Attack detection method and system for amphibious vehicle

Abstract

The invention discloses an attack detection method and system for an amphibious vehicle. The method comprises the steps that bus flow data, multi-sensor data and actuator feedback information of the vehicle are collected in real time; judging whether a bus attack exists or not based on the bus flow data; detecting whether a sensor attack exists or not through a multi-sensor redundancy judgment method based on the multi-sensor data; and detecting whether a controller attack or a delay attack exists based on the actuator feedback information. The network attack detection capability of the unmanned amphibious vehicle in a complex cross-domain operation environment can be effectively improved, the omission ratio and the false alarm rate are remarkably reduced, and safe and stable operation of the vehicle is guaranteed. Meanwhile, through an information-physical cross-layer fusion detection mechanism, various types of attacks can be accurately identified, the defense capability of the vehicle facing unknown threats is enhanced, and reliable safety guarantee is provided for wide application of the unmanned amphibious vehicle.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of intelligent amphibious vehicle safety and attack detection, and particularly relates to an amphibious vehicle attack detection method and system. BACKGROUND

[0002] In a multi-domain operation scene, amphibious vehicles have both land driving and water navigation capabilities, and their operating environments cover complex terrains and water areas. They are faced with cross-domain environmental interference such as sensor jolting, water flow impact, electromagnetic noise, and at the same time, need to deal with security threats such as denial of service attacks (DoS), Byzantine attacks, sensor data tampering, and physical layer attacks (such as mechanical impact and motor stall). The existing technology relies on a single sensor or is limited to single scene detection, and does not link the information side and the physical side across layers, so the detection capability for new attacks under cross-domain environments is insufficient, the missed detection rate is high, and it is difficult to ensure the safe operation of the vehicle. Therefore, it is an urgent problem to build a cross-layer collaborative detection mechanism that adapts to the characteristics of amphibious vehicles. SUMMARY

[0003] The present application proposes an amphibious vehicle attack detection method and system to solve the above-mentioned problems of the prior art.

[0004] One of the amphibious vehicle attack detection methods includes the following steps:

[0005] Real-time collection of bus flow data, multi-sensor data and actuator feedback information of the vehicle;

[0006] Based on the bus flow data, determine whether there is a bus attack;

[0007] Based on the multi-sensor data, detect whether there is a sensor attack by a multi-sensor redundancy judgment method;

[0008] Based on the actuator feedback information, detect whether there is a controller attack or a delay attack.

[0009] Optionally, the real-time collection step includes:

[0010] Collecting bus flow data through a vehicle bus network;

[0011] Collecting environmental and operating parameters through several groups of the same type of sensors deployed at key parts of the vehicle;

[0012] Collecting execution status and delay data through a feedback module built-in the actuator.

[0013] Optionally, the determination of whether there is a bus attack includes:

[0014] calculating a CAN bus load rate, judging whether the bus load is abnormal through a preset threshold according to the load rate;

[0015] calculating the Euclidean distance between the real-time data vector and the attack feature vector when the bus load is abnormal;

[0016] judging that it is an information side attack if the Euclidean distance exceeds a set threshold.

[0017] Optionally, the expression of the Euclidean distance is as follows:

[0018]

[0019] wherein D(S, F) is the Euclidean distance between the real-time data vector S and the attack feature library F, s i is the i-th element in the real-time data vector S; f i is the i-th element in the attack feature library vector F; and n is the dimension of the vector.

[0020] Optionally, the step of detecting the sensor attack comprises:

[0021] establishing a multi-source redundant observation model, including a land working condition model and a water working condition model;

[0022] estimating an output fusion state through dynamic weighted fusion;

[0023] calculating the residual error of each sensor measurement value and the fusion state;

[0024] judging whether there is a sensor attack based on residual error statistical analysis.

[0025] Optionally, the land working condition model comprises a 2DoF Kalman filter model, a kinematics wheel speed difference model and a sensor direct fusion model.

[0026] The 2DoF Kalman filter dynamics model is based on the lateral dynamics characteristics of the vehicle and is simplified as a two-degree-of-freedom bicycle model; the state vector of the two-degree-of-freedom bicycle model comprises the longitudinal position, the lateral position, the longitudinal speed, the lateral speed, the yaw angular speed and the mass center side slip angle of the vehicle; the state equation takes the front wheel steering angle, the front and rear wheel longitudinal force and the lateral force as the input, and estimates the state through the Kalman filter algorithm, wherein the process noise covariance and the measurement noise covariance are dynamically adjusted according to the real-time tire side slip stiffness and the road adhesion coefficient;

[0027] The kinematics wheel speed difference model is based on the pure kinematics principle, and calculates the yaw angular speed and the lateral speed of the vehicle through the wheel speed difference of the left and right wheels and the front wheel steering angle, and supplements the dynamics model;

[0028] The sensor direct fusion model directly fuses raw observation data from lidar, inertial navigation unit and millimeter wave radar; it uses weighted least squares method for fusion estimation, where the weight of each sensor is the inverse of its measurement noise covariance matrix, and a working condition adaptation coefficient is introduced to dynamically adjust the weight ratio of different sensors according to real-time road conditions.

[0029] Optionally, the waterborne operating condition model includes a hydrodynamic extended Kalman filter model, a navigation kinematics model, and a multi-sensor cross-validation model;

[0030] The hydrodynamic extended Kalman filter model, based on the land dynamics model, introduces propeller thrust, water drag coefficient, and hydrodynamic coefficient to characterize water flow resistance and wave-making resistance; the extended Kalman filter algorithm is used to process the nonlinear characteristics of the system and estimate the ship's attitude and motion state.

[0031] The navigation kinematics model establishes a propulsion model based on the mapping relationship between propeller speed and ship speed, and combines the absolute position and heading information provided by GPS to obtain the ship's speed and position estimate through differential calculation;

[0032] The multi-sensor cross-validation model integrates measurement data from inertial navigation units, tilt sensors, and millimeter-wave radar with strong resistance to water mist interference; high-frequency interference is eliminated and random noise is smoothed through a first-order low-pass filter.

[0033] Optionally, the steps of the dynamic weighted fusion estimation include:

[0034] The weights are dynamically assigned based on the confidence scores of each model, and the weighted fusion state is output. The weighted fusion state is the weighted sum of the estimates of each model.

[0035] A smooth transition strategy is adopted when switching from land to water until the switch is completed, avoiding state jumps.

[0036] Optionally, detecting whether a controller attack or delay attack exists includes:

[0037] The timing of the acquisition and control command issuance and the actuator response time;

[0038] Calculate instruction execution delay;

[0039] If the delay exceeds a preset threshold, it is determined to be a delay attack;

[0040] If the delay does not exceed the limit but there is a systematic deviation in the execution result, it is determined to be a controller attack.

[0041] One such attack detection system for amphibious vehicles includes:

[0042] The data acquisition module is used to collect real-time bus traffic data, multi-sensor data, and actuator feedback information of the vehicle;

[0043] The traffic and bus attack detection module is used to determine whether a bus attack exists based on the bus traffic data.

[0044] A multi-sensor redundancy detection module is used to detect whether a sensor attack exists based on the multi-sensor data and a multi-sensor redundancy judgment method.

[0045] The actuator feedback and delay detection module is used to detect whether there is a controller attack or delay attack based on the actuator feedback information.

[0046] Compared with the prior art, the present invention has the following advantages and technical effects:

[0047] This invention discloses an attack detection method and system for amphibious vehicles, comprising: real-time acquisition of vehicle bus traffic data, multi-sensor data, and actuator feedback information; determining the existence of a bus attack based on the bus traffic data; detecting the existence of a sensor attack based on the multi-sensor data using a multi-sensor redundancy judgment method; and detecting the existence of a controller attack or delay attack based on the actuator feedback information. This invention effectively improves the network attack detection capability of unmanned amphibious vehicles in complex cross-domain operating environments, significantly reducing the false negative rate and false positive rate, and ensuring the safe and stable operation of the vehicle. Simultaneously, through a cyber-physical cross-layer fusion detection mechanism, this invention can accurately identify various types of attacks, enhancing the vehicle's defense capabilities against unknown threats and providing reliable security for the widespread application of unmanned amphibious vehicles. Attached Figure Description

[0048] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0049] Figure 1 This is a schematic diagram of the method flow according to an embodiment of the present invention. Detailed Implementation

[0050] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0051] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0052] Example 1

[0053] like Figure 1 As shown, this embodiment provides a method for attack detection of amphibious vehicles, including the following steps:

[0054] Real-time acquisition of vehicle bus traffic data, multi-sensor data, and actuator feedback information;

[0055] Based on the bus traffic data, determine whether a bus attack exists;

[0056] Based on the multi-sensor data, a multi-sensor redundancy judgment method is used to detect whether a sensor attack exists.

[0057] Based on the actuator feedback information, detect whether there is a controller attack or a delay attack.

[0058] Furthermore, deploy traffic acquisition devices, such as CAN bus analyzers, in the amphibious vehicle bus network to capture bus data in real time; install multiple sets of similar sensors in key parts (such as the power system and attitude sensors) to synchronously collect environmental and operating parameters; and have actuators (such as motor drivers) with built-in feedback modules to transmit execution status and delay data in real time, ensuring that the collection covers all dimensions of information required for attack detection.

[0059] Deploy lidar, cameras, inertial navigation, millimeter-wave radar, vibration sensors, motor current sensors, vehicle tilt sensors, and CAN bus monitoring modules to cover environmental perception in both water and land environments (lidar and millimeter-wave radar resist water fog and terrain interference), motion status (inertial navigation and tilt sensors adapt to water and land attitude changes), physical parameters (vibration and current sensors monitor the status of water and land dynamic systems), and communication status (CAN bus module monitors the universal water and land communication load).

[0060] Furthermore, determining whether a bus attack exists includes:

[0061] Calculate the CAN bus load rate, and based on the load rate, determine whether the bus load is abnormal by using a preset threshold.

[0062] When the bus load is abnormal, calculate the Euclidean distance between the real-time data vector and the attack feature vector;

[0063] If the Euclidean distance exceeds a set threshold, it is determined to be an information-side attack.

[0064] Specifically, the traffic assessment algorithm (information side) determines the existence of attacks (DoS / DDoS / Byzantine attacks, etc.): based on a normal vehicle bus load model, a load threshold is set. By statistically analyzing the number of bus data frames and bytes within a period, the real-time load rate is calculated and compared with the threshold and the attack dataset to determine if a bus attack exists.

[0065] Step 1: Real-time acquisition of CAN bus data;

[0066] First, it is necessary to acquire the CAN bus transmission information in real time, including the start and end times of each data frame. This information is the basis for subsequent calculations of bus load rate and determination of any anomalies. Only by accurately acquiring this raw data can subsequent analysis and judgment be performed.

[0067] Step 2: Calculate the CAN bus load rate;

[0068] After obtaining the above data, the CAN bus load rate is calculated using the following formula:

[0069]

[0070] In the formula, L t T represents the CAN bus load rate (in %) at time t, reflecting the bus's busy level; transmit The formula represents the sum of the actual transmission times (in seconds) of all data frames on the bus within a time window ΔT; ΔT is the time window for calculating the CAN bus load rate (in seconds). This formula quantifies the bus transmission status into a specific load rate value, providing an intuitive indicator for determining whether the bus is malfunctioning.

[0071] Step 3: Determine if the bus load is abnormal;

[0072] After obtaining the CAN bus load rate, determine whether the bus load is abnormal using the following conditions:

[0073] If L t >θ L And t duration ≥t hold If so, it is determined that the bus load is abnormally high.

[0074] In the formula, θ L The bus load rate threshold (value > 80%) is the critical value for determining whether the load is too high; t duration For L t More than θ L The continuous duration (in seconds); t hold This is the threshold for determining the persistence of anomalies.

[0075] Step 4: Matching attack datasets

[0076] Simultaneously with the third step, rule-based matching, machine learning (such as random forests and LSTMs), or deep learning (such as VAE-GMMs) are used to determine whether there are traffic spikes, connection anomalies, protocol violations, or behavioral patterns deviating from the normal baseline in the current traffic dataset. Alternatively, the Euclidean distance between the real-time data vector and the attack signature database can be calculated to confirm whether a network attack has occurred. The calculation formula is as follows:

[0077]

[0078] In the formula, D(S,F) is the Euclidean distance between the real-time data vector S and the attack feature library F, used to measure the similarity between the two; S is the real-time data vector, composed of collected CAN bus-related data, etc.; F is the feature vector in the attack feature library, containing feature data of known information-side attacks (such as DoS / DDoS / Byzantine attacks, etc.); s i f is the i-th element in the real-time data vector S; i Let be the i-th element in the attack feature library vector F; n is the dimension of the vector. By calculating the Euclidean distance, the difference between real-time data and known attack features can be quantified, providing a basis for subsequent attack determination.

[0079] Based on the Euclidean distance calculation, if D(S,F)>λ, it is determined to be an information-side attack. Where λ is the Euclidean distance threshold.

[0080] When the Euclidean distance between the real-time data vector and the attack signature database exceeds the threshold, or when the CAN bus load rate is abnormal, it indicates that the vehicle's information-based judgment is under attack (DoS / DDoS / Byzantine attack, etc.).

[0081] Furthermore, the steps for detecting sensor attacks include:

[0082] Establish a multi-source redundant observation model, including a land-based operating condition model and a water-based operating condition model;

[0083] The fusion state is estimated and output through dynamic weighted fusion estimation;

[0084] Calculate the residual between the measurements of each sensor and the fused state;

[0085] The presence of sensor attacks can be determined based on residual statistical analysis.

[0086] Specifically, the land-based working condition model includes a 2DoF Kalman filter model, a kinematic wheel speed difference model, and a sensor direct fusion model;

[0087] The 2DoF Kalman filter dynamics model is based on the lateral dynamics of the vehicle and is simplified to a two-degree-of-freedom bicycle model. The state vector of the two-degree-of-freedom bicycle model includes the vehicle's longitudinal position, lateral position, longitudinal velocity, lateral velocity, yaw rate, and center of gravity sideslip angle. Its state equation takes the front wheel steering angle, the longitudinal force of the front and rear wheels, and the lateral force as inputs, and performs state estimation through the Kalman filter algorithm. The process noise covariance and the measurement noise covariance are dynamically adjusted according to the real-time tire sideslip stiffness and the road adhesion coefficient.

[0088] The 2DoF Kalman filter model, based on the vehicle's lateral dynamics, is simplified to a bicycle model. The state vector includes the x / y position (x, y) and x / y velocity (v). x ,v y ), yaw rate (r), and sideslip angle (β). The equation of state is:

[0089]

[0090]

[0091] Among them, F {xf} ,F {yf} For the longitudinal / lateral forces of the front wheels, F {xr} ,F {yr} The longitudinal / lateral forces are the forces on the rear wheels, M is the vehicle mass, and I is the force on the rear wheels. z Let l be the moment of inertia of yaw rotation. f ,l r Let δ be the distance from the center of mass to the front and rear axles, and δ be the front wheel steering angle. State estimation is achieved through Kalman filtering, and the filtering parameters (process noise covariance Q, measurement noise covariance R) are dynamically adjusted based on tire lateral stiffness and road adhesion coefficient.

[0092] The kinematic wheel speed difference model is based on pure kinematic principles. It calculates the vehicle's yaw rate and lateral velocity by using the wheel speed difference between the left and right wheels and the front wheel steering angle, thus supplementing the dynamic model.

[0093] Specifically, the kinematic wheel speed difference model: calculates the motion state using the speed difference between the left and right wheels, with the following formula:

[0094]

[0095] Among them, v {fl} ,v {fr} For the speeds of the left and right front wheels, t f Where is the front track width and δ is the front wheel steering angle. This model does not depend on dynamic parameters and is suitable for low-adhesion road surface scenarios.

[0096] The sensor direct fusion model directly fuses raw observation data from lidar, inertial navigation unit and millimeter wave radar; it uses weighted least squares method for fusion estimation, where the weight of each sensor is the inverse of its measurement noise covariance matrix, and a working condition adaptation coefficient is introduced to dynamically adjust the weight ratio of different sensors according to real-time road conditions.

[0097] Specifically, the sensor direct fusion model: fusing lidar (position measurement z) {lidar} =[x {lidar} ,y {lidar} ]), Inertial navigation (velocity measurement z) {ins} =[v {x,ins} ,v {y,ins} ]), millimeter-wave radar (relative velocity z) {mmw} =v {rel} The data was fused using weighted least squares, with the weights being the inverse of the sensor noise covariance.

[0098]

[0099] Among them, W i For the operating condition adaptation factor (e.g., increasing the weight of lidar on flat roads and increasing the weight of inertial navigation on bumpy roads), H i Let R be the observation matrix. i Let be the sensor noise covariance.

[0100] Furthermore, the maritime operating condition model includes a hydrodynamic extended Kalman filter model, a navigation kinematics model, and a multi-sensor cross-validation model;

[0101] Based on the land dynamics model, the extended Kalman filter hydrodynamic model introduces propeller thrust, water drag coefficient and hydrodynamic coefficient to characterize water flow resistance and wave-making resistance; the extended Kalman filter algorithm is used to process the nonlinear characteristics of the system and estimate the ship attitude and motion state.

[0102] Specifically, the extended Kalman filter model for hydrodynamics considers water flow resistance and hydrodynamic lateral force. The state vector is the same as the land model, and the state equations are adjusted as follows:

[0103]

[0104] Among them, F {prop} For propeller thrust, C x C y D is the water resistance coefficient. y M y N r Here, represents the hydrodynamic coefficient. State estimation is achieved by processing the nonlinear characteristics using an extended Kalman filter.

[0105] The navigation kinematics model establishes a propulsion model based on the mapping relationship between propeller speed and ship speed, and combines the absolute position and heading information provided by GPS to obtain the ship's speed and position estimates through differential calculation;

[0106] Specifically, the navigation kinematics model is based on the mapping relationship between propeller speed and ship speed, combined with GPS position difference calculations.

[0107] v x,w =k n n(k n (where n is the hydrodynamic coefficient and n is the propeller speed). (ψ {gps} (where L is the GPS heading angle and L is the ship's length).

[0108] The multi-sensor cross-validation model integrates measurement data from inertial navigation units, tilt sensors, and millimeter-wave radar with strong resistance to water mist interference; high-frequency interference is eliminated and random noise is smoothed through a first-order low-pass filter.

[0109] Specifically, the multi-sensor cross-validation model: fused inertial navigation (acceleration integral v) ins =∫a ins dt), tilt sensor (attitude compensation ψ) {tilt} ), millimeter-wave radar (anti-water mist velocity measurement v) {mmw} First-order low-pass filtering is used to eliminate water flow impact noise.

[0110] (α is the filtering coefficient, which is taken as 0.3 to 0.5 when the water flow is turbulent).

[0111] Furthermore, dynamic weighted fusion estimation:

[0112] By dynamically allocating weights based on the confidence scores of each model, the fusion state is output, balancing the model accuracy under different scenarios.

[0113] (1) Confidence level calculation;

[0114] Dynamic models (land model 1, water model 1): Confidence level is negatively correlated with parameter error, as shown in the formula:

[0115] c dyn =1-λ1·|ΔCα|-λ2·|ΔC x |(λ1+λ2=1, ΔCα is the lateral stiffness error, ΔC x (This refers to the error in the water resistance coefficient).

[0116] Kinematic models (land model 2, water model 2): ​​Confidence level is negatively correlated with wheel speed / rotation speed measurement noise.

[0117] c kin=1-λ3·σ v -λ4·σ n (σ v For wheel speed noise, σ n (This refers to rotational speed noise).

[0118] Sensor fusion models (land model 3, water model 3): Confidence level is negatively correlated with environmental disturbance.

[0119] c sen =1-λ5·fog-λ6·vib (fog is the water mist interference coefficient, vib is the vibration noise).

[0120] (2) Weighted fusion output;

[0121] The fusion state is a weighted sum of the estimates from each model, with the weights being the normalized confidence scores.

[0122] in (i = 1 to 6 correspond to 6 redundant models).

[0123] (3) Working condition switching adaptation;

[0124] When switching from land to water, a smooth transition strategy is adopted: w dyn_land (k)=w dyn_land (k-1)·0.9, w dyn_water (k)=w dyn_water (k-1)+(1-w dyn_land (k))·0.1, until the switch is completed, to avoid state jumps.

[0125] Furthermore, the steps of dynamic weighted fusion estimation include:

[0126] The weights are dynamically assigned based on the confidence scores of each model, and the weighted fusion state is output. The weighted fusion state is the weighted sum of the estimates of each model.

[0127] A smooth transition strategy is adopted when switching from land to water until the switch is completed, avoiding state jumps.

[0128] Specifically, correlation residual analysis:

[0129] By analyzing the residuals between the fusion state and sensor measurements, and combining the correlation between the model and the sensors, the source of the fault can be located.

[0130] (1) Residual calculation;

[0131] Calculate the deviation between the measurements from each sensor and the fused state:

[0132]

[0133] Among them, zi H is the measurement value of the i-th sensor. i For the observation matrix, It is in a fused state.

[0134] (2) Associative reasoning logic;

[0135] Land scenario: If the lidar position residual e lidar >3σ lidar However, the inertial navigation velocity residual e ins <2σ ins And the kinematic model residual e kin >3σ kin The lidar is determined to be faulty (because the kinematic model does not depend on the lidar).

[0136] Waterborne scenario: If the velocity residual e of the millimeter-wave radar mmw >3σ mmw However, the GPS location residual e gps <2σ gps And the hydrodynamic model residual e hydro <2σ hydro The millimeter-wave radar was determined to be affected by water mist interference.

[0137] Furthermore, detecting the presence of controller attacks or delay attacks includes:

[0138] The timing of the acquisition and control command issuance and the actuator response time;

[0139] Calculate instruction execution delay;

[0140] If the delay exceeds a preset threshold, it is determined to be a delay attack;

[0141] If the delay does not exceed the limit but there is a systematic deviation in the execution result, it is determined to be a controller attack.

[0142] Specifically, attacks are determined based on the residual distribution in the time domain to avoid misjudgments caused by transient interference.

[0143] (1) Sliding window statistics;

[0144] Take the most recent 50 sampling points (time window 1s), count the number of times k of residuals exceeding the threshold, and calculate the failure probability:

[0145] p = k / 50

[0146] (2) Fault activation and rollback;

[0147] If p > 0.6 (activation threshold), it is determined to be a sensor attack and an alarm is triggered; if p < 0.2 (fallback threshold) and continues for 3 windows, the alarm is deactivated and it is considered as environmental interference.

[0148] 3. Delay Detection Algorithm: Records the timestamp of computer command transmission and the timestamp of executor feedback, and calculates the time difference as the delay. Based on different operating conditions of amphibious vehicles (water navigation, land driving, mode switching, etc.), preset corresponding delay thresholds, compares the actual delay with the thresholds, and judges delay attacks and controller attacks.

[0149] Specifically, the parameters and symbols required to implement the delay detection algorithm are explained below: the delay attack threshold is represented by δ. t This indicates the threshold for determining whether a time-delay attack has occurred; according to the key parameter table, the value is >200ms; the command issuance time is represented by t. send The time (in milliseconds) when the control command is issued from the controller is indicated; the execution response time is expressed in t. resp The time interval between receiving an instruction and starting execution is expressed as Δt (in milliseconds); the time difference between instruction issuance and execution is expressed as Δt. delay This indicates the delay time (unit: milliseconds).

[0150] Step 1: Collect commands and response times;

[0151] The foundation of delay detection is obtaining the issuance time of control commands and the response time of actuators. During vehicle operation, the issuance time t of each control command (such as throttle, steering, and braking commands) is recorded in real time. send Simultaneously, the time t at which the actuator (such as a motor or steering mechanism) responds to the command is collected. resp This time data will be used to calculate the latency of instruction transmission and execution, serving as the primary basis for subsequent determination of latency attacks.

[0152] Step 2: Calculate instruction execution delay;

[0153] Based on the collected time data, the time difference, i.e., the delay, from the issuance of the instruction to its execution is calculated using the following formula:

[0154] Δt delay =t resp -t send ;

[0155] In the formula, Δt delay t represents the time difference between instruction issuance and execution (in milliseconds); resp t is the actuator response time. send This represents the instruction issuance time. This formula directly quantifies the lag time of the instruction during transmission and execution. Under normal operating conditions, this delay should be kept within a small range; if the delay is too large, it may indicate an attack.

[0156] Step 3: Determine whether it is a delay attack or a controller attack;

[0157] After obtaining the delay time, it is compared with a preset delay attack threshold to determine whether a delay attack or a controller attack exists. If Δt delay ≥δ t If Δt delay <δ t This constitutes a controller attack.

[0158] In the formula, Δt delay The calculated delay time; δ t This is the threshold for delay attacks (value > 200ms). This criterion compares the actual delay with the maximum acceptable delay under normal operating conditions. When the actual delay exceeds the threshold, it indicates that the instruction transmission or execution process may be maliciously interfered with, thus being identified as a delay attack. If the delay is within the normal range, but the execution result shows a systematic deviation (e.g., δ is not exceeded but continues to deviate in a certain direction), it is identified as a controller attack.

[0159] This embodiment also discloses an attack detection system for amphibious vehicles, including:

[0160] The data acquisition module is used to collect real-time bus traffic data, multi-sensor data, and actuator feedback information of the vehicle;

[0161] The traffic and bus attack detection module is used to determine whether a bus attack exists based on the bus traffic data.

[0162] A multi-sensor redundancy detection module is used to detect whether a sensor attack exists based on the multi-sensor data and a multi-sensor redundancy judgment method.

[0163] The actuator feedback and delay detection module is used to detect whether there is a controller attack or delay attack based on the actuator feedback information.

[0164] The above are merely preferred embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for attack detection of amphibious vehicles, characterized in that, Includes the following steps: Real-time acquisition of vehicle bus traffic data, multi-sensor data, and actuator feedback information; Based on the bus traffic data, determine whether a bus attack exists; Based on the multi-sensor data, a multi-sensor redundancy judgment method is used to detect whether a sensor attack exists. Based on the actuator feedback information, detect whether there is a controller attack or a delay attack.

2. The method according to claim 1, characterized in that, The real-time data acquisition steps include: Collect bus traffic data through the vehicle bus network; Environmental and operational parameters are collected by deploying several sets of similar sensors in key parts of the vehicle. The actuator's built-in feedback module collects execution status and delay data.

3. The method according to claim 1, characterized in that, The determination of whether a bus attack exists includes: Calculate the CAN bus load rate, and determine whether the bus load is abnormal based on the load rate and a preset threshold. When the bus load is abnormal, calculate the Euclidean distance between the real-time data vector and the attack feature vector; If the Euclidean distance exceeds a set threshold, it is determined to be an information-side attack.

4. The method according to claim 3, characterized in that, The expression for the Euclidean distance is: In the formula, D(S,F) is the Euclidean distance between the real-time data vector S and the attack feature database F, and s i f is the i-th element in the real-time data vector S; i Let be the i-th element in the attack feature library vector F; n is the dimension of the vector.

5. The method according to claim 1, characterized in that, The steps for detecting sensor attacks include: Establish a multi-source redundant observation model, including a land-based operating condition model and a water-based operating condition model; The fusion state is estimated and output through dynamic weighted fusion estimation; Calculate the residual between the measurements of each sensor and the fused state; The presence of sensor attacks can be determined based on residual statistical analysis.

6. The method according to claim 5, characterized in that, The land-based working condition model includes a 2DoF Kalman filter model, a kinematic wheel speed difference model, and a sensor direct fusion model. The 2DoF Kalman filter dynamics model is based on the lateral dynamics of the vehicle and is simplified to a two-degree-of-freedom bicycle model. The state vector of the two-degree-of-freedom bicycle model includes the vehicle's longitudinal position, lateral position, longitudinal velocity, lateral velocity, yaw rate, and center of mass sideslip angle. Its state equation takes the front wheel steering angle, front and rear wheel longitudinal forces and lateral forces as inputs, and performs state estimation through Kalman filtering algorithm. The process noise covariance and measurement noise covariance are dynamically adjusted according to the real-time tire lateral stiffness and road adhesion coefficient. The kinematic wheel speed difference model is based on pure kinematic principles. It calculates the vehicle's yaw rate and lateral velocity by using the wheel speed difference between the left and right wheels and the front wheel steering angle, thus supplementing the dynamic model. The sensor direct fusion model directly fuses raw observation data from lidar, inertial navigation unit and millimeter wave radar; it uses weighted least squares method for fusion estimation, where the weight of each sensor is the inverse of its measurement noise covariance matrix, and a working condition adaptation coefficient is introduced to dynamically adjust the weight ratio of different sensors according to real-time road conditions.

7. The method according to claim 5, characterized in that, The waterborne operating condition model includes a hydrodynamic extended Kalman filter model, a navigation kinematics model, and a multi-sensor cross-validation model. The hydrodynamic extended Kalman filter model, based on the land dynamics model, introduces propeller thrust, water drag coefficient, and hydrodynamic coefficient to characterize water flow resistance and wave-making resistance; the extended Kalman filter algorithm is used to process the nonlinear characteristics of the system and estimate the ship's attitude and motion state. The navigation kinematics model establishes a propulsion model based on the mapping relationship between propeller speed and ship speed, and combines the absolute position and heading information provided by GPS to obtain the ship's speed and position estimate through differential calculation; The multi-sensor cross-validation model integrates measurement data from inertial navigation units, tilt sensors, and millimeter-wave radar with strong resistance to water mist interference; high-frequency interference is eliminated and random noise is smoothed through a first-order low-pass filter.

8. The method according to claim 5, characterized in that, The steps of the dynamic weighted fusion estimation include: The weights are dynamically assigned based on the confidence scores of each model, and the weighted fusion state is output. The weighted fusion state is the weighted sum of the estimates of each model. A smooth transition strategy is adopted when switching from land to water until the switch is completed, avoiding state jumps.

9. The method according to claim 5, characterized in that, The detection of whether a controller attack or delay attack exists includes: The timing of the acquisition and control command issuance and the actuator response time; Calculate instruction execution delay; If the delay exceeds a preset threshold, it is determined to be a delay attack; If the delay does not exceed the limit but there is a systematic deviation in the execution result, it is determined to be a controller attack.

10. An attack detection system for amphibious vehicles, characterized in that, include: The data acquisition module is used to collect real-time bus traffic data, multi-sensor data, and actuator feedback information of the vehicle; The traffic and bus attack detection module is used to determine whether a bus attack exists based on the bus traffic data. A multi-sensor redundancy detection module is used to detect whether a sensor attack exists based on the multi-sensor data and a multi-sensor redundancy judgment method. The actuator feedback and delay detection module is used to detect whether there is a controller attack or delay attack based on the actuator feedback information.

Images