Network connection vehicle GPS spoofing attack detection method and system

Abstract

The invention relates to a networked vehicle GPS spoofing attack detection method and system, and the method comprises the steps: adjusting a process noise parameter of improved Kalman filtering in real time through dynamic noise estimation, calculating a Sigma sampling point according to the parameter of the improved Kalman filtering in combination with QR decomposition, and then carrying out the nonlinear state transmission through the Sigma sampling point, a state prediction value and a prediction error covariance matrix are calculated, an estimation state is generated, then an observation value is obtained, the estimation state is updated by using the observation value, CUSUM detection is carried out according to the estimation state, a network connection vehicle GPS spoofing attack is judged, and the problem that a traditional method fails to detect a hidden attack with an invariable output residual error is effectively solved. According to the method provided by the invention, the accuracy, the robustness, the stability and the detection capability on the hidden attack of the networked vehicle GPS spoofing attack detection system are remarkably improved, so that the driving safety of the networked vehicle is enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of connected vehicle safety, and particularly relates to a method and system for detecting GPS spoofing attacks on connected vehicles. Background Art

[0002] The present invention relates to the field of connected vehicle safety, and particularly to a method and system for detecting global positioning system (GPS) spoofing attacks on connected vehicles.

[0003] In recent years, with the rapid development of autonomous driving and vehicle networking technologies, connected vehicles have been gradually deployed and operated on public roads. These vehicles are usually equipped with multiple sensors, such as GPS, lidar (LiDAR), cameras, etc., to perceive the surrounding environment and make driving decisions. The position information provided by the GPS sensor is crucial for navigation, path planning, and vehicle coordination, and is the basis for ensuring the safe and efficient operation of connected vehicles.

[0004] However, the widespread application of sensors has also increased the risk of connected vehicles being attacked by networks. Among them, GPS spoofing attack is a common threat. Attackers mislead the vehicle's positioning system by broadcasting false GPS signals, making it believe that it is in the wrong position or traveling at the wrong speed. Once the control system of the connected vehicle receives the spoofed GPS information, it may generate incorrect control instructions, interfere with the normal driving of the vehicle, and even may cause collision accidents, resulting in serious consequences.

[0005] To address such threats, various attack detection methods based on Kalman Filter (KF) and its variants (such as Extended Kalman Filter EKF, Unscented Kalman Filter UKF) have been proposed in the prior art. However, the existing detection methods based on KF / EKF / UKF generally have problems such as insufficient adaptability to noise changes, limited detection ability for stealthy attacks, and numerical stability.

[0006] For example, some methods use KF or EKF combined with statistical detection techniques (such as chi-square test, cumulative sum CUSUM test) to identify abnormal sensor readings. Matthew Porter et al. designed various detectors using KF technology, but regarded the environmental noise as a fixed value in the design, which may lead to a decline or even divergence in filtering performance in the actual changing road environment. Yuanzhe Wang et al. used EKF and CUSUM to detect position attacks, but it relies on the output (measurement) residuals of EKF. For stealthy spoofing attacks where the output residuals do not change significantly before and after the attack, that is, the attack signal can just be masked by the state change, the detection ability is limited.

[0007] In addition, when dealing with non-linear systems such as vehicle motion, standard KF and EKF have linearization errors or rely on the Gaussian noise assumption. Although UKF improves the processing ability for non-linear systems through the Unscented Transform, its performance may still be affected by changes in environmental noise, and standard UKF may have numerical stability problems. Although some studies have introduced machine learning methods (such as CNN, SVM) combined with Kalman filtering, their effects are often limited by the quality of training data and the generalization ability of the model. The distributed KF method proposed by Zhiyang Ju et al. improves the accuracy, but is only applicable to specific linear models.

[0008] Therefore, there is an urgent need to propose a new method that can overcome the above limitations and improve the accuracy, robustness, and stability of detecting various GPS spoofing attacks (especially stealth attacks) in a dynamic noise environment. Summary of the Invention

[0009] One of the objectives of the present invention is to at least solve one or more of the above problems existing in the prior art. In other words, one of the objectives of the present invention is to provide a method and system for detecting GPS spoofing attacks on connected vehicles that meet one or more of the foregoing requirements.

[0010] To achieve the above invention objective, the present invention adopts the following technical solutions:

[0011] In the first aspect, the present invention provides a method for detecting GPS spoofing attacks on connected vehicles, including the steps of:

[0012] S1. Obtain the state variables and control inputs of the connected vehicle system, and set an improved Kalman filter, where the improved Kalman filter uses a process noise parameter adjusted in real time;

[0013] S2. Set the parameters of the improved Kalman filter according to the state variables and control inputs;

[0014] S3. Process the improved Kalman filter using the square root method to calculate the Sigma sampling points;

[0015] S4. Perform non-linear state transfer using the Sigma sampling points, calculate the state prediction value and the predicted error covariance matrix, and generate the estimated state;

[0016] S5. Obtain the observed value and update the estimated state using the observed value;

[0017] S6. Perform state residual CUSUM detection based on the estimated state to determine GPS spoofing attacks on the connected vehicle.

[0018] As a preferred implementation, the process noise parameter is calculated using the dynamically adjusted process noise estimate.

[0019] As a further preferred embodiment, the process noise estimation is calculated using the Sage-Husa estimation algorithm and assuming that the measurement noise is known.

[0020] As a preferred embodiment, the parameters of the improved Kalman filter include the state estimate value, the covariance matrix, and also include the covariance matrix of the process noise and the measurement noise.

[0021] As a preferred embodiment, when using the square root method to process the improved Kalman filter, QR decomposition is used to calculate the Sigma sampling points to improve the numerical stability.

[0022] As a preferred embodiment, step S5 propagates the Sigma sampling points using the observation model and calculates the posterior estimate of the estimated state, thereby updating the estimated state.

[0023] As a preferred embodiment, the state residual CUSUM detection based on the estimated state specifically includes:

[0024] S61. Calculate the state estimation residual according to the estimated state;

[0025] S62. Calculate the quadratic form of the state estimation residual;

[0026] S63. Calculate the CUSUM detection quantity according to the quadratic form of the state estimation residual;

[0027] S64. Compare the CUSUM detection quantity with a preset threshold to determine whether there is a GPS spoofing attack.

[0028] As a further preferred embodiment, when calculating the CUSUM detection quantity according to the quadratic form of the state estimation residual, a decreasing coefficient is set for the CUSUM detection quantity, and the decreasing coefficient is used to control the influence of the CUSUM detection quantity at the previous moment on the current moment.

[0029] As a further preferred embodiment, the preset threshold is adjusted according to the historical data of the quadratic form of the state residual within a recent sliding window.

[0030] On the other hand, the present invention also provides a connected vehicle GPS spoofing attack detection system, which uses the connected vehicle GPS spoofing attack detection method as described in any one of the above to detect the connected vehicle GPS spoofing attack.

[0031] Compared with the prior art, the connected vehicle GPS spoofing attack detection method and system of the present invention have the following beneficial effects:

[0032] The present invention adopts an improved Kalman filter and combines it with dynamic process noise estimation, enabling the filter to adjust the estimation of process noise in real time according to the actual operating conditions, effectively coping with changes in environmental noise, and improving the adaptability to dynamic environmental noise and the state estimation accuracy;

[0033] In addition, the present invention uses an improved Kalman filter to adjust the process noise parameters in real time through dynamic noise estimation and combines QR decomposition to process the covariance matrix, ensuring the positive definiteness and numerical stability of the covariance matrix during the filtering process and improving the reliability of the algorithm in actual calculations.

[0034] Furthermore, the CUSUM detection algorithm of the present invention is based on the state estimation residuals of the filter and their quadratic forms, and a decreasing coefficient and an adaptive threshold are set, which can effectively capture covert attacks, overcome the main defects of existing methods relying on measurement residuals, solve the problem of the failure of traditional methods to detect covert attacks with unchanged output residuals, and can increase the threshold to avoid false alarms when the system fluctuates greatly normally, and decrease the threshold to improve the sensitivity to weak attacks when the system runs smoothly. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram comparing the MSE of the connected vehicle GPS spoofing attack detection method and the EKF method of the present invention at each moment;

[0036] Figure 2 A schematic diagram of the CUSUM detection quantity of the connected vehicle GPS spoofing attack detection method of the present invention under normal conditions;

[0037] Figure 3 A schematic diagram of the CUSUM detection quantity of the connected vehicle GPS spoofing attack detection method of the present invention under a covert false injection attack. DETAILED DESCRIPTION OF THE INVENTION

[0038] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention.

[0039] The following description provides examples and does not limit the scope, applicability, or examples set forth in the claims. Changes can be made to the functions and arrangements of the described elements without departing from the scope of the content of the present invention. Various processes or components can be appropriately omitted, substituted, or added to each example. For example, the described methods can be executed in a different order from the described order, and various steps can be added, omitted, or combined. In addition, the features described in some examples can be combined into other examples.

[0040] To facilitate the understanding of the inventive concept of the present invention, before introducing the specific implementation steps of the present invention, the implementation method of the stealth attack will be described to a certain extent.

[0041] It is assumed that the position information of the connected vehicle is obtained through GPS measurement. Since GPS is affected by observation noise during the measurement process, the measurement model under the influence of noise is expressed as:

[0042] y o = g(x o , ε)

[0043] where y o = [x m , y m , θ m T , x m , y m , θ m respectively represent the lateral position, longitudinal position, and front steering angle observation values, ε = [ε x , ε y , ε θ T represents the observation noise of the corresponding measurement value. It is assumed that ε follows a Gaussian distribution with a mean of 0 and a variance of R, i.e., ε ~ N(0, R). g(x o , ε) is expressed as:

[0044] g(x o , ε) = x o + ε

[0045] To facilitate subsequent derivation, the measurement model is rewritten in the following form:

[0046] y o = H o x o + ε

[0047] where H o represents the 3-dimensional identity matrix I3.

[0048] Connected vehicles mainly rely on GPS sensors to obtain position information. The GPS signal is obtained externally and is easily threatened by false injection attacks. After the connected vehicle receives the wrong information, it will execute wrong decisions. To ensure the safety of the connected vehicle, the system is required to promptly identify false injection attack signals for information repair of the system. Under the influence of false injection attack signals, the output of the vehicle will change, and an additional signal term will be introduced at the output end. The measurement model in the attack state is as follows:

[0049] y o，α = g(x o , ε) + α

[0050] where y o，α ​​Denote the observed value after the attack as \( \hat{z} \), and the false injection attack signal as \( \alpha \). Mainly considering the more dangerous stealthy false injection attack, the stealthy false injection attack can make the system output residual remain unchanged before and after the attack, thus avoiding conventional detection methods. Let \( x \) α and \( r \) α represent the state variable and the residual respectively when the system is under attack. Analyzing the stealth of the attack signal from the output signal equation, we can obtain:

[0051]

[0052] Let \( r \) o represent the system output residual under normal conditions, and \( c \) represent the change in the system state quantity caused by the attack. When the attack signal satisfies \( \alpha = H \) o \( c \), the system output residual remains unchanged before and after the attack, achieving stealth.

[0053] From the above analysis, it can be seen that the stealthy false injection attack on the connected vehicle GPS cannot be detected from the perspective of the system output residual. Therefore, a detection algorithm is designed from the perspective of the system state quantity of the filter. The detection quantity is designed based on the improved adaptive UKF state estimate value and a threshold is set to complete the detection of the stealthy false injection attack.

[0054] To effectively detect the above stealthy attack, an embodiment of the present invention provides a method for detecting GPS spoofing attacks on connected vehicles, and its specific implementation steps are as follows:

[0055] S1. Obtain the state variables and control inputs of the connected vehicle system, and set up an improved Kalman filter.

[0056] In this embodiment, first, a system model for describing the motion state of the connected vehicle needs to be established. This model is the basis for subsequent state estimation and attack detection.

[0057] Specifically, state variables that can fully characterize the key motion characteristics of the vehicle need to be defined. In this embodiment, the state vector \( y \) of the vehicle o includes the following components:

[0058] \( x \) m , \( y \) m , \( \theta \) m , representing the lateral position, longitudinal position, and observed value of the front steering angle respectively.

[0059] It is also necessary to determine the control inputs that affect the change of the vehicle state over time. These inputs usually come from the vehicle's control system. In this embodiment, typical control inputs may include the vehicle's acceleration, throttle / brake commands, or the vehicle's steering angular velocity, steering angle commands.

[0060] These state variables and control inputs together form the basis of a non-linear state space model that describes the dynamic behavior of the vehicle and is used as the input for subsequent filtering algorithms.

[0061] Step S1 also sets an improved Kalman filter. The traditional algorithm assumes that the means and variances of process noise and measurement noise are constant values. However, in practical applications, the statistical characteristics of the noise usually vary. As another preferred embodiment, the internal parameters of the improved Kalman filter used in the present invention have a dynamic adjustment mechanism and use a process noise parameter that is adjusted in real time. Specifically, it uses the estimated process noise after dynamic adjustment for calculation.

[0062] In this embodiment, this adaptive process noise estimation can be achieved through the Sage-Husa estimation algorithm.

[0063] Considering that the Sage-Husa noise estimator cannot estimate the situation where both measurement noise and process noise are unknown at the same time, the method of this embodiment focuses on dynamically estimating the process noise and assumes that the measurement noise is known to improve the accuracy of noise estimation.

[0064]

[0065] Among them, the gain of the improved Kalman filter is K k and the state update value is and the updated error covariance is S k|k .

[0066] The method for estimating the process noise mean is as follows:

[0067]

[0068] Estimate the square root of the process noise covariance matrix:

[0069]

[0070] The above steps combine the process noise estimation step with the design step of the improved Kalman filter, enabling this embodiment to estimate the measurement noise mean at the current moment after completing the state estimation at each moment, thereby realizing an improved Kalman filter that can dynamically estimate the process noise and improving the accuracy of state estimation under the normal driving state of the vehicle. At the same time, the state estimation value of the improved Kalman filter can be used to design subsequent detection algorithms, thereby effectively detecting the hidden false injection attack on the connected vehicle GPS.

[0071] S2. Set the parameters of the improved Kalman filter according to the state variables and control inputs.

[0072] After defining the state variables and control inputs of the system model, it is necessary to initialize the parameters of the improved Kalman filter algorithm set in step S1. These parameters are crucial for the correct operation of the filter and achieving the expected performance.

[0073] Specifically, in this embodiment, these parameters mainly include the state estimate value, covariance matrix, and also include the covariance matrices of process noise and measurement noise.

[0074] This embodiment provides an initialization example of these parameters:

[0075] Initialization vector Covariance matrix P0, and process and measurement noise covariance matrices Q0 and R0, process noise and measurement noise means q0 and r0.

[0076] Calculate the extended parameter λ according to UKF parameters β, N, κ:

[0077] λ = β 2 (N + κ) - N

[0078] Where N represents the state dimension, and it is known that N = 3. λ is used to control the distance between Sigma sampling points and is used to calculate W i，m and W i，c .

[0079]

[0080] The above parameters are usually taken as: 10 -4 ≤β≤1, γ = 2, N + κ = 3.

[0081] S3. Calculate Sigma sampling points according to the parameters of the improved Kalman filter.

[0082] After initializing the parameters through steps S1 and S2, step S3 generates a set of deterministic sampling points, namely Sigma points, by performing the improved Kalman filter. These Sigma points will be used to approximate the probability distribution of the state variables and propagated through the subsequent non - linear system model to replace the linearization step in the traditional EKF, thereby more accurately handling the non - linearity of the system.

[0083] In order to improve the numerical stability of the filtering algorithm, in the calculation process of the improved Kalman filter, the prediction error covariance matrix is not directly used to construct Sigma sampling points, but perform QR decomposition on it, defined as

[0084]

[0085] The matrix obtained through this numerically stable method can indirectly improve the stability and reliability of the Sigma point calculation and even the entire filtering process.

[0086] In addition, since the improved Kalman filter of the present invention uses a process noise parameter that is adjusted in real time, the generation of the Sigma points is carried out within a filtering framework that can dynamically adapt to environmental changes.

[0087] The Sigma sampling points generated through step S3 are:

[0088]

[0089] S4. Use the Sigma sampling points to perform non-linear state propagation, calculate the state prediction value and the predicted error covariance matrix, and generate the estimated state.

[0090] This step executes the state prediction stage of the improved Kalman filter. Its purpose is to predict the state at the current time k based on the state estimate at the previous time and the system model, while transmitting uncertainty information.

[0091] Perform non-linear state propagation through the Sigma points generated by step S3 to obtain and use it to calculate the state prediction value and the predicted error covariance matrix

[0092] Specifically,

[0093]

[0094] In the above equation, P k|k-1 is the matrix obtained through Cholesky update, used to calculate the updated error covariance matrix, and the symbol ± is used to ensure that the weight value under the square root does not become negative.

[0095] S5. Obtain the observation value and use the observation value to update the estimated state.

[0096] Step S5 is used to execute the state update of the improved Kalman filter. Its purpose is to use the actual sensor observation value obtained at the current time k to correct the prior state estimate obtained in step S4, so as to obtain a more accurate posterior state estimate.

[0097] Specifically, the system state observation update is obtained through non-linear function propagation

[0098]

[0099] Calculate the predicted mean and the posterior error covariance

[0100]

[0101] Finally, calculate the improved Kalman filter gain K k and the state update value as well as the updated error covariance S k|k .

[0102] S6. Perform CUSUM detection based on the estimated state to determine the GPS spoofing attack on the connected vehicle.

[0103] After completing the state estimation of the improved Kalman filter through steps S1 to S5, step S6 of this embodiment utilizes the output information of the filter to design and execute an improved CUSUM detection algorithm to real-time determine whether the GPS sensor of the connected vehicle has suffered a spoofing attack, especially for those stealth attacks that are difficult to detect through traditional measurement residual detection.

[0104] Let

[0105] The state estimation value of the improved Kalman filter when the system is under attack is:[[]]

[0106]

[0107] where φ k-1 represents the change in the system state caused by the attack signal. Under the stealth false injection attack, that is, when the attack signal satisfies α k = H o φ k-1 , the system state estimation value will still change, and the change value is φ k-1 , so an attack detection method can be designed through the state residuals of the improved Kalman filter in the above steps.

[0108] The present invention provides a specific implementation of step S6, which specifically includes the following sub-steps:[[]]

[0109] First, define the state estimation quantity Perform step S61. Calculate the state estimation residual according to the estimated state, and step S62. Calculate the quadratic form of the state estimation residual. Obtain the quadratic form of

[0110] S63. Calculate the CUSUM detection quantity according to the quadratic form of the state estimation residual.

[0111] The CUSUM detection quantity is designed as:[[]]

[0112]

[0113] The above-mentioned detection quantity will change before and after the stealthy false injection attack. However, since the situation of infinite increase may occur during the iterative process, the detection algorithm needs to be improved again. When calculating the CUSUM detection quantity according to the quadratic form of the state estimation residual, a decreasing coefficient is set for the CUSUM detection quantity, and the decreasing coefficient is used to control the influence of the CUSUM detection quantity at the previous moment on the current moment.

[0114] The improved detection quantity is designed as follows:

[0115]

[0116] Wherein, represents the decreasing coefficient of the CUSUM detection quantity, and its value range is [0, 1]. This parameter is used to control the influence of the detection quantity at the previous moment on the current moment. b k is the adaptive threshold, and the expression is:

[0117]

[0118] Wherein, b0 represents the initial threshold of the CUSUM detection algorithm. In order to reduce false alarms and missed detections, the preset threshold is adjusted according to the historical data of the quadratic form of the state residual in the recent sliding window.

[0119]

[0120]

[0121] represents the proportional coefficient, and W is the size of the sliding window.

[0122] S64. Compare the CUSUM detection quantity with the preset threshold to determine whether there is a GPS spoofing attack.

[0123]

[0124] By executing steps S61 to S64, the present invention realizes an improved CUSUM detection mechanism based on state estimation residual, with a forgetting factor and an adaptive threshold. This mechanism can sensitively capture the state estimation anomalies caused by GPS spoofing attacks (including stealthy attacks), and can maintain a low false alarm rate and good robustness in a changing environment, so as to effectively judge whether the connected vehicle is suffering from a GPS spoofing attack.

[0125] The method of the above embodiment of the present invention adopts an improved Kalman filter and combines dynamic process noise estimation, which enables the filter to adjust the estimation of the process noise in real time according to the actual operating conditions, effectively cope with the change of environmental noise, and improve the adaptability to dynamic environmental noise and the state estimation accuracy.

[0126] In addition, in step S3, an improved Kalman filter is adopted, the process noise parameter is adjusted in real time through dynamic noise estimation, and the covariance matrix is processed by QR decomposition, ensuring the positive definiteness and numerical stability of the covariance matrix during the filtering process and improving the reliability of the algorithm in actual calculations.

[0127] Furthermore, the CUSUM detection algorithm used in step S6 is based on the state estimation residuals of the filter and their quadratic forms, and a decreasing coefficient and an adaptive threshold are set, which can effectively capture stealth attacks, overcome the main defects of existing methods relying on measurement residuals, and can increase the threshold to avoid false alarms when the system fluctuates greatly normally, and decrease the threshold to improve the sensitivity to weak attacks when the system runs smoothly.

[0128] In a verification embodiment of the present invention, a spoofing attack scenario was created using data obtained from a GPS sensor carried by a vehicle. In this attack, the spoofers manipulated the GNSS signals so that when the self-driving vehicle was actually moving forward, it sensed that the vehicle was leaving from the highway exit.

[0129] The inputs and initial parameters executed in this embodiment are as follows:

[0130] Initial state input Initial covariance P0 = diag(100, 100, 0.1), process noise covariance matrix R0 = diag(25, 25, 1.22×10 -3 ), measurement noise covariance Q0 = diag(0.1, 0.1, 0.01), state dimension N = 3, Sigma point hyperparameter β = 10 -2 , k = 0 and the total number of sampling points S = 200.

[0131] After comparing various algorithms, it is found that both the EKF and the method of the present invention show good performance, but their accuracies need to be further analyzed. As a classic linearized filter, EKF may be more suitable for state estimation tasks in simple systems or low-dynamic situations. The improved adaptive square root UKF is more suitable for dealing with state estimation in nonlinear systems and high-dynamic situations and can better adapt to different environments and application scenarios. To compare the performance of EKF and the method of the present invention, in a real scenario, the mean squared error (MSE) is used as a performance metric to evaluate the positioning accuracy of both. As a commonly used metric for measuring prediction accuracy, the MSE calculation formula is defined as follows:

[0132]

[0133] where S represents the total number of sampling points at the current moment. x i and yi respectively represent the true position coordinates of the i-th sampling point, and and respectively represent the estimated position coordinates of the i-th sampling point. By comparing the MSE of the EKF and the method of the present invention at each moment, the performance of the two filters in position estimation can be intuitively evaluated and compared.

[0134] Figure 1 is a schematic diagram of the comparison of the MSE of the connected vehicle GPS spoofing attack detection method and the EKF method of the embodiment of the present invention at each moment. According to the illustrated results, the connected vehicle GPS spoofing attack detection method of the present invention has a smaller MSE than the EKF. Therefore, it can be concluded that in the state estimation task, the connected vehicle GPS spoofing attack detection method of the present invention can provide a more accurate position estimation result, and its performance is superior to the traditional EKF method.

[0135] Under the condition of the covert false injection attack, there is a certain deviation between the state estimation value of the vehicle and the true position. Although the amount of attack is relatively small, being subjected to this kind of attack for a long time will cause the vehicle to gradually deviate from the correct position. During the attack, except for occasional false alarm times, the chi-square detection and the CUSUM detection method based on the output residual of the adaptive UKF did not show obvious situations exceeding the threshold. A short-term exceeding of the threshold is not sufficient to determine that the system is under attack. Only when continuously exceeding the threshold within the attack time period can the chi-square detection and the CUSUM detection based on the output residual of the adaptive UKF determine that the system is under attack. Therefore, these two detection methods cannot effectively identify the covert false injection attack.

[0136] The CUSUM detection method adopted in step S6 of the present invention for the detection of the covert false injection attack, after the first attack occurs, although the detection amount increases and exceeds the threshold range, due to the accumulation of the detection amount, the detection amount cannot quickly return to the normal level after the attack ends and always stays in the alarm state, affecting the subsequent detection. This situation indicates that the algorithm does not have enough adaptability to the state transition after the attack ends. Figure 2 is a schematic diagram of the CUSUM detection amount of the connected vehicle GPS spoofing attack detection method of the embodiment of the present invention under normal conditions, Figure 3FIG. 0 is a schematic diagram of the CUSUM detection quantity of the connected vehicle GPS spoofing attack detection method according to the embodiment of the present invention under a stealthy false injection attack. It can be seen that after the attack signal is sent, the detection quantity corresponding to the detection algorithm rises rapidly and exceeds the threshold within a short time, thus triggering a system alarm. This indicates that the improved CUSUM detection algorithm of the present invention can effectively detect stealthy false injection attacks, and after the attack ends, the algorithm can quickly return the detection quantity to the range below the threshold, showing its high robustness when dealing with the situation after the attack ends. This characteristic provides a guarantee for the security of the connected vehicle system.

[0137] To implement the above method, another embodiment of the present invention further provides a connected vehicle GPS spoofing attack detection system. This system can be integrated in the in-vehicle computing unit of a connected vehicle, or be part of the vehicle electronic control unit (ECU), or be deployed on a cloud server to process vehicle data.

[0138] The connected vehicle GPS spoofing attack detection system may include, but is not limited to, one or more of the following modules: a data acquisition module, a parameter configuration module, an adaptive state estimation module, and a CUSUM detection module.

[0139] Among them, the data acquisition module is responsible for obtaining observation data in real time from the sensor system of the connected vehicle, and obtaining initial information on the system state and control input signals from the vehicle-related control unit.

[0140] The parameter configuration module is responsible for storing and providing the initial parameters and configuration information required by the improved Kalman filter algorithm.

[0141] The adaptive state estimation module is responsible for performing the improved Kalman filter algorithm as in steps S3 - S5 of the above method, and updating the square root of the error covariance matrix.

[0142] Preferably, this module also integrates a dynamic noise estimation unit, which is responsible for estimating and updating the process noise covariance matrix in real time according to the internal state of the filter to achieve the self - adaptability of the filter.

[0143] The CUSUM detection module is responsible for the CUSUM attack detection algorithm as in step S6 of the above method.

[0144] Through the collaborative work of the above modules, the system can process the sensor data and state information of the connected vehicle in real time, perform high - precision, high - robustness, and high - stability adaptive state estimation, and perform effective CUSUM attack detection based on the state estimation results, especially being able to cope with stealthy GPS spoofing attacks, thereby improving the running safety of the connected vehicle.

[0145] Those of ordinary skill in the art will realize that the units and algorithm steps of each example described in connection with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. A professional technician can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0146] The above are only exemplary embodiments of the present disclosure, and the scope of the present disclosure cannot be limited thereby. That is, any equivalent changes and modifications made in accordance with the teachings of the present disclosure still fall within the scope covered by the present disclosure. Those skilled in the art will readily think of other embodiments of the present disclosure after considering the specification and practicing the disclosure herein. The present invention is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common general knowledge or conventional technical means in the technical field not recorded in the present disclosure. The specification and embodiments are only regarded as exemplary, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A method for detecting GPS spoofing attacks on connected vehicles, characterized in that, Including the steps: S1. Obtain the state variables and control inputs of the connected vehicle system, and set an improved Kalman filter, where the improved Kalman filter uses a process noise parameter adjusted in real time; S2. Set the parameters of the improved Kalman filter according to the state variables and the control inputs; S3. Process the improved Kalman filter using the square root method to calculate the Sigma sampling points; S4. Use the Sigma sampling points for non-linear state transfer, calculate the state prediction value and the prediction error covariance matrix, and generate an estimated state; S5. Obtain the observed value and use the observed value to update the estimated state; S6. Perform state residual CUSUM detection according to the estimated state to judge the GPS spoofing attack on the connected vehicle.

2. The method for detecting GPS spoofing attacks on connected vehicles according to claim 1, characterized in that, The process noise parameter is calculated using the dynamically adjusted process noise estimate.

3. The method for detecting a GPS spoofing attack on a connected vehicle according to claim 2, wherein, The process noise estimate is calculated using the Sage-Husa estimation algorithm and assuming that the measurement noise is known.

4. The method for detecting a GPS spoofing attack on a connected vehicle according to claim 1, wherein The parameters of the improved Kalman filter include the state estimate value, the covariance matrix, and also the covariance matrices of the process noise and the measurement noise.

5. The method for detecting a GPS spoofing attack on a connected vehicle according to claim 1, wherein When processing the improved Kalman filter using the square root method, use QR decomposition to calculate the Sigma sampling points to improve numerical stability.

6. The method for detecting a GPS spoofing attack on a connected vehicle according to claim 1, wherein, In step S5, the Sigma sampling points are propagated using the observation model, and the posterior estimate of the estimated state is calculated to update the estimated state.

7. The method for detecting a GPS spoofing attack on a connected vehicle according to claim 1, wherein, Performing state residual CUSUM detection according to the estimated state specifically includes: S61. Calculate the state estimation residual according to the estimated state; S62. Calculate the quadratic form of the state estimation residual; S63. Calculate the CUSUM detection quantity according to the quadratic form of the state estimation residual; S64. Compare the CUSUM detection quantity with a preset threshold to judge whether there is a GPS spoofing attack.

8. The method for detecting a GPS spoofing attack on a connected vehicle according to claim 7, wherein, When calculating the CUSUM detection quantity according to the quadratic form of the state estimation residual, a decreasing coefficient is set for the CUSUM detection quantity, and the decreasing coefficient is used to control the influence of the CUSUM detection quantity at the previous moment on the current moment.

9. The method for detecting a GPS spoofing attack on a connected vehicle according to claim 7, wherein The preset threshold is adjusted according to the historical data of the quadratic form of the state residual within the recent sliding window.

10. A network-connected vehicle GPS spoofing attack detection system according to claim 1, characterized in that, Use the method for detecting GPS spoofing attack on a connected vehicle according to any one of claims 1-9 to detect the GPS spoofing attack on the connected vehicle.

Images