Internet of vehicles safety detection system based on graph neural network

Abstract

The invention discloses an Internet of Vehicles security detection system based on a graph neural network, which belongs to the technical field of Internet of Vehicles security detection and comprises a data acquisition module, a feature extraction module, a feature association module, a feature matching module, a data expansion module and a security detection module. The method not only has perspectiveness, but also has comprehensiveness.

Description

Technical Field

[0001] The present invention belongs to the technical field of vehicle networking security detection, and particularly relates to a vehicle networking security detection system based on a graph neural network. Background Technique

[0002] Vehicle networking, as a product of the deep integration of new generation information technology with the fields of automobiles, electronics, and road traffic, can realize the intelligent information exchange and sharing between vehicle and vehicle, vehicle and road, vehicle and person, and vehicle and cloud through in-vehicle sensors, controllers, actuators, etc. In this process, each link of vehicle networking may become a potential attack target. In order to avoid vehicle networking being attacked due to security vulnerabilities, a vehicle networking security detection system has emerged as the times require.

[0003] A vehicle networking security detection system refers to a system that comprehensively evaluates each link of the "cloud, pipe, and terminal" of vehicle networking through system framework decomposition, business process analysis, security compliance analysis, threat analysis modeling, and penetration test verification, discovers potential security vulnerabilities, and proposes corresponding rectification suggestions.

[0004] Currently, the detection of vehicle networking security detection systems is generally based on database comparison detection, and the data in the database generally comes from the collection of historical data, which has lag and poor comprehensiveness, and is difficult to meet the forward-looking and comprehensiveness of vehicle networking security detection.

[0005] In view of this, a vehicle networking security detection system based on a graph neural network is designed to solve the above problems. Summary of the Invention

[0006] To solve the problems raised in the above background technique, the present invention provides a vehicle networking security detection system based on a graph neural network, which has the characteristics of forward-looking and comprehensiveness.

[0007] To achieve the above object, the present invention provides the following technical solution: A vehicle networking security detection system based on a graph neural network, comprising:

[0008] A data acquisition module, which acquires historical interaction data of the vehicle networking of each vehicle, including normal historical interaction data and abnormal historical interaction data; acquires real-time interaction data of the vehicle networking of the current vehicle, including normal real-time interaction data and abnormal real-time interaction data;

[0009] A feature extraction module, which extracts the features of the historical interaction data of the vehicle networking of each vehicle acquired, including normal historical interaction data features and abnormal historical interaction data features; extracts the features of the real-time interaction data of the vehicle networking of the current vehicle acquired, including normal real-time interaction data features;

[0010] A feature association module that establishes relationships between the historical interaction data features of the vehicle networking of each vehicle extracted, including the relationships between normal historical interaction data features and the relationships between abnormal historical interaction data features; and establishes relationships between the real-time interaction data features of the vehicle networking of the current vehicle extracted, including the relationships between normal real-time interaction data features.

[0011] A feature matching module that, based on the established relationships between the normal historical interaction data features of the vehicle networking of each vehicle and the established relationships between the normal real-time interaction data features of the vehicle networking of the current vehicle extracted, matches the normal historical interaction data of the vehicle networking of vehicles with highly similar relationships between features, and uses the relationships between the abnormal historical interaction data features of the vehicle networking of this vehicle as the relationships between the abnormal interaction data features of the current vehicle.

[0012] A data expansion module that obtains the abnormal real-time interaction data of the vehicle networking of the current vehicle and the determined relationships between the abnormal interaction data features of the current vehicle, and expands and saves the abnormal real-time interaction data of the vehicle networking of the current vehicle.

[0013] A security detection module that constructs a graph based on the interaction data of the vehicle networking of the current vehicle using a graph neural network, and performs security detection within the graph structure based on the expanded abnormal real-time interaction data of the vehicle networking of the current vehicle.

[0014] Furthermore, the feature extraction of the interaction data of the vehicle networking of the vehicle by the feature extraction module is based on a feature extraction model. The specific steps of the feature extraction model include:

[0015] Construct a feature extraction model, including a data input layer, a feature extraction layer, a feature selection layer, and a feature output layer. Among them, the data input layer receives the input interaction data of the vehicle networking of the vehicle, the feature extraction layer receives the data input by the data input layer and extracts features one by one, and at the same time learns to improve the accuracy of data feature extraction. The feature selection layer receives the features extracted by the feature extraction layer, calculates the similarity between features, and selects data features with non-overlapping similarities. The feature output layer outputs the features selected by the feature selection layer.

[0016] Train and construct the feature extraction model based on the historical interaction data of the vehicle networking of each vehicle, and optimize the model based on the feature extraction results.

[0017] Extract the features of the interaction data of the vehicle networking of the vehicle based on the optimized feature extraction model.

[0018] Furthermore, the specific steps of the feature association module for establishing relationships between the interaction data features of the vehicle networking of the vehicle include:

[0019] Any two features of the interaction data of the vehicle networking of the vehicle have a stable time series variable X t and Yt , set the lag coefficient as p and construct a VAR model:

[0020] The expression without the lag term of Y is:

[0021]

[0022] The expression including the lag term of Y is:

[0023]

[0024] In the formula: p represents the determined lag coefficient, α i and β i respectively represent the coefficients to be estimated, ∈ 1t represents the error term;

[0025] Test whether the Y feature is the Granger cause of the X feature. The null hypothesis H 0 : β 1 = β 2 =…= β p = 0, that is, the lag terms of Y have no explanatory power for the current value of X;

[0026] Calculate the F statistic, and the expression is:

[0027]

[0028] In the formula: (x - y) / p represents the average reduction in the sum of squared residuals including the lag terms of Y, and y / (T - 2p - 1) represents the average reduction in the sum of squared residuals without including the lag terms of Y. p represents the determined lag coefficient, and T represents the number of feature samples;

[0029] Obtain the F distribution based on the F statistic;

[0030] Obtain the corresponding p value based on the F distribution. If p < 0.05, reject the null hypothesis, and the Y feature is the Granger cause of the X feature. Otherwise, the null hypothesis cannot be rejected, and the Y feature is not the Granger cause of the X feature;

[0031] The judgment steps for whether the X feature is the Granger cause of the Y feature are the same as above;

[0032] Based on the Granger cause between features, judge the causal relationship between features and establish the causal relationship between features.

[0033] Furthermore, the specific steps for the similarity matching of the normal interaction data feature relationship between the vehicle networks of the two vehicles in the feature matching module include:

[0034] Calculate the similarity between the features of the normal interaction data of the vehicle networks of the two vehicles. The expression is:

[0035]

[0036] where: x i =(x 1 ,…,x n ) and y i =(y 1 ,…,y n ) respectively represent the characteristics of the normal interaction data of the vehicle networking of two vehicles;

[0037] Calculate the similarity between the causally related characteristics of the normal interaction data of the vehicle networking of two vehicles. The expression is:

[0038]

[0039] where: x i =(x 1 ,…,x n ) and y i =(y 1 ,…,y n ) respectively represent several characteristics with causal relationships of a characteristic of the normal interaction data of the vehicle networking of two vehicles;

[0040] Take the average value of the two similarities as the final similarity. The expression is:

[0041]

[0042] Take the normal historical interaction data of the vehicle networking of the vehicle with a high similarity in the relationship between the matched characteristics where the D value is higher than the preset threshold.

[0043] Further, the specific steps of the security detection module for constructing the interaction data of the vehicle networking of the vehicle into a graph based on the graph neural network include:

[0044] Take the entities in the interaction data of the vehicle networking of the current vehicle as nodes, and take the communication interaction relationship between the nodes as edges to construct the graph structure of the interaction data of the vehicle networking of the current vehicle.

[0045] Further, the specific steps of the security detection module for performing security detection on the abnormal real-time interaction data of the vehicle networking of the current vehicle based on the extension within the graph structure include:

[0046] Construct the extended abnormal real-time interaction data of the vehicle networking of the current vehicle into a graph structure based on the above steps;

[0047] Based on the same parameters of the two graph structures, perform security detection at the same positions in the graph structure.

[0048] Compared with the prior art, the beneficial effects of the present invention are:

[0049] The present invention first obtains the normal and abnormal historical interaction data of the vehicle networking of each vehicle for feature extraction and feature causal relationship association to form reference data. When obtaining the normal real-time interaction data of the current vehicle's vehicle networking, it can quickly determine the feature causal relationship of the abnormal interaction data of the current vehicle's vehicle networking based on the similarity of the associated feature causal relationships, so as to be able to quickly expand the possible abnormal interaction data of the current vehicle's vehicle networking when abnormal real-time interaction data appears in the current vehicle's vehicle networking. Safety detection is performed on the possible abnormal interaction data of the expanded current vehicle's vehicle networking, which not only has foresight but also can be expanded when the amount of abnormal real-time interaction data in the vehicle networking is small to improve comprehensiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 is a system framework diagram of the present invention;

[0051] In the figure: 1, data acquisition module; 2, feature extraction module; 3, feature association module; 4, feature matching module; 5, data expansion module; 6, safety detection module. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0052] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0053] The present invention provides the following technical solutions: A vehicle networking safety detection system based on a graph neural network, comprising:

[0054] A data acquisition module 1, which acquires the historical interaction data of the vehicle networking of each vehicle, including normal historical interaction data and abnormal historical interaction data; acquires the real-time interaction data of the vehicle networking of the current vehicle, including normal real-time interaction data and abnormal real-time interaction data;

[0055] A feature extraction module 2, which extracts the features of the historical interaction data of the vehicle networking of each vehicle acquired, including normal historical interaction data features and abnormal historical interaction data features; extracts the features of the real-time interaction data of the vehicle networking of the current vehicle acquired, including normal real-time interaction data features;

[0056] The feature extraction module 2 extracts features from the interaction data of the vehicle's Internet of Vehicles based on a feature extraction model. The specific steps of the feature extraction model include: constructing a feature extraction model, including a data input layer, a feature extraction layer, a feature selection layer, and a feature output layer. Among them, the data input layer receives the input interaction data of the vehicle's Internet of Vehicles, the feature extraction layer receives the data input by the data input layer and extracts features one by one, while learning to improve the accuracy of data feature extraction. The feature selection layer receives the features extracted by the feature extraction layer, calculates the similarity between the features, and selects the data features whose similarities do not overlap. The feature output layer outputs the features selected by the feature selection layer;

[0057] Based on the historical interaction data of the Internet of Vehicles of each vehicle, train and construct a feature extraction model, and optimize the model based on the feature extraction results;

[0058] Extract the features of the interaction data of the vehicle's Internet of Vehicles based on the optimized feature extraction model;

[0059] The feature association module 3 establishes the relationships between the features of the historical interaction data of the Internet of Vehicles of each vehicle extracted, including the relationships between the features of normal historical interaction data and the relationships between the features of abnormal historical interaction data; establish the relationships between the features of the real-time interaction data of the current vehicle's Internet of Vehicles extracted, including the relationships between the features of normal real-time interaction data;

[0060] The specific steps for the feature association module 3 to establish relationships for the interaction data features of the vehicle's Internet of Vehicles include:

[0061] Any two features of the interaction data of the vehicle's Internet of Vehicles have stable time series variables X t and Y t , set the lag coefficient as p, and construct a VAR model:

[0062] The expression without the Y lag term is:

[0063]

[0064] The expression including the Y lag term is:

[0065]

[0066] In the formula: p represents the determined lag coefficient, α i and β i respectively represent the coefficients to be estimated, ∈ 1t represents the error term;

[0067] Test whether the Y feature is the Granger cause of the X feature. The original hypothesis H 0 : β 1 =β 2 =…=β p= 0, that is, the lagged terms of Y have no explanatory power for the current value of X;

[0068] Calculate the F-statistic, and the expression is:

[0069]

[0070] In the formula: (x - y) / p represents the average reduction in the sum of squared residuals due to including the lagged terms of Y, and y / (T - 2p - 1) represents the average reduction in the sum of squared residuals without including the lagged terms of Y. p represents the determined lag coefficient, and T represents the number of characteristic samples;

[0071] Obtain the F-distribution based on the F-statistic;

[0072] Obtain the corresponding p-value based on the F-distribution. If p < 0.05, reject the null hypothesis, and the Y feature is the Granger cause of the X feature. Otherwise, the null hypothesis cannot be rejected, and the Y feature is not the Granger cause of the X feature;

[0073] The steps for judging whether the X feature is the Granger cause of the Y feature are the same as above;

[0074] Based on the Granger cause judgment between features, establish the causal relationship between features;

[0075] Selecting to establish the causal relationship between features can not only associate the abnormal real-time interaction data of the vehicle network of the current vehicle with the possible abnormal interaction data of the vehicle network of the vehicle, so as to achieve prediction, but also automatically infer the cause of the abnormal real-time interaction data of the vehicle network of the current vehicle, so as to timely confirm the abnormal cause and generate rectification suggestions;

[0076] The feature matching module 4, based on the established relationships between the normal historical interaction data features of the vehicle networks of each vehicle, and the established relationships between the normal real-time interaction data features of the vehicle network of the current vehicle, matches the normal historical interaction data of the vehicle network of the vehicle with a high similarity in the relationships between features, and uses the relationships between the abnormal historical interaction data features of the vehicle network of this vehicle as the relationships between the abnormal interaction data features of the current vehicle;

[0077] The specific steps for matching the similarity of the relationships between the normal interaction data features of the vehicle networks of two vehicles by the feature matching module 4 include:

[0078] Calculate the similarity between the features of the normal interaction data of the vehicle networks of two vehicles, and the expression is:

[0079]

[0080] In the formula: x i = (x 1 , …, x n ) and yi =(y 1 , y n ) represent the characteristics of the normal interaction data of the vehicle networking of two vehicles respectively;

[0081] Calculate the similarity between the characteristics with causal relationships in the normal interaction data of the vehicle networking of two vehicles. The expression is:

[0082]

[0083] In the formula: x i =(x 1 , …, x n ) and y i =(y 1 , y n ) represent several characteristics with causal relationships of a characteristic of the normal interaction data of the vehicle networking of two vehicles respectively;

[0084] Take the average value of the two similarities as the final similarity. The expression is:

[0085]

[0086] Take those with D value higher than the preset threshold as the normal historical interaction data of the vehicle networking of the vehicles with a high similarity in the relationship between the matched characteristics;

[0087] Using the similarity between characteristics and the average value of the similarity between characteristics with causal relationships as the final similarity can reduce the generation of similarity error values and improve the matching accuracy;

[0088] The data expansion module 5 obtains the abnormal real-time interaction data of the current vehicle's vehicle networking and determines the relationship between the characteristics of the current vehicle's abnormal interaction data, and expands and saves the abnormal real-time interaction data of the current vehicle's vehicle networking;

[0089] The security detection module 6 constructs a graph based on the interaction data of the current vehicle's vehicle networking using a graph neural network, and performs security detection within the graph structure based on the expanded abnormal real-time interaction data of the current vehicle's vehicle networking;

[0090] The specific steps for the security detection module 6 to construct a graph based on the interaction data of the vehicle networking of the vehicle using a graph neural network include:

[0091] Take the entities in the interaction data of the current vehicle's vehicle networking as nodes and the communication interaction relationship between the nodes as edges to construct the graph structure of the interaction data of the current vehicle's vehicle networking;

[0092] The specific steps for the security detection module 6 to perform security detection within the graph structure based on the expanded abnormal real-time interaction data of the current vehicle's vehicle networking include:

[0093] Construct the abnormal real-time interaction data of the extended current vehicle's Internet of Vehicles into a graph structure based on the above steps;

[0094] Based on the same parameters of the two graph structures, perform security detection at the same positions of the graph structures;

[0095] The graph neural network will retain the constructed parameters during the process of constructing the graph structure. Based on the same parameters of the two graph structures, that is, find the same retained construction parameters to achieve fast and accurate positioning for security detection, and the detection effect is good.

[0096] Although the embodiments of the present invention have been shown and described, for those of ordinary skill in the art, it can be understood that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principle and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A vehicle network security detection system based on a graph neural network, characterized in that: include: The data acquisition module (1) acquires the historical interaction data of the Internet of Vehicles of each vehicle, including normal historical interaction data and abnormal historical interaction data; and acquires the real-time interaction data of the Internet of Vehicles of the current vehicle, including normal real-time interaction data and abnormal real-time interaction data; A feature extraction module (2) extracts features of the historical interaction data of each vehicle's Internet of Vehicles, including features of normal historical interaction data and features of abnormal historical interaction data; extracts features of the real-time interaction data of the current vehicle's Internet of Vehicles, including features of normal real-time interaction data; The feature association module (3) establishes the relationship between the historical interaction data features of each vehicle's Internet of Vehicles, including the relationship between the normal historical interaction data features and the relationship between the abnormal historical interaction data features; establishes the relationship between the real-time interaction data features of the current vehicle's Internet of Vehicles, including the relationship between the normal real-time interaction data features; The feature matching module (4) matches the normal historical interaction data of the Internet of Vehicles of the vehicles with high similarity in feature relationship based on the feature relationship between the normal historical interaction data of the Internet of Vehicles of each vehicle and the feature relationship between the normal real-time interaction data of the Internet of Vehicles of the current vehicle, and uses the feature relationship between the abnormal historical interaction data of the Internet of Vehicles of the vehicle as the feature relationship between the abnormal interaction data of the current vehicle; A data expansion module (5) acquires abnormal real-time interaction data of the Internet of Vehicles of the current vehicle, determines the relationship between the features of the abnormal interaction data of the current vehicle, and expands the abnormal real-time interaction data of the Internet of Vehicles of the current vehicle for storage; The safety detection module (6) constructs the interaction data of the current vehicle's Internet of Vehicles into a graph based on a graph neural network, and performs safety detection within the graph structure based on the expanded abnormal real-time interaction data of the current vehicle's Internet of Vehicles.

2. The vehicle networking safety detection system based on a graph neural network according to claim 1 is characterized by: The feature extraction module (2) extracts features of the vehicle's Internet of Vehicles interaction data based on a feature extraction model. The specific steps of the feature extraction model include: Construct a feature extraction model, including a data input layer, a feature extraction layer, a feature selection layer and a feature output layer, wherein the data input layer receives the interactive data of the vehicle network inputted, the feature extraction layer receives the data inputted by the data input layer and extracts features one by one, and performs learning at the same time to improve the accuracy of data feature extraction, the feature selection layer receives the features extracted by the feature extraction layer, calculates the similarity between features, selects data features with non-overlapping similarities, and the feature output layer outputs the features selected by the feature selection layer; A feature extraction model is constructed based on the historical interaction data of the Internet of Vehicles of each vehicle, and the model is optimized based on the feature extraction results; The features of the vehicle's Internet of Vehicles interaction data are extracted based on the optimized feature extraction model.

3. The vehicle network security detection system based on a graph neural network according to claim 2 is characterized by: The specific steps of the feature association module (3) establishing a relationship between the interactive data features of the vehicle's Internet of Vehicles include: Any two features of the vehicle's Internet of Vehicles interaction data have a stable time series variable X t and Y t , set the lag coefficient to p and construct a VAR model: The expression without the Y lag term is: The expression including the lagged term of Y is: Where: p represents the determined hysteresis coefficient, α i and β i They are respectively represented as the coefficients to be estimated, ∈ 1t It is represented as the error term; Test whether the Y feature is the Granger cause of the X feature, the original hypothesis H0: β1 = β2 = ... = β p =0, that is, the lagged term of Y has no explanatory power for the current value of X; Calculate the F statistic, the expression is: Where: (xy) / p represents the average residual sum of squares reduced by including the Y lag term, y / (T-2p-1) represents the average residual sum of squares reduced by not including the Y lag term, p represents the determined lag coefficient, and T represents the number of characteristic samples; Based on the F statistic, the F distribution is obtained; Based on the F distribution, the corresponding p value is obtained. If p < 0.05, the null hypothesis is rejected and the Y feature is the Granger cause of the X feature. Otherwise, the null hypothesis cannot be rejected and the Y feature is not the Granger cause of the X feature. The steps to determine whether feature X is the Granger cause of feature Y are the same as above; The causal relationship between features is determined based on the Granger causality between features, and the causal relationship between features is established.

4. The vehicle networking safety detection system based on a graph neural network according to claim 3 is characterized by: The specific steps of the feature matching module (4) for matching the similarity of the feature relationship of the normal interactive data of the Internet of Vehicles of two vehicles include: Calculate the similarity between the features of the normal interaction data of the Internet of Vehicles of two vehicles. The expression is: Where: x i =(x1,…,x n ) and y i =(y1,…,y n ) represent the features of normal interaction data of the Internet of Vehicles of two vehicles respectively; Calculate the similarity between the causal features of the normal interaction data of the Internet of Vehicles of two vehicles. The expression is: Where: x i =(x1,…,x n ) and y i =(y1,…,y n ) are respectively represented as a feature of the normal interaction data of the Internet of Vehicles of two vehicles, and several features with causal relationship; Take the average of the two similarities as the final similarity, the expression is: The normal historical interaction data of the Internet of Vehicles of vehicles with D values ​​higher than the preset threshold are taken as the matched feature relationships with high similarity.

5. The vehicle networking safety detection system based on a graph neural network according to claim 4 is characterized by: The specific steps of constructing the vehicle's Internet of Vehicles interactive data into a graph based on the graph neural network of the safety detection module (6) include: The entities in the current vehicle's Internet of Vehicles interaction data are taken as nodes, and the communication interaction relationships between nodes are taken as edges, so as to construct a graph structure of the current vehicle's Internet of Vehicles interaction data.

6. The vehicle networking safety detection system of a graph neural network according to claim 5 is characterized by: The specific steps of the safety detection module (6) performing safety detection in a graph structure based on the abnormal real-time interactive data of the vehicle network of the expanded current vehicle include: The abnormal real-time interaction data of the expanded current vehicle's Internet of Vehicles is constructed into a graph structure based on the above steps; Based on the same parameters of the two graph structures, security detection is performed at the same position of the graph structure.

Images