Automatic driving attack detection method based on laser radar
By placing obstacles near the lidar system to obtain point cloud data and using attack equipment to forge data to design standard judgment functions, the problem of insufficient accuracy and targeting of autonomous driving attack detection methods in long distances and complex scenarios is solved, and higher recognition accuracy and stronger versatility are achieved, ensuring the safety of autonomous driving systems.
Patent Information
- Application Number
- CN202510114239.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-01-24
- Publication Date
- 2025-03-21
AI Technical Summary
Existing lidar-based autonomous driving attack detection methods have problems of reduced accuracy and insufficient targeting when judging the existence of long-distance objects and identifying malicious attack implanted points, especially when facing sparse point clouds and complex attack scenarios.
By placing obstacle entities near the vehicle-mounted lidar system, obtaining point cloud data at different distances, and using attack equipment to forge point cloud data, designing standard functions to judge forged point cloud signals, obtaining empirical thresholds to judge the authenticity of long-distance point cloud data, and expanding the detection object to various obstacles, comprehensively analyzing multi-dimensional features to improve recognition accuracy.
It effectively improves the recognition accuracy of long-distance objects, enhances the ability to judge malicious attacks, expands the universality of the model, and can more accurately identify various objects that may be maliciously implanted, including cars, and improves the safety and reliability of the autonomous driving system.
Smart Images
Figure SMS_20 
Figure SMS_23 
Figure SMS_29
Abstract
Description
Technical Field
[0001] The present invention relates to an automatic driving attack detection method based on laser radar, and belongs to the field of network security and machine learning. Background Art
[0002] Existing LiDAR systems mainly detect forged car point cloud data for implantation to achieve attack purposes. LiDAR obtains return signals from the surroundings to construct point clouds in order to achieve the purpose of planning autonomous driving strategies. At this time, if relevant points are implanted to forge the existence of the car, it may cause the autonomous driving system to make a sudden braking decision, resulting in rollovers, rear-end collisions and other accidents, completing the malicious attack. Existing systems only focus on the implantation of motor vehicle point clouds. Current research has shown that there are some methods to place non-existent car presence signals in front of autonomous driving cars for malicious implanted signals, so that the original autonomous driving planned route is interrupted or changed, causing serious threats to life and property. However, it also has some shortcomings:
[0003] First, learning is done based on the density characteristics of the point cloud to determine whether the obtained car presence signal is real or false. However, once the point cloud is too sparse, the current data is very scarce, which makes the model's accuracy in learning and judging the existence of objects farther away, such as 10-20 meters, drop significantly, and it becomes even lower above 20 meters. However, the distance of 20 meters is a distance that cannot be ignored in real driving speeds. If there is no way to accurately recognize this distance, then its application in actual road driving is a castle in the air.
[0004] The second point is the current ability to determine the implanted points of malicious attacks. Currently, an important criterion for determining attacks is the number of points. Due to technical limitations, the number of maliciously implanted points is generally significantly less than the number of points in the real car point cloud signal, so this feature is used for learning and judgment. However, with the improvement of attack technology, the number of points in the point cloud of a fake car signal in an attack can be very close to the number of points of a real car at some distances and scenarios in reality, which further reduces the number of scenarios in which the current model can accurately identify obstacle cars.
[0005] Third, the current model is very targeted. The current model focuses on cars as obstacles. Whether it is feature analysis of point clouds for machine learning or actual applications, it focuses on detecting attacks by fake obstacle cars. When more and more defense work is done against cars, intruders will turn their attention to other objects. For autonomous vehicles planning routes, it is not just the appearance of vehicles that will cause them to make dangerous wrong plans. Pedestrians, non-motor vehicles, animals, and even any rare objects that will be identified as larger in size and cause emergency braking can be used by intruders for malicious implantation. The current model has not done more general work on objects other than cars, but focuses on the recognition of car signals.
[0006] In summary, there are three significant problems with the LiDAR-based autonomous driving attack detection method: First, when relying on the density characteristics of the point cloud to judge the authenticity of the car's signal, in the face of sparse point clouds, the model's accuracy in judging objects at a distance of 10-20 meters and farther drops sharply. Given the importance of a distance of 20 meters in actual driving, this greatly restricts the practical application value of this method; second, in terms of judging the malicious attack implantation points, attacks were previously identified based on the number of points, but with the advancement of attack technology, the number of points in the forged point cloud is approaching the actual situation, resulting in the current model being unable to accurately identify scenes with obstacle cars. The number of objects detected by the vehicle is greatly reduced, and its ability to judge attacks is significantly weakened; third, the model is limited in its targeting. It currently focuses on detecting forged car obstacles. In both point cloud feature analysis and practical applications, it ignores various objects other than cars, such as pedestrians, non-motor vehicles, animals, etc. When the defense against cars is strengthened, intruders are very likely to turn to using these objects for malicious implantation, which will put autonomous vehicles at risk of dangerous misplanning. The current model lacks the general detection capability to deal with such situations and is difficult to adapt to complex and changeable attack scenarios. It is urgent to improve and perfect it to ensure the safety and reliability of autonomous driving. Summary of the invention
[0007] In view of the shortcomings of the existing technology, the present invention provides an autonomous driving intrusion detection and identification method, which aims to solve the shortcomings of the current autonomous driving intrusion detection technology and achieve the purpose of protecting the safety of the autonomous driving process.
[0008] The objective of the present invention is achieved through the following technical solutions:
[0009] A method for detecting an attack on an autonomous driving vehicle based on a laser radar, the steps are as follows:
[0010] Step 1: Place the obstacle entity at a certain position near the vehicle-mounted LiDAR system, obtain the surrounding 3D space point cloud data through the LiDAR system sending and receiving signals, and frame the cube area where the obstacle entity point cloud is located;
[0011] Step 2: Use the existing advanced attack equipment against laser radar to forge the point cloud data of the obstacle placed in the cube area in step 1, and obtain the real and forged data of the obstacle; compare and analyze the real and forged data through the standard function of judging the forged point cloud signal to obtain the empirical threshold;
[0012] Step 3: During actual driving, when the LiDAR sends and receives signals to obtain the surrounding point cloud, the point cloud data in each identified cube area is calculated using a standard function for determining forged point cloud signals, and the calculation result is compared with the corresponding threshold to determine whether the data is forged, that is, whether it has been attacked.
[0013] Preferably, the process of acquiring the 3D space point cloud data set obtained by sending and receiving signals by the laser radar system in step 1 is as follows:
[0014] 1.1 Define the range of each object in the input space point cloud form. We represent the point cloud data received by the lidar as p, then we have: It should be a 4-dimensional coordinate. The first three variables are its position coordinates in the point cloud space, the fourth variable represents the intensity of the point cloud here, and N represents the total number of points in the point cloud.
[0015] 1.2 The 3D detection system performs a process f:p→B to give a rough cube range limit for each surrounding object: B = {b1, b2, b3, ..., b M}, where M is the number of object boundaries, each boundary Defined as x, y, z, the three coordinates represent the unknown coordinates of the point cloud space of the geometric center of the boundary, l, w, h represent the length, width and height of the cube area respectively, and θ represents the rotation angle of the sub-square area on the y-axis; therefore, we can divide the space into blocks for the obtained laser radar signal according to the above representation;
[0016] 1.3 For the potential various known classifications of data encountered by the radar detector, use To express, then we have: There are K object types on the classification, for Our main goal is to divide each area b in the input point cloud obtained by the lidar i The classification number is given in the , that is, first identify what this object is. Classification number set S K ={1, 2, 3, ..., K};
[0017] Preferably, the standard function design process for judging the forged point cloud signal in step 2 is as follows:
[0018] Select a certain position and distance to place a certain type of object. For a certain type of object, place the real object at a certain position and obtain the boundary area b of the object i . Use the latest attack equipment to implant the same type of forged data K = κ with the same y-axis rotation angle at this position; we will b i The feature vector of the real data in Recorded as
[0019]
[0020] b i The feature vector of the data embedded in Recorded as
[0021]
[0022] Among them, the 6 coordinates of the two are: and Representative b i The number of points in the region, and The three parameters representing the position coordinates of the center of mass of the real data and the fake data in this area, and Represent the mean intensity of all points of real data and fake data in this area, and Represent the variance of the intensity of all points of real data and fake data in this area respectively;
[0023] Among them, the mean and variance of intensity and The calculations are as follows:
[0024]
[0025] in, is the intensity of the mth point, That is b i The total number of points in range.
[0026] Calculate the variance of intensity:
[0027]
[0028] in, is the intensity of the mth point, That is b i The total number of points in the range, It is the mean intensity calculated by formula 3.
[0029] Then, to compare the difference between the two, calculate the following:
[0030] calculate and Euclidean distance (the smaller the more similar, [0, +∞));
[0031]
[0032] in, for The jth coordinate of for The j-th coordinate of
[0033] calculate and Cosine similarity (the larger the value, the more similar it is, [-1, +1]);
[0034] Inner Product:
[0035]
[0036] in, for The jth coordinate of for The j-th coordinate of .
[0037] Cosine Similarity:
[0038]
[0039] in, is calculated in Formula 6 and Inner product, for The jth coordinate of for The j-th coordinate of
[0040] Then, the judgment value S is designed (the larger the value, the closer to the truth, [0,100]);
[0041] Normalized cosine similarity:
[0042]
[0043] in, Calculation is as in formula 6, 7;
[0044] Judgment value:
[0045]
[0046] Where, e is the base of natural logarithm;
[0047] In summary, we have obtained the judgment criteria. For a certain type of object at a certain position, there is always a constant As the threshold, It can be considered true.
[0048] For different K, that is, different types of obstacle data, they are uniformly defined within the block range B to roughly outline their volume features, and the thresholds of the real and forged data of each type of obstacle are determined in formula (9). The point cloud data of each object in any area of the surrounding environment is obtained to determine whether it is real or forged, and then it can be judged whether it has been invaded.
[0049] The present invention adopts the above scheme, by actively placing obstacle entities such as people, bicycles, and cartons near the vehicle-mounted laser radar system, to obtain point cloud data at different distances, including data in the long-distance range, thus changing the previous situation of lack of long-distance point cloud data. At the same time, the attack device is used to forge point cloud data, and the empirical threshold is obtained after comparative analysis. During actual driving, the authenticity of the long-distance point cloud data is judged based on this, effectively improving the recognition accuracy of long-distance objects. In terms of dealing with the weakening of the ability to judge the implantation points of malicious attacks, it is no longer simply dependent on the number of points, but for a variety of obstacle entities, the multi-dimensional characteristics of the real and forged point cloud data are comprehensively analyzed, and a more discriminative threshold is comprehensively obtained, so as to accurately identify the attack, and even if the number of forged point cloud points is close to the real situation, it can be accurately judged. In addition, in order to address the problem of the model being too narrowly targeted, the detection objects are expanded to various types of obstacles, point cloud data of different objects are collected and compared and analyzed, and their respective thresholds are determined. This enables the model to effectively detect various objects other than cars that may be maliciously implanted, such as pedestrians and non-motor vehicles, to prevent the autonomous driving system from making dangerous decisions due to its inability to recognize forged signals from non-automotive objects. This greatly enhances the versatility of the model and its ability to cope with complex attack scenarios, and comprehensively improves the effectiveness and safety of autonomous driving attack detection. DETAILED DESCRIPTION
[0050] The specific implementation modes of the present invention are described in detail below.
[0051] Specific ideas: First, use an obstacle entity (such as a person, bicycle, or cardboard box) to place it near the on-board laser radar system, and use the laser radar system to send and receive signals to obtain the surrounding space point cloud data, frame the cube area where the obstacle entity point cloud is located, and use the existing advanced attack equipment against laser radar to forge the point cloud data of this obstacle placed in this cube area. After obtaining the real and forged data of this obstacle, perform comparative analysis to obtain the empirical threshold based on the invented calculation method. Finally, in the actual driving process, when the laser radar sends and receives signals to obtain the surrounding point cloud, the point cloud data in each identified cube area is calculated using the designed formula, and the calculation result is compared with the corresponding threshold to determine whether the data is forged, that is, whether it has been attacked. After judging that the data is forged, it can assist the autonomous driving system to ignore this obstacle and complete real-time driving decisions normally.
[0052] First, in order to explore the implantation of data on other potential obstacle objects, such as pedestrians, non-motor vehicles, and larger objects of a certain size that are identified as requiring braking and steering decisions, in the characteristics of lidar system intrusion, we need some definitions to describe the experiment and formula design.
[0053] Due to the lack of relevant data sets, we first explore the setting of thresholds and the creation of relevant data sets through experiments. Define the range of each object in the form of input 3D space point cloud. We represent the point cloud data received by the lidar as p, then:
[0054] It should be a 4-dimensional coordinate. The first three variables are its position coordinates in the point cloud space. The fourth variable represents the intensity of the point cloud here. N represents the total number of points in the point cloud. The 3D detection system performs a process f: p→B to give a rough cubic range limit for each surrounding object: B = {b1, b2, b3, ..., b M}, where M is the number of object boundaries, each boundary The three coordinates x, y, and z represent the unknown coordinates of the point cloud space of the geometric center of the boundary, l, w, and h represent the length, width, and height of the cube area respectively, and θ represents the rotation angle of the sub-square area on the y axis. Therefore, we can divide the space into blocks for the obtained laser radar signal according to the above representation.
[0055] For the case where the point clouds of objects commonly seen on the road, such as pedestrians and non-motor vehicles, are artificially implanted into the lidar system, we analyze the differences in point cloud density, distribution, and quantity compared to the actual detection of the same type of objects. After obtaining the spatial range, we need to give representations of various other obstacle classifications such as pedestrians and non-motor vehicles. For the potential known classifications encountered by the radar detector, we use To express, then we have:
[0056] for There are K types of objects on the image. K is adjusted according to the requirements of our design. For example, when I only need to identify one type of object, then K = 1. When I need to identify multiple objects, such as 90 types, then K = 90. Our main goal is to divide each area b in the input point cloud obtained by the lidar i The classification number is given in the , that is, first identify what this object is. Classification number set S K ={1, 2, 3, ..., K}.
[0057] After obtaining the necessary representation basis of these feature data, we need to use the characteristics of these differences to give a mathematical method to judge the authenticity. For each type of obstacle, the same method can be applied to extract features and threshold judgment of real and fake data.
[0058] Select a certain position and distance to place a certain type of object. For a certain type of object, place the real object at a certain position and obtain the boundary area b of the object i . Use the latest attack equipment to implant the same type of K = κ fake data with the same y-axis rotation angle at this position. We will b i The feature vector of the real data in Recorded as
[0059]
[0060] b i The feature vector of the data embedded in Recorded as
[0061]
[0062] Among them, the 6 coordinates of the two are: and Representative b i The number of points in the region, and The three parameters representing the position coordinates of the center of mass of the real data and the fake data in this area, and Represent the mean intensity of all points of real data and fake data in this area, and Represent the variance of the intensity of all points of real data and fake data in this area respectively.
[0063] Among them, the mean and variance of intensity and The calculations are as follows:
[0064]
[0065] in, is the intensity of the mth point, That is b i The total number of points in range.
[0066] Calculate the variance of intensity:
[0067]
[0068] in, is the intensity of the mth point, That is b i The total number of points in the range, It is the mean intensity calculated by formula 3.
[0069] Then, to compare the difference between the two, calculate the following:
[0070] calculate and Euclidean distance (the smaller the more similar, [0, +∞)):
[0071]
[0072] in, for The jth coordinate of for The j-th coordinate of .
[0073] calculate and Cosine similarity (the larger the more similar, [-1, +1]):
[0074] Inner Product:
[0075]
[0076] in, for The jth coordinate of for The j-th coordinate of .
[0077] Cosine Similarity:
[0078]
[0079] in, is calculated in Formula 6 and Inner product, for The jth coordinate of for The j-th coordinate of .
[0080] Then, design the judgment value S (the larger the value, the closer to the truth, [0,100]):
[0081] Normalized cosine similarity:
[0082]
[0083] in, Calculation is as in formula 6 and 7.
[0084] Judgment value:
[0085]
[0086] Here, e is the base of natural logarithms.
[0087] In summary, we have obtained the judgment criteria. For a certain type of object at a certain position, there is always a constant As the threshold, , it can be considered true. For different K, that is, different types of obstacle data, we uniformly define it within the block range B to roughly outline its volume features, because their specific details are not the most important. For example, facing an obstacle that is basically distributed in an area of 1.8m×0.5m×0.5m, whether it is a person or a bamboo pole of similar volume, the machine should judge to stop if it is real data. Therefore, we can determine the threshold of formula (9) for real and fake data of each type of obstacle, and thus obtain whether the point cloud data of each object in any area of the surrounding environment is real or fake, and then determine whether it has been invaded. Since the authenticity of the data can be determined, when the obstacle is judged to be a fake signal, it can assist the autonomous driving system to ignore this object when making real-time route planning and make correct decisions.
Claims
1. A laser radar-based autonomous driving attack detection method, characterized in that: Here are the steps: Step 1: Place the obstacle entity at a certain position near the vehicle-mounted LiDAR system, obtain the surrounding 3D space point cloud data through the LiDAR system sending and receiving signals, and frame the cube area where the obstacle entity point cloud is located; Step 2: Use the existing advanced attack equipment against laser radar to forge the point cloud data of the obstacle placed in the cube area in step 1, and obtain the real and forged data of the obstacle; compare and analyze the real and forged data through the standard function of judging the forged point cloud signal to obtain the empirical threshold; Step 3: During actual driving, when the LiDAR sends and receives signals to obtain the surrounding point cloud, the point cloud data in each identified cube area is calculated using a standard function for determining forged point cloud signals, and the calculation result is compared with the corresponding threshold to determine whether the data is forged, that is, whether it has been attacked.
2. The laser radar-based autonomous driving attack detection method according to claim 1, characterized in that: The process of acquiring the 3D space point cloud data set obtained by the laser radar system sending and receiving signals in step 1 is as follows: 1.1 Define the range of each object in the input space point cloud form. We represent the point cloud data received by the lidar as p, then we have: It should be a 4-dimensional coordinate. The first three variables are its position coordinates in the point cloud space, the fourth variable represents the intensity of the point cloud here, and N represents the total number of points in the point cloud. 1.2 The 3D detection system performs a process f:p→B to give a rough cube range limit for each surrounding object: B = {b1, b2, b3, ..., b M }, where M is the number of object boundaries, each boundary Defined as x, y, z, the three coordinates represent the unknown coordinates of the point cloud space of the geometric center of the boundary, l, w, h represent the length, width and height of the cube area respectively, and θ represents the rotation angle of the sub-square area on the y-axis; therefore, we can divide the space into blocks for the obtained laser radar signal according to the above representation; 1.3 For the potential various known classifications of data encountered by the radar detector, use To express, then we have: There are K object types on the classification, for Our main goal is to divide each area b in the input point cloud obtained by the lidar i The classification number is given in the , that is, first identify what this object is. Classification number set S K ={1, 2, 3, ..., K}.
3. The laser radar-based autonomous driving attack detection method according to claim 1 or 2, characterized in that: The design process of the standard function for judging the forged point cloud signal in step 2 is as follows: Select a certain position and distance to place a certain type of object. For a certain type of object, place a real object at a certain position and obtain the boundary area b of this object i . Use the latest attack equipment to implant forged data of the same type K = κ and the same y-axis rotation angle at this position; we will b i The feature vector of the real data in Recorded as b i The feature vector of the data embedded in Recorded as Among them, the 6 coordinates of the two are: and Representative b i The number of points in the region, and The three parameters representing the position coordinates of the center of mass of the real data and the fake data in this area, and Represent the mean intensity of all points of real data and fake data in this area, and Represent the variance of the intensity of all points of real data and fake data in this area respectively; Among them, the mean and variance of intensity and The calculations are as follows: in, is the intensity of the mth point, That is b i The total number of points in range. Calculate the variance of intensity: in, is the intensity of the mth point, That is b i The total number of points in the range, It is the intensity mean calculated by formula 3. Then, to compare the difference between the two, calculate the following: calculate and Euclidean distance (the smaller the more similar, [0, +∞)); in, for The jth coordinate of for The j-th coordinate of calculate and Cosine similarity (the larger the value, the more similar it is, [-1, +1]); Inner Product: in, for The jth coordinate of for The j-th coordinate of . Cosine Similarity: in, is calculated in Formula 6 and Inner product, for The jth coordinate of for The j-th coordinate of Then, the judgment value S is designed (the larger the value, the closer to the truth, [0,100]); Normalized cosine similarity: in, Calculation is as in formula 6, 7; Judgment value: Where, e is the base of natural logarithm; In summary, we have obtained the judgment criteria. For a certain type of object at a certain position, there is always a constant As the threshold, It can be considered true.
4. The laser radar-based autonomous driving attack detection method according to claim 3, characterized in that: For different K, that is, different types of obstacle data, they are uniformly defined within the block range B to roughly outline their volume features, and the thresholds of the real and forged data of each type of obstacle are determined in formula (9). The point cloud data of each object in any area of the surrounding environment is obtained to determine whether it is real or forged, and then it can be judged whether it has been invaded.