Attack identification and positioning method and device

Abstract

The invention discloses an attack identification and positioning method and device. According to the method, an unmanned aerial vehicle with flexible flight capability is taken as an execution main body, a data sender, data content and flow parameters of a channel in a communication network are classified and identified carefully, attack data are determined when an attack is identified, and attack behaviors can be identified timely, accurately and comprehensively in the face of complex attacks. Vehicles located in a preset distance range of the unmanned aerial vehicle are regarded as nodes, RSSI values of attack data received by all the vehicles are collected, and information of surrounding vehicles is fully utilized. And based on the relationship between the RSSI value and the data propagation distance, calculating the estimated distance from a sender of the attack data to a plurality of nodes, and preliminarily determining the position of an attack source. And the attack source position is further positioned according to the positions of the plurality of nodes and the estimated distance, so that the positioning accuracy and reliability are enhanced. Therefore, the attack path can be cut off from the source, the safety of V2X communication is improved, and the driving safety is effectively improved.

Description

Technical Field

[0001] This application relates to the field of automotive wireless communication technology, and in particular to a method and apparatus for attack identification and location. Background Technology

[0002] V2X (Vehicle to Everything) communication is a vehicle-to-everything wireless communication technology that establishes a tightly connected information interaction network between vehicles and their surroundings through information exchange. Currently, V2X communication faces various security threats, such as attackers forging legitimate identities to infiltrate the communication network or injecting large amounts of abnormal data into the network to disrupt communication order. These actions severely interfere with the normal operation of V2X communication, preventing vehicles from accurately obtaining information about their surroundings, affecting driving safety, and in severe cases, potentially leading to traffic accidents.

[0003] In existing technologies, security protection for V2X communication mainly relies on encryption and access control. For example, data is accessed through roadside units and vehicles equipped with onboard units. Abnormal behavior is detected in real-time at the terminal, reported to the vehicle-to-everything (V2X) platform, and then abnormal devices are dealt with through processes such as certificate revocation. This method is complex, consumes the processing power of normal vehicles, lacks real-time capability, and cannot promptly identify complex network attacks. Even if the certificate of an abnormal device is revoked, the device can still forge other certificates to continue the attack. The attack source cannot be accurately located for blocking, leaving V2X communication still vulnerable to network attacks and failing to effectively guarantee vehicle driving safety. Summary of the Invention

[0004] To address the aforementioned issues, this application provides a method and apparatus for attack identification and localization, enabling timely and accurate identification of attack behaviors and location of attack sources, thereby cutting off attack paths at the source, improving the security of V2X communication, and ultimately enhancing driving safety.

[0005] This application discloses a method for attack identification and localization, applied to a drone, the method comprising:

[0006] If the object to be identified does not meet the preset requirements, attack data is determined based on the object to be identified; the object to be identified is a data communication parameter in the communication network.

[0007] Collect the Received Signal Strength Indicator (RSSI) values ​​of the attack data received by multiple nodes; the nodes are vehicles located within a preset distance range of the UAV.

[0008] Based on the relationship between the RSSI value and the data propagation distance, the estimated distance from the sender of the attack data to the multiple nodes is calculated;

[0009] The location of the sender is obtained based on the locations of the multiple nodes and the estimated distance.

[0010] Optionally, the plurality of nodes includes a first node, and the step of calculating the estimated distance from the sender of the attack data to the plurality of nodes based on the relationship between the RSSI value and the data propagation distance includes:

[0011] The RSSI difference is obtained by subtracting the reference RSSI value from the RSSI value corresponding to the first node; the reference RSSI value is the RSSI value corresponding to a position at a reference distance from the first node; the reference distance is obtained by a preset.

[0012] The result of the power operation is obtained based on the RSSI difference and the path loss index; the path loss index is obtained by a preset and is related to the environment in which the first node is located.

[0013] The estimated distance from the sender to the first node is obtained by multiplying the result of the exponentiation operation with the reference distance.

[0014] Optionally, obtaining the sender's location based on the locations of the multiple nodes and the estimated distance includes:

[0015] Obtain the coordinate difference between the location of the sender and the location of each node;

[0016] Based on the coordinate difference and the estimated distance, the distance error value from the sender to each of the nodes is calculated respectively;

[0017] Minimize the distance error value to solve for the coordinates of the sender's location.

[0018] Optionally, the object to be identified is a data sender, data content, and channel traffic parameters in a communication network. The traffic parameters include data transmission frequency, data size, data format, and channel occupancy. The preset requirements are that the digital signature of the data sender is valid, the data content conforms to a physical motion trajectory, and the traffic parameters are within a preset range. If the object to be identified does not meet the preset requirements, determining the attack data based on the object to be identified includes:

[0019] When the digital signature is found to be invalid, the data sent by the data sender is determined to be the attack data.

[0020] When the data content is found to be inconsistent with the physical motion trajectory, the data is determined to be the attack data;

[0021] When the traffic parameter is detected to be outside the preset range, the data corresponding to the traffic parameter is determined to be the attack data.

[0022] Optionally, identifying that the data content does not conform to the physical motion trajectory includes:

[0023] The motion trajectory in the data content is obtained based on the motion parameters in the data content;

[0024] If the difference between the motion trajectory and the physical motion trajectory exceeds a preset difference value, it is determined that the data content does not conform to the physical motion trajectory.

[0025] Optionally, identifying the digital signature as invalid includes:

[0026] Obtain the digital signature of the data sender;

[0027] The digital signature is verified using a public key, and if verification fails, the digital signature is determined to be invalid.

[0028] Optionally, identifying that the traffic parameter is not within a preset range includes:

[0029] When one or more of the following conditions exist: the data transmission frequency exceeds a preset frequency, the data size exceeds a preset size, the data format is not a preset format, or the channel occupancy rate exceeds a preset occupancy rate, it is determined that the traffic parameter is not within the preset range.

[0030] Optionally, after obtaining the location of the sender, the method further includes:

[0031] The location of the sender is sent to vehicles within a preset distance range of the drone to provide early warning.

[0032] Optionally, if the object to be identified does not meet the preset requirements, before determining the attack data based on the object to be identified, the method further includes:

[0033] Receive a request from the target vehicle and plan a target driving route for the target vehicle;

[0034] Fly to the center of the intersection according to the target driving route and conduct communication monitoring.

[0035] Based on the above-mentioned method for attack identification and localization, this application also discloses an attack identification and localization device applied to a drone, the device comprising: a determination unit, a data acquisition unit, an estimation unit, and a localization unit;

[0036] The determining unit is used to determine attack data based on the object to be identified when the object to be identified does not meet the preset requirements; the object to be identified is a data communication parameter in a communication network.

[0037] The acquisition unit is used to acquire the Received Signal Strength Indicator (RSSI) values ​​of the attack data received by multiple nodes; the nodes are vehicles located within a preset distance range of the UAV.

[0038] The estimation unit is used to calculate the estimated distance from the sender of the attack data to multiple nodes based on the relationship between the RSSI value and the data propagation distance.

[0039] The positioning unit is used to obtain the location of the sender based on the locations of the multiple nodes and the estimated distance.

[0040] Optionally, the plurality of nodes includes a first node, and the estimation unit includes:

[0041] The difference calculation subunit is used to subtract the reference RSSI value from the RSSI value corresponding to the first node to obtain the RSSI difference value; the reference RSSI value is the RSSI value corresponding to a position at a reference distance from the first node; the reference distance is obtained by a preset.

[0042] The exponentiation subunit is used to obtain the exponentiation result based on the RSSI difference and the path loss index; the path loss index is obtained by a preset and is related to the environment where the first node is located.

[0043] An estimation subunit is used to obtain the product of the exponentiation result and the reference distance to obtain the estimated distance from the sender to the first node.

[0044] Optionally, the positioning unit includes:

[0045] The difference acquisition subunit is used to acquire the coordinate difference between the location of the sender and the location of each node;

[0046] An error calculation subunit is used to calculate the distance error value from the sender to each of the nodes based on the coordinate difference and the estimated distance.

[0047] The minimization sub-unit is used to minimize the distance error value and solve for the coordinates of the sender's location.

[0048] Optionally, the object to be identified is a data sender, data content, and channel flow parameters in a communication network. The flow parameters include data transmission frequency, data size, data format, and channel occupancy. The preset requirements are that the digital signature of the data sender is valid, the data content conforms to a physical motion trajectory, and the flow parameters are within a preset range. The determining unit includes:

[0049] An invalid identification subunit is used to determine that the data sent by the data sender is the attack data when the digital signature is found to be invalid.

[0050] The trajectory recognition subunit is used to determine that the data is the attack data when the data content does not conform to the physical motion trajectory.

[0051] The range identification subunit is used to determine the data corresponding to the traffic parameter as the attack data when the traffic parameter is detected to be outside the preset range.

[0052] Optionally, the trajectory recognition subunit includes:

[0053] The trajectory acquisition subunit is used to acquire the motion trajectory of the data content based on the motion parameters in the data content;

[0054] The trajectory comparison subunit is used to determine that the data content does not conform to the physical motion trajectory when the difference between the motion trajectory and the physical motion trajectory exceeds a preset difference value.

[0055] Optionally, the invalid identification subunit includes:

[0056] The signature acquisition subunit is used to acquire the digital signature of the data sender;

[0057] The signature verification subunit is used to verify the digital signature using a public key and to determine that the digital signature is invalid if the verification fails.

[0058] Optionally, the range identification subunit includes:

[0059] The determining subunit is used to determine that the traffic parameter is not within the preset range when one or more of the following conditions exist: the data transmission frequency exceeds the preset frequency, the data size exceeds the preset size, the data format is not a preset format, or the channel occupancy rate exceeds the preset occupancy rate.

[0060] Optionally, the device further includes:

[0061] The early warning unit is used to send the location of the sender to vehicles within a preset distance range of the drone for early warning.

[0062] Optionally, the device further includes:

[0063] The planning unit is used to receive requests from target vehicles and plan target driving routes for the target vehicles.

[0064] The flight unit is used to fly to the center of the intersection according to the target driving route and to conduct communication monitoring.

[0065] This application discloses a method and apparatus for attack identification and localization. Using a drone with flexible flight capabilities as the primary agent, it conducts patrols to comprehensively control road areas. It meticulously classifies and identifies data senders, data content, and channel traffic parameters in the communication network, and determines the attack data upon detection of an attack. This allows for timely, accurate, and comprehensive identification of attack behaviors even in the face of complex attacks. Vehicles within a preset distance range of the drone are considered nodes, and the Received Signal Strength Indicator (RSSI) value of each node is collected to fully utilize information from surrounding vehicles. Based on the relationship between RSSI values ​​and data propagation distance, the estimated distances from the attacker to multiple nodes are quickly and accurately calculated, initially determining the attack source location. Further location of the attack source is determined based on the locations of multiple nodes and the estimated distances, enhancing the accuracy and reliability of the localization. This effectively cuts off the attack path at its source, improves the security of V2X communication, and significantly enhances driving safety. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0067] Figure 1 This is a flowchart illustrating a method for attack identification and localization disclosed in an embodiment of this application;

[0068] Figure 2 This is a flowchart illustrating another method for attack identification and localization disclosed in an embodiment of this application;

[0069] Figure 3 This is a schematic diagram of the structure of an attack identification and location device disclosed in an embodiment of this application. Detailed Implementation

[0070] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0071] Example 1: This application discloses a method for attack identification and localization.

[0072] For details, please refer to Figure 1 The attack identification and location method disclosed in this embodiment includes the following steps:

[0073] Step 101: If the object to be identified does not meet the preset requirements, determine the attack data based on the object to be identified.

[0074] In this embodiment, the execution entity is a drone, and the data acquisition and processing tasks throughout the entire process are all completed independently by the drone. Specifically, the drone first receives a request from the target vehicle and plans a reasonable and efficient target driving route for the target vehicle based on the request content. Then, it conducts an inspection according to the planned target driving route, flies to the center of the intersection, and performs communication monitoring at this location, closely monitoring the various data transmissions in the V2X communication network.

[0075] In the method of this embodiment, common attack methods against V2X communication can include identity spoofing attacks, denial-of-service attacks, and malicious data attacks. Identity spoofing attacks involve the attacker forging fake or expired certificates to disguise their identity. For example, the attacker could impersonate an emergency vehicle and send information to surrounding vehicles via V2X communication, misleading their decisions and actions, thereby disrupting traffic order and safety. Denial-of-service attacks involve the communication channel itself. The attacker sends a large number of useless messages to surrounding vehicles in a short period of time by transmitting data at high frequency in the V2X communication channel, occupying channel resources and preventing surrounding vehicles from receiving and processing valid communication data normally, thus affecting normal driving. Malicious data attacks involve the attacker sending data containing malicious content to surrounding vehicles via V2X communication, such as sending unreasonable information like special speeds or locations. This interferes with surrounding vehicles' accurate judgment of their own status and the surrounding environment, posing a potential threat to traffic safety.

[0076] Specifically, one manifestation of a malicious data attack could be that attacker A claims in a message that it "moves from position P to P' within 10 seconds," but the speed obtained by dividing the straight-line distance between P and P' by 10 seconds exceeds the maximum physical speed of a vehicle (such as 200 km / h), which does not conform to a normal physical movement trajectory.

[0077] In this embodiment, taking these three attack methods as examples, the data sender, data content, and channel traffic parameters in the V2X communication network are considered as objects to be identified, and attack identification is performed on them. If the object to be identified does not meet preset requirements, attack data is determined based on the object to be identified. The preset requirements are that the digital signature of the data sender is valid, the data content conforms to the physical movement trajectory, and the traffic parameters are within a preset range.

[0078] In this embodiment, to address identity spoofing attacks, a unique digital certificate is first assigned to each legitimate entity (such as a vehicle or roadside unit) based on a Public Key Infrastructure (PKI) system. This certificate contains a public key and identity information. During message transmission, the sender signs the message using their private key, and the receiver verifies the validity of the digital signature using the public key in the certificate. If the verification fails, the digital signature is deemed invalid. An invalid digital signature indicates that the sender's identity may have been forged, making the transmitted data untrustworthy, thus confirming the existence of an identity spoofing attack. Furthermore, the data corresponding to the verification failure is the attack data, and the sender corresponding to the verification failure is the sender of the attack data.

[0079] In the method of this embodiment, for a denial-of-service attack, it is necessary to determine whether traffic parameters, including data transmission frequency, data size, data format, and channel occupancy rate, are within a preset range. Specifically, if one or more of the following conditions are identified: data transmission frequency exceeds a preset frequency, data size exceeds a preset size, data format is not a preset format, or channel occupancy rate exceeds a preset occupancy rate, it can be determined that the traffic parameters are not within the preset range, thereby determining the existence of a denial-of-service attack. Furthermore, the data that causes the traffic parameters to be outside the preset range is the attack data, and the sender of this data is the sender of the attack data.

[0080] As a feasible solution, legitimate messages in V2X communication are typically sent at a fixed frequency (e.g., 10Hz). However, attackers may send a large number of useless messages at frequencies much higher than this fixed frequency (e.g., 100Hz), consuming channel resources. Therefore, a preset frequency can be reasonably set based on industry standards or historical data. When the data transmission frequency exceeds this preset frequency, it indicates the presence of a denial-of-service attack.

[0081] As a feasible solution, normal messages in V2X communication have strictly standardized formats and defined size ranges. Attackers may send excessively large or small data packets, or messages with malformed formats, to disrupt normal communication. Therefore, the data packet structure can be validated based on preset sizes and formats. When the data packet size exceeds the preset size or the format does not conform to the preset format, it indicates the presence of a denial-of-service attack.

[0082] As a feasible solution, channel occupancy rates in normal commuting scenarios typically remain between 50% and 70%. Attackers might send large amounts of information to monopolize the channel and disrupt normal communication for other vehicles. Therefore, a preset occupancy rate can be set, and spectrum analysis tools (such as software-defined radio) can be used to monitor channel congestion in real time. If the channel occupancy rate suddenly spikes and exceeds the preset rate (e.g., 90%) within a short period, it indicates the presence of a denial-of-service attack.

[0083] In the method of this embodiment, for malicious data attacks, the motion trajectory in the data content can be obtained based on the motion parameters in the data content, and it can be identified whether the motion trajectory conforms to the physical motion trajectory. Specifically, if the difference between the motion trajectory and the physical motion trajectory exceeds a preset difference value, it can be determined that the data content does not conform to the physical motion trajectory. For example, if the motion trajectory of vehicle A in the message indicates that it is traveling at a speed of 400 km / h, it clearly does not conform to the laws of physics. In this case, it can be determined that there is a malicious data attack, and this message is attack data, and vehicle A is the sender of the attack data.

[0084] Step 102: Collect the Received Signal Strength Indicator (RSSI) values ​​of the attack data received by multiple nodes.

[0085] In the method of this embodiment, to accurately locate the sender of the attack data, vehicles within a preset distance range of the drone can be used as nodes. For example, vehicles within 500m of the drone can be used as nodes. The coordinates of these nodes are known and can be obtained by the drone. Since the vehicle positions obtained in practical applications are usually latitude and longitude coordinates, while the coordinates used for calculation in this embodiment are planar coordinates, the obtained latitude and longitude coordinates can be converted into planar coordinates. As an feasible solution, a local planar rectangular coordinate system can be constructed first, with the latitude and longitude coordinates of the drone as the origin, and the direction facing the drone is defined as the positive Y-axis, and the direction perpendicular to the right side of the drone is defined as the positive X-axis. Then, the latitude and longitude coordinates of each node are converted into planar coordinates according to the geographic coordinate transformation method.

[0086] In this embodiment, the sender of the attack data broadcasts the attack data to the surrounding area via V2X communication, and nearby vehicles simultaneously receive the attack data. As one possible approach, the drone collects the Received Signal Strength Indicator (RSSI) values ​​of each node when it receives the attack data. Alternatively, each node can also synchronously record its RSSI value and actively upload it to the drone when it receives the attack data.

[0087] In the method of this embodiment, RSSI values ​​are susceptible to interference factors such as multipath effects and occlusion, resulting in fluctuations and noise in the RSSI values, which is detrimental to subsequent RSSI-based localization steps. Therefore, the RSSI values ​​can be filtered and smoothed first.

[0088] As a feasible solution, a moving average filtering method is used to denoise the RSSI values. This method is easy to implement and can effectively smooth the data. Specifically, for the i-th node, k consecutive RSSI values ​​are obtained, and then the average of the k RSSI values ​​is calculated as the denoised RSSI value. The formula is as follows:

[0089] (1)

[0090] In the formula, The RSSI value after denoising is r. i1 r i2 r ik These are the RSSI values ​​obtained for the first, second, and kth iterations of the i-th node, respectively.

[0091] Step 103: Based on the relationship between the RSSI value and the data propagation distance, calculate the estimated distance from the sender of the attack data to the multiple nodes.

[0092] In this embodiment, there is a correlation between the RSSI value and the data propagation distance. Specifically, the signal attenuates as the distance increases during propagation. Therefore, the signal propagation distance can be estimated using the RSSI value. As an feasible solution, taking the first node among multiple nodes as an example, a reference point is set as the distance between the first node and the reference distance. The difference between the reference RSSI value obtained at the reference point and the RSSI value corresponding to the first node is obtained. Then, the ratio of the RSSI difference to a path loss index of 10 is used as the exponent, and the result is obtained by exponentiation with 10 as the base. Here, the path loss index is a preset value that is related to the environment in which the first node is located. For example, when the first node is in an open road, the path loss index can be set to 2~3; when the first node is in a dense urban area, the path loss index can be set to 3~5.

[0093] Finally, by multiplying the result of the exponentiation by the reference distance, the estimated distance from the sender to the first node can be obtained. Taking the i-th node as the first node, the formula for calculating the estimated distance is as follows:

[0094] (2)

[0095] In the formula, d i d0 is the estimated distance from the sender to the i-th node, r0 is the reference distance, and N is the path loss exponent.

[0096] Step 104: Obtain the location of the sender based on the locations of the multiple nodes and the estimated distance.

[0097] In the method of this embodiment, in order to accurately obtain the location of the sender of the attack data, a multilateral positioning method can be used to solve for the sender's coordinates. That is, the sender's coordinates are treated as unknowns in a least-squares multilateral positioning problem. Given the coordinates of a certain number of nodes and the estimated distances between the sender and these nodes, the sender's coordinates are determined by a multilateral solution method.

[0098] As a feasible approach, the coordinate differences between the sender's location and the location of each node are first obtained. Based on the coordinate differences and the estimated distance to each node, the distance error from the sender to each node is calculated. Specifically, it can be represented by the following formula:

[0099] (3)

[0100] In the formula, e i Let x be the distance error value from the sender to the i-th node, and let x and y be the coordinates of the sender. i and y i Let be the coordinates of the i-th node.

[0101] In the method of this embodiment, to obtain the most accurate sender coordinates, it is necessary to minimize the distance error values ​​of all nodes. The objective function can be as follows:

[0102] (4)

[0103] In the formula, n is the number of nodes.

[0104] Based on the coordinates of the first node and the i-th node, expanding formula (3) yields:

[0105] (5)

[0106] (6)

[0107] In the formula, x1 and y1 are the coordinates of the first node, d1 is the estimated distance from the sender to the first node, and e1 is the distance error value from the sender to the first node.

[0108] Combining formulas (5) and (6), we get:

[0109] (7)

[0110] Let a i =2(x i -x1), b i =2(y i -y1), c i =d i 2 -d12 +x1 2 +y1 2 -x i 2 -y i 2 We can obtain:

[0111] (8)

[0112] When n>2, the following linear equation can be constructed:

[0113] (9)

[0114] Solving using the least squares method yields:

[0115] (10)

[0116] Expand as follows:

[0117] (11)

[0118] (12)

[0119] Solving this problem will give you the coordinates (x, y) of the sender's location.

[0120] In the method of this embodiment, in order to warn surrounding vehicles that may be under attack, after successfully determining the location of the sender, the drone can, on the one hand, send the sender's coordinates to vehicles within its preset distance range, enabling these vehicles to take timely preventive measures, such as adjusting their driving routes or increasing vigilance. On the other hand, it can also report the sender's coordinates to the vehicle-to-everything (V2X) platform, facilitating law enforcement personnel to handle the situation, and can also continuously track the moving attacker, thereby effectively ensuring road traffic safety.

[0121] The method described in this embodiment uses a drone as the execution subject, supporting comprehensive monitoring of road areas and increasing the timeliness and comprehensiveness of attack behavior identification. Vehicles within a preset distance range of the drone are considered nodes, forming a dynamic monitoring network. Based on the RSSI value of each node, the estimated distance from the sender of the attack data to multiple nodes is calculated, initially determining the location of the attack source. Compared to methods that first detect abnormal behavior at the terminal, then report to the vehicle network platform, and finally revoke the certificate of the abnormal device, the attack identification and attack source location steps in this embodiment are continuous and easy to implement. Furthermore, execution via a drone does not consume vehicle performance. This embodiment's method also combines the locations of multiple nodes and estimated distances, employing algorithms such as multilateral positioning to further locate the attack source, effectively reducing positioning errors and enhancing the accuracy and reliability of positioning. Simultaneously, this application takes measures to address the location of the attack source, such as broadcasting the attack source location and tracking and intercepting the attacking vehicle. Compared to simply revoking the attack source's certificate, this embodiment's method can cut off the attack path at its source, preventing further certificate forgery and attacks. This effectively maintains the normal operation of the V2X communication network, thereby improving driving safety.

[0122] Example 2: This application discloses another method for attack identification and localization. Please refer to [link / reference]. Figure 2 This embodiment describes the entire process of attack location.

[0123] Step 201: The drone flies to the center of the intersection according to the planned route for the target vehicle and begins to monitor the V2X communication network.

[0124] Step 202: The drone acquires attack data through monitoring.

[0125] Step 203: The drone constructs a Cartesian coordinate system with itself as the origin, and uses vehicles within a preset distance range as nodes to obtain the coordinates of each node.

[0126] Step 204: The drone acquires the raw RSSI value of the attack data received by each node, and smooths each raw RSSI value to obtain the RSSI value.

[0127] Step 205: Based on the relationship between RSSI value and data propagation distance, the drone calculates the estimated distance from the sender of the attack data to each node.

[0128] Step 206: The UAV determines the sender's coordinates using a multilateral solution method based on the estimated distance and the coordinates of each node.

[0129] Step 207: The drone sends the sender's coordinates to vehicles within its preset distance range and reports the sender's coordinates to the vehicle network platform.

[0130] Based on the attack identification and location method disclosed in the above embodiments, this embodiment correspondingly discloses an attack identification and location device applied to unmanned aerial vehicles (UAVs). Please refer to... Figure 3 The attack identification and location device includes: a determination unit 301, a collection unit 302, an estimation unit 303, and a location unit 304;

[0131] The determining unit 301 is used to determine attack data based on the object to be identified when the object to be identified does not meet the preset requirements; the object to be identified is a data communication parameter in a communication network.

[0132] The acquisition unit 302 is used to acquire the Received Signal Strength Indicator (RSSI) values ​​of the attack data received by multiple nodes; the nodes are vehicles located within a preset distance range of the UAV.

[0133] The estimation unit 303 is used to calculate the estimated distance from the sender of the attack data to multiple nodes based on the relationship between the RSSI value and the data propagation distance.

[0134] The positioning unit 304 is used to obtain the location of the sender based on the locations of the multiple nodes and the estimated distance.

[0135] Optionally, the plurality of nodes includes a first node, and the estimation unit 303 includes:

[0136] The difference calculation subunit is used to subtract the reference RSSI value from the RSSI value corresponding to the first node to obtain the RSSI difference value; the reference RSSI value is the RSSI value corresponding to a position at a reference distance from the first node; the reference distance is obtained by a preset.

[0137] The exponentiation subunit is used to obtain the exponentiation result based on the RSSI difference and the path loss index; the path loss index is obtained by a preset and is related to the environment where the first node is located.

[0138] An estimation subunit is used to obtain the product of the exponentiation result and the reference distance to obtain the estimated distance from the sender to the first node.

[0139] Optionally, the object to be identified is a data sender, data content, and channel flow parameters in a communication network. The flow parameters include data transmission frequency, data size, data format, and channel occupancy. The preset requirements are that the digital signature of the data sender is valid, the data content conforms to a physical motion trajectory, and the flow parameters are within a preset range. The positioning unit 304 includes:

[0140] The difference acquisition subunit is used to acquire the coordinate difference between the location of the sender and the location of each node;

[0141] An error calculation subunit is used to calculate the distance error value from the sender to each of the nodes based on the coordinate difference and the estimated distance.

[0142] The minimization sub-unit is used to minimize the distance error value and solve for the coordinates of the sender's location.

[0143] Optionally, the determining unit 301 includes:

[0144] An invalid identification subunit is used to determine that the data sent by the data sender is the attack data when the digital signature is found to be invalid.

[0145] The trajectory recognition subunit is used to determine that the data is the attack data when the data content does not conform to the physical motion trajectory.

[0146] The range identification subunit is used to determine the data corresponding to the traffic parameter as the attack data when the traffic parameter is detected to be outside the preset range.

[0147] Optionally, the trajectory recognition subunit includes:

[0148] The trajectory acquisition subunit is used to acquire the motion trajectory of the data content based on the motion parameters in the data content;

[0149] The trajectory comparison subunit is used to determine that the data content does not conform to the physical motion trajectory when the difference between the motion trajectory and the physical motion trajectory exceeds a preset difference value.

[0150] Optionally, the invalid identification subunit includes:

[0151] The signature acquisition subunit is used to acquire the digital signature of the data sender;

[0152] The signature verification subunit is used to verify the digital signature using a public key and to determine that the digital signature is invalid if the verification fails.

[0153] Optionally, the range identification subunit includes:

[0154] The determining subunit is used to determine that the traffic parameter is not within the preset range when one or more of the following conditions exist: the data transmission frequency exceeds the preset frequency, the data size exceeds the preset size, the data format is not a preset format, or the channel occupancy rate exceeds the preset occupancy rate.

[0155] Optionally, the device further includes:

[0156] The early warning unit is used to send the location of the sender to vehicles within a preset distance range of the drone for early warning.

[0157] Optionally, the device further includes:

[0158] The planning unit is used to receive requests from target vehicles and plan target driving routes for the target vehicles.

[0159] The flight unit is used to fly to the center of the intersection according to the target driving route and to conduct communication monitoring.

[0160] The embodiments in this specification are described in a progressive manner. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant details can be found in the method section.

[0161] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0162] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0163] The features described in the embodiments of this specification can be substituted for or combined with each other, so that those skilled in the art can implement or use this application.

[0164] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for attack identification and localization, characterized in that, Applied to drones, the method includes: If the object to be identified does not meet the preset requirements, attack data is determined based on the object to be identified; the object to be identified is a data communication parameter in the communication network. Collect the Received Signal Strength Indicator (RSSI) values ​​of the attack data received by multiple nodes; the nodes are vehicles located within a preset distance range of the UAV. Based on the relationship between the RSSI value and the data propagation distance, the estimated distance from the sender of the attack data to the multiple nodes is calculated; The location of the sender is obtained based on the locations of the multiple nodes and the estimated distance.

2. The method according to claim 1, characterized in that, The plurality of nodes includes a first node, and the step of calculating the estimated distance from the sender of the attack data to the plurality of nodes based on the relationship between the RSSI value and the data propagation distance includes: The RSSI difference is obtained by subtracting the reference RSSI value from the RSSI value corresponding to the first node; the reference RSSI value is the RSSI value corresponding to a position at a reference distance from the first node; the reference distance is obtained by a preset. The result of the power operation is obtained based on the RSSI difference and the path loss index; the path loss index is obtained by a preset and is related to the environment in which the first node is located. The estimated distance from the sender to the first node is obtained by multiplying the result of the exponentiation operation with the reference distance.

3. The method according to claim 1, characterized in that, The step of obtaining the sender's location based on the locations of the multiple nodes and the estimated distance includes: Obtain the coordinate difference between the location of the sender and the location of each node; Based on the coordinate difference and the estimated distance, the distance error value from the sender to each of the nodes is calculated respectively; Minimize the distance error value to solve for the coordinates of the sender's location.

4. The method according to claim 1, characterized in that, The object to be identified includes the data sender in the communication network, the data content, and the channel traffic parameters. The traffic parameters include the data transmission frequency, data size, data format, and channel occupancy rate. The preset requirements include that the digital signature of the data sender is valid, the data content conforms to the physical motion trajectory, and the traffic parameters are within a preset range. The step of determining attack data based on the object to be identified when the object to be identified does not meet the preset requirements includes: When the digital signature is found to be invalid, the data sent by the data sender is determined to be the attack data. When the data content is found to be inconsistent with the physical motion trajectory, the data is determined to be the attack data; When the traffic parameter is detected to be outside the preset range, the data corresponding to the traffic parameter is determined to be the attack data.

5. The method according to claim 4, characterized in that, The identification that the data content does not conform to the physical motion trajectory includes: The motion trajectory in the data content is obtained based on the motion parameters in the data content; If the difference between the motion trajectory and the physical motion trajectory exceeds a preset difference value, it is determined that the data content does not conform to the physical motion trajectory.

6. The method according to claim 4, characterized in that, The identification of the invalid digital signature includes: Obtain the digital signature of the data sender; The digital signature is verified using a public key, and if verification fails, the digital signature is determined to be invalid.

7. The method according to claim 4, characterized in that, The identification that the traffic parameters are not within the preset range includes: When one or more of the following conditions exist: the data transmission frequency exceeds a preset frequency, the data size exceeds a preset size, the data format is not a preset format, or the channel occupancy rate exceeds a preset occupancy rate, it is determined that the traffic parameter is not within the preset range.

8. The method according to any one of claims 1-7, characterized in that, After obtaining the location of the sender, the method further includes: The location of the sender is sent to vehicles within a preset distance range of the drone for early warning.

9. The method according to any one of claims 1-7, characterized in that, If the object to be identified does not meet the preset requirements, before determining the attack data based on the object to be identified, the method further includes: Receive a request from the target vehicle and plan a target driving route for the target vehicle; Fly to the center of the intersection according to the target driving route and conduct communication monitoring.

10. An attack identification and location device, characterized in that, Applied to unmanned aerial vehicles (UAVs), it includes: determination unit, data acquisition unit, estimation unit, and positioning unit; The determining unit is used to determine attack data based on the object to be identified when the object to be identified does not meet the preset requirements; the object to be identified is a data communication parameter in a communication network. The acquisition unit is used to acquire the Received Signal Strength Indicator (RSSI) values ​​of the attack data received by multiple nodes; the nodes are vehicles located within a preset distance range of the UAV. The estimation unit is used to calculate the estimated distance from the sender of the attack data to multiple nodes based on the relationship between the RSSI value and the data propagation distance. The positioning unit is used to obtain the location of the sender based on the locations of the multiple nodes and the estimated distance.

Images