A safety assessment method and system based on vehicle-to-everything (V2X)

Abstract

This invention relates to the field of Internet of Things (IoT) technology and discloses a security assessment method and system based on the Internet of Vehicles (IoV). The method includes acquiring multi-dimensional raw data, contextual data, and traffic data streams; generating attack event features through data classification, cleaning, standardization, and PCA feature extraction; constructing spatiotemporal distribution features based on contextual data; determining the victim and hazard radius using K-means clustering and morphological dilation algorithms; outputting the hazard area; analyzing the distribution of abnormal behavior based on this area and traffic data streams to generate a distribution map; analyzing the threat level based on this distribution map, victim, and hazard radius; allocating resources and planning a time-series dynamic defense strategy using a greedy algorithm; optimizing the protection scheme based on real-time feedback data; and finally, continuously monitoring behavioral changes to generate a risk heatmap and a security gap list. This method improves the security assessment capabilities of the Internet of Vehicles.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to a safety assessment method and system based on vehicle-to-everything (V2X) networks. Background Technology

[0002] Currently, the Internet of Vehicles (IoV) is a key pillar of intelligent transportation and smart cities, profoundly transforming travel and traffic management, with significant value in improving safety and efficiency. However, deep vehicle connectivity also raises serious security issues, hindering development. Existing security assessment methods are ineffective in complex and dynamic environments, struggling to deeply analyze ever-changing attack characteristics, leading to delayed identification of new threats and an inability to predict harm, with defenses often lagging behind attack evolution. The core challenge lies in effectively extracting attack characteristics from massive amounts of heterogeneous data. This bottleneck makes it difficult to scientifically determine the nature of harm using pattern recognition, collectively weakening the reliability of assessments. Therefore, building a system capable of accurately extracting characteristics and determining harm is crucial.

[0003] In one existing technology, heterogeneous data such as vehicle CAN bus data, GPS positioning data, and cloud logs are first collected via Flume and stored in Hadoop distributed storage. The feature extraction stage uses predefined SQL scripts and regular expressions for matching, with manually configured fields such as "sudden increase in message frequency" and "abnormal GPS drift" as fixed feature items. The pattern recognition layer uses a hard-coded rule base, for example, setting "CAN messages > 500 per second as a DoS attack" or "GPS displacement speed > 300 km / h as a location spoofing flag." When data flows through the Storm real-time computing engine, triggering preset rules generates alarm events. Finally, the matching results are written to a relational database, and the alarm logs are manually checked by operations personnel.

[0004] Existing technologies rely on static rules and manual feature extraction, which cannot dynamically identify new types of attacks. Rule updates lag behind attack evolution, resulting in an inability to improve the security assessment capabilities of connected vehicles. Summary of the Invention

[0005] This invention provides a security assessment method and system based on the Internet of Vehicles (IoV) to improve the security assessment capabilities of IoV.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides a security assessment method based on the Internet of Vehicles, comprising:

[0007] Obtain multi-dimensional raw data, contextual data, and traffic data streams from the field of connected vehicles;

[0008] Based on the multidimensional raw data, data classification, data cleaning, standardization processing, and feature extraction are performed to obtain attack event characteristics;

[0009] Based on the attack event characteristics and the context data, the temporal and spatial distribution characteristics of the attack event are constructed, the victim and the radius of harm are determined, and the harm area of ​​the attack event is obtained.

[0010] Based on the hazardous area and the traffic data stream, analyze the distribution of abnormal behaviors related to the attack event to obtain an abnormal behavior distribution map.

[0011] Based on the abnormal behavior distribution map, the victim, and the radius of the hazard, the threat level of the attack event is analyzed, and a dynamic defense strategy is constructed by combining the preset defense resource allocation rules and timing planning to obtain the protection execution sequence and protection coverage.

[0012] Based on the protection execution sequence and the protection coverage, real-time feedback data is obtained, and the dynamic defense strategy is locally optimized to obtain an updated protection execution scheme.

[0013] Based on the protection implementation plan and the real-time feedback data, the system continuously monitors changes in behavior within the hazard radius and generates a security situation assessment report that includes a risk heatmap and a security gap list.

[0014] In one optional implementation, the step of performing data classification, data cleaning, feature extraction, and standardization processing based on the multidimensional raw data to obtain attack event characteristics includes:

[0015] The multidimensional raw data is classified using a pre-established classification rule base to obtain categorized data;

[0016] Based on the categorized data, outliers are identified and removed using the 3σ criterion, and then missing values ​​are compensated using linear interpolation to obtain cleaned data.

[0017] Based on the cleaned data, principal component analysis was used for feature extraction, and Z-score normalization was applied to obtain the attack event features.

[0018] In one optional implementation, the step of constructing the temporal and spatial distribution characteristics of the attack event based on the attack event characteristics and the context data, determining the victim and the radius of influence of the attack event, and obtaining the harmful area of ​​the attack event includes:

[0019] Based on the characteristics of the attack event, a feature correlation matrix is ​​generated by calculating the Pearson correlation coefficient, and feature pairs with correlation coefficients exceeding a preset correlation threshold are selected to generate a core feature matrix.

[0020] Based on the core feature matrix and the context data, the timestamp interval is unified by linear interpolation, and the attack event sequence is extracted based on preset attack behavior rules.

[0021] Location data is extracted based on the attack event sequence, and the space is divided into spatial units according to a preset standard size using a latitude and longitude grid division method. The density of abnormal data within the spatial units is then statistically analyzed.

[0022] High-density clustering areas are filtered out based on preset abnormal density thresholds to determine the attack event area and the victim.

[0023] Based on the abnormal data density, the attack event region, and the context data, the attack pattern is classified using a support vector machine classification model, and the attack event label is output.

[0024] Based on the attack event label, the abnormal data density, and the attack event region, the victim objects are grouped using the K-means clustering algorithm, and the hazard radius is determined by combining the morphological dilation algorithm to generate the hazard region.

[0025] In one optional implementation, the step of analyzing the distribution of abnormal behaviors related to the attack event based on the hazardous area and the traffic data stream to generate an abnormal behavior distribution map includes:

[0026] Based on the hazardous area, it is divided into spatial units using an equidistant grid division method. The abnormality rate of vehicle abnormal behavior within the spatial unit is counted, and spatial units with an abnormality rate exceeding a preset abnormality threshold are selected to generate an abnormal space set.

[0027] Based on the abnormal spatial set and the traffic data stream, the DBSCAN density clustering algorithm is used to perform hierarchical clustering to extract high-density clusters of abnormal behaviors as the target dataset.

[0028] Spatiotemporal trajectory records are extracted from the target dataset, and the data are grouped according to the similarity of location and time using the K-means clustering algorithm. For groups whose similarity exceeds a preset similarity threshold, the communication logs of the earliest time point of the anomaly are extracted as traceability information fragments.

[0029] Based on the traceability information fragments and the preset source location requirements, a Hidden Markov Model is used to probabilistically model the propagation path of abnormal behavior, and finally outputs an abnormal behavior distribution map.

[0030] In one optional implementation, the step of analyzing the threat level of the attack event based on the abnormal behavior distribution map, the victim, and the radius of hazard impact, and constructing a dynamic defense strategy in conjunction with preset defense resource allocation rules and timing planning, to obtain the protection execution sequence and protection coverage, includes:

[0031] Based on the abnormal behavior distribution map, the target area is divided into spatial units by the equidistant grid division method, and units that overlap with the location of the victim are selected to generate a high-risk spatial set.

[0032] Based on the high-risk space set, the joint probability of abnormal behavior features within the unit and pre-stored historical attack events is calculated using a Naive Bayes classifier. Threat weights are generated by combining the hazard impact radius. When the threat weight exceeds a preset threat threshold, the unit is marked as a high-threat unit.

[0033] Based on the high-threat units, the transition probability of behavioral patterns between units is analyzed using a hidden Markov model, and spatiotemporal correlation features are extracted to output an attack propagation map.

[0034] Based on the attack propagation map, threat level groups are obtained by grouping the threats using the DBSCAN density clustering algorithm.

[0035] Based on the threat level grouping, resource weights are calculated using a greedy algorithm according to preset defense resource allocation rules, and protection execution sequence and protection coverage are generated in combination with preset time-series planning.

[0036] In one optional implementation, the step of obtaining real-time feedback data based on the protection execution sequence and the protection coverage, and performing local optimization of the dynamic defense strategy to obtain an updated protection execution scheme, includes:

[0037] Execute dynamic defense strategies based on the protection execution sequence and the protection coverage, obtain real-time feedback data and the distribution density of protection devices, and generate a list of time periods to be adjusted.

[0038] Based on the list of time periods to be adjusted and the distribution density of the protective equipment, the spatial coverage uneven area is calculated using the kernel density estimation algorithm, and a list of priority adjustment areas is output.

[0039] Based on the priority adjustment area list, the resource gap locations are obtained, and the resource weights are recalculated according to the preset resource allocation rules to generate an optimized resource allocation scheme.

[0040] Based on the optimized resource allocation scheme and the real-time feedback data, the execution interval of the timing segment is adjusted by the PID control algorithm, and the coverage intensity of the weak area is increased according to the distribution density of the protection equipment, and the updated protection execution scheme is output.

[0041] In one optional implementation, the step of continuously monitoring behavioral changes within the hazard radius based on the protection implementation scheme and the real-time feedback data, and generating a security situation assessment report including a risk heatmap and a security gap list, includes:

[0042] Based on the updated protection execution plan, the coordinates of the protection equipment, vehicle response delay records, and attack source coordinates are extracted. The real-time feedback data is then classified according to behavior type using a decision tree classification algorithm, and abnormal fluctuation records within the influence radius are extracted.

[0043] Based on the abnormal fluctuation records and the preset communication delay threshold, the data within a continuous time window is subjected to rolling threshold detection using the sliding window method, and the abnormal fluctuation points that deviate from the threshold are output to generate a first hazard assessment heatmap.

[0044] Based on the first hazard assessment heat map, the propagation path of abnormal behavior is probabilistically modeled using a hidden Markov model, and the coordinates of protective equipment are superimposed to perform path coverage matching to determine the first gap distribution map.

[0045] Based on the first gap distribution map and the preset monitoring operation requirements, the monitoring frequency adjustment parameters are calculated through the PID control algorithm, the network bandwidth and sensor resources are reallocated, and the updated monitoring frequency configuration table is output.

[0046] Based on the updated monitoring frequency configuration table and the abnormal fluctuation records, the spatial distribution of the abnormal fluctuation points is converted into a thermal value matrix using a kernel density estimation algorithm, and a two-dimensional risk heat map is generated by combining the coordinates of the protective equipment.

[0047] Based on the preset coverage standard, a list of safety gap coordinates for areas that do not meet the standard is marked, and a security situation assessment report version containing the two-dimensional risk heat map and the list of safety gap coordinates is finally output.

[0048] Secondly, the present invention provides a safety assessment system based on the Internet of Vehicles, comprising:

[0049] The data acquisition module is used to acquire multi-dimensional raw data, contextual data, and traffic data streams from the field of vehicle networking;

[0050] The attack feature analysis module is used to perform data classification, data cleaning, standardization, and feature extraction based on the multidimensional raw data to obtain attack event features.

[0051] The hazard area analysis module is used to construct the temporal and spatial distribution characteristics of the attack event based on the attack event characteristics and the context data, determine the victim and the radius of hazard impact, and obtain the hazard area of ​​the attack event.

[0052] The abnormal behavior analysis module is used to analyze the distribution of abnormal behaviors related to the attack event based on the hazardous area and the traffic data stream, and generate an abnormal behavior distribution map.

[0053] The defense strategy construction module is used to analyze the threat level of the attack event based on the abnormal behavior distribution map, the victim object and the radius of the hazard, and to construct a dynamic defense strategy in combination with the preset defense resource allocation rules and timing planning to obtain the protection execution sequence and protection coverage.

[0054] The defense scheme update module is used to obtain real-time feedback data based on the protection execution sequence and the protection coverage, and to perform local optimization of the dynamic defense strategy to obtain the updated protection execution scheme.

[0055] The security situation assessment module is used to continuously detect changes in behavior within the hazard radius based on the protection implementation plan and the real-time feedback data, and generate a security situation assessment report that includes a risk heatmap and a security gap list.

[0056] Thirdly, the present invention also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the vehicle-to-everything (V2X) based security assessment method described in any one of the above.

[0057] Fourthly, the present invention also provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform any of the above-described vehicle-to-everything (V2X)-based security assessment methods.

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] (1) Principal component analysis is used to extract attack features, and the data is processed by combining the 3σ criterion and Z-score standardization. This breaks through the limitations of manually predefined rules and improves the dynamic recognition capability and timeliness of new attack features.

[0060] (2) The core matrix is ​​constructed by screening key features using the Pearson coefficient, and the radius of hazard is dynamically calculated by combining K-means clustering of the affected objects and morphological dilation algorithm to achieve accurate quantification and visualization of the hazard area, thus solving the problem of insufficient accuracy of fixed threshold assessment.

[0061] (3) By allocating defense resources through a greedy algorithm, dynamically adjusting the timing by combining PID control, and locating coverage gaps based on kernel density estimation, the problem of static strategy lag is solved, and resource adaptive scheduling and real-time vulnerability patching are realized.

[0062] (4) Apply Hidden Markov Model to predict attack paths, combine decision tree classification with real-time data and generate risk heat map to visualize weak links and mark security gaps, provide support for proactive defense and reduce response delay. Attached Figure Description

[0063] Figure 1 This is a schematic diagram of the safety assessment method based on the Internet of Vehicles provided in the first embodiment of the present invention;

[0064] Figure 2 This is a schematic diagram of the structure of a vehicle-to-everything (V2X)-based safety assessment system provided in the second embodiment of the present invention. Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] Reference Figure 1 The first embodiment of the present invention provides a security assessment method based on the Internet of Vehicles, including the following steps:

[0067] S11 acquires multi-dimensional raw data, contextual data, and traffic data streams from the field of vehicle networking;

[0068] S12, perform data classification, data cleaning, standardization processing and feature extraction based on the multidimensional raw data to obtain attack event features;

[0069] S13, Based on the attack event characteristics and the context data, construct the temporal and spatial distribution characteristics of the attack event, determine the victim and the radius of harm, and obtain the harm area of ​​the attack event;

[0070] S14, Based on the hazardous area and the traffic data stream, analyze the distribution of abnormal behaviors related to the attack event to obtain an abnormal behavior distribution map;

[0071] S15. Based on the abnormal behavior distribution map, the victim, and the radius of the hazard, analyze the threat level of the attack event, and construct a dynamic defense strategy by combining the preset defense resource allocation rules and timing planning to obtain the protection execution timing and protection coverage.

[0072] S16. Based on the protection execution sequence and the protection coverage, obtain real-time feedback data and perform local optimization on the dynamic defense strategy to obtain an updated protection execution scheme.

[0073] S17. Based on the protection implementation plan and the real-time feedback data, continuously monitor behavioral changes within the hazard radius and generate a security situation assessment report that includes a risk heatmap and a security gap list.

[0074] In step S11, multidimensional raw data, contextual data, and traffic data streams are obtained from the Internet of Vehicles (IoV) domain.

[0075] Specifically, multi-dimensional raw data is acquired from onboard equipment, including steering wheel angle and brake pressure of vehicle control signals, controller area network bus sequence and load content of communication messages, triaxial acceleration and tire pressure of sensor readings, and memory usage and processor temperature of equipment status. Contextual data is acquired from the municipal system, including time and environmental timestamps and weather condition codes, lane line coordinate sequences and speed limit sign location coordinates of road topology, and traffic rule codes of regulatory information. Traffic data streams are acquired from road monitoring equipment, including lane-level average vehicle speed and headway of traffic status, surrounding vehicle position coordinate sequences and pedestrian movement direction vectors of the target trajectory, and traffic accident coordinates and construction area boundary point sets of the event stream.

[0076] By integrating three heterogeneous data sources—vehicle-mounted equipment, municipal systems, and road monitoring equipment—basic data support is provided for subsequent processing.

[0077] In step S12, data classification, data cleaning, standardization, and feature extraction are performed on the multidimensional raw data to obtain attack event features.

[0078] In one specific implementation, the step of performing data classification, data cleaning, feature extraction, and standardization processing based on the multidimensional raw data to obtain attack event features includes:

[0079] The multidimensional raw data is classified using a pre-established classification rule base to obtain categorized data;

[0080] Based on the categorized data, outliers are identified and removed using the 3σ criterion, and then missing values ​​are compensated using linear interpolation to obtain cleaned data.

[0081] Based on the cleaned data, principal component analysis was used for feature extraction, and Z-score normalization was applied to obtain the attack event features.

[0082] Specifically, the data classification operation is performed through a pre-established classification rule base. This rule base constructs mapping logic based on the business attributes and standard data types of the vehicle network data source (such as data fields defined according to the ISO 26262 functional safety standard and the SAE J1939 communication protocol), mapping the raw data stream to four types of structured data: vehicle control signals, which contain real-time operational data fields that directly affect the vehicle's dynamic behavior, such as steering wheel angle and brake pressure; communication messages, which contain raw or parsed message data fields from vehicle internal buses (such as CAN, LIN) and vehicle-to-the-cloud / vehicle-to-vehicle (V2X) communication, such as bus message identifiers and load content; sensor readings, which contain measurement data fields from vehicle physical sensors and environmental perception sensors, such as triaxial acceleration and tire pressure; and device status, which contains operating status indicator fields of the on-board electronic control unit (ECU) and the computing platform itself, such as memory usage and processor temperature. This operation automatically classifies the input raw data stream according to predefined rules (such as field names matching specific keyword sets, data source interface identifiers, and predefined data structure templates), generating categorized data.

[0083] The data cleaning operation applies the 3σ criterion to each numerical field in the categorical data: the arithmetic mean of the field values ​​and three times the standard deviation are calculated as a dynamic threshold, and outliers exceeding the threshold are marked and removed; missing values ​​are compensated using linear interpolation (calculated based on the weighted average of the two valid values ​​before and after the missing value). This operation outputs cleaned data.

[0084] The standardization process involves Z-score processing of the cleaned data: subtracting the arithmetic mean from each numerical field and then dividing by the standard deviation to generate standardized data that conforms to a Gaussian distribution.

[0085] The feature extraction operation uses principal component analysis (PCA) to process standardized data: the covariance matrix and eigenvectors of all fields are calculated, sorted in descending order of eigenvalues, and the top K principal components (K value determined by the eigenvalue sorting) with a cumulative contribution rate exceeding 85% are selected. The standardized data is then projected onto the principal component directions to generate dimensionality-reduced feature vectors. The final output is the attack event feature vector.

[0086] This step eliminates the limitations of manually predefined rules through dynamic threshold cleaning and data dimensionality reduction, thereby improving the accuracy of subsequent hazard area analysis.

[0087] In step S13, based on the attack event characteristics and the context data, the temporal and spatial distribution characteristics of the attack event are constructed, the victim and the radius of harm are determined, and the harm area of ​​the attack event is obtained.

[0088] In one specific implementation, the step of constructing the temporal and spatial distribution characteristics of the attack event based on the attack event characteristics and the context data, determining the victim and the radius of influence of the harm, and obtaining the harm area of ​​the attack event includes:

[0089] Based on the characteristics of the attack event, a feature correlation matrix is ​​generated by calculating the Pearson correlation coefficient, and feature pairs with correlation coefficients exceeding a preset correlation threshold are selected to generate a core feature matrix.

[0090] Based on the core feature matrix and the context data, the timestamp interval is unified by linear interpolation, and the attack event sequence is extracted based on preset attack behavior rules.

[0091] Location data is extracted based on the attack event sequence, and the space is divided into spatial units according to a preset standard size using a latitude and longitude grid division method. The density of abnormal data within the spatial units is then statistically analyzed.

[0092] High-density clustering areas are filtered out based on preset abnormal density thresholds to determine the attack event area and the victim.

[0093] Based on the abnormal data density, the attack event region, and the context data, the attack pattern is classified using a support vector machine classification model, and the attack event label is output.

[0094] Based on the attack event label, the abnormal data density, and the attack event region, the victim objects are grouped using the K-means clustering algorithm, and the hazard radius is determined by combining the morphological dilation algorithm to generate the hazard region.

[0095] Specifically, firstly, based on the characteristics of the attack event, the Pearson correlation coefficient of all feature pairs is calculated to generate a feature correlation matrix. Then, feature pairs with correlation coefficients exceeding a preset correlation threshold are selected to generate a core feature matrix. The correlation threshold is determined statistically through historical attack event datasets, and the 95th percentile of the correlation coefficients of all feature pairs is taken as the dynamic threshold.

[0096] Next, combining the timestamp sequence of the core feature matrix and context data, a linear interpolation method is used to unify the time interval. Missing time points are filled using a weighted average of adjacent time point data. Attack event sequences are extracted according to preset attack behavior rules. The sequence elements include time points, latitude and longitude coordinates, and feature values. The construction of the preset attack behavior rule library integrates the statistical characteristics of vehicle network security standards (such as the attack mode definition of ISO / SAE 21434) and historical attack datasets. Its core is to dynamically mark attack events through multi-dimensional feature thresholds and spatiotemporal correlation logic. In its implementation, the rule base includes joint judgment conditions based on time, space, and context dimensions: the time dimension detects the suddenness of abnormal features within a continuous time window (e.g., a sudden increase of 300% in CAN bus message frequency within 200ms for more than 3 cycles); the space dimension analyzes the propagation path of abnormal features (e.g., similar abnormal features appear in other vehicles within a 100-meter radius of the first victim vehicle within 5 seconds, conforming to the hop count pattern of V2X communication); and the context dimension combines the road environment (e.g., when the probability of GPS signal loss increases in tunnel areas, conflict with vehicle sensor data triggers a spoofing attack flag). The generation process of the attack event sequence first matches the values ​​of the core feature matrix with the multi-dimensional conditions in the rule base to filter candidate events; then, it aggregates the candidate events through a spatiotemporal sliding window (default time window of 2 seconds, spatial clustering radius of 50 meters) to eliminate redundant detection; finally, it assigns an attack type label (e.g., DoS attack, location spoofing) to each aggregated event using a pre-trained support vector machine classification model (based on feature-label mapping of historical attack data). The final output attack event sequence includes timestamps, geographic coordinates, attack type labels, and feature vectors for subsequent hazard area analysis. Latitude and longitude coordinates are then extracted from the attack event sequence, and the geographic space is divided into pre-defined standard-sized units using a grid partitioning method. The anomaly density value is obtained by dividing the number of attack events within each unit by the unit area. High-density clustered units are filtered based on a pre-defined anomaly density threshold, and adjacent units are merged to form attack event regions. Vehicle identifiers within these regions are then associated to generate a list of affected entities. The anomaly density threshold is set to the 90th percentile of all unit density values.

[0097] Then, the abnormal data density values, attack event region boundary coordinates, and environmental parameters of the context data are input into the support vector machine classification model. The model uses a radial basis function kernel to classify attack patterns. Model hyperparameters are tuned using Bayesian optimization: the search space for the penalty coefficient C is [0.1, 1000], and the search space for the kernel parameter γ is [10^-5, 10^1]. The optimal parameter combination is determined to be C=12.8 and γ=0.023, maximizing the F1 score through 5-fold cross-validation (balancing precision and recall). During training, a class weighting strategy is used, dynamically adjusting the class weights based on the sample size of each attack event in the historical attack data (e.g., increasing the weight of GPS spoofing attacks with a small sample size to 1.8 times) to alleviate data imbalance. The model outputs attack event labels and their probability estimates. Finally, the affected objects are grouped using the K-means clustering algorithm. A morphological dilation algorithm is applied with the location of each group of objects as the center. The initial radius is set to the side length of a unit grid. The radius is gradually expanded until the average density of abnormal data in the covered spatial unit drops to a preset termination density. This termination density is set to 70% of the density threshold. At this point, the radius value is the hazard radius. The output is a set of hazard areas consisting of the coordinates of the affected object groups and the corresponding hazard radius.

[0098] This step enhances the ability to identify attack events by filtering core features through dynamic correlation thresholds, and achieves precise spatial positioning by combining adaptive morphological expansion quantization of the hazard radius.

[0099] In step S14, based on the hazardous area and the traffic data stream, the distribution of abnormal behaviors related to the attack event is analyzed to obtain an abnormal behavior distribution map.

[0100] In one specific implementation, the step of analyzing the distribution of abnormal behaviors related to the attack event based on the hazardous area and the traffic data stream to generate an abnormal behavior distribution map includes:

[0101] Based on the hazardous area, it is divided into spatial units using an equidistant grid division method. The abnormality rate of vehicle abnormal behavior within the spatial unit is counted, and spatial units with an abnormality rate exceeding a preset abnormality threshold are selected to generate an abnormal space set.

[0102] Based on the abnormal spatial set and the traffic data stream, the DBSCAN density clustering algorithm is used to perform hierarchical clustering to extract high-density clusters of abnormal behaviors as the target dataset.

[0103] Spatiotemporal trajectory records are extracted from the target dataset, and the data are grouped according to the similarity of location and time using the K-means clustering algorithm. For groups whose similarity exceeds a preset similarity threshold, the communication logs of the earliest time point of the anomaly are extracted as traceability information fragments.

[0104] Based on the traceability information fragments and the preset source location requirements, a Hidden Markov Model is used to probabilistically model the propagation path of abnormal behavior, and finally outputs an abnormal behavior distribution map.

[0105] Specifically, in step S14, the input variables, hazard area and traffic data stream, are processed. The hazard area includes the group coordinates of affected objects and the corresponding hazard radius values. The traffic data stream includes lane-level average vehicle speed value sequences, vehicle headway value sequences, surrounding vehicle position coordinate sequences, and pedestrian movement direction vector value sequences. The output variable is an abnormal behavior distribution map. Based on the boundary coordinates of the hazard area, a spatial unit division operation is performed. The area is divided into preset size units using an equidistant grid division method. The ratio of the number of vehicles with abnormal behavior in each unit to the total number of vehicles is counted as the abnormality occurrence rate value. Units with an abnormality occurrence rate exceeding a preset threshold are selected to generate an abnormal spatial set. This threshold is determined by analyzing the statistical distribution curve of the abnormality occurrence rate of historical normal traffic data streams and selecting a high-confidence critical point as the automatically set value of the algorithm. The method for determining the high-confidence critical point is based on the statistical distribution of the abnormality occurrence rate of historical normal traffic data streams. After fitting its probability distribution curve through kernel density estimation, the 99th percentile of the cumulative distribution function (CDF) is taken as the threshold. The specific calculation process is as follows: First, collect at least 3 months of historical normal data (covering different time periods, weather, and road conditions) and statistically analyze the occurrence rate of abnormal behavior within each spatial unit. Then, use Gaussian kernel density estimation (with Silverman rule for bandwidth selection) to fit the distribution curve and calculate the CDF value. Finally, set the threshold at the abnormal occurrence rate value corresponding to CDF=0.99 (e.g., 5.2 times / minute). This critical point ensures that the false positive rate for normal data is ≤1% (i.e., confidence level ≥99%). Combining the coordinates of the abnormal spatial set units with the coordinate sequences of surrounding vehicle locations in the traffic data stream, a density-based spatial clustering algorithm is used. This algorithm performs hierarchical clustering and extracts high-density clusters of abnormal behavior as the target dataset. The parameter settings and execution process of the density-based spatial clustering algorithm (DBSCAN) are as follows: The neighborhood radius ε is dynamically calculated based on the spatial distribution characteristics of historical abnormal behavior data, taking the 55th percentile of the distance between all abnormal points (typically 82 meters, 95% confidence interval [75, 89]); the minimum number of points MinPts is adaptively adjusted according to traffic flow density, and the calculation formula is MinPts = ⌈0.3 × average number of vehicles per unit area⌉ (e.g., 5 during the day and 3 at night for urban roads). During algorithm execution, a KD tree is first constructed for the coordinate points in the abnormal spatial set to accelerate the neighborhood search, and then the core points (containing ≥MinPts points in the ε neighborhood) are iteratively expanded to expand the clusters. Finally, high-density abnormal behavior clusters with a density more than twice the baseline value are extracted as the target dataset. The clustering results are output after morphological closing operation (3×3 circular kernel) to eliminate small holes.Vehicle spatiotemporal trajectory records, including timestamp sequences and latitude / longitude coordinate sequences, are extracted from the target dataset. K-means clustering is used to calculate similarity based on spatial distance and time difference between trajectory points. The similarity threshold is determined by the average distance distribution within clusters of historical abnormal trajectory samples. For groups with similarity exceeding the threshold, the vehicle communication log byte stream corresponding to the earliest abnormal timestamp within the group is extracted as a traceability information segment. Hidden Markov Model (HMM) training is performed using the communication features of the traceability information segments (such as message frequency mutation markers and specific payload hash values): a hidden state set is defined, including initial infection state, lateral spread state, and continuously active state; the observation state set corresponds to the communication feature combination; the state sequence and observation sequence of historical attack propagation events are used to iteratively update the state transition probability matrix (specifically, statistically calculating the state transition frequency and transition probability) and the observation probability matrix (specifically, statistically calculating the occurrence frequency of observation features in each state and calculating conditional probability) using a forward-backward algorithm; the Viterbi algorithm is applied to the observation sequence of the current traceability information segment to calculate the optimal state path (specifically, recursively calculating the path probability and backtracking the path sequence); the probability weight value of this path is output. Finally, the spatial unit anomaly markers, anomalous behavior clustering results, and propagation path state sequences are integrated to generate an anomalous behavior distribution map containing spatial coordinates and behavior propagation links. This step overcomes the limitations of traditional static analysis by combining density clustering and probabilistic path modeling, achieving dynamic visualization of behavior propagation. In step S15, based on the anomalous behavior distribution map, the victim, and the radius of hazard impact, the threat level of the attack event is analyzed, and a dynamic defense strategy is constructed by combining preset defense resource allocation rules and timing planning to obtain the protection execution sequence and protection coverage.

[0106] In one specific implementation, the step of analyzing the threat level of the attack event based on the abnormal behavior distribution map, the victim, and the radius of the hazard impact, and constructing a dynamic defense strategy in conjunction with preset defense resource allocation rules and timing planning, to obtain the protection execution sequence and protection coverage, includes:

[0107] Based on the abnormal behavior distribution map, the target area is divided into spatial units by the equidistant grid division method, and units that overlap with the location of the victim are selected to generate a high-risk spatial set.

[0108] Based on the high-risk space set, the joint probability of abnormal behavior features within the unit and pre-stored historical attack events is calculated using a Naive Bayes classifier. Threat weights are generated by combining the hazard impact radius. When the threat weight exceeds a preset threat threshold, the unit is marked as a high-threat unit.

[0109] Based on the high-threat units, the transition probability of behavioral patterns between units is analyzed using a hidden Markov model, and spatiotemporal correlation features are extracted to output an attack propagation map.

[0110] Based on the attack propagation map, threat level groups are obtained by grouping the threats using the DBSCAN density clustering algorithm.

[0111] Based on the threat level grouping, resource weights are calculated using a greedy algorithm according to preset defense resource allocation rules, and protection execution sequence and protection coverage are generated in combination with preset time-series planning.

[0112] Specifically, in step S15, the input variables are processed: an abnormal behavior distribution map (including spatial unit abnormal markers and propagation path state sequences), a list of affected objects (vehicle identifier sequences), and a sequence of hazard impact radius values. The output variables are the protection execution sequence (time window allocation list) and the protection coverage area (spatial coordinate set). Based on the spatial unit coordinates and the location coordinates of the affected objects in the abnormal behavior distribution map, an overlap detection operation is performed. The target area is divided into preset size units using an equidistant grid partitioning method, and a list of high-risk spatial set units is generated by filtering the units where the affected objects are located. For each unit in the high-risk spatial set, an abnormal behavior feature vector (including propagation path state frequency and average hazard impact radius) is extracted and input into a Naive Bayes classifier to calculate the threat weight: First, a pre-stored historical attack event database (including feature vectors and corresponding attack type labels) is loaded, and the joint probability of the current feature vector under each attack type is calculated (specifically, the feature value distribution of similar attack events in the statistical historical data is used to calculate the probability density product of the current feature value in the distribution). The joint probability is weighted by combining the hazard impact radius value of this unit (the weighting coefficient is the ratio of the hazard radius to the historical average radius) to generate the threat weight value. When the threat weight exceeds the preset threat threshold, it is marked as a high-threat unit. This threshold is determined by backtracking analysis of historical attack events, taking 80% of the minimum threat weight in successful attack events as the statistical setting value.

[0113] Hidden Markov Modeling (HMM) is performed on a set of high-threat units: Attack states between units are defined (including initial outbreak state, diffusion state, and stable state), and a state transition matrix is ​​constructed based on the anomalous behavior characteristics of the units. Specifically, this involves traversing the spatiotemporal correlation features between units (such as the coordinate distance and time difference between adjacent units), counting the frequency of state transitions (such as the number of times from the initial outbreak state to the diffusion state), calculating the transition probabilities, and applying Laplace smoothing to handle zero-value problems. The output is an attack propagation graph (directed graph structure) containing state transition paths and their probability weights.

[0114] Density clustering is performed based on node coordinates and transition probability values ​​from the attack propagation map: the DBSCAN algorithm is used to group high-threat units according to spatial density. The core parameter, neighborhood radius, is set to 0.7 times the average hazard radius (determined based on historical attack cluster spatial distribution statistics), and the minimum sample size is 3 (verified by the minimum effective attack cluster size). The output is a threat level grouping list (each group includes a set of unit coordinates and a threat level label).

[0115] Resource allocation is performed using a greedy algorithm based on threat level grouping: A protection resource pool (including the number of available devices and coverage radius) is initialized, and groups are iteratively processed in descending order of threat level. Resource weights are calculated for the current group (the formula is the sum of the threat weights of units within the group multiplied by the group's coverage area). The number of protection devices allocated is the ratio of the resource weight to the total weight multiplied by the total number of resources (rounded down). The coverage area is the union of the coordinates of all units in the group. Simultaneously, a protection execution sequence is generated: high-threat-level groups are assigned to the earliest time window, and groups of the same level are merged into batches based on spatial adjacency. The final output is the protection execution sequence (a list of time windows and group correspondences) and the protection coverage area (a set of device deployment coordinates).

[0116] This step overcomes the limitations of static defense strategies through probabilistic modeling and greedy optimization: threat weight calculation is integrated with historical attack feature distribution to achieve dynamic evaluation; resource allocation is dynamically adjusted based on real-time threat levels.

[0117] In step S16, real-time feedback data is obtained based on the protection execution sequence and the protection coverage, and the dynamic defense strategy is locally optimized to obtain an updated protection execution scheme.

[0118] In one specific implementation, the step of obtaining real-time feedback data based on the protection execution sequence and the protection coverage, and performing local optimization of the dynamic defense strategy to obtain an updated protection execution scheme, includes:

[0119] Execute dynamic defense strategies based on the protection execution sequence and the protection coverage, obtain real-time feedback data and the distribution density of protection devices, and generate a list of time periods to be adjusted.

[0120] Based on the list of time periods to be adjusted and the distribution density of the protective equipment, the spatial coverage uneven area is calculated using the kernel density estimation algorithm, and a list of priority adjustment areas is output.

[0121] Based on the priority adjustment area list, the resource gap locations are obtained, and the resource weights are recalculated according to the preset resource allocation rules to generate an optimized resource allocation scheme.

[0122] Based on the optimized resource allocation scheme and the real-time feedback data, the execution interval of the timing segment is adjusted by the PID control algorithm, and the coverage intensity of the weak area is increased according to the distribution density of the protection equipment, and the updated protection execution scheme is output.

[0123] Specifically, real-time feedback data is acquired (data sources include roadside unit monitoring logs and vehicle sensor feedback streams). This data includes equipment response delay records and abnormal fluctuation point coordinate sequences. A comparison operation is performed based on the time window allocation list of protection execution timing and the actual response delay records: when the actual delay value exceeds the preset response delay threshold (this threshold is determined by statistical analysis of the 95th percentile of historical normal response time datasets), the time window is marked as a period to be adjusted and added to the list of periods to be adjusted.

[0124] By combining the time stamps of the time period list to be adjusted with the set of device coordinates within the protection coverage area, the distribution density of protective devices for the corresponding time period is extracted. The device coordinate set is processed using a kernel density estimation algorithm: a Gaussian probability density field is generated centered on each device location, and the spatial coverage intensity value is calculated after superimposing the density fields of all devices. Areas with coverage intensity values ​​below 70% of the average coverage intensity are filtered out, and a list of priority adjustment areas (including spatial coordinate boundaries and intensity gap values) is output.

[0125] Based on the spatial coordinate boundaries in the priority adjustment area list, retrieve the actual number of deployed devices within that area and compare it with the expected number of devices required (the expected number is set by the initial protection coverage). Calculate the resource gap (expected number minus actual number). Recalculate the resource weights according to the preset resource allocation rules: the resource weight equals the original weight in the regional threat level group (from the output of step S15) multiplied by the strength gap value. Allocate the new devices to each area in descending order of resource weight, generating an optimized resource configuration plan (including a list of coordinates for the new devices).

[0126] Based on the newly added equipment coordinate list and the abnormal fluctuation point coordinate sequence from real-time feedback data, a proportional-integral-derivative (PID) control algorithm is applied to adjust the timing: First, the deviation between the actual execution interval and the planned interval of the time window is calculated as the error input; the proportional term adjusts the time window length according to the current error value (proportional to the error magnitude); the integral term accumulates historical error values ​​to compensate for long-term deviations; and the derivative term predicts the error change trend and adjusts it in advance. Simultaneously, the coverage intensity of weak areas is increased according to the distribution density of protective equipment (increasing equipment deployment density by 20% in areas with density below the average). The final output is an updated protection execution scheme containing the new timing sequence list and the coordinate set of the expanded coverage area.

[0127] This step overcomes the limitations of static deployment through dynamic density detection and closed-loop control mechanisms: kernel density estimation accurately quantifies spatial coverage gaps; proportional-integral-differential algorithms achieve time-adaptive adjustment, which can reduce response latency.

[0128] In step S17, based on the protection implementation plan and combined with the real-time feedback data, the behavior changes within the hazard radius are continuously detected, and a security situation assessment report containing a risk heatmap and a security gap list is generated.

[0129] In one specific implementation, the step of continuously detecting behavioral changes within the hazard radius based on the protection implementation plan and the real-time feedback data, and generating a security situation assessment report including a risk heatmap and a security gap list, includes:

[0130] Based on the updated protection execution plan, the coordinates of the protection equipment, vehicle response delay records, and attack source coordinates are extracted. The real-time feedback data is then classified according to behavior type using a decision tree classification algorithm, and abnormal fluctuation records within the influence radius are extracted.

[0131] Based on the abnormal fluctuation records and the preset communication delay threshold, the data within a continuous time window is subjected to rolling threshold detection using the sliding window method, and the abnormal fluctuation points that deviate from the threshold are output to generate a first hazard assessment heatmap.

[0132] Based on the first hazard assessment heat map, the propagation path of abnormal behavior is probabilistically modeled using a hidden Markov model, and the coordinates of protective equipment are superimposed to perform path coverage matching to determine the first gap distribution map.

[0133] Based on the first gap distribution map and the preset monitoring operation requirements, the monitoring frequency adjustment parameters are calculated through the PID control algorithm, the network bandwidth and sensor resources are reallocated, and the updated monitoring frequency configuration table is output.

[0134] Based on the updated monitoring frequency configuration table and the abnormal fluctuation records, the spatial distribution of the abnormal fluctuation points is converted into a thermal value matrix using a kernel density estimation algorithm, and a two-dimensional risk heat map is generated by combining the coordinates of the protective equipment.

[0135] Based on the preset coverage standard, a list of safety gap coordinates for areas that do not meet the standard is marked, and a security situation assessment report version containing the two-dimensional risk heat map and the list of safety gap coordinates is finally output.

[0136] Specifically, based on the device coordinate set of the protection execution scheme, vehicle response delay records from real-time feedback data, and attack source coordinate sequences, anomaly fluctuation records are extracted using a decision tree classification algorithm. The algorithm's construction process is as follows: First, select the characteristic attributes of the real-time feedback data (message frequency change rate, response delay increment, distance to the attack source), calculate the optimal split point based on the information gain ratio (specifically, calculate the Gini coefficient by statistically analyzing the distribution of each characteristic value, and select the feature with the largest decrease in Gini coefficient for splitting); recursively generate a classification tree structure, and finally output the behavior type label of the anomaly fluctuation records (such as communication hijacking or data tampering). When extracting anomaly fluctuation records within the influence radius, the system adjusts the analysis scope in conjunction with the protection execution scheme. If a new attack source coordinate is detected in real time, the relative distance to its surrounding vehicles is recalculated, and the hazard influence radius is dynamically expanded using a morphological dilation algorithm to ensure coverage of the potential propagation range of the new attack source. Subsequently, the system filters out vehicle identifiers located within the influence radius and extracts the anomaly fluctuation records of these vehicles within a continuous time window, including abnormal behavioral characteristics such as sudden changes in message frequency and response delays exceeding preset thresholds, based on the decision tree classification results. A sliding window detection operation is performed on the timestamp sequence and location coordinate sequence of the subset of abnormal fluctuation records: the time window length is set to twice the minimum execution interval in the protection execution plan (based on the minimum duration of the attack behavior); the number of abnormal fluctuations is counted within each window, and when the number exceeds a preset communication delay threshold, the center point of the window is marked as an abnormal fluctuation point. This threshold is determined by analyzing the statistical distribution of abnormal fluctuation frequencies in historical normal communication data streams, and the 95th percentile is used as the algorithm setting value. All marked points constitute the coordinate dataset of the first hazard assessment heatmap.

[0137] Combining the coordinate set of abnormal fluctuation points from the first hazard assessment heatmap with the coordinate set of protective equipment, a Hidden Markov Model (HMM) is applied to model the propagation path of abnormal behavior: defining a hidden state set (propagation initiation state, path transit state, target arrival state); observing the equipment coverage intensity value of the fluctuation point corresponding to the observed state (calculating the number of devices within the radius of that point); loading historical attack path data to train the state transition probability matrix (statistically calculating the probability of state transition frequency); and applying the Viterbi algorithm to decode the optimal path for the current fluctuation sequence. A path coverage matching operation is performed by overlaying the protective equipment coordinates: if the distance between a path node and a device exceeds the device coverage radius, it is marked as an uncovered node, and all uncovered nodes constitute the coordinate set of the first gap distribution map.

[0138] Based on the coordinate set of uncovered nodes in the first gap distribution map and the preset monitoring operation requirements (such as the minimum monitoring frequency for key areas), the monitoring frequency adjustment parameters are calculated using a proportional-integral-derivative (PID) control algorithm: the input error value is the difference between the actual monitoring frequency and the target frequency; the proportional term is multiplied by a coefficient to adjust the frequency; the integral term is accumulated with historical error compensation; and the derivative term predicts the trend of change. The output is a scheme for the reallocation of network bandwidth and sensor resources (such as reducing the bandwidth allocation value for covered areas and incrementally allocating it to gap areas), forming an updated monitoring frequency configuration table (including a mapping table of coordinate areas and frequency values).

[0139] Based on the frequency value mapping table of the monitoring frequency configuration table and the abnormal fluctuation records of real-time feedback data, the spatial distribution is transformed through a kernel density estimation algorithm: a Gaussian kernel function is generated centered on each abnormal fluctuation point, and all kernel function values ​​are superimposed to generate a heat map matrix. A spatial mapping operation is then performed using the set of protective equipment coordinates: the heat map matrix is ​​projected onto a geographic coordinate system, with the heat map values ​​in the area where the equipment coordinates are located reduced by 50%, outputting a two-dimensional risk heat map (rasterized matrix data).

[0140] Based on preset coverage standards (e.g., regional monitoring coverage must reach 95%), the coordinates of areas in the risk heat map where the heat value exceeds the warning threshold but the equipment coverage is zero are scanned and marked as a list of security gap coordinates. Finally, the two-dimensional risk heat map and the list of security gap coordinates are integrated to generate a versioned security situation assessment report. This step overcomes the limitations of static assessment through a closed-loop feedback mechanism and spatial thermal modeling, achieving dynamic visualization of protection effectiveness.

[0141] Reference Figure 2 The second embodiment of the present invention provides a safety assessment system based on the Internet of Vehicles, comprising:

[0142] The data acquisition module is used to acquire multi-dimensional raw data, contextual data, and traffic data streams from the field of vehicle networking;

[0143] The attack feature analysis module is used to perform data classification, data cleaning, standardization, and feature extraction based on the multidimensional raw data to obtain attack event features.

[0144] The hazard area analysis module is used to construct the temporal and spatial distribution characteristics of the attack event based on the attack event characteristics and the context data, determine the victim and the radius of hazard impact, and obtain the hazard area of ​​the attack event.

[0145] The abnormal behavior analysis module is used to analyze the distribution of abnormal behaviors related to the attack event based on the hazardous area and the traffic data stream, and generate an abnormal behavior distribution map.

[0146] The defense strategy construction module is used to analyze the threat level of the attack event based on the abnormal behavior distribution map, the victim object and the radius of the hazard, and to construct a dynamic defense strategy in combination with the preset defense resource allocation rules and timing planning to obtain the protection execution sequence and protection coverage.

[0147] The defense scheme update module is used to obtain real-time feedback data based on the protection execution sequence and the protection coverage, and to perform local optimization of the dynamic defense strategy to obtain the updated protection execution scheme.

[0148] The security situation assessment module is used to continuously detect changes in behavior within the hazard radius based on the protection implementation plan and the real-time feedback data, and generate a security situation assessment report that includes a risk heatmap and a security gap list.

[0149] It should be noted that the vehicle-to-everything (V2X) security assessment device provided in this embodiment of the invention is used to execute all the process steps of the vehicle-to-everything (V2X) security assessment method described in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0150] This invention also provides an electronic device. The electronic device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a vehicle-to-everything (V2X) security assessment program. When the processor executes the computer program, it implements the steps described in the various V2X security assessment method embodiments above, for example... Figure 1 The step S11 shown. Alternatively, when the processor executes the computer program, it implements the functions of each module / unit in the above-described device embodiments, such as a vehicle-to-everything (V2X) security assessment module.

[0151] For example, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the electronic device.

[0152] The electronic device may be a desktop computer, laptop, handheld computer, or smart tablet, etc. The electronic device may include, but is not limited to, a processor and memory. Those skilled in the art will understand that the above components are merely examples of electronic devices and do not constitute a limitation on the electronic device. It may include more or fewer components than described above, or combine certain components, or different components. For example, the electronic device may also include input / output devices, network access devices, buses, etc.

[0153] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the electronic device, connecting all parts of the electronic device via various interfaces and lines.

[0154] The memory can be used to store the computer programs and / or modules. The processor implements various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory and by calling data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0155] Wherein, if the modules / units integrated in the electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0156] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0157] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A safety assessment method based on vehicle-to-everything (V2X) communication, characterized in that, include: Obtain multi-dimensional raw data, contextual data, and traffic data streams from the field of connected vehicles; Based on the multidimensional raw data, data classification, data cleaning, standardization processing, and feature extraction are performed to obtain attack event characteristics; Based on the attack event characteristics and the context data, the temporal and spatial distribution characteristics of the attack event are constructed, the victim and the radius of harm are determined, and the harm area of ​​the attack event is obtained. Based on the hazardous area and the traffic data stream, analyze the distribution of abnormal behaviors related to the attack event to obtain an abnormal behavior distribution map. Based on the abnormal behavior distribution map, the victim, and the radius of the hazard, the threat level of the attack event is analyzed, and a dynamic defense strategy is constructed by combining the preset defense resource allocation rules and timing planning to obtain the protection execution sequence and protection coverage. Based on the protection execution sequence and the protection coverage, real-time feedback data is obtained, and the dynamic defense strategy is locally optimized to obtain an updated protection execution scheme. Based on the protection implementation plan and the real-time feedback data, the system continuously monitors changes in behavior within the hazard radius and generates a security situation assessment report that includes a risk heatmap and a security gap list. The step of constructing the temporal and spatial distribution characteristics of the attack event based on the attack event characteristics and the context data, determining the victim and the radius of influence of the attack event, and obtaining the harmful area of ​​the attack event includes: Based on the characteristics of the attack event, a feature correlation matrix is ​​generated by calculating the Pearson correlation coefficient, and feature pairs with correlation coefficients exceeding a preset correlation threshold are selected to generate a core feature matrix. Based on the core feature matrix and the context data, the timestamp interval is unified by linear interpolation, and the attack event sequence is extracted based on preset attack behavior rules. Location data is extracted based on the attack event sequence, and the space is divided into spatial units according to a preset standard size using a latitude and longitude grid division method. The density of abnormal data within the spatial units is then statistically analyzed. High-density clustering areas are filtered out based on preset abnormal density thresholds to determine the attack event area and the victim. Based on the abnormal data density, the attack event region, and the context data, the attack pattern is classified using a support vector machine classification model, and the attack event label is output. Based on the attack event label, the abnormal data density, and the attack event region, the victim objects are grouped using the K-means clustering algorithm, and the hazard radius is determined by combining the morphological dilation algorithm to generate the hazard region.

2. The safety assessment method based on vehicle-to-everything (V2X) communication according to claim 1, characterized in that, The process of classifying, cleaning, extracting features, and standardizing the multidimensional raw data to obtain attack event features includes: The multidimensional raw data is classified using a pre-established classification rule base to obtain categorized data; Based on the categorized data, outliers are identified and removed using the 3σ criterion, and then missing values ​​are compensated using linear interpolation to obtain cleaned data. Based on the cleaned data, principal component analysis was used for feature extraction, and Z-score normalization was applied to obtain the attack event features.

3. The safety assessment method based on vehicle-to-everything (V2X) communication according to claim 1, characterized in that, The step of analyzing the distribution of abnormal behaviors related to the attack event based on the hazardous area and the traffic data stream to generate an abnormal behavior distribution map includes: Based on the hazardous area, it is divided into spatial units using an equidistant grid division method. The abnormality rate of vehicle abnormal behavior within the spatial unit is counted, and spatial units with an abnormality rate exceeding a preset abnormality threshold are selected to generate an abnormal space set. Based on the abnormal spatial set and the traffic data stream, the DBSCAN density clustering algorithm is used to perform hierarchical clustering to extract high-density clusters of abnormal behaviors as the target dataset. Spatiotemporal trajectory records are extracted from the target dataset, and the data are grouped according to the similarity of location and time using the K-means clustering algorithm. For groups whose similarity exceeds a preset similarity threshold, the communication logs of the earliest time point of the anomaly are extracted as traceability information fragments. Based on the traceability information fragments and the preset source location requirements, a Hidden Markov Model is used to probabilistically model the propagation path of abnormal behavior, and finally outputs an abnormal behavior distribution map.

4. The safety assessment method based on vehicle-to-everything (V2X) communication according to claim 1, characterized in that, The attack event threat level is analyzed based on the abnormal behavior distribution map, the victim, and the radius of hazard impact. A dynamic defense strategy is constructed by combining preset defense resource allocation rules and timing planning to obtain the protection execution sequence and protection coverage, including: Based on the abnormal behavior distribution map, the target area is divided into spatial units by the equidistant grid division method, and units that overlap with the location of the victim are selected to generate a high-risk spatial set. Based on the high-risk space set, the joint probability of abnormal behavior features within the unit and pre-stored historical attack events is calculated using a Naive Bayes classifier. Threat weights are generated by combining the hazard impact radius. When the threat weight exceeds a preset threat threshold, the unit is marked as a high-threat unit. Based on the high-threat units, the transition probability of behavioral patterns between units is analyzed using a hidden Markov model, and spatiotemporal correlation features are extracted to output an attack propagation map. Based on the attack propagation map, threat level groups are obtained by grouping the threats using the DBSCAN density clustering algorithm. Based on the threat level grouping, resource weights are calculated using a greedy algorithm according to preset defense resource allocation rules, and protection execution sequence and protection coverage are generated in combination with preset time-series planning.

5. The vehicle-to-everything (V2X) security assessment method according to claim 4, characterized in that, The step of obtaining real-time feedback data based on the protection execution sequence and the protection coverage, and performing local optimization of the dynamic defense strategy to obtain an updated protection execution scheme includes: Execute dynamic defense strategies based on the protection execution sequence and the protection coverage, obtain real-time feedback data and the distribution density of protection devices, and generate a list of time periods to be adjusted. Based on the list of time periods to be adjusted and the distribution density of the protective equipment, the spatial coverage uneven area is calculated using the kernel density estimation algorithm, and a list of priority adjustment areas is output. Based on the priority adjustment area list, the resource gap locations are obtained, and the resource weights are recalculated according to the preset resource allocation rules to generate an optimized resource allocation scheme. Based on the optimized resource allocation scheme and the real-time feedback data, the execution interval of the timing segment is adjusted by the PID control algorithm, and the coverage intensity of the weak area is increased according to the distribution density of the protection equipment, and the updated protection execution scheme is output.

6. The safety assessment method based on vehicle-to-everything (V2X) communication according to claim 1, characterized in that, The process involves continuously monitoring behavioral changes within the hazard radius based on the protection implementation plan and the real-time feedback data, generating a security situation assessment report that includes a risk heatmap and a security gap list, including: Based on the updated protection execution plan, the coordinates of the protection equipment, vehicle response delay records, and attack source coordinates are extracted. The real-time feedback data is then classified according to behavior type using a decision tree classification algorithm, and abnormal fluctuation records within the influence radius are extracted. Based on the abnormal fluctuation records and the preset communication delay threshold, the data within a continuous time window is subjected to rolling threshold detection using the sliding window method, and the abnormal fluctuation points that deviate from the threshold are output to generate a first hazard assessment heatmap. Based on the first hazard assessment heat map, the propagation path of abnormal behavior is probabilistically modeled using a hidden Markov model, and the coordinates of protective equipment are superimposed to perform path coverage matching to determine the first gap distribution map. Based on the first gap distribution map and the preset monitoring operation requirements, the monitoring frequency adjustment parameters are calculated through the PID control algorithm, the network bandwidth and sensor resources are reallocated, and the updated monitoring frequency configuration table is output. Based on the updated monitoring frequency configuration table and the abnormal fluctuation records, the spatial distribution of the abnormal fluctuation points is converted into a thermal value matrix using a kernel density estimation algorithm, and a two-dimensional risk heat map is generated by combining the coordinates of the protective equipment. Based on the preset coverage standard, a list of safety gap coordinates for areas that do not meet the standard is marked, and a security situation assessment report version containing the two-dimensional risk heat map and the list of safety gap coordinates is finally output.

7. A safety assessment system based on the Internet of Vehicles, characterized in that, The method for implementing the vehicle-to-everything (V2X) based security assessment method as described in any one of claims 1 to 6 includes: The data acquisition module is used to acquire multi-dimensional raw data, contextual data, and traffic data streams from the field of vehicle networking; The attack feature analysis module is used to perform data classification, data cleaning, standardization, and feature extraction based on the multidimensional raw data to obtain attack event features. The hazard area analysis module is used to construct the temporal and spatial distribution characteristics of the attack event based on the attack event characteristics and the context data, determine the victim and the radius of hazard impact, and obtain the hazard area of ​​the attack event. The abnormal behavior analysis module is used to analyze the distribution of abnormal behaviors related to the attack event based on the hazardous area and the traffic data stream, and generate an abnormal behavior distribution map. The defense strategy construction module is used to analyze the threat level of the attack event based on the abnormal behavior distribution map, the victim object and the radius of the hazard, and to construct a dynamic defense strategy in combination with the preset defense resource allocation rules and timing planning to obtain the protection execution sequence and protection coverage. The defense scheme update module is used to obtain real-time feedback data based on the protection execution sequence and the protection coverage, and to perform local optimization of the dynamic defense strategy to obtain the updated protection execution scheme. The security situation assessment module is used to continuously detect changes in behavior within the hazard radius based on the protection implementation plan and the real-time feedback data, and generate a security situation assessment report that includes a risk heatmap and a security gap list.

8. An electronic device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor, when executing the computer program, implements the vehicle-to-everything (V2X) based safety assessment method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the vehicle-to-everything (V2X) based security assessment method as described in any one of claims 1 to 6.

Images