Internet of vehicles safety protection method based on self-learning multi-mode perception

Abstract

The invention discloses an Internet of Vehicles safety protection method based on self-learning multi-mode perception, which is characterized in that a unified safety perception model is generated by fusing various data sources from a vehicle-mounted sensor, a visual sensor, a radar, a LiDAR and the like, the comprehensive perception capability of a vehicle environment is enhanced, and the safety of the vehicle environment is improved through machine learning and a self-learning mechanism. The threat detection strategy is continuously optimized, and the recognition precision and the response speed of unknown threats are improved. By making real-time safety protection decisions according to threat types and severity and triggering corresponding emergency response measures, the system can effectively prevent different levels of safety threats, the safety and stability of the Internet of Vehicles system are ensured, and the system has high adaptability and real-time performance.

Description

Technical Field

[0001] The present invention belongs to the field of vehicle network security protection, and specifically relates to a vehicle network security protection method based on self-learning multimodal perception. Background Art

[0002] With the rapid development of connected vehicle (IoV) technology, IoV systems have become a core component of intelligent transportation, autonomous driving, and information exchange between vehicles and infrastructure. Through wireless communications, sensors, and cloud computing, IoV can acquire a wealth of real-time information about vehicles, road conditions, and traffic flow. This information enables a variety of intelligent applications, including vehicle scheduling, automated driving assistance, and smart parking, significantly improving traffic efficiency and safety. However, this also presents increasingly severe security threats. The openness and complexity of IoV make it a prime target for cyberattacks such as hacking, data tampering, and identity forgery, and these attacks are becoming increasingly subtle and sophisticated. Traditional IoV security approaches often rely on single data sources (such as GPS, visual sensors, or radar) for threat detection. These approaches, to a certain extent, are unable to fully perceive and accurately identify complex and ever-changing security threats. For example, relying solely on GPS data can be susceptible to signal interference or spoofing, and visual sensors are prone to failure in poor lighting or inclement weather. While radar and LiDAR data are relatively reliable, relying solely on these sensors cannot fully understand the diverse anomalies that can occur in IoV environments. Furthermore, traditional approaches often lack dynamic adaptability. When faced with new attack patterns (such as complex attacks targeting sensors or communication links), protection systems are unable to quickly adapt and respond effectively. Therefore, IoV security urgently requires a more intelligent, dynamic, and multi-dimensional solution that can draw information from multiple data sources and adjust detection strategies in real time to address increasingly complex and evolving security threats.

[0003] In view of this, the present invention is proposed. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to overcome the deficiencies of the existing technology and provide a vehicle network security protection method based on self-learning multimodal perception, which solves the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the basic concept of the technical solution adopted by the present invention is:

[0006] A vehicle network security protection method based on self-learning multimodal perception includes the following steps:

[0007] S1: Collects data from the connected vehicle environment and its onboard sensors, visual sensors, radar, and LiDAR, and pre-processes the acquired data;

[0008] S2: The collected multimodal data are synthesized into a unified security perception model through the weighted average data fusion method;

[0009] S3: Uses machine learning algorithms to analyze IoV communication and sensor data in real time, identifying and classifying different types of security threats. Through self-learning models, it continuously adjusts threat detection strategies based on new attack patterns and environmental changes, improving detection accuracy and response speed.

[0010] S4: After a threat is detected, security protection decisions are made in real time based on the threat type and emergency response measures are triggered based on the severity of the attack.

[0011] Optionally, the steps for multimodal data fusion in step S2 are:

[0012] Extract key features from the preprocessed data and introduce an adaptive weight w i (t), the key features include target recognition features of visual data, distance and speed information of radar data, and geographic location information of GPS data. Its expression is: Among them, α i is the fixed reliability coefficient of each sensor, which reflects the reliability of the sensor under ideal conditions. i (t) is the trust level based on real-time data evaluation, which reflects the quality of sensor data. It usually uses measurement methods such as variance and error range of sensor data. t is a time variable, which is used to adjust the weight that changes over time to ensure the system's dynamic adaptation to data quality.

[0013] According to the reliability and importance of different sensor data, the formula Assign corresponding weights and synthesize the eigenvalues of each mode into a unified comprehensive eigenvector, where ·f i (t) represents the feature vector extracted by the i-th sensor at time t. fused (t) is the comprehensive feature vector after merging at time t, which represents the weighted fusion result of multiple sensor data;

[0014] For the fused feature vector f fused (t) Introduce a nonlinear transformation function This function is optimized based on a self-learning mechanism to adapt to the data characteristics in different scenarios. Its expression is: in, It is a nonlinear transformation function obtained through recursive neural network training, which can automatically optimize the feature fusion method based on real-time data;

[0015] Finally, the weighted fused feature vector is input into the security perception model to generate comprehensive security perception information, which can be used for subsequent threat detection, target identification and decision execution.

[0016] Optionally, the steps for real-time analysis of IoV communication data and sensor data using machine learning algorithms to identify and classify different types of security threats are as follows:

[0017] Based on historical data and known attack patterns, a support vector machine algorithm is used to build and train a recognition model and establish a classifier for Internet of Vehicles security threats.

[0018] The real-time collected Internet of Vehicles data is input into the trained machine learning model for real-time analysis to automatically identify potential security threats. Then, based on the output of the model, the identified threats are classified into different types and the classification results are output for subsequent response. Subsequently, based on the classification results, the corresponding security protection measures are triggered in real time.

[0019] Optionally, use a support vector machine algorithm to build and train a recognition model. The steps for building a classifier for Internet of Vehicles security threats are as follows:

[0020] Collect multiple data sources from the Internet of Vehicles, including communication traffic, sensor data, and driving behavior data, and combine them with known security threat samples to aggregate these data into a training dataset.

[0021] Data samples are labeled based on known attack types and normal behaviors, where the labels are divided into normal and attack. Then, an SVM model is built using the acquired historical data, and the data is mapped into a high-dimensional space using a Gaussian radial basis function.

[0022] The SVM model is trained using a labeled training dataset. The objective function is optimized using the SMO algorithm, and the training error and interval size of the model are balanced by adjusting the penalty factor. The training goal of the SVM model is:

[0023] After determining the training target, the weight of the feature is adjusted by analyzing the correlation between the feature and the attack mode. The expression is: w i (t+1)=w i (t)+α·correlation(x i ,y)·δ, where w i (t) is the current weight of feature i, α is the learning rate, δ is the step size, correlation(x i , y) represents the correlation between features and labels, t is the current time step, and t+1 is the updated time step

[0024] After completing the weight adjustment, use k-fold cross validation to evaluate the trained model, calculate the model's accuracy, recall rate, and F1 value, and use grid search and other methods to optimize the hyperparameters.

[0025] Optional steps to improve detection accuracy and response speed by continuously adjusting threat detection strategies based on new attack samples and environmental changes through self-learning models:

[0026] The attack behaviors predicted by the SVM model are obtained and classified. Then, new attack samples are annotated based on the threat detection results of real-time data. These samples are then combined with historical samples to form a new self-learning dataset.

[0027] The generated new attack samples and environmental data are input into the self-learning model, and the SVM model is continuously updated through incremental learning, so that it can learn and adapt to new attack patterns and environmental changes. Its expression is: in, is the weight of the i-th feature at time t, η is the learning rate, Δw i is the weight adjustment calculated by the new sample

[0028] The threat detection strategy is automatically adjusted based on the training results of the self-learning model. For newly emerging attack patterns, the self-learning model will adjust the classification boundaries and update the feature weights based on the new samples learned.

[0029] Optionally, after a threat is detected, security protection decisions are made in real time based on the threat type and emergency response measures are triggered based on the severity of the attack. For low-level threats, only events are recorded and warnings are issued to administrators; for high-priority threats, communication blocking and node isolation are triggered.

[0030] Optionally, low-level threats include but are not limited to minor packet loss, small sensor errors, non-malicious equipment failures, minor network delays or bandwidth fluctuations, and high-priority threats include but are not limited to denial of service attacks, malicious node intrusions, identity forgery, abuse of control, and data tampering or theft.

[0031] After adopting the above technical solution, the present invention has the following beneficial effects compared with the prior art. Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described below at the same time:

[0032] By integrating multiple data sources, including onboard sensors, visual sensors, radar, and LiDAR, the system generates a unified security perception model, enhancing comprehensive awareness of the vehicle environment. Through machine learning and self-learning mechanisms, it continuously optimizes threat detection strategies, improving the accuracy of identifying and responding to unknown threats. By making real-time security decisions based on threat type and severity and triggering appropriate emergency response measures, the system effectively prevents security threats at all levels, ensuring the security and stability of the connected vehicle system, and exhibiting strong adaptability and real-time performance.

[0033] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The drawings described below are only some embodiments. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0035] In the picture:

[0036] Figure 1 This is a flowchart for Internet of Vehicles security protection.

[0037] It should be noted that these drawings and textual descriptions are not intended to limit the conceptual scope of the present invention in any way, but rather to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0038] The present invention will now be described in further detail with reference to the accompanying drawings.

[0039] See also Figure 1 As shown, in this embodiment, a vehicle network security protection method based on self-learning multimodal perception is provided, which includes the following steps:

[0040] S1: The system collects and pre-processes data from the connected vehicle environment and its onboard sensors, visual sensors, radar, and LiDAR. Through the collaborative operation of multiple devices, such as onboard sensors, visual sensors, radar, and LiDAR, the collected multimodal data provides comprehensive environmental perception. This fusion of multi-source data not only improves the accuracy of the vehicle's surroundings but also enhances the system's ability to recognize complex scenes and reduces the rate of misjudgment caused by insufficient data from a single sensor.

[0041] S2: The collected multimodal data is combined into a unified safety perception model using a weighted average data fusion method. This method uses a weighted average method to fuse multimodal data, assigning weights based on the reliability and importance of different data sources to generate a comprehensive safety perception model. This method effectively combines the precision of visual data with the stability of radar data, improving the accuracy and robustness of the overall data.

[0042] S3: This system uses machine learning algorithms to analyze IoV communication and sensor data in real time, identifying and classifying different types of security threats. Using self-learning models, it continuously adjusts threat detection strategies based on new attack patterns and environmental changes, improving detection accuracy and response speed. This system uses machine learning algorithms to analyze IoV communication and sensor data in real time, enabling timely identification and classification of different types of security threats. The introduction of self-learning models, in particular, enables the system to adaptively adjust to new attack patterns and environmental changes, continuously improving threat detection accuracy and response speed. This means the system can gradually optimize and respond to new security challenges without requiring human intervention.

[0043] S4: After detecting a threat, the system makes real-time security protection decisions based on the threat type and triggers emergency response measures such as communication blocking and node isolation based on the severity of the attack. When the system detects a security threat, it can make real-time security protection decisions based on the type and severity of the threat, and trigger corresponding emergency response measures based on the different levels of threat. For example, for high-priority threats (such as malicious node intrusions and DoS attacks), the system can immediately implement protection measures such as isolation and communication blocking to ensure the safe operation of the Internet of Vehicles system.

[0044] In this embodiment, the steps of multimodal data fusion in step S2 are as follows:

[0045] Extract key features from the preprocessed data and introduce an adaptive weight w i (t), the key features include target recognition features of visual data, distance and speed information of radar data, and geographic location information of GPS data. Its expression is: Among them, α i is the fixed reliability coefficient of each sensor, which reflects the reliability of the sensor under ideal conditions. i (t) is the trust level based on real-time data evaluation, which reflects the quality of sensor data. It usually uses measurement methods such as variance and error range of sensor data. t is a time variable, which is used to adjust the weight that changes over time to ensure the system's dynamic adaptation to data quality.

[0046] According to the reliability and importance of different sensor data, the formula Assign corresponding weights and synthesize the eigenvalues of each mode into a unified comprehensive eigenvector, where ·f i (t) represents the feature vector extracted by the i-th sensor at time t. fused (t) is the combined feature vector after merging at time t, representing the weighted fusion result of multiple sensor data. Dynamic weights can be adjusted based on the quality of real-time data and the actual performance of the sensors, ensuring the system's rapid adaptation to environmental changes. For example, when visual sensor performance degrades in strong light or inclement weather, the weights automatically reduce the impact of visual data and increase the weight of radar or GPS data, ensuring that the fusion result always reflects the most reliable data. The weighted fused feature vector is input into the security perception model to generate comprehensive security perception information, which serves as an important basis for subsequent threat detection, target identification, and protection decisions. This enables the system to respond in real time to various security threats, such as malicious attacks, traffic accidents, and abnormal driving behavior, ensuring that the security protection capabilities of the Internet of Vehicles are always optimized.

[0047] For the fused feature vector f fused (t) Introduce a nonlinear transformation function This function is optimized based on a self-learning mechanism to adapt to the data characteristics in different scenarios. Its expression is: in, A nonlinear transformation function derived from recursive neural network training automatically optimizes feature fusion strategies based on real-time data. By introducing this nonlinear transformation function and optimizing it through a self-learning mechanism, the system can automatically adapt to data characteristics in different scenarios. This self-learning mechanism enables the system to not only process existing known data but also automatically learn from real-time data to optimize feature fusion strategies. This enables the system to maintain high adaptability and accuracy in new and unknown environments and scenarios.

[0048] Finally, the weighted fused feature vector is input into the security perception model to generate comprehensive security perception information, which can be used for subsequent threat detection, target identification and decision execution.

[0049] In this embodiment, the steps of performing real-time analysis of IoV communication data and sensor data using a machine learning algorithm to identify and classify different types of security threats are as follows:

[0050] Based on historical data and known attack patterns, a support vector machine algorithm is used to build and train a recognition model and establish a classifier for Internet of Vehicles security threats.

[0051] The real-time collected Internet of Vehicles data is input into the trained machine learning model for real-time analysis to automatically identify potential security threats. Then, based on the output of the model, the identified threats are classified into different types, such as data tampering, denial of service attacks (DoS), malicious nodes, etc., and the classification results are output for subsequent response. Subsequently, based on the classification results, the corresponding security protection measures are triggered in real time.

[0052] In this embodiment, the steps of using the support vector machine algorithm to establish and train a recognition model and establish a classifier for Internet of Vehicles security threats are as follows:

[0053] Collect multiple data sources from the Internet of Vehicles, including communication traffic, sensor data (such as GPS location and vehicle speed), and driving behavior data (such as acceleration and braking). Combined with known security threat samples (such as DoS attacks and data tampering), these data are aggregated into a training dataset.

[0054] Data samples are labeled based on known attack types and normal behaviors, where the labels are divided into normal and attack. Then, an SVM model is built using the acquired historical data, and the data is mapped into a high-dimensional space using a Gaussian radial basis function.

[0055] The SVM model is trained using a labeled training dataset. The objective function is optimized using the SMO algorithm, and the training error and interval size of the model are balanced by adjusting the penalty factor. The training goal of the SVM model is:

[0056] After determining the training target, the weight of the feature is adjusted by analyzing the correlation between the feature and the attack mode. The expression is: w i (t+1)=w i (t)+α·correlation(x i ,y)·δ, where w i (t) is the current weight of feature i, α is the learning rate, δ is the step size, correlation(x i , y) represents the correlation between features and labels, t is the current time step, and t+1 is the updated time step;

[0057] After completing the weight adjustment, use k-fold cross validation to evaluate the trained model, calculate the model's accuracy, recall rate, and F1 value, and use grid search and other methods to optimize the hyperparameters.

[0058] Specifically, the system adaptively optimizes the SVM (Support Vector Machine) model to improve the detection accuracy and response speed of security threats. First, a training dataset is compiled from multiple data sources (such as communication traffic, sensor data, and driving behavior data) along with known attack samples. This ensures that the training data covers both normal behavior and a variety of attack types, enhancing the model's generalization capabilities. Using the SVM model and mapping the data into a high-dimensional space using Gaussian radial basis functions (RBFs) improves classification accuracy, especially when dealing with complex nonlinear problems. The SMO algorithm optimizes the model's objective function and adjusts the penalty factor to balance training error and interval size, ensuring that the model can both accurately identify normal data and effectively distinguish attack behaviors. During feature weight adjustment, by analyzing the correlation between features and attack patterns, the system dynamically optimizes the weights of each feature, making the model more accurate and efficient in different scenarios. Finally, k-fold cross-validation and grid search are used to evaluate and optimize the model, ensuring that it can continuously adapt to new threats and maintain high performance in real-world environments. Overall, this method significantly improves the ability of the Internet of Vehicles security protection system to identify and respond to complex and security threats by comprehensively utilizing historical data, self-learning mechanisms, and refined hyperparameter adjustments.

[0059] In this embodiment, the following steps are used to continuously adjust threat detection strategies based on new attack samples and environmental changes through a self-learning model to improve detection accuracy and response speed:

[0060] The attack behaviors predicted by the SVM model are obtained and classified. Then, based on the threat detection results of real-time data, new attack samples (such as new attack patterns and abnormal behaviors) are annotated. These samples are then combined with historical samples to form a new self-learning dataset.

[0061] The generated new attack samples and environmental data are input into the self-learning model, and the SVM model is continuously updated through incremental learning, so that it can learn and adapt to new attack patterns and environmental changes. Its expression is: in, is the weight of the i-th feature at time t, η is the learning rate, Δw i is the weight adjustment calculated by the new sample

[0062] The threat detection strategy is automatically adjusted based on the training results of the self-learning model. For newly emerging attack patterns, the self-learning model will adjust the classification boundaries and update the feature weights based on the new samples learned.

[0063] In this embodiment, after a threat is detected, security protection decisions are made in real time based on the threat type and emergency response measures are triggered based on the severity of the attack. For low-level threats (such as minor data packet tampering), only events are recorded and warnings are issued to administrators; for high-priority threats (such as DoS attacks or malicious node intrusions), communication blocking and node isolation are triggered.

[0064] In this embodiment, low-level threats include but are not limited to minor packet loss, small sensor errors, non-malicious equipment failures, minor network delays or bandwidth fluctuations, and high-priority threats include but are not limited to denial of service attacks, malicious node intrusions, identity forgery, abuse of control, and data tampering or theft.

[0065] Low-level threat examples

[0066] 1. Minor packet tampering

[0067] In connected vehicle communications, some data packets may be slightly tampered with, but the extent of the tampering is not enough to affect the normal operation of the system or cause communication failures. For example, the timestamp or metadata of some transmitted data packets may be tampered with, but the content itself is not changed and does not affect the normal operation of the vehicle.

[0068] When the system detects packet tampering, it logs the event and alerts the administrator, who can then further investigate the source to determine if it's malicious activity or a minor error caused by communication noise or sensor issues.

[0069] 2. Small sensor error

[0070] Vehicle sensors (such as GPS, radar, and cameras) may experience small errors in certain situations, resulting in slight deviations in location data or measurements. For example, weak GPS signals in tunnels or areas with densely populated buildings may cause small errors in location.

[0071] The system detects unusual fluctuations in sensor output and compares them against historical data. If the error is minor and doesn't impact overall safety, it records the information and issues a warning. The system also smooths the sensor data to ensure continuous and effective monitoring of the vehicle's position and status.

[0072] 3. Non-malicious equipment failure

[0073] Certain devices, such as in-vehicle cameras or radar sensors, may experience temporary failures due to hardware failures, resulting in interrupted or incomplete data transmission. For example, a radar sensor may experience a short-term failure without directly impacting the vehicle's core safety systems.

[0074] The system will detect the failure of the device and automatically switch to a backup device or use other sensors (such as visual sensors or GPS) to supplement the data. The failure event will be recorded and the administrator will be notified to repair it.

[0075] 4. Slight network delay or bandwidth fluctuation

[0076] Small network delays or bandwidth fluctuations may occur in IoV communications, resulting in a slight decrease in data transmission speed, but this will not have a substantial impact on the operation of the entire system. For example, communication between the vehicle system and the infrastructure may be delayed by a few milliseconds due to brief network congestion.

[0077] The system detects latency or bandwidth fluctuations through network monitoring and logs the event. If the latency fluctuation is within an acceptable range, the system issues a warning to the administrator and monitors the network status to ensure stable system operation.

[0078] Examples of high-priority threats

[0079] 1. Denial of Service Attack

[0080] Attackers can cause service interruptions or performance degradation in connected vehicle systems by sending a large number of invalid requests. For example, attackers can send a large number of false messages to vehicles or infrastructure, causing the connected vehicle communication network to overload and be unable to process legitimate requests.

[0081] When the system detects a DoS attack, it immediately triggers a communication blocking mechanism to limit traffic from the attack source. Simultaneously, the system automatically activates a load balancing mechanism to redirect normal traffic to alternate channels, ensuring uninterrupted service and preventing disruption to transportation services.

[0082] 2. Malicious node intrusion

[0083] Attackers illegally insert malicious nodes into the IoV system, attempting to forge information or disrupt normal communications. For example, attackers might use counterfeit onboard devices to simulate normal vehicle behavior, steal sensitive data, or compromise network security.

[0084] Once a malicious node is detected, the system will isolate it from the connected car system through a node isolation mechanism to prevent it from further disrupting the network. The infected node will be marked and the administrator will be notified for investigation and disposal.

[0085] 3. Identity forgery

[0086] Attackers can forge the identity of a vehicle or device to conduct illegal operations or gain access to the connected vehicle system. For example, an attacker can disguise themselves as a legitimate vehicle and obtain system authorization, allowing for unauthorized communication or access.

[0087] The system will identify and reject forged identity requests through the authentication mechanism. Once identity forgery is detected, an alarm will be triggered immediately and authentication measures will be taken to ensure that communication between the vehicle and the device can only be carried out under the legal identity.

[0088] 4. Abuse of control

[0089] Attackers can remotely control key devices in a vehicle or connected vehicle system, changing the vehicle's speed, direction, or other operations, creating potential safety hazards. For example, an attacker could remotely control an out-of-control vehicle and cause a traffic accident.

[0090] If the system detects signs of control abuse, it triggers an emergency stop mechanism, automatically shutting down or resetting the vehicle's critical control systems. At the same time, the system identifies the source of the attack and immediately notifies relevant security personnel for on-site intervention.

[0091] 5. Data tampering or theft

[0092] Attackers can steal personal privacy or cause data leaks by intercepting or tampering with sensitive data in the Internet of Vehicles, such as vehicle location, driving behavior, or passenger information.

[0093] The system detects anomalies in data transmission in real time and encrypts all communications using data encryption technology. If tampered data is found, the system immediately triggers an alarm and blocks further dissemination or use.

[0094] The present invention is not limited to the above-described embodiments. Any structural changes made under the guidance of the present invention, which have the same or similar technical solutions as the present invention, should be understood to fall within the scope of protection of the present invention. The technologies, shapes, and structural parts not described in detail in the present invention are all well-known technologies.

Claims

1. A vehicle network security protection method based on self-learning multimodal perception, characterized in that: The following steps are involved: S1: Collects data from the connected vehicle environment and its onboard sensors, visual sensors, radar, and LiDAR, and pre-processes the acquired data; S2: The collected multimodal data are synthesized into a unified security perception model through the weighted average data fusion method; S3: Uses machine learning algorithms to analyze IoV communication and sensor data in real time, identifying and classifying different types of security threats. Through self-learning models, it continuously adjusts threat detection strategies based on new attack patterns and environmental changes, improving detection accuracy and response speed. S4: After a threat is detected, security protection decisions are made in real time based on the threat type and emergency response measures are triggered based on the severity of the attack.

2. The vehicle network security protection method based on self-learning multimodal perception according to claim 1 is characterized in that: The steps for multimodal data fusion in step S2 are as follows: Extract key features from the preprocessed data and introduce an adaptive weight w i (t), the key features include target recognition features of visual data, distance and speed information of radar data, and geographic location information of GPS data. Its expression is: Among them, α i is the fixed reliability coefficient of each sensor, which reflects the reliability of the sensor under ideal conditions. i (t) is the trust level based on real-time data evaluation, which reflects the quality of sensor data. It usually uses measurement methods such as variance and error range of sensor data. t is a time variable, which is used to adjust the weight that changes over time to ensure the system's dynamic adaptation to data quality. According to the reliability and importance of different sensor data, the formula Assign corresponding weights and synthesize the eigenvalues of each mode into a unified comprehensive eigenvector, where ·f i (t) represents the feature vector extracted by the i-th sensor at time t. fused (t) is the comprehensive feature vector after merging at time t, which represents the weighted fusion result of multiple sensor data; For the fused feature vector f fused (t) Introduce a nonlinear transformation function This function is optimized based on a self-learning mechanism to adapt to the data characteristics in different scenarios. Its expression is: in, It is a nonlinear transformation function obtained through recursive neural network training, which can automatically optimize the feature fusion method based on real-time data; Finally, the weighted fused feature vector is input into the security perception model to generate comprehensive security perception information, which can be used for subsequent threat detection, target identification and decision execution.

3. The vehicle network security protection method based on self-learning multimodal perception according to claim 1 is characterized in that: The steps for using machine learning algorithms to analyze the communication data and sensor data of the Internet of Vehicles in real time and identify and classify different types of security threats are as follows: Based on historical data and known attack patterns, a support vector machine algorithm is used to build and train a recognition model and establish a classifier for Internet of Vehicles security threats. The real-time collected Internet of Vehicles data is input into the trained machine learning model for real-time analysis to automatically identify potential security threats. Then, based on the output of the model, the identified threats are classified into different types and the classification results are output for subsequent response. Subsequently, based on the classification results, the corresponding security protection measures are triggered in real time.

4. The vehicle network security protection method based on self-learning multimodal perception according to claim 1 is characterized in that: The steps to build and train a recognition model using the support vector machine algorithm and to establish a classifier for security threats to the Internet of Vehicles are as follows: Collect multiple data sources from the Internet of Vehicles, including communication traffic, sensor data, and driving behavior data, and combine them with known security threat samples to form a training dataset; Data samples are labeled based on known attack types and normal behaviors, where the labels are divided into normal and attack. Then, an SVM model is built using the acquired historical data, and the data is mapped into a high-dimensional space using a Gaussian radial basis function. The SVM model is trained using a labeled training dataset. The objective function is optimized using the SMO algorithm, and the training error and interval size of the model are balanced by adjusting the penalty factor. The training goal of the SVM model is: After determining the training target, the weight of the feature is adjusted by analyzing the correlation between the feature and the attack mode. The expression is: w i (t+1)=w i (t)+α·correlation(x i ,y)·δ, where w i (t) is the current weight of feature i, α is the learning rate, δ is the step size, correlation(x i , y) represents the correlation between features and labels, t is the current time step, and t+1 is the updated time step; After completing the weight adjustment, use k-fold cross validation to evaluate the trained model, calculate the model's accuracy, recall rate, and F1 value, and use grid search and other methods to optimize the hyperparameters.

5. The vehicle network security protection method based on self-learning multimodal perception according to claim 1 is characterized in that: Steps to improve detection accuracy and response speed by continuously adjusting threat detection strategies based on new attack samples and environmental changes through self-learning models: The attack behaviors predicted by the SVM model are obtained and classified. Then, new attack samples are annotated based on the threat detection results of real-time data. These samples are then combined with historical samples to form a new self-learning dataset. The generated new attack samples and environmental data are input into the self-learning model, and the SVM model is continuously updated through incremental learning, so that it can learn and adapt to new attack patterns and environmental changes. Its expression is: in, is the weight of the i-th feature at time t, η is the learning rate, Δw i is the weight adjustment calculated by the new sample; The threat detection strategy is automatically adjusted based on the training results of the self-learning model. For newly emerging attack patterns, the self-learning model will adjust the classification boundaries and update the feature weights based on the new samples learned.

6. The vehicle network security protection method based on self-learning multimodal perception according to claim 1 is characterized in that: After a threat is detected, security protection decisions are made in real time based on the threat type and emergency response measures are triggered based on the severity of the attack. For low-level threats, only events are recorded and warnings are issued to administrators; for high-priority threats, communication blocking and node isolation are triggered.

7. The vehicle network security protection method based on self-learning multimodal perception according to claim 1 is characterized in that: Low-level threats include but are not limited to minor packet loss, small sensor errors, non-malicious equipment failures, minor network delays or bandwidth fluctuations. High-priority threats include but are not limited to denial of service attacks, malicious node intrusion, identity forgery, abuse of control, and data tampering or theft.

Images