Internet of Things security protection method and system for Internet of Vehicles intrusion detection

Abstract

The invention provides an Internet of Things security protection method and system for Internet of Vehicles intrusion detection, and the method comprises the steps: preliminarily discriminating vehicle internal network data and vehicle-to-outside information exchange data through a built-in detection system of a vehicle, and generating a local abnormal event with confidence; then, the preliminary detection result is confirmed through an Internet of Vehicles regional cooperation mechanism, and a fine-grained space query and verification mechanism taking a vehicle captured image as a reference is introduced, so that accurate discovery and association of abnormal network events and physical world perception inconsistency are realized; and therefore, complex threats such as false information injection and man-in-the-middle attack can be efficiently identified and relieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Vehicles, and more particularly to an Internet of Things security protection method and system for Internet of Vehicles intrusion detection. BACKGROUND

[0002] As the core application of Internet of Things in the field of intelligent transportation, the security of Internet of Vehicles is of vital importance. Traditional centralized intrusion detection systems have defects such as single point of failure, high response delay, and difficulty in responding to attacks rapidly spreading in local areas. Existing Internet of Vehicles security solutions focus on communication encryption and identity authentication, but lack effective real-time detection and collaborative handling capabilities for attacks that have penetrated into the network (such as "false information injection attacks" initiated by falsifying sensor data or tampering with V2X messages, and "man-in-the-middle attacks" that eavesdrop and tamper with communication links). In addition, existing technologies lack a mechanism to associate and cross-verify the physical environment perceived by vehicles (especially visual information) with network behavior, resulting in low detection rates for advanced attacks with context spoofing. SUMMARY

[0003] In view of the above problems, the purpose of the present application is to provide an Internet of Things security protection method and system for Internet of Vehicles intrusion detection, which can efficiently identify and mitigate complex threats such as false information injection and man-in-the-middle attacks.

[0004] The first aspect of the present application provides an Internet of Things security protection method for Internet of Vehicles intrusion detection, comprising: Real-time acquisition of vehicle internal network data and vehicle-to-external information exchange data, preliminary detection of false information injection attacks and man-in-the-middle attacks through a spatiotemporal consistency verification model and a dynamic threshold behavior profiling method, and generation of local abnormal events with confidence; When the confidence of the local abnormal event exceeds a first preset threshold, a vehicle-to-vehicle fine-grained spatial query mechanism centered on images is triggered: a query request containing abnormal event description and vehicle key frame image perception hash is generated, and broadcasted to other vehicle nodes in the geographic area where the abnormal event is suspected to have occurred; Upon receiving the query request, other vehicle nodes compare and verify the information in the query request based on their own sensor data and image perception hash within the same spatiotemporal range, and return verification feedback information containing supporting, opposing, or uncertain conclusions; Aggregating the local abnormal event information and verification feedback information from other vehicle nodes, and determining the comprehensive intrusion confidence of the abnormal event based on the verification feedback information of the vehicle nodes; If the comprehensive intrusion confidence exceeds a second preset threshold, it is determined as a confirmed intrusion event, a distributed security response strategy is started, and the confirmed intrusion event is uploaded to the regional cloud security center.

[0005] In the scheme, the dynamic threshold behavior image method specifically comprises: Extracting features and feature values in the vehicle internal network data, at least including current vehicle position, vehicle speed and time; Based on the current vehicle time, the historical data of the adjacent vehicle within the set first time range and the set distance is obtained, and the historical data of the adjacent vehicle at least includes the historical position of the adjacent vehicle, the historical speed and the historical time; The current vehicle position, speed and time are compared and analyzed in sequence with the historical position of the adjacent vehicle, the historical speed and the historical event, to obtain the consistency score value of the current vehicle and the corresponding adjacent vehicle; After traversing all the adjacent vehicles within the set distance, the consistency score value set of the current vehicle and the adjacent vehicle is obtained; The consistency score value in the consistency score value set of the current vehicle and the adjacent vehicle is calculated by mean value, to obtain the consistency score average value; If the consistency score average value is less than or equal to the preset consistency score threshold, the current vehicle is marked as a potential false information injection source.

[0006] In the scheme, the steps of the space-time consistency verification model for data processing are specifically: According to the vehicle-to-external information exchange data, the signal strength between the vehicle node and its communication opposite end and the end-to-end communication delay are determined; Based on the preset historical sliding time window, the historical signal strength set and the end-to-end historical communication delay set between the corresponding vehicle node and its communication opposite end are extracted; According to the historical signal strength set and the historical communication delay set, the corresponding dynamic abnormal threshold range is calculated respectively; When the signal strength between the vehicle node and its communication opposite end exceeds the signal strength abnormal threshold range or the end-to-end communication delay exceeds the communication delay abnormal threshold range, the current man-in-the-middle attack is marked.

[0007] In the scheme, the step of generating local abnormal events with confidence is specifically: If there is a potential false information injection source or a man-in-the-middle attack in the current vehicle, it is marked that there is a local abnormal event in the current vehicle; Extracting the consistency score average value or the signal strength / communication delay; If there is a potential false information injection source in the current vehicle, the confidence of the corresponding local abnormal event is determined according to the consistency score average value, the preset consistency score threshold and the corresponding preset mapping reference value; If the current vehicle has a potential man-in-the-middle attack, the confidence level of the corresponding local abnormal event is determined according to the signal strength / communication delay, the signal strength abnormal threshold range / communication delay abnormal threshold range and the corresponding preset mapping reference value.

[0008] In the scheme, the generation and broadcast of the query request of the image-centered V2X fine-grained spatial query mechanism specifically include: Based on the trigger query time, the key frame images captured by the current vehicle camera within a set second time window are extracted; The key frame images are converted into fixed-length perceptual hash values H; the query request at least includes: an abnormal event type, suspected occurrence geographical coordinates and a time range, and the perceptual hash value; Based on the V2X network joined by the current vehicle, the query request is broadcast to all vehicle nodes within a preset query radius centered on the suspected occurrence geographical coordinates.

[0009] In the scheme, the preset query radius is dynamically adjusted based on the vehicle speed: when the vehicle speed is greater than 60 km / h, the query radius is 300-500 meters; when the vehicle speed is less than or equal to 60 km / h, the query radius is 100-300 meters, to ensure that the vehicle nodes within the broadcast range have a spatio-temporal intersection with the abnormal event.

[0010] In the scheme, the acquisition step of the verification feedback information specifically includes: The vehicle node k receiving the query request retrieves the perceptual hash values recorded by the corresponding vehicle node near the geographical coordinates and within the time range specified in the query request and sensor data; The perceptual hash values and H are compared and analyzed to obtain a perceptual similarity value; According to the degree of coincidence of the perceptual similarity value and the own sensor data with the description of the abnormal event, a verification conclusion is generated; The verification conclusion, together with the calculated perceptual similarity value and the own sensor data, constitutes the verification feedback information.

[0011] In the scheme, the acquisition step of the verification conclusion according to the degree of coincidence of the perceptual similarity value and the own sensor data with the description of the abnormal event specifically includes: The vehicle position, speed and time in the own sensor data are extracted; The vehicle position, speed and time in the description of the abnormal event are extracted; The vehicle position in the self-sensor data and the vehicle position in the abnormal event description, the vehicle speed in the self-sensor data and the vehicle speed in the abnormal event description, the time in the self-sensor data and the time in the abnormal event description are compared and analyzed respectively, and a coincidence degree is calculated by comprehensive calculation. According to the perception similarity value and the coincidence degree, the state of the verification conclusion is determined, and the state of the verification conclusion includes support, opposition and uncertainty.

[0012] In this scheme, after the broadcast to other vehicle nodes in the geographical area where the abnormal event is suspected to occur, the following is further included: When no verifiable adjacent vehicle message is received within a preset time length, automatically enter the "island mode"; Based on the "island mode", the traffic environment model of the current geographical position and the current vehicle driving direction are obtained; According to the traffic environment model of the current geographical position and the current vehicle driving direction, the visual scene image set is estimated; The visual scene images in the estimated visual scene image set are compared and analyzed with the key frame images captured by the current vehicle camera in turn, and a scene deviation index is determined; According to the scene deviation index, the safety threat level faced by the current vehicle is evaluated; If the safety threat level faced by the current vehicle exceeds a preset safety threat level threshold, a safety warning information is triggered and a high-risk time is reported through vehicle-road communication.

[0013] The second aspect of the application provides an Internet of Things security protection system for vehicle network intrusion detection, comprising a memory and a processor, and the memory stores a vehicle network intrusion detection Internet of Things security protection method program according to any one of the above.

[0014] The application provides an Internet of Things security protection method and system for vehicle network intrusion detection, which preliminarily discriminates vehicle internal network data and vehicle external information exchange data through a built-in detection system of the vehicle, generates a local abnormal event with a confidence degree, confirms the preliminary detection result through a vehicle networking area cooperative mechanism, and introduces a fine-grained spatial query and verification mechanism based on vehicle captured images, realizes accurate discovery and correlation of abnormal network events and physical world perception inconsistency, and thus efficiently identifies and relieves complex threats such as false information injection and man-in-the-middle attacks. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 A flowchart of the vehicle network intrusion detection Internet of Things security protection method is shown; Figure 2 A step flowchart of the data processing of the spatiotemporal consistency verification model is shown. Figure 3 A block diagram of an Internet of Things security protection system for vehicle networking intrusion detection is shown. DETAILED DESCRIPTION

[0016] In order to enable a more clear understanding of the above-mentioned objects, features and advantages of the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0017] In the following description, a large number of specific details are set forth in order to facilitate a thorough understanding of the present application, however, the present application can also be implemented in other manners different from those described herein, and therefore, the protective scope of the present application is not limited by the specific embodiments disclosed below.

[0018] Figure 1 A flowchart of an Internet of Things security protection method for vehicle networking intrusion detection is shown.

[0019] As shown in Figure 1 The present application discloses an Internet of Things security protection method for vehicle networking intrusion detection, comprising: S101, real-time acquisition of vehicle internal network data and vehicle-external information exchange data, preliminary detection of false information injection attacks and man-in-the-middle attacks through a space-time consistency verification model and a dynamic threshold behavior portrait method, generation of local abnormal events with confidence; S102, when the confidence of the local abnormal event exceeds a first preset threshold, triggering a vehicle networking fine-grained space query mechanism centered on images: generating a query request containing abnormal event description and vehicle key frame image perception hash, and broadcasting to other vehicle nodes in the geographic area where the abnormal event is suspected to occur; S103, other vehicle nodes receiving the query request, based on their own sensor data and image perception hash within the same space-time range, comparing and verifying with the information in the query request, and returning verification feedback information containing support, opposition or uncertain conclusions; S104, gathering the local abnormal event information and the verification feedback information from other vehicle nodes, determining the comprehensive intrusion confidence of the abnormal event according to the verification feedback information of the vehicle nodes; S105, if the comprehensive intrusion confidence exceeds a second preset threshold, determining as a confirmed intrusion event, starting a distributed security response strategy, and uploading the confirmed intrusion event to a regional cloud security center.

[0020] According to the embodiment of the present application, the space-time consistency verification model and the dynamic threshold behavior portrait method are arranged in the vehicle system, that is, after the vehicle internal network data and the vehicle external information exchange data are acquired, preliminary determination is immediately performed, the problems of low delay and limited bandwidth of the vehicle network are solved, the space-time consistency verification model uses the strong inertia of the physical movement of the vehicle, such as the front vehicle sudden braking, the rear vehicle must slow down or keep a safe distance, and the false information is found by comparing the logical contradictions, and the dynamic threshold behavior portrait focuses on the micro feature abnormalities of the communication channel itself, which are difficult to completely conceal when the intermediate attack inserts the proxy node. The distributed security corresponding strategy includes rapidly spreading the alarm in the corresponding vehicle network through a lightweight protocol, enabling the affected area vehicles to immediately take evasive actions, such as re-planning the route, ignoring malicious information, etc., and setting up a software isolation to perform soft isolation on the malicious source.

[0021] It should be noted that, assuming that an intruder injects false "accident ahead" information into a certain intersection area, after vehicle A receives the message, but its own camera does not capture the accident, and the radar monitors that the front vehicle flow is not decelerated, the built-in preliminary detection system of the vehicle A determines that the message is highly suspicious false information injection based on construction consistency verification; the vehicle A generates a query request including the accident location, timestamp, etc., and the image hash value of the "no accident" scene at the location captured by its camera, and broadcasts it to the vehicles around the intersection; vehicles B, C and D within the set range of the intersection receive the request, B and C call the images at the same time, calculate the hash value, and the hash value is highly similar to the hash value provided by A, and the sensor is also normal, so feedback "support" the feedback information that the corresponding information is false information injection, vehicle D is blocked by a large vehicle at that time, and feedbacks "uncertain" feedback information; and according to the feedback information of vehicles B, C and D, the comprehensive intrusion confidence is calculated, and when the comprehensive intrusion confidence exceeds the second preset threshold, it is determined that the corresponding "accident ahead" information is a false information injection intrusion event.

[0022] According to the embodiment of the present application, the dynamic threshold behavior portrait method specifically includes: extracting features and feature values in the vehicle internal network data, at least including the current vehicle position, vehicle speed and time; based on the current vehicle time, acquiring the historical data of the adjacent vehicle within the set first time range set distance, the historical data of the adjacent vehicle at least including the historical position of the adjacent vehicle, the historical vehicle speed and the historical time; comparing and analyzing the current vehicle position, vehicle speed and time with the historical position of the adjacent vehicle, historical vehicle speed and historical event in turn, to obtain the consistency score value of the current vehicle and the corresponding adjacent vehicle; after traversing all adjacent vehicles within the set distance, the consistency score value set of the current vehicle and the adjacent vehicle is obtained; The consistency score of the current vehicle and the consistency score of the adjacent vehicle are averaged to obtain a consistency score average value; If the consistency score average value is less than or equal to a preset consistency score threshold, the current vehicle is marked as a potential false information injection source.

[0023] It should be noted that the internal network data of the current vehicle i is set as , wherein represents the position of the current vehicle i, represents the speed of the current vehicle i, represents the internal network data acquisition time of the current vehicle i; the historical data of the adjacent vehicle j is set as , and the consistency score of the current vehicle i and the adjacent vehicle j is set as , and the formula is ; wherein represents a speed projection function based on maximum acceleration, , represents the maximum acceleration of the vehicle j; , represents the corresponding weight coefficient; when the consistency score average value is less than or equal to the preset consistency score threshold, it indicates that the behavior of the corresponding vehicle is inconsistent with the behavior of most surrounding vehicles, and the corresponding vehicle is set as a potential false information injection source.

[0024] Figure 2 The steps of the spatiotemporal consistency verification model for data processing are shown in the flowchart.

[0025] According to an embodiment of the present application, as shown in Figure 2 , the steps of the spatiotemporal consistency verification model for data processing are as follows: S201, according to the exchange of data between the vehicle and the external information, the signal strength between the vehicle node and its communication opposite end and the end-to-end communication delay are determined; S202, based on a preset historical sliding time window, a historical signal strength set and an end-to-end historical communication delay set between the corresponding vehicle node and its communication opposite end are extracted; S203, according to the historical signal strength set and the historical communication delay set, the corresponding dynamic abnormal threshold range is calculated respectively; S204, when the signal strength between the vehicle node and its communication opposite end exceeds the signal strength abnormal threshold range or the end-to-end communication delay exceeds the communication delay abnormal threshold range, the current man-in-the-middle attack is marked.

[0026] It should be noted that according to the historical signal strength set and the historical communication delay set, the moving average of the corresponding historical signal strength set and the historical communication delay set is calculated as and mobile standard deviation ; corresponding dynamic abnormal threshold range is set as , wherein and are adjustable coefficients, when the signal strength between the vehicle node and its communication counterpart exceeds range, or the vehicle end-to-end communication delay exceeds range, it is suspected that there is a man-in-the-middle attack, and the abnormal behavior characteristics are recorded to build an attacker profile.

[0027] According to the embodiment of the present application, the step of generating local abnormal events with confidence, specifically includes: If the current vehicle has a potential false information injection source or a man-in-the-middle attack, mark that the current vehicle has a local abnormal event; extract the average value of the consistency score or the signal strength / communication delay; If the current vehicle has a potential false information injection source, determine the confidence of the corresponding local abnormal event according to the average value of the consistency score, the preset consistency score threshold, and the corresponding preset mapping reference value; If the current vehicle has a potential man-in-the-middle attack, determine the confidence of the corresponding local abnormal event according to the signal strength / communication delay, the signal strength abnormal threshold range / communication delay abnormal threshold range, and the corresponding preset mapping reference value.

[0028] It should be noted that the preset consistency score threshold is subtracted from the average value of the consistency score to obtain a consistency score difference value, when the consistency score difference value exceeds the corresponding preset mapping reference value, the confidence of the corresponding local abnormal event is 1, when the consistency score difference value is less than the corresponding preset mapping reference value, the consistency score difference value is divided by the corresponding preset mapping reference value to obtain the confidence of the corresponding local abnormal event; If the current vehicle has a potential man-in-the-middle attack, when the signal strength exceeds the signal strength abnormal threshold range, calculate the signal strength difference value, if the signal strength difference value is greater than or equal to the corresponding preset mapping reference value, set the confidence of the corresponding signal strength to 1, if the signal strength difference value is less than the corresponding preset mapping reference value, the confidence of the corresponding signal strength is equal to the signal strength difference value divided by the corresponding preset mapping reference value; When the communication delay exceeds the communication delay abnormal threshold range, calculate the communication delay difference value, if the communication delay difference value is greater than or equal to the corresponding preset mapping reference value, set the confidence of the corresponding communication delay to 1, if the communication delay difference value is less than the corresponding preset mapping reference value, the confidence of the corresponding communication delay is equal to the communication delay difference value divided by the corresponding preset mapping reference value; Then multiply the confidence of the communication delay by the corresponding weight coefficient, multiply the confidence of the signal strength by the corresponding weight coefficient, obtain the product accumulation, and obtain the confidence of the local abnormal event.

[0029] It should be noted that when the communication delay is less than the minimum value in the communication delay abnormal threshold range, the minimum value in the communication delay abnormal threshold range is subtracted from the communication delay, and the minimum value is obtained as the corresponding communication delay difference; when the communication delay is greater than the maximum value in the communication delay abnormal threshold range, the maximum value in the communication delay abnormal threshold range is subtracted from the communication delay, and the corresponding communication delay difference is obtained; and the signal strength difference can be obtained in the same way.

[0030] According to the embodiment of the application, the generation and broadcast of the image-centered V2X fine-grained spatial query request specifically include: Based on the trigger query time, key frame images captured by the current vehicle camera within a set second time window are extracted; The key frame images are converted into fixed-length perception hash values H; the query request at least includes: an abnormal event type, suspected occurrence geographic coordinates and a time range, and the perception hash value; Based on the V2X network joined by the current vehicle, the query request is broadcast to all vehicle nodes within a preset query radius centered on the suspected occurrence geographic coordinates.

[0031] It should be noted that the abnormal event type at least includes injection of false information and man-in-the-middle attack; for example, the preset query radius is 100 meters, and the suspected occurrence geographic coordinates are the geographic coordinates of the vehicle position when the local abnormal event is triggered to obtain the vehicle internal network data or the vehicle-to-external information exchange data.

[0032] According to the embodiment of the application, the preset query radius is dynamically adjusted based on the vehicle driving speed: when the driving speed of the current vehicle is greater than 60km / h, the query radius is 300 to 500 meters; and when the driving speed is less than or equal to 60km / h, the query radius is 100 to 300 meters, to ensure that the vehicle nodes within the broadcast range have a space-time intersection with the abnormal event.

[0033] According to the embodiment of the application, the verification feedback information acquisition step specifically includes: The vehicle node k receiving the query request searches the perception hash value recorded by the corresponding vehicle node near the time range and geographic coordinates specified in the query request And sensor data; The perception hash value And H are compared and analyzed to obtain a perception similarity value; According to the degree of coincidence of the perception similarity value and the sensor data of the abnormal event description, a verification conclusion is generated; The verification conclusion, the calculated perception similarity value, and the sensor data of the vehicle node itself jointly constitute the verification feedback information.

[0034] It should be noted that the vehicle node k receiving the query request and the perception similarity value of the current vehicle are set as , and the formula is , wherein represents the Hamming distance between the two corresponding perception hash values, and the greater the corresponding Hamming distance, the more significant the difference between the corresponding two image contents, and the more likely the corresponding completely different road scenes; L represents the hash value length.

[0035] According to the embodiment of the present application, the obtaining step of generating the verification conclusion according to the consistency of the perception similarity value and the description of the abnormal event, specifically includes: extracting the vehicle position, speed and time in the self-sensor data; extracting the vehicle position, speed and time in the description of the abnormal event; comparing and analyzing the vehicle position in the self-sensor data and the vehicle position in the description of the abnormal event, the speed in the self-sensor data and the speed in the description of the abnormal event, the time in the self-sensor data and the time in the description of the abnormal event, respectively, and comprehensively calculating to obtain the consistency; determining the state of the verification conclusion according to the perception similarity value and the consistency, wherein the state of the verification conclusion includes support, opposition and uncertainty.

[0036] It should be noted that the position distance difference value is determined according to the vehicle position in the self-sensor data and the vehicle position in the description of the abnormal event; the speed difference value is determined according to the speed in the self-sensor data and the speed in the description of the abnormal event; the time difference value is determined according to the time in the self-sensor data and the time in the description of the abnormal event; the position distance difference value, the speed difference value and the time difference value are respectively mapped to the interval of 0-1, wherein the greater the difference value, the closer to 1; then the different mapping values are multiplied by the corresponding weight coefficients to obtain the product accumulation to determine the corresponding consistency; the state of the verification conclusion is set as V, ; wherein , respectively represent the high threshold value of the perception similarity value and the high threshold value of the consistency, which are respectively set as 0.8 and 0.75, , respectively represent the low threshold value of the perception similarity value and the low threshold value of the consistency, which are respectively set as 0.4 and 0.3; C represents the consistency.

[0037] According to the embodiment of the present application, after broadcasting to other vehicle nodes in the geographical area where the abnormal event is suspected to occur, it further includes: when no verifiable adjacent vehicle message is received within a preset time length, automatically entering an "island mode"; Based on the "island mode", the traffic environment model of the current geographical position and the current vehicle driving direction are acquired; According to the traffic environment model of the current geographical position and the current vehicle driving direction, the visual scene image set is estimated; The visual scene images in the estimated visual scene image set are compared with the key frame images captured by the current vehicle camera in sequence to determine the scene deviation index; According to the scene deviation index, the safety threat level faced by the current vehicle is evaluated; If the safety threat level faced by the current vehicle exceeds the preset safety threat level threshold, a safety warning information is triggered and a high-risk time is reported through vehicle-road communication.

[0038] It should be noted that the traffic environment model of the current geographical position contains all the scene images seen by the vehicle on the road surface at the corresponding geographical position, and all the scene images are filtered according to the current vehicle driving direction to estimate the visual scene image set. The step of comparing the visual scene images in the estimated visual scene image set with the key frame images captured by the current vehicle camera in sequence to determine the scene deviation index, specifically includes: comparing the visual scene images in the estimated visual scene image set with the key frame images captured by the current vehicle camera to obtain scene image similarity values; after traversing all the visual scene images, the maximum scene image similarity value is extracted, and the scene deviation index is set as , and the formula is , wherein represents the corresponding conversion coefficient, represents the maximum scene image similarity value; the scene deviation index is divided into multiple region segments, and each region segment corresponds to a safety threat level, and the higher the corresponding value in the region segment, the greater the corresponding safety threat level. For example, if the preset safety threat level threshold is 2, the safety threat level value of the current vehicle will be greater than 2, and the safety warning information will be generated; for example, if the current vehicle exceeds the original lane range during driving, the scene deviation index of the key frame image captured by the vehicle camera and the visual scene image will be large, and the corresponding safety threat level will be large.

[0039] Figure 3 A block diagram of an Internet of Things security protection system for vehicle networking intrusion detection is shown.

[0040] As Figure 3 shown, the second aspect of the present application provides an Internet of Things security protection system 3 for vehicle networking intrusion detection, comprising a memory 31 and a processor 32, and the memory stores a vehicle networking intrusion detection Internet of Things security protection method program as described in any of the above.

[0041] The application provides an Internet of Things security protection method and system for vehicle networking intrusion detection. Through a detection system built in a vehicle, internal network data of the vehicle and vehicle-external information exchange data are preliminarily distinguished to generate local abnormal events with confidence. The preliminary detection results are confirmed through a vehicle networking regional cooperation mechanism, and a fine-grained spatial query and verification mechanism based on vehicle captured images is introduced to realize accurate discovery and correlation of abnormal network events and inconsistency of physical world perception, thereby efficiently identifying and relieving complex threats such as false information injection and man-in-the-middle attacks.

[0042] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other manners. The above described device embodiments are only schematic. For example, the division of the units is only a logical function division. There can be another division manner for the actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling, direct coupling or communication connection between the components can be indirect coupling or communication connection through some interfaces, or electrical, mechanical or other forms.

[0043] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units; they can be located in one place, or distributed on multiple network units; and part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0044] In addition, each functional unit in each embodiment of the application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be realized in the form of hardware or in the form of hardware plus software functional unit.

[0045] Those skilled in the art can understand that all or part of the steps of the above method embodiments can be completed by program instruction related hardware, and the foregoing program can be stored in a computer readable storage medium. When the program is executed, the steps of the above method embodiments are executed; and the foregoing storage medium includes mobile storage devices, read-only memories (ROMs), random access memories (RAMs), magnetic disks or optical disks, and various storage media that can store program codes.

[0046] Alternatively, the above-mentioned integrated unit of the present application, if realized in the form of a software function module and sold or used as an independent product, can also be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: mobile storage devices, ROM, RAM, magnetic disks or optical disks, and various media that can store program codes.

Claims

1. A method for Internet of Things security protection of Internet of Vehicles intrusion detection, characterized in that, The method comprises the following steps: When the confidence of the local abnormal event exceeds a first preset threshold, a vehicle-to-image-based fine-grained spatial query mechanism is triggered: a query request containing an abnormal event description and an image perception hash of a key frame of the vehicle is generated, and is broadcast to other vehicle nodes in a geographical area where the abnormal event is suspected to have occurred; Other vehicle nodes receiving the query request compare and verify the information in the query request based on their own sensor data and image perception hash within the same time and space range, and return verification feedback information containing supporting, opposing or uncertain conclusions; The local abnormal event information and the verification feedback information from other vehicle nodes are aggregated, and the comprehensive intrusion confidence of the abnormal event is determined according to the verification feedback information of the vehicle nodes; If the comprehensive intrusion confidence exceeds a second preset threshold, it is determined that a confirmed intrusion event has occurred, a distributed security response strategy is started, and the confirmed intrusion event is uploaded to a regional cloud security center. The dynamic threshold behavior profiling method specifically comprises the following steps: 2.The Internet of Things security protection method for vehicle networking intrusion detection according to claim 1, characterized in that, Extracting features and feature values from vehicle internal network data, including at least current vehicle position, vehicle speed and time; Based on the current vehicle time, the historical data of the neighboring vehicles within a set first time range and a set distance are obtained, including at least the historical position, historical speed and historical time of the neighboring vehicles; The current vehicle position, speed and time are compared and analyzed with the historical position, historical speed and historical time of the neighboring vehicles in sequence to obtain a consistency score value of the current vehicle and the corresponding neighboring vehicles; After traversing all neighboring vehicles within the set distance, a consistency score value set of the current vehicle and the neighboring vehicles is obtained; The consistency score value set of the current vehicle and the neighboring vehicles is subjected to mean value calculation to obtain a consistency score average value; If the consistency score average value is less than or equal to a preset consistency score threshold, the current vehicle is marked as a potential false information injection source. The steps of data processing of the space-time consistency verification model are as follows: 3.The Internet of Things security protection method for vehicle networking intrusion detection according to claim 2, characterized in that, According to the vehicle-to-external information exchange data, the signal strength and end-to-end communication delay between the vehicle node and its communication counterpart are determined; Based on a preset historical sliding time window, a historical signal strength set and an end-to-end historical communication delay set between the corresponding vehicle node and its communication counterpart are extracted; According to the historical signal strength set and the historical communication delay set, the corresponding dynamic abnormal threshold range is calculated; When the signal strength between the vehicle node and its communication counterpart exceeds the signal strength abnormal threshold range or the end-to-end communication delay exceeds the communication delay abnormal threshold range, it is marked that a man-in-the-middle attack exists. The steps of generating a local abnormal event with confidence are as follows: 4.The Internet of Things security protection method for vehicle networking intrusion detection according to claim 3, characterized in that, If the current vehicle has a potential false information injection source or a man-in-the-middle attack, it is marked that the current vehicle has a local abnormal event. ​ extracting a consistency score average or signal strength / communication delay; if the current vehicle is a potential false information injection source, determining a confidence level of the local abnormal event according to the consistency score average, a preset consistency score threshold, and a corresponding preset mapping reference value; if the current vehicle is a potential man-in-the-middle attack, determining a confidence level of the local abnormal event according to the signal strength / communication delay, a signal strength abnormal threshold range / communication delay abnormal threshold range, and a corresponding preset mapping reference value. 5.The Internet of Things security protection method for vehicle networking intrusion detection according to claim 1, wherein, The image-centered V2X fine-grained spatial query mechanism, the generation and broadcast of the query request specifically include: extracting a key frame image captured by a camera of the current vehicle within a set second time window based on a trigger query time; converting the key frame image into a fixed-length perceptual hash value H; the query request at least includes an abnormal event type, suspected occurrence geographic coordinates and a time range, and the perceptual hash value; broadcasting the query request to all vehicle nodes within a preset query radius centered on the suspected occurrence geographic coordinates based on a V2X network to which the current vehicle belongs. 6.The method of claim 5, wherein, The preset query radius is dynamically adjusted based on vehicle speed: when the vehicle speed is greater than 60 km / h, the query radius is 300-500 meters; when the vehicle speed is less than or equal to 60 km / h, the query radius is 100-300 meters, to ensure that the vehicle nodes within the broadcast range have a spatio-temporal intersection with the abnormal event.

7. The Internet of Things security protection method for vehicle networking intrusion detection according to claim 1, characterized in that, The verification feedback information acquisition step specifically includes: a vehicle node k receiving the query request, retrieving the perception hash value recorded by the corresponding vehicle node in the time range and vicinity of the geographic coordinates specified by the query request and sensor data; comparing the perception hash value and H, to obtain a perception similarity value; generating a verification conclusion according to the perceptual similarity value and the degree of consistency of the abnormal event description with the sensor data of the current vehicle; The verification conclusion, the calculated perceptual similarity value, and the sensor data of the current vehicle together constitute the verification feedback information. 8.The method of claim 7, wherein, The verification conclusion generation step according to the perceptual similarity value and the degree of consistency of the abnormal event description with the sensor data of the current vehicle specifically includes: extracting the vehicle position, speed, and time from the sensor data of the current vehicle; extracting the vehicle position, speed, and time from the abnormal event description; comparing and analyzing the vehicle position in the sensor data of the current vehicle with the vehicle position in the abnormal event description, the speed in the sensor data of the current vehicle with the speed in the abnormal event description, and the time in the sensor data of the current vehicle with the time in the abnormal event description, and comprehensively calculating the degree of consistency; determining the state of the verification conclusion according to the perceptual similarity value and the degree of consistency, the state of the verification conclusion including support, opposition, and uncertainty. 9.The Internet of Things security protection method for vehicle networking intrusion detection of claim 1, wherein, After broadcasting to other vehicle nodes in the abnormal event suspected geographic area, it further includes: automatically entering an "island mode" when no verifiable adjacent vehicle message is received within a preset time period; based on the "island mode", obtaining a traffic environment model of the current geographic location and a driving direction of the current vehicle; estimating a set of visual scene images according to the traffic environment model of the current geographic location and the driving direction of the current vehicle; comparing and analyzing the visual scene images in the estimated set of visual scene images with the key frame image captured by the camera of the current vehicle in sequence to determine a scene deviation index; According to the scene deviation index, the safety threat level faced by the current vehicle is evaluated; If the safety threat level faced by the current vehicle exceeds the preset safety threat level threshold, a safety warning information is triggered and a high-risk time is reported through vehicle-road communication.

10. An Internet of Things security protection system for vehicle networking intrusion detection, characterized in that, The application relates to a kind of Internet of Things security protection methods for vehicle networking intrusion detection, comprising memory and processor, the memory has the program of one kind of vehicle networking intrusion detection of Internet of Things security protection method as claimed in any one of claims 1 to 9.

Images