Network traffic anomaly detection method for vehicle-network interaction

Abstract

The invention discloses a vehicle network interaction-oriented network traffic anomaly detection method, which belongs to the technical field of traffic anomaly detection, and comprises the following steps of: 1, collecting and preprocessing data; step 2, carrying out deep learning model training; step 3, constructing a federal learning framework; and step 4, real-time flow anomaly detection and alarm are carried out. The first step comprises a data source, a data collection process and data preprocessing; the data source is used for communication between a vehicle and the Internet, including uplink traffic, downlink traffic, data transmission of a vehicle internal network and external interaction data; the data transmission of the vehicle internal network comprises communication between CAN bus data and an ECU (Electronic Control Unit); the external interaction data comprises communication data with the drive test unit and interaction data with the traffic control system. According to the invention, deep learning and federated learning are combined, so that the abnormal traffic in vehicle network interaction can be efficiently identified in real time.

Description

Technical Field

[0001] The present invention belongs to the technical field of traffic anomaly detection, and in particular relates to a network traffic anomaly detection method for vehicle-network interaction. Background Art

[0002] With the rapid development of intelligent transportation systems (ITS) and autonomous driving technologies, vehicle-to-everything (V2X) has become one of the core technologies for future traffic management. V2X technology enables vehicles, roadside units, traffic management systems and other traffic facilities to interconnect and collaborate in real time, share important traffic information, and greatly improve road safety, efficiency and smoothness. However, the openness and complexity of V2X information systems also expose them to severe network security threats. Therefore, how to improve the security of V2X systems, especially in terms of network traffic monitoring and anomaly detection, attack path deduction and situational awareness, has become a current research hotspot.

[0003] The prior art has the following defects:

[0004] Lack of dedicated modeling of vehicle-grid interaction: Traffic anomaly detection methods in vehicle-grid interaction are usually based on traditional network traffic analysis, which fails to fully consider the characteristics of vehicle-grid interaction (such as real-time interaction between vehicles and roadside units and traffic management systems). Therefore, existing methods cannot fully capture the dynamic changes and complex interaction patterns of traffic in vehicle-grid interaction.

[0005] Lack of real-time performance: Although existing deep learning-based anomaly detection methods have improved in accuracy, most of them rely on data analysis of a single node and cannot handle the massive distributed data in vehicle-grid interaction. They also have high latency problems and cannot meet the high real-time requirements of vehicle-grid interaction information systems.

[0006] Data privacy and heterogeneity issues: Traditional intrusion detection methods require all data on vehicle-network interactions to be centralized in one center for processing, which may bring the risk of data privacy leakage. Although existing federated learning methods can solve data privacy issues, they are still not optimized for the various heterogeneous devices in the vehicle-network environment and cannot efficiently handle heterogeneous networks and devices in vehicle-network interactions. Summary of the invention

[0007] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a network traffic anomaly detection method for vehicle-network interaction. The prior art cannot efficiently, real-time and accurately detect network traffic anomalies in vehicle-network interaction, especially when dealing with heterogeneous environments, distributed data and large-scale interactive traffic that are unique to vehicle-network interaction. There are problems such as low processing efficiency, poor real-time performance, and privacy leakage. Although the existing vehicle-network interaction anomaly detection methods have improved the accuracy of traffic anomaly identification to a certain extent, they generally have the defects of being unable to efficiently handle complex interactive relationships in vehicle-network interaction, poor real-time performance, and privacy issues. Especially when faced with large-scale data and dynamic traffic patterns in vehicle-network interaction, existing methods often cannot adapt well to the needs. The present invention proposes a new network traffic anomaly detection method based on vehicle-network interaction by combining deep learning methods and federated learning frameworks to solve the defects in the prior art.

[0008] The objective of the present invention is achieved as follows: a network traffic anomaly detection method for vehicle-network interaction, which comprises the following steps: step one, data collection and preprocessing; step two, deep learning model training; step three, building a federated learning framework; step four, real-time traffic anomaly detection and alarm.

[0009] The step 1 includes data source, data collection process and data preprocessing;

[0010] The data source is used for communication between the vehicle and the Internet, including uplink traffic, downlink traffic, data transmission of the vehicle's internal network, and external interactive data; the data transmission of the vehicle's internal network includes the communication between CAN bus data and the ECU electronic control unit; the external interactive data includes communication data with the road test unit and interactive data with the traffic control system;

[0011] The data collection process is used to deploy a traffic monitoring module inside the vehicle to capture the communication data between the vehicle and the Internet in real time; obtain external network environment data through the API interface of the Internet of Vehicles platform or cloud service provider, and store the collected data in a distributed database for subsequent processing and analysis;

[0012] The data preprocessing uses decision trees and clustering algorithms to perform preliminary screening on the collected data, remove redundant and invalid data, and use the Kalman filter algorithm to smooth the original data to remove noise and outliers; by analyzing the statistical characteristics of the data, the statistical characteristics include mean, variance and standard deviation, identify and remove data points that do not conform to the normal distribution, and use the Z-score standardization method to standardize the data.

[0013] The step 2 includes graph structure modeling, Graph-LSTM model construction, deep learning model training, abnormal traffic detection, model evaluation and optimization;

[0014] The graph structure modeling is used to construct a topological graph structure of vehicle-grid interaction by taking the communication entities including vehicles and roadside units in the vehicle-grid interaction as nodes of the graph and the communication relationships between them as edges of the graph, and to extract the interaction features between different vehicles using a graph neural network;

[0015] The construction of the Graph-LSTM model includes building a Graph-LSTM model to fuse graph structure information and multi-dimensional data features to extract traffic features; the Graph-LSTM unit replaces the fully connected network in the standard LSTM unit with a network containing GNN to fuse topology information and indicator information;

[0016] Deep learning model training uses normal traffic data to train the Graph-LSTM model to learn normal traffic patterns, and uses CNN to extract the spatial features of data packets and LSTM to extract the temporal features between data packets;

[0017] Abnormal traffic detection uses the trained model to analyze real-time traffic data, automatically identifies abnormal traffic that does not conform to the normal traffic pattern, and uses the SoftMax classifier to detect abnormal traffic based on the learned spatiotemporal features;

[0018] Model evaluation and optimization Use the validation set to evaluate the model effect, adjust the model parameters to optimize the performance, and use the k-fold cross-validation technique to evaluate and select the model.

[0019] The step three includes each node training locally, transmitting the local model parameters to the central server through the federated learning framework, and the server updating the global model; this process is used to ensure data privacy protection and avoid the hidden dangers of centrally processing all data sets.

[0020] The step three comprises:

[0021] (1) Initialize the global model: The server initializes the global model and distributes it to all clients. This is the starting point of the federated learning process and is used to ensure that each client has the same model parameters to start training.

[0022] (2) Local training: Each client performs local training of the model based on its own data and calculates gradients or updates model parameters. The client divides its local dataset into multiple batches based on the experimental settings, and uses one batch of dataset for each local training.

[0023] (3) Upload parameters: The client uploads the locally updated model parameters or gradients to the server, including the transmission of model parameters, and does not involve the transmission of original data, which is used to protect data privacy;

[0024] (4) Parameter aggregation: The server receives model parameters from all clients and aggregates them to update the global model. The aggregation methods include averaging or weighted averaging.

[0025] (5) Global model update: The server updates the aggregated model parameters into a global model and distributes it to each client for the next round of training;

[0026] (6) Iterative training: It involves repeating the above process until the model converges or reaches the predetermined number of training rounds.

[0027] The step four includes the system automatically generating an alarm when abnormal traffic is detected, marking the location, type and potential threat of the abnormal traffic, and updating the detection results in real time to ensure the security of vehicle-grid interaction.

[0028] The fourth step comprises:

[0029] (1) Anomaly detection trigger: used to deploy a Graph-LSTM-based deep learning model to monitor traffic data in vehicle-grid interaction in real time. The model automatically identifies abnormal traffic that does not conform to the normal pattern by learning the normal traffic pattern.

[0030] (2) Alarm generation: When the model detects abnormal traffic, the system automatically triggers the alarm mechanism. The alarm content includes the specific location, type and potential threat of the abnormal traffic; the location includes a specific device or IP address; the type includes DoS attack and Probe attack; the potential threat includes data leakage risk and service interruption risk;

[0031] (3) Alarm detail recording: The system records the details of abnormal events, including timestamp, source and destination addresses, and protocol type, for subsequent analysis and auditing;

[0032] (4) Real-time update of detection results: The system continuously collects new traffic data and updates the model input in real time to adapt to changes in the network environment. Through online training or fine-tuning of the model, the system adapts to new traffic patterns to improve detection accuracy.

[0033] (5) Security response: Based on the severity and type of the alert, the system automatically executes predefined security response measures, including blocking suspicious connections and isolating affected devices;

[0034] (6) Feedback loop: The detected abnormal traffic and response results are fed back to the model for model retraining and optimization.

[0035] The beneficial effects of the present invention are as follows: by combining deep learning and federated learning, abnormal traffic in vehicle-grid interaction can be identified efficiently and in real time.

[0036] The IoT intrusion detection method based on graph neural network (GNN) constructs a network topology diagram of vehicle-network interaction, combines the interaction data between vehicles, roadside units and traffic management systems, and uses graph neural networks to capture multi-dimensional abnormal behaviors in the vehicle-network environment. The deep learning framework can identify abnormal traffic in complex traffic patterns, such as data tampering, communication failures, and malicious attacks, through automatic feature extraction and learning of traffic data. The graph neural network (GNN) in the deep learning model can effectively capture the complex interactive behaviors between vehicles, roadside units and traffic management systems in vehicle-network interaction, improving the accuracy and robustness of anomaly detection.

[0037] Based on the framework of federated learning, the problems of data privacy and heterogeneous environment in vehicle-grid interaction are solved by means of distributed training models. Each node (such as vehicles, roadside units, etc.) performs data analysis and model training locally, and then sends the results of local training to the central server to update the global model. In this way, the privacy data of vehicles and roadside facilities can be protected, while improving the efficiency of anomaly detection in the entire vehicle-grid interaction information system. Applying federated learning in distributed scenarios of vehicle-grid interaction can solve the problems of data privacy and heterogeneous environment, while improving the overall detection efficiency and real-time performance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a network topology diagram of the vehicle-network interaction of the present invention;

[0039] Figure 2 is a flowchart of network traffic anomaly detection based on deep learning of the present invention;

[0040] Figure 3 This is a distributed training framework diagram based on federated learning of the present invention. DETAILED DESCRIPTION

[0041] The present invention is further described in detail below in conjunction with the accompanying drawings. It should be pointed out that it is only for the purpose of more clearly describing and explaining the present invention.

[0042] like Figure 1-3 As shown, this embodiment discloses a network traffic anomaly detection method for vehicle-network interaction, including:

[0043] 1. Data collection and preprocessing

[0044] Collect real-time traffic data from various nodes (vehicles, roadside units, etc.) in the vehicle-grid interaction, including communication data, location data, sensor data, etc. The preprocessing process includes operations such as denoising and standardization to ensure the quality of the data.

[0045] The specific steps are as follows:

[0046] (1) Data sources: Communication data between the vehicle and the Internet, including uplink and downlink traffic; data transmission within the vehicle’s internal network, such as CAN bus data and communication between ECUs (electronic control units); external interaction data, such as communication data with the road test unit and interaction data with the traffic control system.

[0047] (2) Data collection process: Deploy a traffic monitoring module inside the vehicle to capture the communication data between the vehicle and the Internet in real time. Use the API interface of the Internet of Vehicles platform or cloud service provider to obtain external network environment data. Store the collected data in a distributed database for subsequent processing and analysis.

[0048] (3) Data preprocessing: Use decision trees and clustering algorithms to preliminarily screen the collected data and remove redundant and invalid data. Use the Kalman filter algorithm to smooth the raw data and remove noise and outliers. By analyzing the statistical characteristics of the data (including mean, variance, standard deviation, etc.), identify and remove data points that do not conform to the normal distribution. Use the Z-score standardization method to standardize the data.

[0049] 2. Deep learning model training

[0050] Use graph neural networks (GNN) to model the topological structure and multidimensional data of vehicle-grid interactions and extract traffic features. By building a deep learning model, learn normal traffic patterns and automatically identify abnormal traffic.

[0051] The specific steps are as follows:

[0052] (1) Graph structure modeling: The communication entities in the vehicle-grid interaction (such as vehicles, roadside units, etc.) are regarded as nodes of the graph, and the communication relationships between them are regarded as edges of the graph. The topological graph structure of the vehicle-grid interaction is constructed, and the graph neural network (GNN) is used to extract the interaction features between different vehicles.

[0053] (2) Graph-LSTM model construction: The Graph-LSTM model is constructed to fuse graph structure information and multi-dimensional data features to extract traffic features. The Graph-LSTM unit replaces the fully connected network in the standard LSTM unit with a network containing GNN to fuse topology information and indicator information.

[0054] (3) Deep learning model training: Use normal traffic data to train the Graph-LSTM model and learn normal traffic patterns. Combine the CNN and LSTM models, use CNN to extract the spatial features of data packets, and use LSTM to extract the temporal features between data packets.

[0055] (4) Abnormal traffic detection: Use the trained model to analyze real-time traffic data and automatically identify abnormal traffic that does not conform to the normal traffic pattern. The SoftMax classifier can be used to detect abnormal traffic based on the learned spatiotemporal features.

[0056] (5) Model evaluation and optimization: Use the validation set to evaluate the model effect and adjust the model parameters to optimize performance. The k-fold cross-validation technique can be used to evaluate and select the model with the best performance.

[0057] 3. Construction of Federated Learning Framework

[0058] Each node is trained locally, and the local model parameters are transmitted to the central server through the federated learning framework, and the server updates the global model. This process ensures data privacy protection and avoids the hidden dangers of processing all data in a centralized manner.

[0059] The specific steps are as follows:

[0060] (1) Initialize the global model: The server initializes the global model and distributes it to all clients. This is the starting point of the federated learning process, ensuring that each client has the same model parameters to start training.

[0061] (2) Local training: Each client performs local training of the model based on its own data and calculates gradients or updates model parameters. The client divides its local dataset into multiple batches based on the experimental settings, and uses one batch of dataset for each local training.

[0062] (3) Upload parameters: The client uploads the locally updated model parameters or gradients to the server. This process involves the transmission of model parameters but not the transmission of original data, thus protecting data privacy.

[0063] (4) Parameter aggregation: The server receives model parameters from all clients, aggregates them, and updates the global model. The aggregation method can be simple averaging or weighted averaging.

[0064] (5) Global model update: The server updates the aggregated model parameters into a global model and distributes it to each client for the next round of training.

[0065] (6) Iterative training: Repeat the above process until the model converges or reaches the predetermined training rounds.

[0066] 4. Real-time traffic anomaly detection and alerting

[0067] When abnormal traffic is detected, the system will automatically generate an alert to mark the location, type and potential threat of the abnormal traffic. The system can update the detection results in real time to ensure the security of vehicle-grid interaction.

[0068] The specific steps are as follows:

[0069] (1) Anomaly detection trigger: Deploy a deep learning model based on Graph-LSTM to monitor traffic data in vehicle-grid interaction in real time. The model learns normal traffic patterns and automatically identifies abnormal traffic that does not conform to normal patterns.

[0070] (2) Alert generation: Once the model detects abnormal traffic, the system will automatically trigger an alert mechanism. The alert content includes the specific location of the abnormal traffic (such as a specific device or IP address), type (such as DoS attack, Probe attack, etc.) and potential threats (such as data leakage risk, service interruption risk).

[0071] (3) Alarm detail recording: The system records the details of abnormal events, including timestamp, source and destination addresses, protocol type, etc., for subsequent analysis and auditing.

[0072] (4) Real-time update of detection results: The system continuously collects new traffic data and updates the model input in real time to adapt to changes in the network environment. By online training or fine-tuning the model, the system can adapt to new traffic patterns and improve detection accuracy.

[0073] (5) Security response: Based on the severity and type of the alert, the system can automatically execute predefined security response measures, such as blocking suspicious connections, isolating affected devices, etc.

[0074] (6) Feedback loop: The detected abnormal traffic and response results are fed back to the model for model retraining and optimization.

[0075] In a vehicle-network interaction simulation environment, when a vehicle communicates with a traffic management system and roadside facilities, the network traffic of a certain vehicle is abnormal. The detection system of the present invention will monitor the traffic data in real time and analyze whether the abnormal traffic conforms to the learned abnormal pattern through the graph neural network model. If it is confirmed to be abnormal traffic, the system will trigger an alarm and perform distributed processing through the federated learning framework to ensure the real-time response and privacy protection of the system.

[0076] The federated learning framework was validated on publicly accessible data of cars that were hacked or attacked. The experimental results show that the deep federated model outperforms the local model in terms of accuracy and improves the detection efficiency by 10.5-13%. This shows that the framework has good performance in dealing with network traffic anomaly detection in vehicle-network interaction scenarios and can be effectively applied to research in this field.

[0077] The core innovation of the present invention is to combine the graph neural network (GNN) with the federated learning framework, and propose an efficient, real-time and scalable solution for the problem of traffic anomaly detection in the vehicle-network interaction scenario, breaking through the shortcomings of the existing technology in terms of real-time, privacy protection and adaptability to heterogeneous environments. 1. Application advantages of deep learning framework The present invention refers to the Internet of Things intrusion detection method based on the graph neural network (GNN), and by constructing a network topology diagram of vehicle-network interaction, combining the interaction data between vehicles, roadside units and traffic management systems, the graph neural network is used to capture multi-dimensional abnormal behaviors in the vehicle-network environment. The deep learning framework can identify abnormal traffic in complex traffic patterns, such as data tampering, communication failures, malicious attacks, etc., through automatic feature extraction and learning of traffic data. 2. Application advantages of the federated learning framework Based on the framework of federated learning, the problems of data privacy and heterogeneous environments in vehicle-network interaction are solved by distributed training models. Each node (such as vehicles, roadside units, etc.) performs data analysis and model training locally, and then sends the results of local training to the central server for updating the global model. In this way, the privacy data of vehicles and roadside facilities can be protected, while improving the efficiency of anomaly detection in the entire vehicle-network interaction information system.

[0078] Vehicle-grid interaction traffic anomaly detection method combined with graph neural network: Through the graph neural network (GNN) in the deep learning model, the complex interactive behaviors between vehicles, roadside units and traffic management systems in vehicle-grid interaction can be effectively captured, improving the accuracy and robustness of anomaly detection. Introduction of federated learning framework: Applying federated learning in distributed scenarios of vehicle-grid interaction can solve data privacy and heterogeneous environment problems, while improving the overall detection efficiency and real-time performance of the system.

[0079] The above are only preferred specific implementation modes of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical solutions and concepts of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A network traffic anomaly detection method for vehicle-network interaction, characterized in that: The following steps are involved: Step 1: Data collection and preprocessing; Step 2: Conduct deep learning model training; Step 3: Build a federated learning framework; Step 4: Perform real-time traffic anomaly detection and alarm.

2. The method for detecting network traffic anomalies for vehicle-network interaction according to claim 1 is characterized by: The step 1 includes data source, data collection process and data preprocessing; The data source is used for communication between the vehicle and the Internet, including uplink traffic, downlink traffic, data transmission of the vehicle's internal network, and external interactive data; the data transmission of the vehicle's internal network includes the communication between CAN bus data and the ECU electronic control unit; the external interactive data includes communication data with the road test unit and interactive data with the traffic control system; The data collection process is used to deploy a traffic monitoring module inside the vehicle to capture the communication data between the vehicle and the Internet in real time; obtain external network environment data through the API interface of the Internet of Vehicles platform or cloud service provider, and store the collected data in a distributed database for subsequent processing and analysis; The data preprocessing uses decision trees and clustering algorithms to perform preliminary screening on the collected data, remove redundant and invalid data, and use the Kalman filter algorithm to smooth the original data to remove noise and outliers; by analyzing the statistical characteristics of the data, the statistical characteristics include mean, variance and standard deviation, identify and remove data points that do not conform to the normal distribution, and use the Z-score standardization method to standardize the data.

3. The method for detecting network traffic anomalies for vehicle-network interaction according to claim 1 is characterized by: The step 2 includes graph structure modeling, Graph-LSTM model construction, deep learning model training, abnormal traffic detection, model evaluation and optimization; The graph structure modeling is used to construct a topological graph structure of vehicle-grid interaction by taking the communication entities including vehicles and roadside units in the vehicle-grid interaction as nodes of the graph and the communication relationships between them as edges of the graph, and to extract the interaction features between different vehicles using a graph neural network; The construction of the Graph-LSTM model includes building a Graph-LSTM model to fuse graph structure information and multi-dimensional data features to extract traffic features; the Graph-LSTM unit replaces the fully connected network in the standard LSTM unit with a network containing GNN to fuse topology information and indicator information; Deep learning model training uses normal traffic data to train the Graph-LSTM model to learn normal traffic patterns, and uses CNN to extract the spatial features of data packets and LSTM to extract the temporal features between data packets; Abnormal traffic detection uses the trained model to analyze real-time traffic data, automatically identifies abnormal traffic that does not conform to the normal traffic pattern, and uses the SoftMax classifier to detect abnormal traffic based on the learned spatiotemporal features; Model evaluation and optimization Use the validation set to evaluate the model effect, adjust the model parameters to optimize the performance, and use the k-fold cross-validation technique to evaluate and select the model.

4. The method for detecting network traffic anomalies for vehicle-network interaction according to claim 1 is characterized by: The step three includes each node training locally, transmitting the local model parameters to the central server through the federated learning framework, and the server updating the global model; this process is used to ensure data privacy protection and avoid the hidden dangers of centrally processing all data sets.

5. The method for detecting network traffic anomalies for vehicle-network interaction according to claim 4 is characterized by: The step three comprises: (1) Initialize the global model: The server initializes the global model and distributes it to all clients. This is the starting point of the federated learning process and is used to ensure that each client has the same model parameters to start training. (2) Local training: Each client performs local training of the model based on its own data and calculates gradients or updates model parameters. The client divides its local dataset into multiple batches based on the experimental settings, and uses one batch of dataset for each local training. (3) Upload parameters: The client uploads the locally updated model parameters or gradients to the server, including the transmission of model parameters, and does not involve the transmission of original data, which is used to protect data privacy; (4) Parameter aggregation: The server receives model parameters from all clients and aggregates them to update the global model. The aggregation methods include averaging or weighted averaging. (5) Global model update: The server updates the aggregated model parameters into a global model and distributes it to each client for the next round of training; (6) Iterative training: It involves repeating the above process until the model converges or reaches the predetermined number of training rounds.

6. The method for detecting network traffic anomalies for vehicle-network interaction according to claim 1 is characterized by: The step four includes the system automatically generating an alarm when abnormal traffic is detected, marking the location, type and potential threat of the abnormal traffic, and updating the detection results in real time to ensure the security of vehicle-grid interaction.

7. The method for detecting network traffic anomalies for vehicle-network interaction according to claim 6 is characterized by: The fourth step comprises: (1) Anomaly detection trigger: used to deploy a Graph-LSTM-based deep learning model to monitor traffic data in vehicle-grid interaction in real time. The model automatically identifies abnormal traffic that does not conform to the normal pattern by learning the normal traffic pattern. (2) Alarm generation: When the model detects abnormal traffic, the system automatically triggers the alarm mechanism. The alarm content includes the specific location, type and potential threat of the abnormal traffic; the location includes a specific device or IP address; the type includes DoS attack and Probe attack; the potential threat includes data leakage risk and service interruption risk; (3) Alarm detail recording: The system records the details of abnormal events, including timestamp, source and destination addresses, and protocol type, for subsequent analysis and auditing; (4) Real-time update of detection results: The system continuously collects new traffic data and updates the model input in real time to adapt to changes in the network environment. Through online training or fine-tuning of the model, the system adapts to new traffic patterns to improve detection accuracy. (5) Security response: Based on the severity and type of the alert, the system automatically executes predefined security response measures, including blocking suspicious connections and isolating affected devices; (6) Feedback loop: The detected abnormal traffic and response results are fed back to the model for model retraining and optimization.

Images