Internet of vehicles advanced malicious software propagation control method based on game theory

Abstract

The invention relates to an Internet of Vehicles advanced malicious software propagation control method based on a game theory, and belongs to the field of network propagation and control. The method comprises the following steps: 1) regarding a vehicle-end device, a road-end device and a cloud-end device in the Internet of Vehicles as network nodes, and connecting the vehicle-end device, the road-end device and the cloud-end device by using edges if communication relationships exist among the nodes; 2) establishing a dynamic model of malicious software spreading in the Internet of Vehicles by applying a differential game theory, and describing the spreading process of the malicious software; 3) combining the propagation strategy of the attacker and the detection and blocking measures of the defender to analyze the earnings of the two game parties; 4) designing an acceleration algorithm, and rapidly solving an optimal strategy (Nash equilibrium) of both parties in the game model; and 5) verifying the effectiveness and practicability of the game model through a comparison experiment of a random strategy, a uniform strategy and an uncertainty attack strategy.

Description

Technical Field

[0001] The present invention belongs to the field of network propagation and control, and relates to a method for controlling the propagation of advanced malware in Internet of Vehicles based on game theory. Background Art

[0002] The Internet of Vehicles (IoV) collects vehicle status and environmental information through devices such as GPS, RFID, sensors and cameras, and aggregates the data to a central processing system through the Internet. It uses computer technology to analyze this information to optimize route planning, report road conditions in real time, and adjust traffic light cycles. The IoV system consists of an on-board terminal, a cloud computing platform and a data analysis platform. The on-board terminal is responsible for information collection, the cloud platform performs data filtering and processing, and the data analysis platform generates reports for management personnel to refer to. IoT technology plays a key role in data collection and management, helping to achieve effective monitoring and management of vehicles.

[0003] However, autonomous vehicles in the connected vehicle environment still face more severe cybersecurity challenges due to the vulnerability of wireless communications. These vehicles are easily targeted by malware, which can be exploited by attackers to disrupt the vehicle's autonomous functions, thereby increasing communication delays and consuming a large amount of vehicle power. This will not only cause traffic jams, but may also seriously threaten passenger safety and bring immeasurable economic losses. Therefore, real-time detection of such attacks is crucial to ensure the safe operation of intelligent transportation systems and connected vehicle environments. Summary of the invention

[0004] In view of this, the purpose of the present invention is to solve the problems in the above existing methods and provide a method for controlling the spread of advanced malware in Internet of Vehicles based on game theory.

[0005] To achieve the above object, the technical solution of the present invention is as follows:

[0006] A method for controlling the spread of advanced malware in Internet of Vehicles based on game theory includes the following steps:

[0007] Step 1: Build the Internet of Vehicles network topology and give the network node status;

[0008] Step 2: Determine the malware propagation behavior in the Internet of Vehicles and establish an advanced malware propagation control model;

[0009] Step 3: Based on the advanced malware propagation control model, define the attack and defense strategies and attack and defense benefits, and propose the attack and defense game problem;

[0010] Step 4: Build a basic necessity system framework and design a numerical optimization algorithm to solve the attack and defense game problem proposed in step 3;

[0011] Step 5: Compare with random strategy, uniform strategy and uncertain attack strategy to verify the superiority of the designed game model in suppressing the spread of malware;

[0012] Furthermore, the specific process of step one includes:

[0013] The vehicle-side devices, road-side devices and cloud devices in the Internet of Vehicles are regarded as nodes in the network. Let V be the node set, E be the edge set, G = (V, E) constitute the topological structure of the Internet of Vehicles, A = (a ij ) N×N is the adjacency matrix of G. When the IoV node is not aware of the threat of malware propagation in the network and has not taken any defensive measures, the node is in an unprotected state (U); when the IoV node is aware of the threat of malware propagation in the network and has taken defensive measures to resist the attack of malware, the node is in a protected state (C); when the IoV node has been infected by malware and may become a source of propagation, the node is in an infected state (I). We assume that the parameters in the following table represent the state transition probability:

[0014] parameter Notes <![CDATA[α UD (t)]]> The probability that a node is in an unprotected state but becomes infected due to the direct influence of an attacker <![CDATA[α CD (t)]]> The probability that a node is in a protected state but changes to an infected state due to the direct influence of an attacker <![CDATA[β UD (t)]]> The probability that a node is in an unprotected state but becomes infected due to interaction with an infected node <![CDATA[β CD (t)]]> The probability that a node is in a protected state but becomes infected due to interaction with an infected node <![CDATA[θ UC (t)]]> The probability that a node is in an unprotected state but becomes protected due to the efforts of the defender <![CDATA[θ DC (t)]]> The probability that a node is in an infected state but becomes protected due to the efforts of the defender <![CDATA[γ UC (t)]]> The probability that a node is in an unprotected state but changes to a protected state due to interaction with a protecting node <![CDATA[γ DC (t)]]> The probability that a node is in an infected state but changes to a protected state due to interaction with a protected node

[0015] Furthermore, the specific process of step 2 includes:

[0016] Let X i (t)=0,1,2 represent v i The probabilities of being in the unprotected state, protected state, and infected state are U i (t), C i (t) and I i (t), then we can get U i (t)+C i (t)+I i (t) = 1. As time goes by, the state of each node can dynamically switch between various states, which may be caused by attacks or repairs. Therefore, the following mathematical framework of the advanced malware propagation control model is derived using the Kolmogorov forward equation of the Markov chain:

[0017]

[0018]

[0019] Note that the total state probability of a node is 1, that is, U i (t)+C i (t)+I i (t) = 1, we can simplify the above equation and summarize the system into two equations to reduce the computational complexity:

[0020]

[0021] Furthermore, the specific process of step three includes:

[0022] Given that both attackers and defenders seek to minimize costs and maximize benefits, this dynamic process coincides with the core principles of game theory. In order to deal with this attack and defense process, we need to understand various attack and defense strategies and their possible consequences. Therefore, based on the established advanced malware propagation control model, we will conduct a systematic and in-depth analysis of this attack and defense process.

[0023] In the above parameter definition, it can be clearly seen that parameter α UD (t), α CD (t), β UD (t), β CD (t) is favorable to the attacker, while θ UC (t),θ DC (t), γ UC (t), γ DC (t) is favorable to the defender. Let α = (α UD ,α CD ),β=(β UD ,β CD ),θ=(θ UC ,θ DC ),γ=(γ UC ,γ DC ). For any t in the interval [0, t], define functions A(t) and D(t) as attack and defense strategies. These strategies can be expressed mathematically as follows:

[0024] A(t)=(α1(t),…,α N (t),β1(t),…,β N (t)),

[0025] D(t)=(θ1(t),…,θ N (t),γ1(t),…,γ N (t)).

[0026] In addition, Respectively represent α i (t),β i (t),θ i (t),γ i (t) is the upper limit of the function. Similarly, represents the upper limit of A(t) and D(t), and defines the following feasible domain:

[0027]

[0028] Then, determine the set and The optimal strategy pair is and are the total revenue accumulated by the attacker at time t and the total loss suffered by the defender, and their respective upper bounds are In an infinitely small time interval [t, t+dt), if for node v i If the attack is successful, the instantaneous attack gain is On the contrary, the attack fails and the profit is zero. Therefore, in the entire time period [0, T], the total profit R A (A, D) and the total loss L A (A,D) can be described as:

[0029]

[0030] Let φ, ψ,σ control parameters α,β,θ,γ, which represent the costs associated with different actions. Let φ i (α i (t)) and represents the cost for the attacker to directly target the node and manipulate the infected node to attack, ψ i (θ i (t)) and σ i (γ i (t)) represents the cost incurred by the defender at time t for directly defending nodes and manipulating protected nodes. The upper limits of these parameters are expressed as In the time period [t, t+dt], the attacker targets node v i The cost of infecting a target is expressed as In addition, the attacker controls the infected node v j To attack node v i The cost is expressed as These costs can be further analyzed in the time interval [0,T], applicable to direct attacks on P C (A, D) and manipulate the infected node to attack other nodes P U (A,D), as shown in the following equation:

[0031]

[0032] Similarly, during the period [t, t+dt], the defender maintains node v i The cost of restoring a node while maintaining protection is The defender controls the protection node v j To restore node v i The cost is Then, in the time interval [0,T], the defender's maintenance cost is described as follows:

[0033]

[0034] Therefore, in the time interval [0,T], the attack benefit G A (A,D) and defense loss L A (A,D) is expressed as:

[0035]

[0036] According to the attack strategy and its benefits, combined with the defense strategy and loss, it is obvious that the attacker strives to maximize the benefits, while the defender strives to minimize the losses. In the end, both parties are committed to achieving the maximum return with the least effort, which constitutes a typical attack and defense game scenario. Next, we will perform mathematical quantification. The mathematical formula of the attack and defense game problem in system (1) can be concisely expressed as:

[0037]

[0038] I i (0),C i (0)∈[0,1],t∈[0,T]

[0039] in and are the strategy spaces of the attacker and the defender respectively. We can use the following expression to fully describe this complex attack and defense game problem:

[0040]

[0041] in,

[0042]

[0043] Represents the initial state, including the infection state (I) and protection state (C) of all nodes at the initial moment.

[0044] Furthermore, the specific process of step 4 includes:

[0045] In order to achieve the goal of Nash equilibrium, we first built a basic necessary system framework. Then, we carefully designed a numerical optimization algorithm to accelerate this search process and improve efficiency. Specifically, we first need to construct the Hamiltonian function. In the attack and defense game of malware propagation, the attacker and the defender have their own Hamiltonian functions, which describe their gains and losses respectively.

[0046] The attacker’s Hamiltonian function: H A(t,C,I,A,D,λ,χ) is defined as:

[0047]

[0048] Hamiltonian function of the defender: H D (t,C,I,A,D,μ,ν) is defined as:

[0049]

[0050] in, are their adjoint vectors respectively.

[0051] Assume that (A, D) constitutes the Nash equilibrium of the attack-defense game problem, and assume that C i and I i represents the solution of system (1), then the following assertions are valid and hold:

[0052] There exist values ​​of λ, χ, μ, and ν that satisfy the system (2) equations, and at time T λ(T) = χ(T) = μ(T) = ν(T) = 0. The following are the equations for system 2:

[0053]

[0054]

[0055] Given 1≤i≤N and 0≤t≤T, we get the following equation:

[0056]

[0057] And, α UD (t)∈argmax[F(α UD (t))],α CD (t)∈argmax[F(α CD (t))](3) Given 1≤i≤N and 0≤t≤T, the following equation holds:

[0058]

[0059] And, β UD (t)∈argmax[F(β UD (t))],β CD (t)∈argmax[F(β CD (t))](4) Given 1≤i≤N and 0≤t≤T, the following equation holds:

[0060]

[0061] And, θ UC (t)∈argmin[F(θUC (t))],θ DC (t)∈argmin[F(θ DC (t))](5) Given 1≤i≤N and 0≤t≤T, the following equation holds:

[0062]

[0063] And, γ UC (t)∈argmin[F(γ UC (t))],γ DC (t)∈argmin[F(γ DC (t))](6)

[0064] The proof process is as follows: Using the Pontryagin maximum / minimum principle, for i∈[1,N] and t∈[0,T], there exist variables λ, χ, μ and ν that satisfy the following equation:

[0065]

[0066] System (2) can be derived by a straightforward computational procedure, since the terminal cost is unspecified and the final state is unrestricted, which logically implies that λ(T) = χ(T) = μ(T) = ν(T) = 0. The following equation can be derived by applying the Pontryagin maximum / minimum principle:

[0067]

[0068] Systems (3), (4), (5), and (6) have been successfully derived, thus completing the proof.

[0069] Based on the principles of game theory, including (1), (2), (3), (4), (5) and (6), as well as the initial condition C i (0),I i (0),λ(T)=χ(T)=μ(T)=ν(T)=0, which constitute a necessary framework (called the necessity system) to solve the game problem described in (7). Although the Nash equilibrium can be solved from the above necessity system under certain conditions, the actual solution process may take a long time. In order to quickly find the Nash equilibrium, we specially designed a Nash equilibrium solution algorithm, which is mainly solved by numerical methods (Euler forward-backward solution method). Finally, by iteratively solving the above system, we can gradually approach the optimal combination of attack and defense strategies. The iterative process is shown in the following table:

[0070]

[0071] The above algorithm fundamentally embodies an iterative framework. In each iteration cycle, we first use the system dynamics described in (1) to simulate the evolution of the device state in a forward-looking manner. Subsequently, we use system (2) in the backward process to derive the updated adjoint function. Finally, we integrate systems (3), (4), (5) and (6) to calculate the new policy combination. The iterative process ends when two consecutive policy combinations converge significantly or the number of iterations reaches a predetermined threshold, indicating that sufficient exploration has been carried out.

[0072] Furthermore, the specific process of step five includes:

[0073] In order to highlight the effectiveness of the method, the experiment compares the effects of multiple attack and defense strategies, and compares three different strategies: random strategy, uniform strategy and uncertain attack strategy. The experiment is based on two actual data sets (VeReMi and LuST), and combined with simulated Internet of Vehicles environment data generated by network simulation tools (such as NS-3, OMNeT++, etc.) to verify the universality and application value of the proposed method. The core goal of the experiment is to evaluate the actual application effect and performance advantages of the attack and defense game method under different control strategies by simulating the propagation behavior of advanced malware in the Internet of Vehicles.

[0074] The beneficial effects of the present invention are as follows: the present invention proposes a method for controlling the spread of advanced malware in an Internet of Vehicles based on game theory, including: 1) using the Internet of Vehicles topology as a basis, simulating the interaction of nodes in the network (such as vehicles, roadside units, infrastructure, etc.), and defining the probability of malware spreading through direct attacks or interactions between nodes; 2) deriving a mathematical framework of an advanced malware propagation control model using the Kolmogorov forward equation of a Markov chain; 3) constructing an attack and defense game model based on the aforementioned propagation model, in which the gains and losses of the attacker and the defender are defined and analyzed through the framework of game theory; 4) constructing a basic necessary system framework and designing a numerical optimization algorithm to solve the optimal strategy (Nash equilibrium) of both parties in the game; 5) comparing different attack and defense strategies through experiments to evaluate the universality and application value of the model.

[0075] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0077] Figure 1 is a schematic flow chart of a method for controlling the propagation of advanced malware in Internet of Vehicles based on game theory;

[0078] Figure 2 This is a node state transition diagram caused by malware propagation in the Internet of Vehicles. DETAILED DESCRIPTION

[0079] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0080] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0081] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0082] like Figure 1 As shown, the present invention provides a method for controlling the propagation of advanced malware in an Internet of Vehicles based on game theory. The implementation scenario is that when a node in the Internet of Vehicles is attacked by malware, different nodes adjust their own defense measures according to the best defense strategy (Nash equilibrium), including the following steps:

[0083] Step 1: Treat the vehicle-side devices, road-side devices and cloud devices in the Internet of Vehicles as nodes in the network, build the network topology, model the scenario, and define the state transition probability between nodes.

[0084] Step 2: Use the Kolmogorov forward equation of the Markov chain to derive the mathematical framework of the advanced malware propagation control model:

[0085]

[0086] Step 3: Based on the established advanced malware propagation control model, the entire attack and defense game problem is proposed according to the attack strategy and its benefits, combined with the defense strategy and losses:

[0087]

[0088] Step 4: A basic necessary system framework was constructed, mainly by constructing the Hamiltonian function, using the Pontryagin maximum / minimum principle to solve the Nash equilibrium, and designing a numerical optimization algorithm (Euler forward-backward solution method) to achieve the goal of Nash equilibrium.

[0089] Step 5: Deploy nodes in a simulation environment of the Internet of Vehicles (such as SUMO, Veins, or OMNeT++) and introduce actual Internet of Vehicles datasets (such as VeReMi or LuST). Simulate the spread of malware in the Internet of Vehicles while applying different attack and defense strategies. By comparing random strategies, uniform strategies, and uncertain attack strategies, analyze the performance differences of these strategies in malware propagation speed, infected node ratio, and protection cost.

[0090] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

[0091] like Figure 2 As shown in the figure, the state transition diagram of the Internet of Vehicles node specifically includes:

[0092] No protection status X i (t) = 0 means that node i in the Internet of Vehicles is in an unprotected state at time t, that is, the node has not yet perceived the threat of malware. The node in this state can i (t) = 1 and X i (t) = 2 for transfer.

[0093] Protection Status X i (t) = 1 means that node i in the Internet of Vehicles has perceived the threat of malware and has taken protective measures. The node in this state can report to state X i (t) = 2 for transfer.

[0094] Infection Status X i (t) = 2 means that node i in the Internet of Vehicles has been infected by malware. This state node can i (t) = 1 to transfer.

Claims

1. A method for controlling the spread of advanced malware in Internet of Vehicles based on game theory, characterized in that: First, we build the network topology of the Internet of Vehicles, analyze the process of malware attacks by attackers on Internet of Vehicles devices and the defensive measures taken by defenders on Internet of Vehicles devices, establish a differential game model, and solve the game model. The specific steps include: Step 1: Build the network topology of the Internet of Vehicles, regard the vehicle-side devices, road-side devices and cloud-side devices of the Internet of Vehicles as network nodes, and give the state changes of the nodes. Step 2: Given the node states and the transition probabilities between node states, establish an advanced malware propagation control model for the Internet of Vehicles; Step 3: Define the attack and defense strategy based on the attack and defense game problem, and quantify the goals of the attacker and defender using mathematical expressions; Step 4: Build a necessary system framework and design a numerical optimization algorithm to accelerate the solution of Nash equilibrium; Step 5: Compare with random strategy, uniform strategy and uncertain attack strategy to verify the superiority of the designed game model in suppressing the spread of malware; 2. The method for controlling the spread of advanced malware in Internet of Vehicles based on game theory according to claim 1 is characterized in that: The network topology of the Internet of Vehicles described in step 1: The network topology of the Internet of Vehicles is represented by a graph structure G = (V, E), where V represents the set of all Internet of Vehicles devices (vehicle-side devices, road-side devices, and cloud-side devices) V = {v1, v2, ..., v N },v i represents the i-th node device, E is the set of communication edges between nodes, indicating the connection relationship between vehicles, between vehicles and roadside units, and between vehicles and cloud servers. During the malware propagation process in the Internet of Vehicles, the state of each node device will change dynamically and each node device can only be in one of the following three states at a certain moment: the infected state (I) means that the node has been infected by malware. The node is not only controlled by the malware, but also attempts to spread the malware through the edges connected to the node; the protected state (C) means that the node has taken protective measures to prevent the spread of malware and protect itself and the surrounding nodes. The unprotected state (U) means that the node has not taken any security measures and is in a vulnerable state. It has weak defense capabilities against malware and is easily infected.

3. The method for controlling the spread of advanced malware in Internet of Vehicles based on game theory according to claim 2, characterized in that: The advanced malware propagation control model of the Internet of Vehicles described in step 2: As time goes by, the state of each node can dynamically switch between various states, which may be caused by attacks or repairs. Therefore, using the Kolmogorov forward equation of the Markov chain, we can establish the following differential equation:

4. The method for controlling the spread of advanced malware in Internet of Vehicles based on game theory according to claim 3 is characterized by: The attack and defense strategies and benefits of step 3: Given that both attackers and defenders seek to minimize costs and maximize benefits, this dynamic process coincides with the core principles of game theory. A (A, D) is the attacker’s attack benefit, L D (A, D) is the defender's defense loss, then the mathematical formula of the attack and defense game problem can be concisely expressed as: The overall goal of attackers and defenders is essentially to determine an optimal strategy combination The conditions of the mathematical formula of the above game problem are met, and we can use the following 13-tuple to fully represent the entire game problem:

5. The method for controlling the spread of advanced malware in Internet of Vehicles based on game theory according to claim 4 is characterized in that: The necessity system framework and numerical optimization algorithm of step 4: Using the principles of game theory, we designed a necessary framework (called the necessity system) to solve the 13-tuple mentioned in step 3. At the same time, in order to quickly solve the final Nash equilibrium, we used the forward and backward Euler method to design a special Nash equilibrium solution algorithm.

6. The method for controlling the spread of advanced malware in Internet of Vehicles based on game theory according to claim 5, characterized in that: Experimental comparison of step five: We conducted a comprehensive and detailed comparative analysis of the attack and defense game strategy we proposed for three different control strategies (i.e., random, uniform, and uncertain attack strategies), aiming to verify the practical application value and performance advantages of our method from multiple dimensions and angles.

Images