A lightweight method for detecting black hole and gray hole attacks in VANET

Abstract

The present invention discloses a lightweight VANET black hole attack and gray hole attack detection method, which relates to the field of vehicle-mounted self-organizing network communication security technology. It proposes a lightweight black hole attack and gray hole attack detection scheme, which enables vehicles to cooperate with each other and between vehicles and RSUs to detect malicious vehicles. At the same time, the calculation is offloaded to the upper network, reducing the calculation amount of resource-constrained vehicles. Under the premise of ensuring the secure establishment of routing, the timeliness of data communication is achieved. Three detection algorithms are designed, which can effectively detect different types of malicious vehicles and reduce the calculation amount of vehicles.

Description

Technical Field

[0001] The present invention relates to the field of vehicle-mounted self-organizing network communication security technology, and in particular to a lightweight VANET black hole attack and gray hole attack detection method. Background Art

[0002] The Internet of Things (IoT) is a network of physical devices that allows physical objects to exchange data with other devices. The Internet of Vehicles (IoV) is a subset of the Internet of Things (IoT). IoV involves interconnected networks of vehicles that communicate with each other and with surrounding infrastructure to enhance traffic management, safety, and efficiency. Mobile ad hoc networks (MANETs) are self-organizing networks of mobile devices that can connect without fixed infrastructure, enabling direct communication between devices and allowing the network to dynamically form and reconfigure as devices move. Vehicular ad hoc networks (VANETs) are a special type of mobile ad hoc network designed to facilitate communication between vehicles and roadside infrastructure, improving road safety, traffic management, and driving efficiency. AODV and DSR are commonly used routing protocols in ad hoc networks. DSR requires maintaining a large amount of routing information, which can incur significant overhead in highly dynamic networks. Therefore, AODV has been adopted by most research. AODV uses three types of control packets: route request (RREQ), route reply (RREP), and route error (RERR).

[0003] Two types of malicious attacks exist in connected vehicle networks: black hole attacks and gray hole attacks. Black hole attacks can be further categorized as routing black hole attacks and smart black hole attacks. The former involves forging high sequence numbers or hop counts during the route establishment process to deceive neighboring vehicles, causing them to send data packets to the black hole vehicle, which then discards these packets instead of delivering them to their destination. This can lead to severe communication disruptions, data loss, and network performance degradation. The latter involves a malicious vehicle acting honestly during the route establishment phase but then discarding all packets passing through it. Detecting smart black hole attacks is more difficult than black hole attacks because it is difficult to distinguish between malicious packet loss and loss caused by network failures. A gray hole attack is a variant of the black hole attack. A malicious vehicle acts honestly during the routing phase but then selectively discards some or specific packets during data transmission, making detection of gray hole vehicles extremely difficult. Gray hole attacks have unique behavioral characteristics. While they also discard data packets, the malicious activity is limited to certain conditions or triggers. The two most common behaviors are:

[0004] (1) Node-dependent attack—drops packets directed to or from a certain victim node, while for other nodes, it operates normally by correctly routing packets to the target node.

[0005] (2) Time-dependent attacks - packets are dropped based on some predetermined / triggered times, while behaving normally in other instances. In the ever-changing intelligent transportation network, if errors occur in packet delivery at a critical moment, it may cause serious traffic hazards.

[0006] However, due to the limited computing power of vehicles, similar intrusion detection system solutions are not applicable to the Internet of Vehicles. Therefore, we need to study a lightweight detection solution that can detect both black hole vehicles and gray hole vehicles at the same time, which is of great significance to the security of Internet of Vehicles network communications. Summary of the Invention

[0007] In view of the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a lightweight VANET black hole attack and gray hole attack detection method. The lightweight detection scheme for the known black hole attacks and gray hole attacks in the Internet of Vehicles network is divided into three stages. Through the collaboration between vehicles and vehicles, and vehicles and roadside units (RSUs), the proposed routing detection algorithm, intersection algorithm and mean algorithm are used for detection. The present invention has better performance overhead than the existing scheme.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a lightweight VANET black hole attack and gray hole attack detection method, comprising the following steps:

[0009] Step 1: First, to ensure security during the route establishment phase and effectively identify specific types of black hole nodes, the roadside unit (RSU) is configured in promiscuous mode and continuously monitors the network activity of all vehicles within its communication range. The RSU monitors the number of route request (RREQ) and route reply (RREP) control packets generated by each vehicle. This monitoring process begins when a vehicle enters the communication edge of the RSU and continues until it leaves the RSU's communication range. The RSU collects RREQ and RREP control packet data from vehicles in its coverage area and, based on this collected information, defines a threshold parameter, RRall, to assess and identify potential black hole behavior.

[0010]

[0011] Among them, RREPall represents the number of all RREP control packets responded by vehicles within the communication range, RREQall represents the total number of RREQ control packets sent by vehicles within the communication range, and when vehicle i enters the communication range of RSU, RSU starts to monitor the ratio RRi of RREQ control packets and RREP control packets generated by the vehicle;

[0012]

[0013] The roadside unit (RSU) identifies black hole nodes by comparing the relative route request and reply ratio (RRi) of a specific vehicle with a preset global threshold (RRall). If a vehicle's RRi value exceeds the limit set by RRall, the vehicle is determined to be a potential black hole node and is automatically marked. The vehicle's identification information will be blacklisted and notified to neighboring roadside units and vehicles through a network broadcast mechanism. The vehicle will be excluded from network communications to maintain the overall security of the network and the integrity of communications.

[0014] Step 2: Smart black holes and gray hole nodes that nodes rely on will discard all or part of the data packets passing through them. This type of malicious node behaves honestly during the route establishment phase and causes serious harm to the network. Redundant transmission is designed to ensure timely communication. During the route establishment phase, the vehicle selects multiple paths to the destination vehicle and sets priorities based on path consumption. Data packets will be transmitted via the high-priority path. If data packet transmission fails, the low-priority path will be immediately used for redundant transmission, and so on.

[0015] Step 3: The detection of smart black holes and node-dependent gray hole nodes requires recording the failure of sending data packets when the source vehicle sends data packets. The record includes the timestamp, source vehicle ID, intermediate vehicle ID, and destination vehicle ID, as shown below:

[0016] {timestamp|sourceID;IntermediateID i ,...,IntermediateID n ;DestinationID;}

[0017] Vehicles send records to the RSU, which runs a classification algorithm to categorize and aggregate the data into a matrix. The first column is the source ID, the last column is the destination vehicle ID, and the middle column is the forwarding vehicle ID. The RSUs share the matrix data through a secure channel. When the number of records reaches a threshold, the RSUs run an intersection algorithm to detect malicious vehicles and add the malicious vehicle ID to a blacklist.

[0018] Step 4: Time-dependent gray hole nodes discard all data packets passing through them at specific or random times. Detecting this type of malicious vehicle is very difficult. Therefore, we propose a detection algorithm based on real-time forwarding rate. Specifically, while a vehicle is driving and transmitting data, we record the real-time forwarding rate (FR) of its neighboring vehicles according to our definition:

[0019]

[0020] Where R1 represents the number of response packets received by vehicle i from vehicle j, dji represents the line loss caused by j sending packets to i within time t, and Dij represents the total number of packets sent by vehicle i to vehicle j at time t;

[0021] The vehicle sends the forwarding rate of its neighbors to the RSU, which classifies and records the data and executes the detection algorithm to find malicious vehicles.

[0022] Preferably, the route is securely established: secure route establishment is the basis of secure communication. The roadside unit turns on the promiscuous mode to monitor the control messages generated by all vehicles within the monitoring range and calculates the threshold RRall. When vehicle i enters the monitoring range of a certain RSU, it monitors the vehicle's control message ratio RRi and compares it with the dynamic threshold RRall to ensure the secure establishment of the route.

[0023] Preferably, the intelligent black hole and node-dependent gray hole node detection: malicious vehicles of this type have similar characteristics, the vehicle collects information of the sent data packets and uploads it to the roadside unit, which executes the intersection algorithm to detect malicious vehicles.

[0024] Preferably, the redundant transmission: in order to ensure the timely transmission of data, a redundant transmission algorithm is proposed, in which the vehicle sets a priority for the existing routing path during the routing establishment phase. If the data packet transmission fails, the data packets are sent in sequence according to the priority to ensure the timely transmission of the data packet.

[0025] Preferably, the time-dependent gray hole node detection is as follows: a malicious vehicle that performs malicious behavior at a specific or random time records the forwarding rate of neighboring vehicles at a certain moment and reports it to the roadside unit RSU regularly, and the RSU executes an algorithm based on the forwarding rate data to find the malicious vehicle.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] The present invention proposes a routing black hole detection algorithm based on control messages, which offloads the calculation workload of routing security establishment to the roadside unit;

[0028] Redundant transmission is proposed to ensure timely transmission of data packets in the Internet of Vehicles network and smooth communication;

[0029] The proposed intersection algorithm detects both intelligent black hole attacks and node-dependent gray hole attacks, reducing the computational complexity of RSU.

[0030] A customized forwarding rate algorithm is proposed to detect time-dependent gray hole attacks, achieving a low false detection rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 Schematic diagram of the system model of the present invention;

[0032] Figure 2 This is a schematic diagram of redundant transmission of the present invention. DETAILED DESCRIPTION

[0033] See also Figure 1-2 The present invention provides a technical solution: a lightweight VANET black hole attack and gray hole attack detection method, comprising the following steps:

[0034] Step 1: First, to ensure security during the route establishment phase and effectively identify specific types of black hole nodes, the roadside unit (RSU) is configured in promiscuous mode and continuously monitors the network activity of all vehicles within its communication range. The RSU monitors the number of route request (RREQ) and route reply (RREP) control packets generated by each vehicle. This monitoring process begins when a vehicle enters the communication edge of the RSU and continues until it leaves the RSU's communication range. The RSU collects RREQ and RREP control packet data from vehicles in its coverage area and, based on this collected information, defines a threshold parameter, RRall, to assess and identify potential black hole behavior.

[0035]

[0036] Among them, RREPall represents the number of all RREP control packets responded by vehicles within the communication range, RREQall represents the total number of RREQ control packets sent by vehicles within the communication range, and when vehicle i enters the communication range of RSU, RSU starts to monitor the ratio RRi of RREQ control packets and RREP control packets generated by the vehicle;

[0037]

[0038] The roadside unit (RSU) identifies black hole nodes by comparing the relative route request and reply ratio (RRi) of a specific vehicle with a preset global threshold (RRall). If a vehicle's RRi value exceeds the limit set by RRall, the vehicle is determined to be a potential black hole node and is automatically marked. The vehicle's identification information will be blacklisted and notified to neighboring roadside units and vehicles through a network broadcast mechanism. The vehicle will be excluded from network communications to maintain the overall security of the network and the integrity of communications.

[0039] Step 2: Smart black holes and gray hole nodes that nodes rely on will discard all or part of the data packets passing through them. This type of malicious node behaves honestly during the route establishment phase and causes serious harm to the network. Redundant transmission is designed to ensure timely communication. During the route establishment phase, the vehicle selects multiple paths to the destination vehicle and sets priorities based on path consumption. Data packets will be transmitted via the high-priority path. If data packet transmission fails, the low-priority path will be immediately used for redundant transmission, and so on.

[0040] Step 3: The detection of smart black holes and node-dependent gray hole nodes requires recording the failure of sending data packets when the source vehicle sends data packets. The record includes the timestamp, source vehicle ID, intermediate vehicle ID, and destination vehicle ID, as shown below:

[0041] {timestamp|sourceID;IntermediateID i ,...,IntermediateID n ;DestinationID;}

[0042] Vehicles send records to the RSU, which runs a classification algorithm to categorize and aggregate the data into a matrix. The first column is the source ID, the last column is the destination vehicle ID, and the middle column is the forwarding vehicle ID. The RSUs share the matrix data through a secure channel. When the number of records reaches a threshold, the RSUs run an intersection algorithm to detect malicious vehicles and add the malicious vehicle ID to a blacklist.

[0043]

[0044] Step 4: Time-dependent gray hole nodes discard all data packets passing through them at specific or random times. Detecting this type of malicious vehicle is very difficult. Therefore, we propose a detection algorithm based on real-time forwarding rate. Specifically, while a vehicle is driving and transmitting data, we record the real-time forwarding rate (FR) of its neighboring vehicles according to our definition:

[0045]

[0046] Where R1 represents the number of response packets received by vehicle i from vehicle j, dji represents the line loss caused by j sending packets to i within time t, and Dij represents the total number of packets sent by vehicle i to vehicle j at time t;

[0047] The vehicle sends the neighbor's forwarding rate to the RSU, which classifies and records the data and executes the detection algorithm to find malicious vehicles;

[0048]

[0049]

[0050] Secure route establishment: Secure route establishment is the basis of secure communication. The roadside unit turns on the promiscuous mode to monitor the control messages generated by all vehicles within the monitoring range and calculates the threshold RRall. When vehicle i enters the monitoring range of a certain RSU, it monitors the vehicle's control message ratio RRi and compares it with the dynamic threshold RRall to ensure the secure establishment of the route. Intelligent black hole and node-dependent gray hole node detection: This type of malicious vehicles has similar characteristics. The vehicle collects information on the sent data packets and uploads it to the roadside unit, which executes the intersection algorithm to detect malicious vehicles.

[0051] Redundant transmission: To ensure timely data transmission, a redundant transmission algorithm is proposed. Vehicles set priorities for existing routing paths during the routing establishment phase. If data packet transmission fails, the data packets are sent in sequence according to priority to ensure timely transmission of the data packets. Time-dependent gray hole node detection: Malicious vehicles that perform malicious behaviors at specific or random times record the forwarding rate of neighboring vehicles at a certain moment and report it to the roadside unit RSU regularly. The RSU executes an algorithm based on the forwarding rate data to find malicious vehicles.

Claims

1. A lightweight VANET black hole attack and gray hole attack detection method, characterized in that: The following steps are involved: Step 1: To ensure security during the route establishment phase and effectively identify specific types of black hole nodes, the roadside unit (RSU) is configured in promiscuous mode and continuously monitors the network activity of all vehicles within its communication range. The RSU monitors the number of route request (RREQ) and route reply (RREP) control packets generated by each vehicle. This monitoring process begins when a vehicle enters the RSU's communication edge and continues until it leaves the RSU's communication range. The RSU collects RREQ and RREP control packet data from vehicles within its coverage area and, based on this information, defines a threshold parameter, RRall, to assess and identify potential black hole behavior. ； Among them, RREPall represents the number of all RREP control packets responded by vehicles within the communication range, RREQall represents the total number of RREQ control packets sent by vehicles within the communication range, and when vehicle i enters the communication range of RSU, RSU starts to monitor the ratio RRi of RREQ control packets and RREP control packets generated by the vehicle; ； The roadside unit (RSU) identifies black hole nodes by comparing the relative route request and reply ratio (RRi) of a specific vehicle with a preset global threshold (RRall). If a vehicle's RRi value exceeds the limit set by RRall, the vehicle is determined to be a potential black hole node and is automatically marked. The vehicle's identification information will be added to the blacklist and notified to neighboring roadside units and vehicles through a network broadcast mechanism. The vehicle will be excluded from network communications to maintain the overall security of the network and the integrity of communications. Step 2: Smart black holes and gray hole nodes that nodes rely on will discard all or part of the data packets passing through them. This type of malicious node behaves honestly during the route establishment phase and causes serious harm to the network. Redundant transmission is designed to ensure timely communication. During the route establishment phase, the vehicle selects multiple paths to the destination vehicle and sets priorities based on path consumption. Data packets will be transmitted via the high-priority path. If data packet transmission fails, the low-priority path will be immediately used for redundant transmission. Step 3: The detection of smart black holes and node-dependent gray hole nodes requires recording the failure of sending data packets when the source vehicle sends data packets. The record includes the timestamp, source vehicle ID, intermediate vehicle ID, and destination vehicle ID, as shown below: {timestamp|sourceID;IntermediateID i ,...,IntermediateID n ;DestinationID;} Vehicles send records to the RSU, which runs a classification algorithm to categorize and aggregate the data into a matrix. The first column is the source ID, the last column is the destination vehicle ID, and the middle column is the forwarding vehicle ID. The RSUs share the matrix data through a secure channel. When the number of records reaches a threshold, the RSUs run an intersection algorithm to detect malicious vehicles and add the malicious vehicle ID to a blacklist. Step 4: Time-dependent gray hole nodes discard all data packets passing through them at specific or random times. Detecting this type of malicious vehicle is very difficult. Therefore, a detection algorithm based on real-time forwarding rate is proposed. Specifically, while a vehicle is driving and transmitting data, it records the real-time forwarding rate (FR) of its neighboring vehicles: ； Where R1 represents the number of response packets received by vehicle i from vehicle j, dji represents the line loss caused by j sending packets to i within time t, and Dij represents the total number of packets sent by vehicle i to vehicle j at time t; The vehicle sends the forwarding rate of its neighbors to the RSU, which classifies and records the data and executes the detection algorithm to find malicious vehicles.

2. A lightweight VANET black hole attack and gray hole attack detection method according to claim 1, characterized in that: Secure route establishment: Secure route establishment is the basis for secure communication. The roadside unit activates promiscuous mode to monitor the control messages generated by all vehicles within the monitoring range and calculates the threshold RRall. When vehicle i enters the monitoring range of a certain RSU, the control message ratio RRi of the monitored vehicle is compared with the dynamic threshold RRall to ensure secure route establishment.

Images