FR of the neighboring vehicles is recorded:

[0019]

[0020] Among them, R1 represents the count of response packets received by vehicle i from vehicle j, dji represents the line loss caused by j sending packets to i within time t, and Dij represents the total number of packets sent by vehicle i to vehicle j at time t;

[0021] The vehicle sends the forwarding rate of its neighbors to the RSU, which classifies and records the data and executes the detection algorithm to find malicious vehicles.

[0022] Preferably, the route is securely established: secure route establishment is the basis of secure communication. The roadside unit turns on the promiscuous mode to monitor the control messages generated by all vehicles within the monitoring range and calculates the threshold RRall. When vehicle i enters the monitoring range of a certain RSU, it monitors the vehicle's control message ratio RRi and compares it with the dynamic threshold RRall to ensure the secure establishment of the route.

[0023] Preferably, the intelligent black hole and node-dependent gray hole node detection: this type of malicious vehicles have similar characteristics, the vehicle collects information on sent data packets and uploads it to the roadside unit, which executes an intersection algorithm to detect malicious vehicles.

[0024] Preferably, the redundant transmission: in order to ensure the timely transmission of data, a redundant transmission algorithm is proposed, and the vehicle sets a priority for the existing routing path during the routing establishment phase. If the data packet transmission fails, the data packets are sent in sequence according to the priority to ensure the timely transmission of the data packets.

[0025] Preferably, the time-dependent gray hole node detection: a malicious vehicle that performs malicious behavior at a specific or random time, the vehicle records the forwarding rate of neighboring vehicles at a certain moment and reports it to the roadside unit RSU regularly, and the RSU executes an algorithm based on the forwarding rate data to find the malicious vehicle.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] The present invention proposes a routing black hole detection algorithm based on control messages, which offloads the calculation workload of routing security establishment to the roadside unit;

[0028] Redundant transmission is proposed to ensure timely transmission of data packets in the Internet of Vehicles network and smooth communication;

[0029] The proposed intersection algorithm detects both intelligent black hole attacks and node-dependent gray hole attacks together, reducing the computational complexity of RSU;

[0030] A customized forwarding rate algorithm is proposed to detect time-dependent gray hole attacks, achieving a low false detection rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of the system model of the present invention;

[0032] Figure 2 This is a schematic diagram of redundant transmission of the present invention. DETAILED DESCRIPTION

[0033] See also Figure 1-2 The present invention provides a technical solution: a lightweight VANET black hole attack and gray hole attack detection method, comprising the following steps:

[0034] Step 1: First, in order to ensure security during the route establishment phase and effectively identify specific types of black hole nodes, the roadside unit (RSU) is configured in promiscuous mode and continuously monitors the network activities of all vehicles within its communication range. The content monitored by the RSU covers the number of route request (RREQ) and route reply (RREP) control packets generated by each vehicle. The monitoring process starts from the time the vehicle enters the communication edge of the RSU until the vehicle leaves the communication range of the RSU. The RSU collects the RREQ and RREP control packet data of vehicles in its coverage area. Based on the collected information, a threshold parameter RRall is defined to evaluate and identify potential black hole behaviors.

[0035]

[0036] Among them, RREPall represents the number of all RREP control packets responded by vehicles within the communication range, RREQall represents the total number of RREQ control packets sent by vehicles within the communication range, and when vehicle i enters the communication range of RSU, RSU starts to monitor the ratio of RREQ control packets and RREP control packets generated by the vehicle RRi;

[0037]

[0038] The roadside unit (RSU) identifies black hole nodes by comparing the relative route request and response ratio (RRi) of a specific vehicle with a preset global threshold (RRall). If the RRi value of a vehicle exceeds the limit set by RRall, the vehicle is determined to be a potential black hole node and is automatically marked. The identification information of the vehicle will be included in the blacklist and notified to neighboring roadside units and vehicles through the network broadcast mechanism. The vehicle will be excluded from network communication to maintain the overall security of the network and the integrity of communication;

[0039] Step 2: The intelligent black hole and the gray hole nodes that the nodes depend on will discard all or part of the data packets passing through it. This type of malicious node behaves honestly in the route establishment phase and causes serious harm to the network. Redundant transmission is designed to achieve timely communication. In the route establishment phase, the vehicle selects multiple paths to the destination vehicle and sets the priority according to the path consumption. The data packet will be transmitted by the high-priority path. When the data packet transmission fails, the low-priority path will be used immediately for redundant transmission, and so on.

[0040] Step 3: The detection of intelligent black holes and node-dependent gray hole nodes requires recording the failure of sending data packets when the source vehicle sends data packets. The records include timestamp, source vehicle ID, intermediate vehicle ID, and destination vehicle ID, as shown below:

[0041] {timestamp|sourceID;IntermediateID i ,...,IntermediateID n ;DestinationID;}

[0042] The vehicle sends the record to the RSU, which executes the Classification algorithm to classify and aggregate it into a matrix, where the first column is the source ID, the last column is the destination vehicle ID, and the middle column is the forwarding vehicle ID. The RSUs share the matrix data through the secure channel between each other; when the number of records reaches the threshold, the RSU executes the intersection algorithm to detect malicious vehicles and add the malicious vehicle ID to the blacklist;

[0043]

[0044] Step 4: Time-dependent gray hole nodes discard all data packets passing through them at specific or random times. This type of malicious vehicle detection is very difficult, and a detection algorithm based on real-time forwarding rate is proposed. Specifically, when the vehicle is driving and transmitting data, according to our definition, the real-time forwarding rate FR of the neighboring vehicles is recorded:

[0045]

[0046] Among them, R1 represents the count of response packets received by vehicle i from vehicle j, dji represents the line loss caused by j sending packets to i within time t, and Dij represents the total number of packets sent by vehicle i to vehicle j at time t;

[0047] The vehicle sends the neighbor’s forwarding rate to the RSU, which classifies and records the data and executes the detection algorithm to find malicious vehicles;

[0048]

[0049]

[0050] Secure route establishment: Secure route establishment is the basis of secure communication. The roadside unit turns on the promiscuous mode to monitor the control messages generated by all vehicles within the monitoring range and calculates the threshold RRall. When vehicle i enters the monitoring range of a certain RSU, it monitors the vehicle's control message ratio RRi and compares it with the dynamic threshold RRall to ensure the secure establishment of the route. Intelligent black hole and node-dependent gray hole node detection: This type of malicious vehicles has similar characteristics. The vehicle collects information on the sent data packets and uploads it to the roadside unit, which executes the intersection algorithm to detect malicious vehicles.

[0051] Redundant transmission: In order to ensure the timely transmission of data, a redundant transmission algorithm is proposed. The vehicle sets the priority for the existing routing path during the routing establishment phase. If the data packet transmission fails, the data packets are sent in sequence according to the priority to ensure the timely transmission of the data packet. Time-dependent gray hole node detection: Malicious vehicles that perform malicious behaviors at specific or random times. The vehicle records the forwarding rate of neighboring vehicles at a certain moment and reports it to the roadside unit RSU regularly. The RSU executes the algorithm based on the forwarding rate data to find malicious vehicles.

Claims

1. A lightweight VANET black hole attack and gray hole attack detection method, characterized in that: The following steps are involved: Step 1: First, in order to ensure security during the route establishment phase and effectively identify specific types of black hole nodes, the roadside unit (RSU) is configured in promiscuous mode and continuously monitors the network activities of all vehicles within its communication range. The content monitored by the RSU covers the number of route request (RREQ) and route reply (RREP) control packets generated by each vehicle. The monitoring process starts from the time the vehicle enters the communication edge of the RSU until the vehicle leaves the communication range of the RSU. The RSU collects the RREQ and RREP control packet data of vehicles in its coverage area. Based on the collected information, a threshold parameter RRall is defined to evaluate and identify potential black hole behaviors. Among them, RREPall represents the number of all RREP control packets responded by vehicles within the communication range, RREQall represents the total number of RREQ control packets sent by vehicles within the communication range, and when vehicle i enters the communication range of RSU, RSU starts to monitor the ratio of RREQ control packets and RREP control packets generated by the vehicle RRi; The roadside unit (RSU) identifies black hole nodes by comparing the relative route request and response ratio (RRi) of a specific vehicle with a preset global threshold (RRall). If the RRi value of a vehicle exceeds the limit set by RRall, the vehicle is determined to be a potential black hole node and is automatically marked. The identification information of the vehicle will be included in the blacklist and notified to neighboring roadside units and vehicles through the network broadcast mechanism. The vehicle will be excluded from network communication to maintain the overall security of the network and the integrity of communication; Step 2: The intelligent black hole and the gray hole nodes that the nodes depend on will discard all or part of the data packets passing through it. This type of malicious node behaves honestly in the route establishment phase and causes serious harm to the network. Redundant transmission is designed to achieve timely communication. In the route establishment phase, the vehicle selects multiple paths to the destination vehicle and sets the priority according to the path consumption. The data packet will be transmitted by the high-priority path. When the data packet transmission fails, the low-priority path will be used immediately for redundant transmission, and so on. Step 3: The detection of intelligent black holes and node-dependent gray hole nodes requires recording the failure of sending data packets when the source vehicle sends data packets. The records include timestamp, source vehicle ID, intermediate vehicle ID, and destination vehicle ID, as shown below: {timestamp|sourceID;IntermediateID i ,...,IntermediateID n ;Destination ID;} The vehicle sends the record to the RSU, which executes the Classification algorithm to classify and aggregate it into a matrix, where the first column is the source ID, the last column is the destination vehicle ID, and the middle column is the forwarding vehicle ID. The RSUs share the matrix data through the secure channel between each other; when the number of records reaches the threshold, the RSU executes the intersection algorithm to detect malicious vehicles and add the malicious vehicle ID to the blacklist; Step 4: Time-dependent gray hole nodes discard all data packets passing through them at specific or random times. This type of malicious vehicle detection is very difficult, and a detection algorithm based on real-time forwarding rate is proposed. Specifically, when the vehicle is driving and transmitting data, according to our definition, the real-time forwarding rate FR of the neighboring vehicles is recorded: Among them, R1 represents the count of response packets received by vehicle i from vehicle j, dji represents the line loss caused by j sending packets to i within time t, and Dij represents the total number of packets sent by vehicle i to vehicle j at time t; The vehicle sends the forwarding rate of its neighbors to the RSU, which classifies and records the data and executes the detection algorithm to find malicious vehicles.

2. A lightweight VANET black hole attack and gray hole attack detection method according to claim 1, characterized in that: The secure establishment of the route: Secure route establishment is the basis of secure communication. The roadside unit turns on the promiscuous mode to monitor the control messages generated by all vehicles within the monitoring range and calculates the threshold RRall. When vehicle i enters the monitoring range of a certain RSU, it monitors the control message ratio RRi of the vehicle and compares it with the dynamic threshold RRall to ensure the secure establishment of the route.

3. A lightweight VANET black hole attack and gray hole attack detection method according to claim 1, characterized in that: The intelligent black hole and node-dependent gray hole node detection: This type of malicious vehicles have similar characteristics. The vehicle collects information on the sent data packets and uploads it to the roadside unit, which executes the intersection algorithm to detect malicious vehicles.

4. A lightweight VANET black hole attack and gray hole attack detection method according to claim 1, characterized in that: The redundant transmission: In order to ensure the timely transmission of data, a redundant transmission algorithm is proposed. The vehicle sets a priority for the existing routing path during the routing establishment phase. If the data packet transmission fails, the data packets are sent in sequence according to the priority to ensure the timely transmission of the data packet.

5. A lightweight VANET black hole attack and gray hole attack detection method according to claim 1, characterized in that: The time-dependent gray hole node detection: a malicious vehicle that performs malicious behavior at a specific or random time records the forwarding rate of neighboring vehicles at a certain moment and reports it to the roadside unit RSU regularly, and the RSU executes an algorithm to find the malicious vehicle based on the forwarding rate data.

Images