Federal learning-oriented vehicle end dynamic adaptive firewall

Abstract

The invention provides a federal learning dynamic self-adaptive firewall system for an intelligent networked automobile. The system integrates data acquisition, preprocessing, federal learning, dynamic strategy generation and firewall execution modules to realize efficient safety protection of a vehicle end network. While user data privacy is protected, a federated learning algorithm is utilized to cooperate with multi-vehicle data to train a global security model, and a firewall strategy is dynamically adjusted to cope with complex and changeable network attacks. The system supports cloud collaborative linkage, realizes vehicle-cloud integrated security detection and management, and significantly improves the intelligence, adaptability and robustness of network security protection of intelligent networked vehicles.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a vehicle-side dynamic adaptive firewall for federated learning. Background Art

[0002] With the rapid development of intelligent connected vehicles, vehicles are no longer just a means of transportation, but have gradually evolved into highly intelligent terminals that integrate communication, computing, control and other functions. While this evolution has improved the level of automobile intelligence, it has also brought unprecedented network security challenges. The in-vehicle network system of intelligent connected vehicles is complex, including multiple communication protocols such as CAN bus, Ethernet, Bluetooth, Wi-Fi, etc., and these networks often interact with each other, forming a complex heterogeneous network environment. This complex network environment provides opportunities for network attacks, making intelligent connected vehicles face multiple security threats such as data leakage, malicious control, and denial of service.

[0003] Although traditional firewall technology can provide network security protection to a certain extent, its application in the field of intelligent connected vehicles faces many challenges. First, the computing power of vehicle-side equipment is limited, and it is difficult to support complex security algorithms and real-time data processing requirements. Secondly, traditional firewall technology often relies on centralized security policy management, which is difficult to adapt to the distributed and dynamically changing network environment of intelligent connected vehicles. In addition, with the continuous evolution of network attack methods, traditional security protection methods based on feature matching can no longer meet the needs, and more intelligent and adaptive security protection technologies are needed.

[0004] As an emerging distributed machine learning method, federated learning provides a new approach to solving network security issues in intelligent connected vehicles. Federated learning allows multiple participants to jointly train models while maintaining data privacy, thereby avoiding the risk of privacy leakage that may be caused by centralized data processing. In the field of intelligent connected vehicles, federated learning can use different vehicles as participants, use their respective vehicle network data to train models, and form a global security protection model. This method can not only improve the efficiency and performance of model training, but also achieve security protection of vehicle-side networks while protecting user data privacy.

[0005] However, it is not easy to apply federated learning to the network security protection of intelligent connected vehicles. First, the heterogeneity and dynamic nature of vehicle-mounted network data pose challenges to the training of federated learning models. Different vehicles may be equipped with different sensors and actuators, and the format and content of the generated data may also differ. In addition, vehicle-mounted network data often has the characteristics of real-time and high concurrency, requiring the federated learning model to respond and process this data quickly. Secondly, the network security protection of intelligent connected vehicles needs to comprehensively consider a variety of security threats and attack scenarios, requiring the federated learning model to have high generalization and robustness. Finally, due to the limited computing power of vehicle-side equipment and the complex and changeable network environment, the deployment and update of federated learning models also face many technical difficulties.

[0006] In order to solve the above problems, the applicant proposed a vehicle-side dynamic adaptive firewall for federated learning. Summary of the invention

[0007] The purpose of the present invention is to provide a vehicle-side dynamic adaptive firewall for federated learning to solve the problems in the prior art.

[0008] To achieve the above object, the present invention provides the following technical solution: a vehicle-side dynamic adaptive firewall for federated learning, comprising:

[0009] Data collection module, used to collect data traffic in the vehicle-side network;

[0010] A preprocessing module is used to preprocess the collected data flow to remove noise and redundant information;

[0011] A federated learning module, used for performing distributed model training based on preprocessed data traffic, wherein the federated learning module includes multiple participants, each of which trains the model locally and uploads model parameters, and simultaneously receives model parameters of other participants from the server for aggregated update;

[0012] Dynamic adaptive strategy generation module, which is used to dynamically adjust the firewall's security strategy according to the model output of the federated learning module to cope with different network attack modes;

[0013] The firewall execution module is used to monitor and protect the vehicle-side network in real time according to the security policy generated by the dynamic adaptive policy generation module.

[0014] Optionally, the preprocessing module further includes:

[0015] Data cleaning submodule, used to remove outliers and duplicate data in data traffic;

[0016] The data formatting submodule is used to convert data traffic into a standard format suitable for federated learning model input.

[0017] Optionally, the federated learning module further includes:

[0018] The model training submodule is used to perform model training locally and upload model parameters according to the preset training cycle;

[0019] The parameter aggregation submodule is used to receive the model parameters of other participants sent by the server and aggregate them with the local model parameters to update the local model.

[0020] Optionally, the dynamic adaptive strategy generation module further includes:

[0021] The attack pattern recognition submodule is used to recognize the current network attack pattern based on the model output of the federated learning module;

[0022] The policy adjustment submodule is used to dynamically adjust the firewall's security policy based on the identified attack pattern, including adjusting the rule base, updating the blacklist and whitelist.

[0023] Optionally, the firewall execution module further includes:

[0024] The real-time monitoring submodule is used to monitor the vehicle-side network in real time and detect abnormal traffic and suspicious behavior;

[0025] The protection execution submodule is used to intercept and block the detected abnormal traffic and suspicious behavior according to the security policy generated by the dynamic adaptive policy generation module.

[0026] Optionally, also include:

[0027] The logging module is used to record the firewall's operation logs, abnormal events, and policy adjustment records for subsequent analysis and auditing.

[0028] Optionally, the firewall also supports collaborative linkage with a cloud security operation platform to achieve centralized policy management and vehicle-cloud integrated security detection.

[0029] Beneficial effects: Efficiency: The federated learning algorithm is used to achieve collaborative modeling among multiple parties, improving the efficiency and performance of model training; it also supports incremental learning algorithms and can quickly adapt to new network attacks.

[0030] Dynamicity: Supports dynamic adaptive policy generation and adjustment functions, and can dynamically adjust firewall policies according to the current network environment and attack mode to improve the flexibility and adaptability of the system.

[0031] Privacy protection: Model training and security protection are carried out under the premise of protecting the privacy of vehicle-side user data to ensure the security and privacy of user data.

[0032] Comprehensiveness: Integrates multiple modules such as data collection, preprocessing, and firewall execution to form a comprehensive in-vehicle network security protection system; at the same time, supports cloud-based collaborative linkage functions to achieve vehicle-cloud integrated security detection and management. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of the flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The following describes the preferred embodiments of the present invention with reference to the drawings in the specification, so that the technical content is clearer and easier to understand. The present invention can be embodied in many different forms of embodiments, and the protection scope of the present invention is not limited to the embodiments mentioned in the text.

[0035] In the drawings, components with the same structure are indicated by the same numerical reference numerals, and components with similar structures or functions are indicated by similar numerical reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present invention does not limit the size and thickness of each component. In order to make the illustration clearer, the thickness of the components is appropriately exaggerated in some places in the drawings.

[0036] Example 1

[0037] Data acquisition module

[0038] Functional description: This module is responsible for real-time data collection in the vehicle-side network, including but not limited to CAN bus data, Ethernet data and other heterogeneous network data. Through comprehensive data collection, it ensures that the firewall system can obtain sufficient information for accurate security protection.

[0039] Technical features: Supports data collection of multiple network protocols, has high concurrent processing capabilities and real-time performance, and ensures the accuracy and integrity of data.

[0040] Preprocessing module

[0041] Function description: Preprocess the collected data flow, including denoising, normalization, feature extraction and other steps to generate standard format data suitable for federated learning model input. Preprocessing can improve data quality and reduce the difficulty of model training.

[0042] Technical features: It uses advanced data processing algorithms, such as principal component analysis (PCA) and independent component analysis (ICA), to effectively extract key features from the data and improve model training efficiency and performance.

[0043] Federated Learning Module

[0044] Functional description: This module is the core part of the firewall system and is responsible for distributed model training based on preprocessed data traffic. Multiple participants (such as different vehicles) train models locally and upload model parameters to the cloud server. The server receives and aggregates these parameters to update the global model, and then distributes the updated model parameters to each participant. Through federated learning, the model performance is continuously improved while protecting the data privacy of vehicle users.

[0045] Technical features: It uses an incremental learning algorithm to dynamically update the local model when a new type of network attack occurs, without the need to retrain from scratch, thus improving the adaptability and detection accuracy of the model. In addition, it also supports multiple federated learning modes such as horizontal federated learning and vertical federated learning to adapt to different data distribution scenarios.

[0046] Dynamic Adaptive Strategy Generation Module

[0047] Functional description: Dynamically adjust the firewall's security policy based on the model output of the federated learning module. This module can identify the current network attack pattern and adjust the rule base, update the blacklist and whitelist accordingly to deal with different security threats.

[0048] Technical features: Supports multi-mode decision mechanism, integrates the detection results of multiple firewall engines to make decisions, and improves the accuracy of attack identification and defense decisions. At the same time, it also uses methods such as attack and defense game model and Nash equilibrium analysis to further optimize firewall strategies and enhance the overall protection capabilities of the system.

[0049] Firewall Execution Module

[0050] Functional description: Based on the security policy generated by the dynamic adaptive policy generation module, the vehicle-side network is monitored and protected in real time. This module can detect abnormal traffic and suspicious behavior, and intercept and block them to ensure the safe operation of the vehicle-side network.

[0051] Technical features: Supports high-concurrency connection processing and low-latency response, ensuring that the firewall system can effectively respond to network attacks in real time. At the same time, it also has self-repair and redundant backup functions to improve the reliability and stability of the system.

[0052] Logging Module

[0053] Function description: Record the firewall system's operation logs, abnormal events, policy adjustment records and other information for subsequent analysis and auditing. Through log records, you can track the firewall system's operating status and performance changes, and provide data support for optimizing the system.

[0054] Technical features: It uses distributed log storage and query technology to support efficient data retrieval and analysis. At the same time, it also has log encryption and access control functions to ensure the security and privacy of log information.

[0055] Cloud collaboration function

[0056] Function description: Supports collaborative linkage with the cloud security operation platform to achieve centralized policy management and vehicle-cloud integrated security detection. Remotely manage and configure the vehicle-side firewall through the cloud platform to improve the flexibility and efficiency of security protection.

[0057] Technical features: It uses secure communication protocols and data encryption technology to ensure the security of data transmission between the vehicle and the cloud. At the same time, it also supports real-time data synchronization and policy issuance functions to ensure that the vehicle firewall can obtain the latest security policies and protection capabilities in a timely manner.

[0058] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0059] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A vehicle-side dynamic adaptive firewall for federated learning, characterized in that: include: Data collection module, used to collect data traffic in the vehicle-side network; A preprocessing module is used to preprocess the collected data flow to remove noise and redundant information; A federated learning module, used for performing distributed model training based on preprocessed data traffic, wherein the federated learning module includes multiple participants, each of which trains the model locally and uploads model parameters, and simultaneously receives model parameters of other participants from the server for aggregated update; Dynamic adaptive strategy generation module, which is used to dynamically adjust the firewall's security strategy according to the model output of the federated learning module to cope with different network attack modes; The firewall execution module is used to monitor and protect the vehicle-side network in real time according to the security policy generated by the dynamic adaptive policy generation module.

2. The vehicle-side dynamic adaptive firewall for federated learning according to claim 1 is characterized in that: The preprocessing module also includes: Data cleaning submodule, used to remove outliers and duplicate data in data traffic; The data formatting submodule is used to convert data traffic into a standard format suitable for federated learning model input.

3. The vehicle-side dynamic adaptive firewall for federated learning according to claim 1 is characterized in that: The federated learning module also includes: The model training submodule is used to perform model training locally and upload model parameters according to the preset training cycle; The parameter aggregation submodule is used to receive the model parameters of other participants sent by the server and aggregate them with the local model parameters to update the local model.

4. The vehicle-side dynamic adaptive firewall for federated learning according to claim 1, characterized in that: The dynamic adaptive strategy generation module also includes: The attack pattern recognition submodule is used to recognize the current network attack pattern based on the model output of the federated learning module; The policy adjustment submodule is used to dynamically adjust the firewall's security policy based on the identified attack pattern, including adjusting the rule base, updating the blacklist and whitelist.

5. The vehicle-side dynamic adaptive firewall for federated learning according to claim 1, characterized in that: The firewall execution module also includes: The real-time monitoring submodule is used to monitor the vehicle-side network in real time and detect abnormal traffic and suspicious behavior; The protection execution submodule is used to intercept and block the detected abnormal traffic and suspicious behavior according to the security policy generated by the dynamic adaptive policy generation module.

6. The vehicle-side dynamic adaptive firewall for federated learning according to any one of claims 1 to 5, characterized in that: Also includes: The logging module is used to record the firewall's operation logs, abnormal events, and policy adjustment records for subsequent analysis and auditing.

7. The vehicle-side dynamic adaptive firewall for federated learning according to any one of claims 1 to 5, characterized in that: The firewall also supports collaborative linkage with the cloud security operation platform to achieve centralized policy management and integrated vehicle-cloud security detection.

Images