Networking attack detection system and method for intelligent networked automobile based on data and knowledge fusion

Abstract

The invention discloses a network attack detection system and a network attack detection method for a digital-aware-fused intelligent connected automobile, and relates to an intelligent vehicle technology. The system comprises a vehicle end data generation module, a road side unit data acquisition module, a cloud end attack detection module and a detection result display module. The method comprises the two steps of online real-time detection and offline training, during offline training, a training database containing multiple attack types is firstly constructed, then a data driving model is constructed based on a hierarchical vector Transformer model, and finally constraints in vehicles, between vehicles and between vehicles and lanes are fused, so that the data driving model is constructed. Weak, medium and strong constraints are divided according to the relevance between the constraints and the attacks, and a differential fusion scheme is designed. According to the method, deep fusion of data driving and knowledge guiding is realized, spatio-temporal features are extracted in a layered manner, high-precision map information is fused, attack detection precision and interpretability are improved, various network attacks can be effectively detected, and safe and efficient operation of an intelligent networked automobile is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of intelligent vehicle technology, specifically to a data-knowledge fusion intelligent connected vehicle network attack detection system and method. Background Technology

[0002] In recent years, connected and autonomous driving has received increasing attention from research both domestically and internationally due to its enormous potential in addressing many long-standing transportation challenges related to safety, congestion, and energy conservation. Driven by vehicle-to-everything (V2X) technology, intelligent connected vehicles can improve traffic safety, alleviate congestion, and optimize traffic efficiency by periodically sending basic safety information and sharing information such as location and speed with other traffic participants and infrastructure in real time. However, the sensors required for the operation of intelligent connected vehicles and the connectivity of traffic networks create multiple attack surfaces for these systems. Cyberattacks severely impact the efficiency and safety of intelligent connected vehicle operations; therefore, real-time detection of cyberattacks is essential for the safe and efficient operation of intelligent connected vehicles.

[0003] With the development of connected autonomous driving technology, researchers are also actively promoting research on network attack detection. Reference [1] (Y. Wang, Q. Liu, E. Mihankhah, C. Lv and D. Wang, "Detection and Isolation of Sensor Attacks for Autonomous Vehicles: Framework, Algorithms, and Validation," in IEEE Transactions on Intelligent Transportation Systems, vol.23, no. 7, pp. 8247-8259, July 2022.) adopts a kinematic model, introduces sensor redundancy, develops a set of detectors based on a combination of extended Kalman filter and accumulator discriminator, and develops a rule-based isolation scheme to identify abnormal sensors. However, such model-based methods can be designed with targeted network attacks to disable the detectors. Reference [2] (Huang H, Zheng X, Yang Y, et al. An integrated architecture for intelligence evaluation of automated vehicles[J]. Accident Analysis & Prevention, 2020, 145:105682.) proposes a detection method that uses a sub-region-based graph attention model to extract spatial features of traffic flow, uses a gated loop unit with a gated mechanism to extract temporal features of traffic flow, constructs a short-term traffic flow prediction model, and finally establishes a reputation mechanism. However, the dataset used has few attack types, the attack forms are simple, and the network structure does not fully extract spatiotemporal feature information and utilize auxiliary information related to the features.

[0004] In view of this, the present invention provides a network attack detection system and method for intelligent connected vehicles that integrates data-driven and knowledge-guided approaches. It integrates high-precision map information and proposes a multi-dimensional heterogeneous rule-guided fusion scheme to improve the detection accuracy and interpretability of network attack detection, which plays a significant role in improving the security performance of intelligent connected vehicles. Summary of the Invention

[0005] The purpose of this invention is to address the problems in existing technologies, such as the vulnerability of model-based attack detection methods to targeted attacks and the limited attack type coverage and insufficient spatiotemporal feature extraction of existing data-driven methods. This invention provides a data-knowledge fusion-based intelligent connected vehicle network attack detection system and method. It constructs a network attack detection data-driven model based on a hierarchical vector Transformer model, considering internal vehicle physical constraints, inter-vehicle physical constraints, and rule constraints between vehicles and lanes. Based on the characteristics of different constraints, a multi-dimensional heterogeneous rule knowledge guidance scheme is designed to achieve real-time and accurate intelligent connected vehicle network attack detection.

[0006] To achieve the above-mentioned objectives, the present invention provides the following technical solution:

[0007] A data-knowledge fusion intelligent connected vehicle network attack detection system includes a vehicle-side data generation module, a roadside unit data acquisition module, a cloud-based attack detection module, and a detection result display module;

[0008] The vehicle-side data generation module is used to actively generate and transmit its own basic safety information, including an onboard sensor data acquisition submodule, a basic safety message generation submodule, and a basic safety message broadcasting submodule; the onboard sensor data acquisition submodule is used to collect vehicle dynamic data in real time through the onboard sensors; the basic safety message generation submodule is used to generate basic safety messages according to the vehicle networking industry standards based on the collected dynamic data; the basic safety message broadcasting submodule is used to broadcast basic safety messages to surrounding roadside units and vehicles at a preset frequency through the communication module;

[0009] The roadside unit data acquisition module is used to collect and preprocess basic safety information, and includes a roadside unit data acquisition submodule, a roadside unit data preprocessing submodule, and a roadside unit data uploading submodule. The roadside unit data acquisition submodule is used to collect basic safety information from the vehicle-to-everything (V2X) network in real time through the vehicle-to-infrastructure (V2X) communication module. The roadside unit data preprocessing submodule is used to preprocess the collected raw data by deduplication, noise filtering, and format standardization. The roadside unit data uploading submodule is used to upload the preprocessed basic safety information to the cloud server in real time.

[0010] The cloud-based attack detection module is used to receive, preprocess, and detect attacks on data uploaded by roadside units. It includes a data receiving submodule, a high-precision map loading and matching submodule, a multi-source data fusion submodule, and a cloud-based attack detection submodule. The data receiving submodule simultaneously receives data uploaded by multiple roadside units to obtain raw basic security information and vehicle dynamic data. The high-precision map loading and matching submodule loads the latest high-precision map data in real time and establishes a mapping relationship between map coordinates and vehicle location coordinates. The multi-source data fusion submodule cross-validates data received from different roadside units using a multi-source data fusion algorithm, integrating vehicle information from multiple roadside units. The cloud-based attack detection submodule loads a pre-trained network attack detection model to identify basic security messages containing vehicle location information under network attack in real time and to identify the type of attack.

[0011] The detection result display module is used to display the attacked vehicle ID, attack type, and attack time.

[0012] A data-knowledge fusion-based method for detecting network attacks on intelligent connected vehicles, based on the aforementioned detection system, comprises two main steps: online real-time detection by the network attack detection system and offline training of the network attack detection model.

[0013] (a) Online real-time detection by the network attack detection system:

[0014] Step 1: The online real-time detection process of the cloud-based network attack detection system consists of four parts: vehicle-side data generation, roadside unit data collection, cloud-based attack detection, and detection result display. The implementation steps are as follows:

[0015] Step 1.1: The vehicle-side data generation module actively generates and transmits its own basic safety information, providing data support for roadside unit collection and cloud detection.

[0016] Step 1.2.1: Vehicle sensor data acquisition submodule: The vehicle collects its own dynamic data in real time through the onboard sensors.

[0017] Step 1.2.2: Basic safety message generation submodule: The vehicle's onboard unit generates basic safety messages based on the collected dynamic data and in accordance with the Internet of Vehicles industry standards.

[0018] Step 1.2.3: Basic Safety Message Broadcast Submodule: The vehicle broadcasts basic safety messages to surrounding roadside units and vehicles at a preset frequency through the communication module.

[0019] Step 1.2: The roadside unit data acquisition module is the core of vehicle network data acquisition, realizing the collection and preprocessing of basic safety information.

[0020] Step 1.2.1: Roadside Unit Data Acquisition Submodule: The roadside unit collects basic safety information from the Internet of Vehicles in real time through its onboard vehicle-to-infrastructure communication module.

[0021] Step 1.2.2: Roadside Unit Data Preprocessing Submodule: The roadside unit performs preliminary preprocessing on the collected raw data, including data deduplication, noise filtering, and format unification, to reduce the pressure of invalid data on subsequent transmission and processing.

[0022] Step 1.2.3: Roadside Unit Data Upload Submodule: The roadside unit uploads the pre-processed basic safety information to the cloud server in real time.

[0023] Step 1.3: The cloud-based attack detection module completes the reception, preprocessing, and attack detection of data uploaded by the roadside units.

[0024] Step 1.3.1: The cloud server simultaneously receives encrypted data uploaded by multiple roadside units to obtain the original basic safety information and vehicle dynamic data.

[0025] Step 1.3.2: The cloud server loads the latest high-precision map data in real time and establishes a mapping relationship between map coordinates and vehicle position coordinates.

[0026] Step 1.3.3: The cloud server cross-validates the data received from different roadside units using a multi-source data fusion algorithm, and integrates the vehicle information from multiple roadside units.

[0027] Step 1.3.4: Cloud Attack Detection Submodule: The cloud server loads a pre-trained network attack detection model to identify BSM information containing vehicle location information under network attack in real time, and identifies the type of attack.

[0028] Step 1.4: The detection result display module displays the detection results, including the attacked vehicle ID, attack type, and attack time.

[0029] (II) Offline training of the network attack detection model:

[0030] Step 2: The offline pre-training process of the network attack detection model consists of three parts: building a training database, a data-driven model for network attack detection, and a network attack detection method that combines data-driven and knowledge-guided approaches. The implementation steps are as follows:

[0031] Step 2.1: The construction of the training database in this invention is accomplished by injecting network attacks into publicly available real-world driving scenario datasets and labeling the data.

[0032] Step 2.2.1: Inject network attacks into the vehicle trajectories in the dataset.

[0033] Step 2.2.2.1 Denial-of-Service Injection Attack: Vehicles subjected to a denial-of-service attack are unable to update their location due to network congestion, and their location will remain at the position of the frame before the attack.

[0034] Step 2.2.2.2 Injection Replay Attack: During a replay attack, the attacker will record the vehicle's historical location information and broadcast it repeatedly.

[0035] Step 2.2.2.3 Step Signal Injection Attack: During a step signal injection attack, vehicle location information is injected with a step attack signal.

[0036] Step 2.2.2.4 Injection of ramp signal false message injection attack: When subjected to ramp signal false message injection attack, the vehicle position information is injected with ramp attack signal.

[0037] Step 2.2.2.5 Injection of False Sine Wave Signals: When subjected to a false sine wave signal injection attack, the vehicle's position information is injected with a ramp attack signal.

[0038] Step 2.2.2.6 Injecting Covert False Messages Attack: The model-based method utilizes a vehicle model to detect attacks based on the deviation between the state estimate and the sensor measurement. By designing an attack signal that ensures the detection index does not exceed a threshold, a covert false message injection attack can be achieved.

[0039] Step 2.2.2.7 Injecting a constant-position Sybil attack: In a constant-position Sybil attack, a malicious vehicle creates a Sybil node with a fixed position.

[0040] Step 2.2.2.8 Injecting a constant offset Sybil attack: In a constant offset Sybil attack, the Sybil node position created by the malicious vehicle has a fixed offset from the malicious vehicle, so that the cloud server receives two parallel trajectory information.

[0041] Step 2.2.2.9 Injecting a random location Sybil attack: During a random location Sybil attack, the malicious vehicle creates Sybil nodes at random locations within the communication range that change over time.

[0042] Step 2.2.2.10 Injecting a random offset Sybil attack: During a random offset Sybil attack, the malicious vehicle creates Sybil nodes at random locations within a certain range of the malicious vehicle that change over time.

[0043] Step 2.2.2.11 Injecting the final stop Sybil attack: When the final stop Sybil attack occurs, the location of the malicious vehicle is the Sybil node of the location of the malicious vehicle in the frame before the attack.

[0044] Step 2.2.2: Add attack status and attack ID labels to the vehicle trajectory information in the dataset. When Sybil attack occurs, mark the Sybil node as the attacked vehicle and mark the trajectory of the malicious vehicle as a normal vehicle.

[0045] Step 2.2: The steps for constructing the network attack detection data-driven model are as follows:

[0046] Step 2.2.1: Scene Vectorization: In order to represent scene information in a structured way, vehicle trajectories and lane information of high-precision maps are represented by vectors.

[0047] Step 2.2.2: Vehicle-to-vehicle encoder module: The vehicle-to-vehicle encoder is used to extract the spatial interaction features between the central vehicle and adjacent vehicles in a local area at a time step.

[0048] Step 2.2.2.1: Rotate the local scene representation vector by taking the direction of the latest trajectory segment of the central vehicle as the reference vector of the local region.

[0049] Step 2.2.2.2: Use a multilayer perceptron to obtain the embedding of the central vehicle and the embedding of the surrounding vehicles at each time step.

[0050] Step 2.2.2.3: Introduce cross attention blocks to learn spatial interaction feature information. In the attention block, the query vector input is the embedding of the central vehicle, and the key vector and value vector input are the embeddings of the surrounding vehicles. The obtained query vector, key vector and value vector are input into the dot product attention block.

[0051] Step 2.2.2.4: Fuse the features of the central vehicle and the environmental features using a gating function.

[0052] Step 2.2.2.5: The attention block is a multi-head attention block. The output of the attention block is encoded as the spatial embedding of the vehicle in the time step using a multilayer perceptron.

[0053] Step 2.2.2.6: Layer normalization and residual connections were used before and after the multilayer perceptron.

[0054] Step 2.2.3: Time Encoder Module: Use the time encoder module to capture the temporal interaction features of the vehicle trajectory.

[0055] Step 2.2.3.1: Add a learnable lexical to the end of the vehicle embedding at different time steps and stack them into a matrix as input to the time encoder module.

[0056] Step 2.2.3.2: The temporal encoder module consists of alternating multi-head attention blocks and a multilayer perceptron. The updated lexical units contain spatiotemporal feature information of the local region and serve as input to subsequent modules.

[0057] Step 2.2.4: Vehicle Map Encoder Module: Use the vehicle map encoder module to aggregate high-precision map information into the embedding.

[0058] Step 2.2.4.1: Rotate the map lane segments and the vehicle-to-lane relative position vectors, and then encode them using a multilayer perceptron.

[0059] Step 2.2.4.2: Using the spatiotemporal features of the central vehicle as the query vector and the lane segment features as the key and value vector inputs, output the vehicle map interaction feature information using the attention block with the same structure as in the vehicle encoder module.

[0060] Step 2.2.5: Global Interaction Module: Use the global interaction module to aggregate global feature information of the scene.

[0061] Step 2.2.5.1: In order to align the reference coordinate vectors of local regions, the relative positions and relative angles of the reference vectors of different local regions are used for encoding.

[0062] Step 2.2.5.2: Use a multilayer perceptron to obtain pairwise embeddings and incorporate the pairwise embeddings into the transformation of the input vector.

[0063] Step 2.2.5.3: The global interaction module uses the same attention block and multilayer perceptron block as the vehicle encoder to output a global scene feature representation.

[0064] Step 2.2.6: Attack discrimination decoder module: The local and global scene feature representations are used as inputs to the attack discrimination decoder module, and the output is the probability value of each vehicle being subjected to different network attack types at each time step.

[0065] Step 2.3: Considering constraints within the vehicle, between vehicles, and between the vehicle and the lane, a data-driven and knowledge-guided network attack detection method for intelligent connected vehicles is proposed. Constraints are further categorized into weak, medium, and strong constraints, optimizing model input, training process, and model output. The specific steps are as follows:

[0066] Step 2.3.1: Vehicle Internal Physical Constraints: Due to vehicle performance and traffic regulations, a series of characteristic values ​​inside the vehicle typically do not exceed a certain threshold. When a characteristic value is detected to exceed the threshold, it means that the probability of a network attack has greatly increased. Specific vehicle internal physical constraint characteristics are as follows:

[0067] Step 2.3.2.1: Vehicle speed: The vehicle speed is constrained by the road speed limit. The speed constraint tensor is calculated based on the relationship between the vehicle speed and the threshold.

[0068] Step 2.3.2.2: Vehicle acceleration: Vehicle acceleration is limited by vehicle acceleration and braking performance. The acceleration constraint tensor is calculated based on the relationship between acceleration and threshold.

[0069] Step 2.3.2.3: Vehicle acceleration change rate: The vehicle acceleration change rate is also limited by the vehicle's acceleration and braking performance. The acceleration change rate constraint tensor is calculated based on the relationship between the vehicle acceleration change rate and the threshold.

[0070] Step 2.3.2.4: Vehicle heading angle change rate: The vehicle heading angle change rate is constrained by vehicle performance and vehicle driving stability. The threshold for the vehicle heading angle change rate is set according to the vehicle stability constraints.

[0071] Step 2.3.2.5: Vehicle trajectory curvature: The vehicle curvature is limited by the minimum turning radius of the vehicle, and the vehicle curvature threshold is set as the reciprocal of the minimum turning radius.

[0072] Step 2.3.2.6: Deviation between estimated and observed values ​​based on vehicle kinematics model: Vehicle kinematics is a physical constraint that must be satisfied during vehicle operation. Due to discretization and linearization approximation, state estimation methods based on vehicle kinematics inevitably lead to a deviation between the estimated state and the sensor observations. However, this deviation should be within a certain threshold. The deviation between the estimated position and the observed position is used as a physical constraint feature.

[0073] Step 2.3.2: Physical constraints between vehicles: Since different physical vehicles should appear in different physical locations at the same time, the positional overlap between vehicles is taken as a physical constraint.

[0074] Step 2.3.2.1: Use rectangles with a certain length and width to represent vehicle nodes, and transform the detection of overlapping positions between physical vehicles into a matrix intersection recognition problem.

[0075] Step 2.3.2.2: First, a pre-judgment is performed based on the position overlap judgment of the circumscribed rectangle.

[0076] Step 2.3.2.3: Accurate judgment is made by using position overlap judgment based on the separation axis theorem.

[0077] Step 2.3.3: Constraints between vehicles and lanes: The vehicle's position and direction are guided by the lane lines. By integrating vehicle position information with high-precision map information, physical constraints between vehicles and lanes are proposed.

[0078] Step 2.3.3.1: Vehicle position and drivable area constraints: The vehicle should drive in the drivable area, and whether the vehicle is in the lane is used as a constraint between the vehicle and the lane.

[0079] Step 2.3.3.2: Constraints on vehicle heading and lane direction: When a vehicle is traveling in a lane, the angle between the vehicle heading and the lane direction should be kept within a certain range.

[0080] Step 2.3.4: Constraint and Data-Driven Model Integration: The above constraints are divided into weak constraints, medium constraints and strong constraints according to their correlation with attacks, and differentiated integration schemes are designed according to the characteristics of different constraints.

[0081] Step 2.3.4.1: Weak constraints: Concatenate the velocity constraint tensor, acceleration constraint tensor, and acceleration rate of change constraint tensor into a weak constraint tensor. Map the obtained constraint tensor to the model feature dimension through a linear transformation, and concatenate it with the local scene features and global scene features as input to the attack discrimination decoder.

[0082] Step 2.3.4.2: Medium Constraints: Vehicle position overlap, vehicle position and drivable area constraints, and vehicle heading and road direction deviation constraints are categorized as medium constraints. The vehicle position overlap detection results are encoded into an interaction matrix and input into the attention mechanism of the vehicle-to-vehicle encoder. The overlap constraint is used as a gating signal to adjust the attention mechanism, guiding the model to focus on the feature interactions of overlapping vehicle pairs. The vehicle position and drivable area constraint tensors and the vehicle heading and road direction constraint tensors are fused, and the fused tensor is also encoded into an interaction matrix and input into the vehicle map encoder.

[0083] Step 2.3.4.3: Strong Constraints: Strong constraints include constraints on the rate of change of vehicle heading angle, vehicle curvature constraints, and errors in the estimated and observed values ​​based on the vehicle kinematics model. When the strong constraint eigenvalue exceeds the threshold, the data-driven model output will be corrected through constraint masking, and the probability of being classified as normal will be forcibly set to zero.

[0084] Compared with the prior art, the advantages of the present invention are as follows:

[0085] This invention proposes a network attack detection system and method for intelligent connected vehicles based on the fusion of data-driven and knowledge-guided approaches. The method extracts spatial and temporal features of vehicle positions hierarchically from the network model and integrates high-precision map information to output the attack type of each frame's vehicle position. Considering different constraint characteristics, the constraints within the vehicle, between vehicles, and between the vehicle and lanes are subdivided into weak, medium, and strong constraints. A multi-dimensional heterogeneous rule-guided fusion scheme is designed to achieve the integration of data-driven and knowledge-guided approaches, effectively realizing network attack detection for intelligent connected vehicles. This invention constructs a collaborative "vehicle-road-cloud" data-knowledge fusion attack detection system, combining data-driven approaches (hierarchical vector Transformer model) and knowledge-guided approaches (physical constraint fusion) to solve technical problems in existing technologies such as model vulnerability to targeted attacks, limited attack type coverage, and insufficient extraction of spatiotemporal features. Attached Figure Description

[0086] Figure 1 This is a diagram illustrating the architecture of the data-knowledge fusion network attack detection system of the present invention.

[0087] Figure 2 This is a diagram of the offline pre-training framework of the data-knowledge fusion network attack detection model of the present invention;

[0088] Figure 3 This is a framework diagram of the network attack data-driven detection model of the present invention;

[0089] Figure 4 This is a structural diagram of the vehicle encoder of the present invention;

[0090] Figure 5 This is a schematic diagram of the vehicle kinematics model of the present invention;

[0091] Figure 6 This is a schematic diagram of the rectangular vehicle model of the present invention;

[0092] Figure 7 This is a schematic diagram of the circumscribed rectangle of the vehicle model of the present invention;

[0093] Figure 8 This is a schematic diagram of the overlapping outer rectangles of the present invention;

[0094] Figure 9 This is a schematic diagram of a possible separation shaft for the present invention;

[0095] Figure 10 This is a schematic diagram illustrating the separation axis overlap determination method of the present invention. Detailed Implementation

[0096] The following embodiments are in conjunction with the appendix. Figure 1-10 The method of the present invention will be described in further detail below.

[0097] like Figure 1 The diagram shown illustrates the architecture of the data fusion network attack detection system of this invention. The system comprises a vehicle-side data generation module, a roadside unit data acquisition module, a cloud-based attack detection module, and a detection result display module. It includes two main steps: online real-time network attack detection and offline training of the network attack detection model.

[0098] Step 1: The online real-time detection process of the cloud-based network attack detection system consists of four parts: vehicle-side data generation, roadside unit data collection, cloud-based attack detection, and detection result display. The implementation steps are as follows:

[0099] Step 1.1: The vehicle-side data generation module actively generates and transmits its own basic safety information, providing data support for roadside unit collection and cloud detection.

[0100] Step 1.2.1: Vehicle sensor data acquisition submodule: The vehicle collects its own dynamic data in real time through the onboard sensors.

[0101] Step 1.2.2: Basic safety message generation submodule: The vehicle's onboard unit generates basic safety messages based on the collected dynamic data and in accordance with the Internet of Vehicles industry standards.

[0102] Step 1.2.3: Basic Safety Message Broadcast Submodule: The vehicle broadcasts the generated basic safety message to surrounding roadside units and vehicles at a preset frequency through the communication module.

[0103] Step 1.2: The roadside unit data acquisition module is the core of vehicle network data acquisition, realizing the collection and preprocessing of basic safety information.

[0104] Step 1.2.1: Roadside Unit Data Acquisition Submodule: The roadside unit collects basic safety information from the Internet of Vehicles in real time through its onboard vehicle-to-infrastructure communication module.

[0105] Step 1.2.2: Roadside Unit Data Preprocessing Submodule: The roadside unit performs preliminary preprocessing on the collected raw data, including data deduplication, noise filtering, and format unification, to reduce the pressure of invalid data on subsequent transmission and processing.

[0106] Step 1.2.3: Roadside Unit Data Upload Submodule: The roadside unit uploads the pre-processed basic safety information to the cloud server in real time.

[0107] Step 1.3: The cloud-based attack detection module completes the reception, preprocessing, and attack detection of data uploaded by the roadside units.

[0108] Step 1.3.1: The cloud server simultaneously receives encrypted data uploaded by multiple roadside units to obtain the original basic safety information and vehicle dynamic data.

[0109] Step 1.3.2: The cloud server loads the latest high-precision map data in real time and uses a geographic information matching algorithm to spatially align the vehicle trajectory information uploaded by the roadside units with the high-precision map.

[0110] Step 1.3.3: The cloud server cross-validates the data received from different roadside units using a multi-source data fusion algorithm, and integrates the vehicle information from multiple roadside units.

[0111] Step 1.3.4: Cloud Attack Detection Submodule: The cloud server loads a pre-trained network attack detection model to identify BSM information containing vehicle location information under network attack in real time, and identifies the type of attack.

[0112] Step 1.4: The detection result display module displays the detection results, including the attacked vehicle ID, attack type, and attack time.

[0113] Step 2: As Figure 2 The diagram illustrates the framework for offline pre-training of a network attack detection model. The offline training process for the network attack detection model consists of three parts: constructing a training database, developing a data-driven model for network attack detection, and implementing a network attack detection method that integrates data-driven and knowledge-guided approaches. The implementation steps are as follows:

[0114] Step 2.1: The construction of the training database in this invention is accomplished by injecting network attacks into publicly available real-world driving scenario datasets and labeling the data.

[0115] Step 2.2.1: Inject network attacks into the vehicle trajectories in the dataset.

[0116] Step 2.2.2.1 Denial-of-Service Injection Attack: Vehicles subjected to a denial-of-service attack are unable to update their location due to network congestion, and their location will remain at the position of the frame preceding the attack. The formula is as follows:

[0117]

[0118] In the formula, I represents the location information sent by vehicle n to the cloud at time t. n (t) represents the true location information of vehicle n at time t, where t0 represents the start time of the attack, and t a Indicates the period during which the attack occurred.

[0119] Step 2.2.2.2 Injection Replay Attack: During a replay attack, the attacker records the vehicle's historical location information and repeatedly broadcasts it. The formula is as follows:

[0120]

[0121] In the formula, t1 represents the signal recording duration, t s Indicates the start time of recording, and mod is the remainder.

[0122] Step 2.2.2.3 Step Signal Injection Attack: In a step signal injection attack, vehicle location information is injected with a step attack signal. The formula is as follows:

[0123]

[0124] In the formula, w step (t) represents the step attack signal.

[0125] Step 2.2.2.4 Slope Signal False Message Injection Attack: When subjected to a slope signal false message injection attack, the vehicle's location information is injected with a slope attack signal. The formula is as follows:

[0126]

[0127] In the formula, w ramp (t) represents the ramp attack signal.

[0128] Step 2.2.2.5 Injection of False Sine Wave Signals: When subjected to a false sine wave signal injection attack, the vehicle's position information is injected with a ramp attack signal.

[0129]

[0130] In the formula, w sine (t) represents a sinusoidal attack signal.

[0131] Step 2.2.2.6 Injecting Covert False Information: A model-based approach utilizes a vehicle model to detect attacks based on the deviation between state estimates and sensor measurements. By designing an attack signal that prevents the detection index from exceeding a threshold, a covert false information injection attack can be achieved. The formula is as follows:

[0132]

[0133]

[0134]

[0135] In the formula, x gps,k y gps,k θ gps,k These are GPS sensor measurements of the vehicle's X-coordinate, Y-coordinate, and direction of travel. , , To generate the expected output based on the vehicle's X-coordinate, Y-coordinate, and direction of travel obtained from the vehicle's mathematical model, g k Let Cov(r) be the square norm of the residual. k ) is r k The covariance matrix, s k Here, b is the CUSUM value, and g is a tuning parameter. When an injection attack is performed on the GPS measurement signal, g... k When ≤b, s can be made k The value is always 0. At this time, the detector does not alarm, but the vehicle location information uploaded to the cloud gradually moves away from the real location. Two covert false message injection attack methods are designed: (1) Attacking the X coordinate value. Let , , for x gps,kInjection attack, making g k =b. (2) Attack the Y coordinate value. Let , , for y gps,k Injection attack, making g k =b.

[0136] Step 2.2.2.7 Injecting a Constant-Position Sybil Attack: In a constant-position Sybil attack, the malicious vehicle creates Sybil nodes with fixed positions. The formula is as follows:

[0137]

[0138] In the formula, S represents the location information of the Sybil node created by the nth vehicle at time t. n,cp =[x n ,y n ] is a constant vector.

[0139] Step 2.2.2.8 Injecting a Constant Offset Sybil Attack: In a constant offset Sybil attack, the Sybil node position created by the malicious vehicle has a fixed offset from the malicious vehicle, causing the cloud server to receive two parallel trajectory information. The formula is as follows:

[0140]

[0141] In the formula, S n,co A constant vector for offset.

[0142] Step 2.2.2.9 Injecting a random location Sybil attack: During a random location Sybil attack, the malicious vehicle creates Sybil nodes at random locations within the communication range that change over time.

[0143]

[0144] In the formula, S n,rp This is a position vector that changes over time.

[0145] Step 2.2.2.10 Injecting a random offset Sybil attack: During a random offset Sybil attack, the malicious vehicle creates Sybil nodes at random locations within a certain range of the malicious vehicle that change over time.

[0146]

[0147] Step 2.2.2.11 Injecting the final stop Sybil attack: When the final stop Sybil attack occurs, the location of the malicious vehicle is the Sybil node of the location of the malicious vehicle in the frame before the attack.

[0148]

[0149] Step 2.2.2: Add attack status and attack ID labels to the vehicle trajectory information in the dataset. During a Sybil attack, the Sybil node is marked as the attacked vehicle, and the trajectory of a malicious vehicle is marked as a normal vehicle. When step signal spoofing injection attacks, ramp signal spoofing injection attacks, and sine wave signal spoofing injection attacks occur, the X-coordinate value, or Y-coordinate value, or both X and Y coordinate values ​​of the attacked vehicle are simultaneously injected with the attack signal.

[0150] Step 2.2: As Figure 3 The diagram shows the framework of a network attack data-driven detection model. This model consists of a vehicle-to-vehicle encoder module, a time encoder module, a vehicle map encoder module, a global interaction module, and an attack discrimination decoder module. The construction steps are as follows:

[0151] Step 2.2.1: Scene Vectorization: To represent scene information in a structured way, we use vectors to represent vehicle trajectories and high-precision map lane information. The formulas are as follows:

[0152]

[0153]

[0154] In the formula, T is the time step of the attack detection window. ξ (0) and I ξ (1) These are the starting and ending coordinates of lane segment ξ, respectively. We use relative position vectors to represent the spatial relationships between vehicles and between vehicles and lanes, such as: This indicates the relative positional relationship between vehicles.

[0155] Step 2.2.2: Vehicle-to-vehicle encoder module: Figure 4 The diagram shows the structure of a vehicle-to-vehicle encoder. The vehicle-to-vehicle encoder is designed to extract spatial interaction features between the central vehicle and adjacent vehicles in a local area over a given time step.

[0156] Step 2.2.2.1: Calculate the latest trajectory segment of the central vehicle n. The direction θ is used as the reference vector for the local region. n Rotate the local scene representation vector.

[0157] Step 2.2.2.2: Obtain the embedding of the central vehicle at each time step using a multilayer perceptron. and embedding with adjacent vehicles The formula is as follows:

[0158]

[0159]

[0160] In the formula, and For different MLP blocks, It is a local region rotation matrix, a n and a m These are semantic attributes of different vehicles. It includes the relative position vectors of neighboring vehicles to the central vehicle, so that the embedding of neighboring vehicles has spatial interaction feature information.

[0161] Step 2.2.2.3: Introduce cross-attention blocks to learn spatial interaction feature information. In the attention block, the query vector input is the embedding of the center vehicle, and the key vector and value vector input are the embeddings of the surrounding vehicles. The obtained query vector, key vector, and value vector are then input into the dot product attention block, as shown in the following formula:

[0162]

[0163]

[0164]

[0165]

[0166]

[0167] In the formula, It is a learnable matrix, d k It is the dimension of the transformation vector. It is the set of neighboring vehicles of vehicle n. Represents element-wise product. and It is a learnable matrix.

[0168] Step 2.2.2.4: Determine the features of the central vehicle. and environmental characteristics Use gating functions for fusion.

[0169] Step 2.2.2.5: The attention block is a multi-head attention block. A multilayer perceptron is used to encode the output of the attention block as the spatial embedding of vehicle n at time step t. .

[0170] Step 2.2.2.6: Layer normalization and residual connections were used before and after the multilayer perceptron.

[0171] Step 2.2.3: Time Encoder Module: Use the time encoder module to capture the temporal interaction features of the vehicle trajectory.

[0172] Step 2.2.3.1: Embed the vehicle at different time steps Add a learnable lexicon at the end And stacked into a matrix The formula used as input to the time encoder module is as follows:

[0173]

[0174]

[0175]

[0176] In the formula, It is a learnable matrix. It is a time mask.

[0177] Step 2.2.3.2: The temporal encoder module consists of alternating multi-head attention blocks and MLP blocks. The updated token contains spatiotemporal feature information of the local region and serves as input to subsequent modules.

[0178] Step 2.2.4: Vehicle Map Encoder Module: Use the vehicle map encoder module to aggregate high-precision map information into the embedding.

[0179] Step 2.2.4.1: Rotate the map lane segments and the vehicle-to-lane relative position vectors, and then encode them using a multilayer perceptron, as shown in the following formula:

[0180]

[0181] In the formula, ϕ lane It is an MLP block, a ξ It is a semantic attribute of the lane segment.

[0182] Step 2.2.4.2: Using the spatiotemporal features of the central vehicle as the query vector, and the lane segment features... As inputs to the key and value vectors, attention blocks with the same structure as those in the vehicle encoder module are used to output vehicle map interaction feature information. .

[0183] Step 2.2.5: Global Interaction Module: Use the global interaction module to aggregate global feature information of the scene.

[0184] Step 2.2.5.1: To align the reference coordinate vectors of local regions, use the relative positions of the reference vectors from different local regions. and relative angle ∆θ nm =θ m -θ n Encode it.

[0185] Step 2.2.5.2: Obtain pairwise embeddings using a multilayer perceptron and incorporate them into the transformation of the input vector, as shown in the following formula:

[0186]

[0187]

[0188]

[0189]

[0190] In the formula , , It is a learnable matrix.

[0191] Step 2.2.5.3: The global interaction module uses the same attention block and multilayer perceptron block as the vehicle-to-vehicle encoder to output a global scene feature representation. .

[0192] Step 2.2.6: Attack Determination Decoder Module: This module takes local and global scene feature representations as input and outputs the probability value of each vehicle being subjected to different network attack types at each time step. The attack detection decoder is an MLP block.

[0193] Step 2.3: Considering three aspects—internal vehicle physical constraints, inter-vehicle physical constraints, and traffic rule constraints between vehicles and lanes—a data-driven and knowledge-guided network attack detection method for intelligent connected vehicles is proposed. Constraints are further divided into weak, medium, and strong constraints, optimizing model input, training process, and model output to improve network model performance and enhance interpretability. The specific steps are as follows:

[0194] Step 2.3.1: Vehicle Internal Physical Constraints: Due to vehicle performance and traffic regulations, a series of characteristic values ​​inside the vehicle typically do not exceed a certain threshold. When a characteristic value is detected to exceed the threshold, it means that the probability of a network attack has greatly increased. Specific vehicle internal physical constraint characteristics are as follows:

[0195] Step 2.3.2.1: Vehicle Speed: When a vehicle is traveling in a lane, its speed is subject to road speed limits. The formula is as follows:

[0196]

[0197] In the formula This represents the sampling time interval. Considering the maximum speed limit, the threshold is set to... The velocity constraint tensor is .

[0198] Step 2.3.2.2: Vehicle Acceleration: Due to limitations in vehicle acceleration and braking performance, vehicle acceleration should be within a certain threshold. The formula is as follows:

[0199]

[0200] Considering vehicle acceleration performance, the acceleration threshold is set to... The acceleration constraint tensor is .

[0201] Step 2.3.2.3: Vehicle Acceleration Change Rate: The vehicle acceleration change rate is also limited by the vehicle's acceleration and braking performance. The formula is as follows:

[0202]

[0203] Considering the daily driving comfort requirements of passenger vehicles, the vehicle acceleration change rate threshold is set to... The acceleration rate of change constraint tensor is... .

[0204] Step 2.3.2.4: Vehicle heading angle change rate: The vehicle heading angle change rate is constrained by vehicle performance and vehicle driving stability. A threshold for the vehicle heading angle change rate is set based on the vehicle stability constraints, using the following formula:

[0205]

[0206]

[0207]

[0208] In the formula For the vehicle's heading angle, The threshold for the rate of change of the vehicle's heading angle. To avoid false positives caused by data noise, the margin coefficient, The road adhesion coefficient, This is the acceleration due to gravity.

[0209] Step 2.3.2.5: Vehicle Trajectory Curvature: The vehicle curvature is limited by the vehicle's minimum turning radius. The vehicle curvature threshold is set as the reciprocal of the minimum turning radius. The formula is as follows:

[0210]

[0211] Step 2.3.2.6: Based on the deviation between the estimated and observed values ​​of the vehicle kinematic model: such as Figure 5 The image shows a vehicle kinematics model. Vehicle kinematics represents the physical constraints that a vehicle must satisfy during its movement. Due to discretization and linearization approximations, state estimation methods based on vehicle kinematics inevitably lead to a deviation between the estimated state and the sensor observations. However, this deviation should be within a certain threshold. Can the deviation between the estimated position and the observed position be considered as a physical constraint feature? The formula is as follows:

[0212]

[0213]

[0214]

[0215]

[0216]

[0217] In the formula , and These are estimates of the vehicle's position and heading angle. This refers to the vehicle's wheelbase. For the steering angle of the vehicle's front wheels, It is a physical constraint feature.

[0218] Step 2.3.2: Physical constraints between vehicles: Since different physical vehicles should appear in different physical locations at the same time, the positional overlap between vehicles is taken as a physical constraint.

[0219] Step 2.3.2.1: Represent vehicle nodes with rectangles of a certain length and width, transforming the detection of overlapping positions between physical vehicles into a matrix intersection recognition problem. For example... Figure 6 As shown, this is a rectangular vehicle model, based on the vehicle's position coordinates, heading angle, and length. Hekuan The coordinates of the four vertices of the rectangle can be calculated. Taking the left front vertex as an example, the formula for calculating the coordinates is as follows:

[0220]

[0221]

[0222] Step 2.3.2.2: First, perform a pre-judgment based on the positional overlap judgment of the circumscribed rectangle: such as Figure 7 As shown, find the minimum x-coordinate of each of the four vertices of the matrix representing vehicle n. and maximum value and the minimum value of the ordinate. and maximum value The vertex coordinates of the circumscribed matrix of matrix n can be obtained. , , , When the outer bound matrices of two vehicle matrices do not intersect, the vehicle positions must not overlap. The criteria for determining whether two outer bound matrices intersect are as follows:

[0223]

[0224] In the formula , , , Let represent the minimum and maximum vertex coordinates of the matrix representing vehicle m. When the judgment condition is not met, it cannot be directly determined that the two vehicles overlap, such as... Figure 8 As shown, when the outer rectangles of the vehicle matrix overlap, the vehicles may not overlap.

[0225] Step 2.3.2.3: Accurately determine the positional overlap based on the separation axis theorem: such as... Figure 9 For two vehicle rectangles n and m, the possible separation axes are the edge normals along the heading angle and the edge normals perpendicular to the heading angle for each vehicle. Calculate the projections of all vertices of matrices n and m onto the possible separation axes and find their respective minimum values. , and maximum value , The projections of rectangles onto this axis do not intersect when the following conditions are met: Figure 10 As shown, it can be directly determined that the positions of the two vehicles do not overlap:

[0226]

[0227] If the decision condition is not met on all possible separation axes, then the two rectangles intersect (i.e., the vehicle positions overlap). The final result is the vehicle overlap constraint tensor. ,in This indicates that vehicle n overlaps in position at time t.

[0228] Step 2.3.3: Constraints between vehicles and lanes: The vehicle's position and direction are guided by the lane lines. By integrating vehicle position information with high-precision map information, constraints between vehicles and lanes are proposed.

[0229] Step 2.3.3.1: Vehicle Position and Driving Area Constraints: Vehicles should travel within the driving area; therefore, whether the vehicle is on the lane is used as a constraint between the vehicle and the lane. First, retrieve the lane IDs near the vehicle. Then, calculate the lane polygon based on the lane centerline corresponding to the lane ID. Determine whether the vehicle is within the lane polygon to obtain the tensor of whether each vehicle is traveling on the lane at each time step. .

[0230] Step 2.3.3.2: Constraints on Vehicle Heading and Lane Direction: When a vehicle is traveling in a lane, the angle between the vehicle's heading and the lane direction should be maintained within a certain range. Based on the lane ID of the lane the vehicle is in, obtain the nearest lane centerline point and calculate the lane direction. When the angle between the lane direction and the vehicle's heading exceeds a threshold, it is considered that the vehicle may be deviating from its heading or traveling in the wrong direction. This yields the constraint tensor between the vehicle's heading and lane direction. ,in This indicates that the heading deviation of vehicle n exceeds the threshold at time t.

[0231] Step 2.3.4: Constraint and Data-Driven Model Fusion: The constraints mentioned above are categorized into weak, medium, and strong constraints based on their relevance to attacks, and differentiated fusion schemes are designed according to the characteristics of different constraints. Weak constraints preserve the model's adaptability to the scenario through feature enhancement; medium constraints serve as weight factors for attention gating to guide the model to focus on abnormal interactions; and strong constraints ensure that the model results conform to physical laws through hard correction at the output layer. Specifically:

[0232] Step 2.3.4.1: Weak Constraints: Concatenate the velocity constraint tensor, acceleration constraint tensor, and acceleration rate of change constraint tensor into a weak constraint tensor. Map the resulting constraint tensor to the model feature dimension through a linear transformation, and concatenate it with local scene features and global scene features. This concatenation serves as the input to the attack discrimination decoder, as shown in the following formula:

[0233]

[0234] In the formula The characteristics after fusion To share MLP blocks.

[0235] Step 2.3.4.2: Medium Constraints: Vehicle position overlap, vehicle position and drivable area constraints, and vehicle heading and road direction deviation constraints are categorized as medium constraints. The vehicle position overlap detection results are encoded into an interaction matrix and input into the attention mechanism of the vehicle-to-vehicle encoder as a gating signal to adjust the attention mechanism and guide the model to focus on the feature interactions of overlapping vehicle pairs. The vehicle position and drivable area constraint tensor and the vehicle heading and road direction constraint tensor are fused, and the fused tensor is also encoded into an interaction matrix and input into the vehicle map encoder. The formula is as follows:

[0236]

[0237]

[0238] In the formula Here, M represents the learnable parameters, and M is the fused lane constraint tensor.

[0239] Step 2.3.4.3: Strong Constraints: Strong constraints include constraints on the vehicle's heading angle change rate, vehicle curvature constraints, and errors in the estimated and observed values ​​based on the vehicle's kinematics model. When a strong constraint eigenvalue exceeds a threshold, the data-driven model output will be corrected using a constraint mask, forcibly setting the probability of classification as normal to zero, as shown in the following formula:

[0240]

[0241]

[0242] In the formula, For strong constraint mask, This represents the probability of the normal category.

[0243] The above description, in conjunction with preferred technical solutions, provides a further detailed explanation of the present invention and should not be construed as limiting the specific implementation of the invention to these descriptions. For those skilled in the art, simple deductions and substitutions can be made without departing from the concept of the present invention, and all such deductions and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A data-knowledge fusion intelligent connected vehicle network attack detection system, characterized in that... It includes a vehicle-side data generation module, a roadside unit data acquisition module, a cloud-based attack detection module, and a detection result display module; The vehicle-side data generation module is used to actively generate and transmit its own basic safety information, including an on-board sensor data acquisition submodule, a basic safety message generation submodule, and a basic safety message broadcasting submodule; the on-board sensor data acquisition submodule is used to collect vehicle dynamic data in real time through the onboard sensors. The basic security message generation submodule is used to generate basic security messages according to the Internet of Vehicles industry standards based on the collected dynamic data. The basic safety message broadcasting submodule is used to broadcast basic safety messages to surrounding roadside units and vehicles at a preset frequency via the communication module. The roadside unit data acquisition module is used to collect and preprocess basic safety information, and includes a roadside unit data acquisition submodule, a roadside unit data preprocessing submodule, and a roadside unit data uploading submodule. The roadside unit data acquisition submodule is used to collect basic safety information in the vehicle network in real time through the vehicle-road communication module; The roadside unit data preprocessing submodule is used to preprocess the collected raw data by deduplication, noise filtering, and format unification. The roadside unit data upload submodule is used to upload the pre-processed basic safety information to the cloud server in real time. The cloud-based attack detection module is used to receive, preprocess, and detect attacks on data uploaded by roadside units. It includes a data receiving submodule, a high-precision map loading and matching submodule, a multi-source data fusion submodule, and a cloud-based attack detection submodule. The data receiving submodule is used to simultaneously receive data uploaded by multiple roadside units to obtain raw basic safety information and vehicle dynamic data; the high-precision map loading and matching submodule is used to load the latest high-precision map data in real time and establish a mapping relationship between map coordinates and vehicle position coordinates; the multi-source data fusion submodule is used to cross-validate the data received by different roadside units through a multi-source data fusion algorithm and integrate vehicle information from multiple roadside units; the cloud attack detection submodule is used to load a pre-trained network attack detection model to identify basic security messages containing vehicle position information under network attack in real time online and identify the type of attack. The detection result display module is used to display the attacked vehicle ID, attack type, and attack time.

2. A method for detecting network attacks on intelligent connected vehicles based on data and knowledge fusion, characterized in that... Based on the detection system as described in claim 1, the method includes two main steps: online real-time detection by the network attack detection system and offline training of the network attack detection model. S1. The online real-time detection steps of the network attack detection system include: S11. The vehicle-side data generation module generates and broadcasts basic security messages; S12. The roadside unit data acquisition module collects basic safety messages, preprocesses them, and then uploads them to the cloud server. S13. The cloud-based attack detection module receives data, loads a high-precision map and performs data fusion, and calls the trained attack detection model to realize attack detection. S14. The test result display module displays the test results; S2. The offline training steps for the network attack detection model include: S21. Construct a training database: Perform network attack injection and data annotation on publicly available real-world driving scenario datasets; S22. Construct a data-driven model for network attack detection: Based on the hierarchical vector Transformer model, the model is constructed sequentially through scene vectorization, vehicle-to-vehicle encoder module, time encoder module, vehicle map encoder module, global interaction module, and attack discrimination decoder module. S23. Data-driven and knowledge-guided fusion detection: Considering the physical constraints inside the vehicle, the physical constraints between vehicles, and the constraints between the vehicle and the lane, the constraints are divided into weak constraints, medium constraints, and strong constraints. A multi-heterogeneous rule-guided fusion scheme is designed to optimize the model input, training process, and model output.

3. The method for detecting network attacks on intelligent connected vehicles based on data and knowledge fusion according to claim 2, characterized in that, The network attack injection described in step S21 includes denial-of-service attacks, replay attacks, step signal spoofing injection attacks, ramp signal spoofing injection attacks, sine wave signal spoofing injection attacks, covert spoofing injection attacks, constant position Sybil attacks, constant offset Sybil attacks, random position Sybil attacks, random offset Sybil attacks, and final stop Sybil attacks. The data annotation involves adding attack status and attack ID labels to the vehicle trajectory information in the dataset. During a Sybil attack, Sybil nodes are marked as attacked vehicles, and malicious vehicle trajectories are marked as normal vehicles.

4. The method according to claim 2, characterized in that, The construction of the vehicle encoder module in step S22 includes: Step 2.2.2.1: Use the direction of the latest trajectory segment of the central vehicle as the reference vector direction of the local region, and rotate the local scene representation vector; Step 2.2.2.2: Use a multilayer perceptron to obtain the embedding of the central vehicle and the embedding of the surrounding vehicles at each time step; Step 2.2.2.3: Introduce cross-attention blocks to learn spatial interaction feature information. In the attention block, the query vector input is the embedding of the central vehicle, and the key vector and value vector input are the embeddings of the surrounding vehicles. The obtained query vector, key vector and value vector are input into the dot product attention block. Step 2.2.2.4: Fuse the features of the central vehicle and the environmental features using a gating function; Step 2.2.2.5: The attention block is a multi-head attention block. The output of the attention block is encoded as the spatial embedding of the vehicle in the time step using a multilayer perceptron. Step 2.2.2.6: Layer normalization and residual connections were used before and after the multilayer perceptron.

5. The method according to claim 2, characterized in that, The construction of the time encoder module in step S22 includes: Step 2.2.3.1: Add a learnable lexical to the end of the vehicle embedding at different time steps and stack them into a matrix as input to the time encoder module; Step 2.2.3.2: The time encoder module consists of alternating multi-head attention blocks and multilayer perceptrons; the updated lexical units contain spatiotemporal feature information of the local region and serve as input for subsequent modules.

6. The method according to claim 2, characterized in that, The construction of the vehicle map encoder module in step S22 includes: Step 2.2.4.1: Rotate the map lane segments and the vehicle-to-lane relative position vectors, and encode them using a multilayer perceptron; Step 2.2.4.2: Using the spatiotemporal features of the central vehicle as the query vector and the lane segment features as the key and value vector inputs, output the vehicle map interaction feature information using the attention block with the same structure as in the vehicle encoder module.

7. The method according to claim 2, characterized in that, The vehicle internal physical constraints mentioned in step S23 include vehicle speed, vehicle acceleration, vehicle acceleration rate of change, vehicle heading angle rate of change, vehicle trajectory curvature, and the deviation between the estimated and observed values ​​based on the vehicle kinematics model; the vehicle inter-vehicle physical constraints are vehicle position overlap constraints; the vehicle-lane constraints include vehicle position and drivable area constraints, and vehicle heading and lane direction constraints.

8. The method according to claim 2, characterized in that, The multi-heterogeneous rule-guided fusion scheme described in step S23 includes: Weak constraint fusion: The velocity constraint tensor, acceleration constraint tensor, and acceleration change rate constraint tensor are concatenated into a weak constraint tensor. After being linearly transformed and mapped to the model feature dimension, it is concatenated with local and global scene features as the input of the attack discrimination decoder. Medium-constraint fusion: The constraints of vehicle position overlap, vehicle position and drivable area constraint and vehicle heading deviation from road direction constraint are classified as medium constraints, encoded into interaction matrices and then input into the attention mechanisms of vehicle encoder and vehicle map encoder respectively. Strong constraint fusion: The constraints of vehicle heading angle change rate, vehicle curvature, and the error between the estimated and observed values ​​based on the vehicle kinematics model are classified as strong constraints. When the feature value exceeds the threshold, the model output is corrected through constraint masking, and the normal category probability is forcibly set to zero.

Images