Intelligent system and method for detecting and relieving Beidou signal deception for Internet of Vehicles

Abstract

The invention relates to the technical field of Internet of Vehicles information security, and discloses an Internet of Vehicles-oriented Beidou signal spoofing detection and mitigation intelligent system and method, and the system comprises a multi-dimensional data sensing and preprocessing module, a deep learning joint detection module, and a security mitigation and reputation management module. The method comprises the following steps: firstly, extracting a physical layer signal feature and a network flow stability feature and generating a multi-dimensional feature vector; secondly, performing feature compression and preliminary screening by using an auto-encoder, analyzing a time sequence evolution rule through a long-short-term memory network, and outputting a judgment probability; and finally, executing hierarchical defense according to the judgment probability, responding to local threats by dynamically adjusting a measurement noise covariance matrix or a hard isolation strategy, evaluating network node reputation based on a path damage index, and adding abnormal nodes into a dynamic blacklist. Through the multi-dimensional feature fusion and deep learning cascade architecture, the spoofing attack detection accuracy is improved, and the diffusion of false information in the Internet of Vehicles is effectively blocked.

Description

Technical Field

[0001] This invention relates to the field of vehicle network information security technology, specifically to an intelligent system and method for detecting and mitigating BeiDou signal spoofing in vehicle networks. Background Technology

[0002] With the rapid development of intelligent transportation systems and autonomous driving technologies, vehicular ad hoc networks (VANETs) play a crucial role in vehicle positioning, path planning, vehicle-to-vehicle communication, and vehicle-to-infrastructure (V2I) cooperation. The safe operation of V2I systems relies on high-precision positioning and timing information provided by satellite navigation systems. Among these, the BeiDou Navigation Satellite System (BDS) has been widely used in the field of intelligent transportation due to its autonomous controllability. However, BDS signals are open broadcast signals, objectively characterized by low signal power, public signal structure, and the lack of encryption and authentication mechanisms in civilian frequency bands, making them vulnerable to malicious attacks. In particular, navigation signal spoofing attacks can subtly induce receivers to output incorrect position and time information by injecting forged signals that closely resemble the real signals. Once such false data takes effect in V2I systems, it can easily lead to vehicle trajectory deviations, failure of traffic cooperative control, and even serious traffic accidents.

[0003] Although some research has been conducted on anti-spoofing technologies for satellite navigation systems, their application in the complex and dynamic environment of vehicle-to-everything (V2X) networks still faces many challenges. Existing technologies mainly have the following limitations: First, existing detection schemes are limited to a single-dimensional defense perspective, such as focusing only on anomalies in signal parameters (e.g., power or waveform) at the receiver's physical layer, or relying solely on encryption verification of upper-layer network communication protocols. This detection model, which separates the physical and network layers, is ill-suited to the environmental noise interference caused by the high-speed movement of nodes and frequent changes in network topology in vehicle-to-everything (V2X) networks. Especially when facing highly covert spoofing attacks such as generative or traction-based attacks, the lack of in-depth analysis of multi-dimensional feature correlations and the evolutionary patterns of data over long time sequences makes it difficult for the system to detect minute anomalies, resulting in insufficient sensitivity and accuracy in detection.

[0004] Secondly, in terms of response strategies, existing technologies often employ a relatively crude blocking mechanism, which directly discards navigation data or cuts off the receiver connection once an abnormal signal is detected. This response method, lacking flexibility and adaptive adjustment capabilities, ignores the high continuity requirements of vehicle-to-everything (V2X) services and lacks the hierarchical processing capability to dynamically adjust data confidence based on attack probability. It is prone to complete service interruption due to false alarms or minor interference. Furthermore, existing solutions neglect the collaborative characteristics of V2X and lack dynamic assessment and management of network node reputation, leading to the secondary propagation of false location information from deceived nodes as legitimate data within the network, thereby contaminating the entire cooperative positioning network.

[0005] Furthermore, many high-security anti-spoofing solutions rely on modifications to the BeiDou satellite signal system (such as adding military-grade encryption spreading codes) or require vehicles to be equipped with expensive anti-jamming antenna arrays and other specialized hardware. For civilian vehicle-to-everything (V2X) networks with an existing market, this not only results in high deployment costs but also makes large-scale deployment difficult through software upgrades, highlighting the complexity and compatibility issues in engineering implementation. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides an intelligent system and method for detecting and mitigating BeiDou signal spoofing in the context of vehicle-to-everything (V2X) networks. This solves the problems of existing technologies relying solely on single-dimensional features in the complex and dynamic environment of V2X networks, resulting in insufficient sensitivity to detect covert spoofing attacks; the lack of flexible hierarchical defense strategies leading to easy system service interruptions; and the inability to effectively suppress the spread of false navigation information in cooperative networks.

[0007] To achieve the above objectives, the present invention provides the following technical solution: The first aspect of this invention provides an intelligent system for detecting and mitigating BeiDou signal spoofing in the context of the Internet of Vehicles.

[0008] The intelligent system is deployed in vehicle terminals, roadside units, or edge computing devices in the vehicle-to-everything (V2X) environment. Its architecture includes a multi-dimensional data perception and preprocessing module, a deep learning joint detection module, and a security mitigation and reputation management module.

[0009] The multidimensional data sensing and preprocessing module is used to perform cross-domain feature fusion. This module establishes an integrity model of the BeiDou navigation signal, decomposes the received signal into deterministic and random components, and extracts a set of features reflecting physical layer characteristics from the original radio frequency signal. These features include signal-to-noise ratio, carrier-to-noise ratio density, Doppler frequency shift and rate of change, angle of arrival, signal arrival time and hopping patterns, and navigation message consistency indicators.

[0010] On the other hand, the multi-dimensional data perception and preprocessing module monitors network traffic related to navigation services in real time, counts the arrival time of data packets within a preset time window, calculates the arithmetic mean of the data packet arrival intervals and traffic stability indicators reflecting the interval variance.

[0011] The multidimensional data perception and preprocessing module further performs first-order difference processing on the traffic stability index sequence to remove the linear trend term, and calculates the autocorrelation function and partial autocorrelation function. Finally, it timestamps and concatenates the physical layer features with the processed traffic feature sequence to generate a multidimensional feature vector.

[0012] The deep learning joint detection module is used to perform anomaly recognition based on a cascaded neural network architecture. This module first utilizes an autoencoder network to construct a feature compression and initial screening mechanism. The encoder maps the joint input feature vector to a low-dimensional latent space to extract low-dimensional latent feature vectors, and the decoder inversely maps these vectors back to the original space to obtain the reconstructed feature vectors.

[0013] The deep learning joint detection module calculates the reconstruction error between the joint input feature vector and the reconstructed feature vector, and compares the reconstruction error with an initial anomaly screening threshold to determine suspected anomaly moments. Subsequently, the deep learning joint detection module constructs an input sequence matrix for the data at suspected anomaly moments, and uses a Long Short-Term Memory (LSTM) network to process the cascaded sequence composed of low-dimensional latent feature vectors and reconstruction errors. The LTM network's gating mechanism dynamically updates the cell state and hidden layer state, and through a fully connected layer, it generates the probability of a BeiDou signal spoofing attack at the current moment.

[0014] The security mitigation and reputation management module is used to implement dual defense at both the local and network levels. At the local defense level, the module executes a tiered response based on decision probabilities: it calculates the covariance inflation coefficient using a nonlinear mapping relationship based on an exponential function, and uses this coefficient to correct the nominal measurement noise covariance matrix of the navigation filter, obtaining the effective measurement noise covariance matrix, thereby reducing the weight of contaminated measurement data; when the decision probability exceeds the critical blocking threshold, it triggers a hard isolation operation, cutting off the BeiDou signal input. At the network defense level, the module analyzes the location data of network nodes and combines it with local observations to calculate the spatial consistency residual, establishing a recursive update model to calculate the path damage index of network nodes. This module performs reputation management on nodes based on the path damage index; when the path damage index exceeds the damage blocking threshold, the corresponding node identifier is added to a dynamic blacklist, blocking the data of abnormal nodes from participating in collaborative information fusion.

[0015] The second aspect of this invention provides an intelligent method for detecting and mitigating BeiDou signal spoofing in the context of vehicle-to-everything (V2X) network.

[0016] This method, when applied to the aforementioned intelligent system, includes the following steps: During the data perception phase, physical layer signal data and network traffic data are acquired separately under the same time reference. Based on the received signal integrity characterization value, a set of physical layer features, including signal-to-noise ratio and Doppler frequency shift, is extracted. Simultaneously, the arrival interval of vehicle-to-everything (V2X) cooperative messages or navigation data packets is statistically analyzed to calculate traffic stability indices. First-order difference operations and correlation analysis are then performed on the traffic stability index sequence to obtain the differentiated traffic feature sequence.

[0017] In the anomaly detection phase, the physical layer feature set and traffic feature sequence are aligned and concatenated to construct a joint input feature vector. An autoencoder network is used to perform dimensionality reduction, compression, and reconstruction of the joint input feature vector, and the reconstruction error is calculated. The reconstruction error is compared with an initial anomaly screening threshold to filter suspected anomaly moments. For suspected anomaly moments, a temporal input matrix is ​​constructed and fed into a Long Short-Term Memory (LSTM) network. The LTM network captures the evolution of multidimensional features over time, and based on the hidden layer states, the probability of a BeiDou signal spoofing attack at the current moment is calculated and output.

[0018] During the security mitigation phase, local defense strategies and network reputation management are executed in parallel based on decision probabilities. On one hand, the covariance inflation coefficient is calculated based on the decision probabilities to inflate and correct the measurement noise covariance matrix of the navigation filter, achieving soft isolation of abnormal signals or, in extreme cases, hard isolation. On the other hand, spatial consistency residuals are calculated by combining the location data of network nodes, and the path impairment index of network nodes is recursively updated using decision probabilities. Malicious or damaged nodes are identified based on this index and added to a dynamic blacklist to block the spread of deceptive information in the vehicle network.

[0019] This invention provides an intelligent system and method for detecting and mitigating BeiDou signal spoofing in the context of vehicle-to-everything (V2X) networks. It offers the following advantages: 1. This invention adopts a multi-dimensional feature fusion and deep learning cascade architecture. By jointly modeling the physical layer features of BeiDou navigation and the traffic behavior features of the vehicle network, and by utilizing the feature reconstruction capability of autoencoders combined with the temporal analysis capability of long short-term memory networks, it can uncover the abnormal patterns of covert spoofing attacks in multi-dimensional space and time series. This overcomes the limitations of single-dimensional detection and improves the detection sensitivity and accuracy of BeiDou signal spoofing attacks in the vehicle network environment.

[0020] 2. This invention establishes a hierarchical defense and dynamic reputation management mechanism, which can dynamically adjust the measurement noise covariance matrix of the navigation filter according to the decision probability when an anomaly is detected, thereby achieving smooth weight reduction processing of contaminated data and avoiding direct service interruption due to misjudgment or slight interference. At the same time, combined with the path damage assessment of network nodes and the dynamic blacklist mechanism, it can promptly block the data transmission of malicious nodes, suppress the spread of false navigation information in the vehicle network system, and ensure the security and reliability of collaborative positioning.

[0021] 3. This invention does not require modification to the existing BeiDou satellite signal system or underlying hardware architecture. It can be deployed in vehicle terminals, roadside units, or edge computing devices through software upgrades. The computational overhead of this solution is controllable, and it can adapt to vehicle networking devices with different computing power resources. This reduces the system deployment cost and the complexity of upgrade and maintenance, making it easy to promote and apply on a large scale in existing intelligent transportation infrastructure. Attached Figure Description

[0022] Figure 1 This is a schematic diagram of the overall architecture of the intelligent system for detecting and mitigating BeiDou signal deception for the Internet of Vehicles according to the present invention; Figure 2 This is a flowchart illustrating the intelligent method for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles according to the present invention. Figure 3 This is a schematic diagram of the data processing flow of the multidimensional data perception and preprocessing module in this invention; Figure 4 This is a schematic diagram of the network structure and data flow of the deep learning joint detection module in this invention; Figure 5 The diagram shows a comparison of the effectiveness of the BeiDou signal spoofing detection method for the Internet of Vehicles provided in this embodiment of the invention with other existing methods. Detailed Implementation

[0023] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] See attached document Figure 1 This invention provides an intelligent system for detecting and mitigating BeiDou signal spoofing in the context of the Internet of Vehicles (IoV). This system is deployed in onboard units (OBUs), roadside units (RSUs), or edge computing devices within the IoV environment to ensure the security of BeiDou satellite navigation data and IoV communication data. The system includes: a multi-dimensional data perception and preprocessing module, a deep learning joint detection module, and a security mitigation and reputation management module.

[0025] In some embodiments, the system is applied to vehicular ad hoc networks (VANETs) scenarios. Vehicle nodes acquire BeiDou navigation signals via satellite receivers and interact with other vehicles or infrastructure through wireless communication interfaces (such as DSRC or C-V2X). To cope with complex spoofing attack environments, the system's module configurations and connections are as follows: The multi-dimensional data perception and preprocessing module is configured to connect to the navigation signal receiving front-end and the network communication interface. It performs data acquisition and preliminary processing, with specific functions including: establishing an integrity model of the BeiDou navigation signal; extracting physical layer features from the raw radio frequency signal to distinguish legitimate signals from potential spoofing errors; monitoring network traffic related to navigation services; calculating data packet arrival intervals and traffic stability indicators; and quantifying the communication behavior patterns of the network layer through differential processing. The multi-dimensional data perception and preprocessing module aligns and fuses the processed physical layer features and traffic features to generate a multi-dimensional feature vector.

[0026] The deep learning joint detection module is configured to connect with the multidimensional data perception and preprocessing module, receiving multidimensional feature vectors. As the core decision engine of the system, the deep learning joint detection module integrates a cascaded deep neural network structure. Specifically, it first uses an autoencoder network to compress and reconstruct the input multidimensional features, filtering out suspected abnormal moments that deviate from the normal baseline based on the reconstruction error. Then, it uses a Long Short-Term Memory (LSTM) network to perform temporal evolution analysis on the filtered feature sequences, capturing the dynamic patterns of deception attacks over time, calculating the probability of a deception attack at the current moment, and outputting the detection result.

[0027] The security mitigation and reputation management module is configured to connect with the deep learning joint detection module and receive detection results. This module performs proactive defense and network management, with specific functions including: maintaining a reputation list of network nodes; dynamically assessing the multipath impairment probability of each node based on detection results; and triggering isolation strategies when a deception risk is confirmed, blocking abnormal node data from participating in critical localization calculations or information fusion, and reducing the node's weight in network collaboration to prevent the spread of deceptive information.

[0028] In summary, the multi-dimensional data perception and preprocessing module is responsible for data perception and feature generation, the deep learning joint detection module is responsible for intelligent analysis and decision-making, and the security mitigation and reputation management module is responsible for policy execution and risk control. These modules communicate via system bus, shared memory, or network interface, collectively forming a closed-loop intelligent defense system.

[0029] See attached document Figure 3 Within the multi-dimensional data perception and preprocessing module, a signal integrity modeling unit is configured. This unit is physically connected to the vehicle-mounted terminal's radio frequency front-end and baseband processing chip, enabling real-time acquisition of raw satellite observation data. The core function of this signal integrity modeling unit is to construct a mathematical model that describes the true state of BeiDou navigation signals in complex electromagnetic environments, thereby providing a theoretical benchmark for subsequently distinguishing between legitimate and deceptive signals.

[0030] Signal integrity modeling unit at vehicle node At the moment Received the When processing navigation-related data from a BeiDou satellite, the integrity status of the received signal is formally represented as follows: ; in, This represents the signal integrity characterization value actually observed by the receiver; This represents the theoretically expected legal navigation signal components to be received; This represents the superposition of ambient white noise, thermal noise, and non-malicious interference / disturbance terms. This represents the anomalous error term introduced by a deceptive attacker (such as a generative deceptive interference source). The purpose of constructing this integrity model is to extract anomalies from the signal integrity representation value through subsequent processing. Peeling out The characteristics of [the attack]. If there is no deception attack, then It should approach the zero vector.

[0031] To accurately define the legitimate signal components in the above formula, the signal integrity modeling unit further constructs a baseline model of the expected behavior of legitimate signals. This baseline model, based on satellite ephemeris, vehicle kinematic constraints, and signal propagation theory, is expressed as: ; in, It represents the expected propagation and evolution path of a signal in an ideal physical channel, which includes the theoretical Doppler frequency shift and theoretical propagation delay calculated based on satellite orbit parameters and vehicle trajectory prediction. This represents the inherent noise term of the receiver system, including clock drift and hardware thermal noise; This represents the permissible natural deviation caused by the current electromagnetic environment, specifically including small signal fading due to multipath effects and ionospheric delay residuals. Using this expected behavior baseline model, the system decomposes the received signal into deterministic and random components; any significant deviation... Signal characteristics within the range are all considered potential deceptive components.

[0032] Based on the above integrity model, the signal integrity modeling unit performs the acquisition and extraction of multi-dimensional physical features to form a feature set. The feature set specifically includes, but is not limited to, the following data items: signal-to-noise ratio (SNR) and carrier-to-noise ratio density. The system employs several key parameters: First, it monitors for abnormal increases or abrupt changes in signal power, as spoofing signals typically transmit at higher power than genuine satellite signals. Second, it measures Doppler frequency shift and its rate of change to verify whether frequency domain variations in the signal align with the vehicle's current motion. Third, it measures the angle of arrival (AoA), using multi-antenna arrays or direction-of-arrival estimation algorithms to determine the spatial incidence direction of the signal and identify whether it originates from a pseudo-satellite source below the horizon rather than a real satellite at a high elevation angle. Fourth, it measures the time of arrival (ToA) and its transitions to detect clock resets or discontinuous phase transitions in the ranging code. Finally, it measures the consistency of the navigation message with historical or auxiliary data. These features, after being standardized, serve as input vectors for subsequent deep learning-based joint detection modules.

[0033] In the multi-dimensional data perception and preprocessing module, the traffic behavior analysis unit is connected to the vehicle communication gateway or network interface controller and is configured to monitor data packet transmission behavior related to navigation services in real time. This traffic behavior analysis unit mainly targets common packet replay, high-frequency injection, or abnormal forwarding behaviors during spoofing attacks. It uses statistical methods to quantitatively model the traffic characteristics of the network layer, thereby forming a complementary detection dimension with the physical layer signal characteristics.

[0034] The traffic behavior analysis unit first captures received BeiDou navigation data packets or V2X cooperative messages containing location information within a preset time window, and records the arrival time of each data packet. (Definition) This is the arithmetic mean of the arrival intervals of all data packets within this statistical window. For the first The data packet and the first The arrival interval between data packets. To measure the time interval. Network traffic stability; traffic behavior analysis unit calculates traffic stability indicators. Its calculation expression is as follows: ; in, This indicates the total number of data packet samples captured within the current statistics window; This represents a traffic stability metric, reflecting the variance of the data packet arrival interval; Indicates to From 1 to All items are summed. In normal periodic broadcast communication, the data packet arrival interval is relatively stable. It remains at a low level; however, during replay attacks or flooding injections, the arrival rhythm of packets is disrupted, leading to... Dramatic fluctuations occurred, which in turn caused The value increased.

[0035] To eliminate the non-stationary trend in traffic data and meet the stationarity requirements of subsequent deep learning models, the traffic behavior analysis unit performs first-order differencing on the calculated traffic stability index sequence. Definition For a moment The calculated flow stability index value (i.e. Then the differenced flow characteristic sequence Represented as: ; in, This represents the flow stability index value at the previous moment. By using a differencing operation, the linear trend term in the sequence is removed, highlighting the abrupt changes in flow over a short period.

[0036] To determine the optimal time step and lag order for subsequent time series analysis models when processing traffic characteristics, the traffic behavior analysis unit further calculates the traffic characteristic sequence. autocorrelation function ( ) and partial autocorrelation function ( Autocorrelation function Used to quantify flow characteristic sequences Rather than lagging behind Flow feature sequence after order The degree of linear correlation between them is calculated using the following formula: ; in, Indicates the lag order; This represents the total length of the sequences used to calculate correlation; Represents the flow characteristic sequence after difference In the total length of the sequence The mean within; Indicates time The flow characteristic sequence; Indicates to from arrive Summation is performed on all items; Indicates to From 1 to The autocorrelation function is used to sum all terms. It is used to identify periodic recurring patterns in the flow characteristic sequence.

[0037] Partial autocorrelation function Used for quantification during the elimination process One lagged term (i.e.) After the influence of ) and The direct correlation between them can be formally expressed as: ; in, This indicates the operation for calculating the conditional correlation coefficient; This indicates conditional dependencies. The traffic behavior analysis unit is based on... and The calculation results help set the input time window length for the subsequent Long Short-Term Memory (LSTM) network, and the processed traffic feature sequence Feature set output by the signal integrity modeling unit Timestamp alignment and concatenation are performed to form a joint feature vector, which is then transmitted to the deep learning joint detection module.

[0038] See attached document Figure 4 In the deep learning joint detection module, the feature compression and initial screening unit is configured to receive joint feature vectors from the multidimensional data perception and preprocessing module. This feature compression and initial screening unit adopts an autoencoder-based unsupervised learning architecture, aiming to reduce the dimensionality of high-dimensional input data by learning the data distribution pattern under normal communication conditions, and quickly screen out suspected abnormal samples that deviate from the normal baseline using reconstruction errors, thereby reducing the computational load of the subsequent time series analysis network.

[0039] The feature compression and initial screening unit first constructs the time step. joint input feature vector This vector is the feature set output by the signal integrity modeling unit. The traffic feature sequence after difference from the output of the traffic behavior analysis unit It is pieced together. To eliminate the differences in units and numerical ranges between features of different dimensions, feature compression and initial screening units are used. Perform normalization to map each component to a uniform numerical range.

[0040] The feature compression and initial screening unit contains an encoder network and a decoder network. The encoder network is responsible for mapping the high-dimensional input vector to a low-dimensional latent space, extracting the core abstract features of the data. This mapping process is represented as: ; in, Indicates time The output low-dimensional latent feature vector has a lower dimension than the joint input feature vector. This dimension enables feature compression; Represents the weight matrix parameters of the encoder; Represents the encoder's bias vector parameters; This represents a non-linear activation function (such as the ReLU function or the Tanh function) used to introduce non-linear mapping capabilities, enabling the model to capture complex data correlations.

[0041] The decoder network is responsible for processing low-dimensional latent feature vectors. The process involves inversely mapping back to the original feature space to reconstruct the original input data. This reconstruction process can be represented as follows: ; in, Indicates time The reconstructed feature vector; Represents the weight matrix parameters of the decoder; This represents the bias vector parameters of the decoder; This represents the activation function of the decoder. During the offline training phase of the system, the feature compression and initial screening units only utilize unaffected normal samples (i.e., white samples) for... The optimization was performed with the training objective of minimizing the reconstruction error of normal samples. Therefore, the model learned the inherent correlation pattern between normal signals and flow rates.

[0042] During the online detection phase, the feature compression and initial screening unit calculates the difference between the input vector and the reconstructed vector, i.e., the reconstruction error. Because the model has never encountered deception attack samples, it cannot effectively extract and accurately reconstruct features from abnormal data containing deception characteristics, leading to increased reconstruction error. The formula for calculating reconstruction error is as follows: ; in, It represents the square of the Euclidean norm, which is the sum of the squares of the differences between the components of the vector. It quantifies the degree to which the data deviates from the normal baseline at the current moment.

[0043] Feature compression and initial screening unit sets abnormal initial screening thresholds The feature compression and initial screening unit will calculate the reconstruction error. With the initial screening threshold for abnormalities Comparison: If If the current data is deemed normal, it can be allowed to proceed directly or discarded to save resources; otherwise... Then determine the current time. This is considered a suspected anomaly. For samples identified as suspected anomalies, the feature compression and initial screening unit will extract their corresponding low-dimensional latent feature vectors. and reconstruction error The data are cascaded and transmitted to subsequent time-series evolution decision units for further time-dependency analysis to eliminate false alarms caused by instantaneous environmental noise.

[0044] In the deep learning joint detection module, the temporal evolution decision unit is located after the feature compression and initial screening units, and is configured to receive the low-dimensional latent feature vector output by the initial screening unit. With reconstruction error The temporal evolution decision unit uses a Long Short-Term Memory (LSTM) network to analyze the evolution of the above data over time, aiming to identify slow drift (such as traction deception) or temporal inconsistencies unique to deception attacks, thereby distinguishing between transient environmental noise and persistent attack behavior.

[0045] The time-series evolution decision unit first determines the optimal time sliding window length based on the truncation characteristics of the autocorrelation function and partial autocorrelation function calculated by the traffic behavior analysis unit. The timing of the construction of the time-series evolution decision unit. Timing input vector The time series input vector is the time series input vector. low-dimensional latent feature vectors With reconstruction error The joint vector obtained by concatenation, i.e. The temporal evolution decision unit further divides the time... and its predecessor The input vectors at each time point are combined to form the time series input matrix. , as input to the LSTM network.

[0046] The temporal evolution decision unit utilizes the gating mechanism unique to LSTM networks to maintain the state of memory cells, thereby capturing long-distance temporal dependencies. Definition For the LSTM unit at time The cellular state used to store long-term memory information; For the LSTM unit at time The hidden state is used to output the short-term memory features at the current time step. The cell state update process is handled by the forget gate output vector. and input gate output vector Joint control, mathematically expressed as: ; in, Indicates the previous moment cellular state; This represents the output vector of the forget gate, with a value between 0 and 1, used to determine how much cell state information from the previous time step is retained; This represents the Hadamard product, which is the element-wise multiplication of a matrix or vector. This represents the input gate output vector, used to determine how much new information is written into the cell state at the current moment; Represents the temporal input vector based on the current input. and the hidden state of the previous time step The calculated candidate cell states.

[0047] The temporal evolution decision unit is based on the updated cell state. Calculate the hidden state at the current time step. This process combines the output gate with the output vector. The control effect is represented as: ; in, This represents the output vector of the output gate, used to control the cell state. How much information is transmitted to the hidden state? This represents the hyperbolic tangent activation function, used to map state values ​​to the interval between -1 and 1. It contains filtered and integrated temporal evolution features and is a high-level abstract representation for determining whether a deception attack exists.

[0048] The temporal evolution decision unit outputs the final hidden state of the LSTM network. A fully connected layer and a Sigmoid activation function are used to generate the probability of determining whether a BeiDou signal spoofing attack exists at the current moment. The calculation formula for this judgment process is as follows: ; in, This represents the Sigmoid activation function, which maps the output value to the probability range of 0 to 1; This represents the weight matrix of the output layer; This represents the bias term of the output layer. The system sets the decision threshold. (e.g., 0.5), if Then determine the current time. A deception attack has been detected, triggering the subsequent security response process; otherwise, the status is determined to be normal.

[0049] In the security mitigation and reputation management module, the dynamic isolation and response unit is deployed between the deep learning joint detection module and the vehicle navigation and positioning fusion engine. It is configured to make decisions based on the decision probabilities output by the temporal evolution decision unit. It implements a tiered defense strategy, which prevents deception errors from contaminating the vehicle's inertial navigation system (INS) or global path planning module by dynamically adjusting the confidence weight of navigation measurement data or cutting off data paths.

[0050] The dynamic isolation and response unit first defines a dynamic reliability adjustment mechanism for BeiDou navigation measurement data. This mechanism does not employ a single binary switching logic, but rather a soft isolation strategy based on measurement noise covariance expansion to maintain the system's robustness under low-probability false alarms. This unit receives the pre-set nominal measurement noise covariance matrix from the vehicle positioning fusion algorithm (such as Extended Kalman Filter EKF). This matrix describes the inherent measurement accuracy of the BeiDou receiver in a non-attack state.

[0051] Dynamic Isolation and Response Unit Calculation Time Covariance inflation coefficient The covariance inflation coefficient is used to quantify the unreliability of the current navigation data. With the probability of judgment They exhibit a non-linear positive correlation, and the calculation formula is established as follows: ; in, Indicates time The covariance inflation coefficient, whose range is: ; This represents the expansion gain constant, used to adjust the system's sensitivity to the risk of deception; The base of the natural logarithm; The exponential growth rate parameter determines the rate at which isolation strength increases as the probability of attack rises. This indicates the operation of finding the maximum value. This represents the probability of a decision at the current moment, as input from the deep learning module. This indicates the system's allowed risk tolerance threshold. When the probability of a decision is lower than... hour, Keeping it at 1, the system does not introduce additional penalties.

[0052] Based on the calculated expansion coefficient, the dynamic isolation and response unit generates a corrected effective measurement noise covariance matrix. This is then input into the downstream navigation fusion filter. The correction process is expressed as: ; in, This represents the actual measurement noise covariance matrix that is involved in the positioning solution. This represents the original measurement noise covariance matrix preset or empirically calibrated by the receiver. Through this calculation, when... When it rises, The increase in the norm leads to a decrease in the Kalman gain in the fusion filter, which mathematically reduces the weight of BeiDou measurement data in the final vehicle position update, thus achieving soft isolation.

[0053] The dynamic isolation and response unit is further configured with a hard isolation fuse mechanism. This dynamic isolation and response unit sets a critical blocking threshold. (in Real-time comparison and Size relationship: If The dynamic isolation and response unit immediately triggers a hard isolation operation, physically disconnecting or logically shielding the data transmission port of the Beidou receiver, forcing the vehicle navigation system to switch completely to pure inertial navigation mode or visual odometry mode; at the same time, the dynamic isolation and response unit generates the highest priority safety alarm signal and sends a status message containing a location untrusted flag to the autonomous driving domain controller through the vehicle CAN bus to trigger the vehicle's degraded operation or safe parking procedure.

[0054] In the security mitigation and reputation management module, the multipath damage assessment unit is configured to connect to the V2X communication receiving interface to manage the reputation status of network nodes (including neighboring vehicle nodes and roadside unit nodes) that establish communication connections with it. This multipath damage assessment unit addresses distributed deception or manipulated malicious nodes in the vehicle-to-everything (V2X) environment by establishing a dynamic assessment mechanism based on the node's historical behavior and the current environmental security status, quantifying the degree of damage to data transmitted along each communication path, i.e., information unreliability.

[0055] The multipath damage assessment unit first assesses the damage from the first path. The unit parses the Cooperative Awareness Message (CAM) or Distributed Environmental Notification Message (DENM) of each network node to extract the reported location coordinates. This unit utilizes non-satellite-dependent sensors (such as lidar, millimeter-wave radar, or vision sensors) mounted on the vehicle to acquire information about the first network node. The relative observation positions of each network node are determined, and these relative observation positions are transformed to a global coordinate system (or the reported positions are transformed to a relative coordinate system) for comparison. Definition For a moment No. The spatial consistency residual of each network node represents the Euclidean distance deviation between the node's reported location and its independently observed location. This Euclidean distance deviation serves as a fundamental metric for evaluating the quality of a single interaction within the communication path.

[0056] The multi-path damage assessment unit establishes a recursive update model to calculate the first... Path damage index of each network node The path impairment index depends not only on the current spatial consistency residual, but also on the decision probability output by the temporally evolved decision unit. The modulation is based on the premise that in a high-risk environment where BeiDou signals are subjected to spoofing attacks, the probability of coordinated or collusive attacks in the network increases accordingly. The update formula for the path impairment index is constructed as follows: ; in, Indicates time No. The path damage index of each network node is normalized to the range of [0,1). The closer the value is to 1, the more severe the damage to the reputation of the network node and the less reliable the data is. Indicates the previous moment The stored historical path corruption index of this network node; The forgetting factor, which ranges from 0 to 1, is used to adjust the weight of the influence of historical reputation records on the current evaluation result and determines the system's sensitivity to changes in node behavior. This represents the hyperbolic tangent function, used to nonlinearly map input values ​​to a bounded interval; This represents the residual sensitivity coefficient, used to normalize spatially consistent residuals. The order of magnitude; This represents the spatial consistency residual calculated at the current moment; This indicates the probability of a BeiDou signal spoofing attack being detected in the current system. This represents the environmental risk correlation factor, used to set the penalty multiplier for deviations in neighboring nodes when the node itself suffers a deception attack.

[0057] The multi-path damage assessment unit is based on the calculated path damage index. Network nodes are managed hierarchically. This multipath damage assessment unit has a preset damage blocking threshold. The multi-path damage assessment unit monitors the damage index of each active node in real time. When a node is detected to meet the damage index, the unit will take action accordingly. When conditions are met, if the communication path is determined to be severely damaged or the node is a malicious node, the node's identifier (ID) is immediately added to a dynamic blacklist. For nodes on the blacklist, the system directly discards all data packets sent by them in subsequent data fusion cycles and no longer allocates cooperative positioning weights to them until the node's damage index naturally decays to below a safe threshold after a preset recovery period. Through this mechanism, the system ensures its own positioning security while blocking the lateral propagation path of deceptive information in the vehicle-to-everything (V2X) topology.

[0058] See attached document Figure 2This invention provides an intelligent method for detecting and mitigating BeiDou signal spoofing in the Internet of Vehicles. This method integrates physical layer signal characteristics and network layer traffic behavior characteristics, and uses a deep learning model to achieve closed-loop detection and defense against BeiDou navigation spoofing attacks, including the following steps S1 to S5.

[0059] Step S1: Perform multidimensional data parallel perception and feature preprocessing.

[0060] The system acquires physical layer signal data from the vehicle-mounted BeiDou receiver and network traffic data from the vehicle-mounted communication gateway, both within the same timeframe. For physical layer signals, the system uses received signal integrity characterization values. Real-time extraction of feature sets including signal-to-noise ratio, Doppler frequency shift, and angle of arrival. For network traffic, the system calculates the arrival interval of navigation service data packets within a set time window. And through the formula Calculate flow stability index Furthermore, the system performs a first-order difference operation on the flow stability index sequence. To eliminate non-stationary trends and obtain the differenced flow characteristic sequence. .

[0061] Step S2: Perform feature fusion compression and anomaly screening based on reconstruction error.

[0062] The system will use the feature set obtained in step S1 With flow characteristic sequence Perform timestamp alignment and concatenation to construct a joint input feature vector. The system inputs the joint input feature vector into a pre-trained autoencoder network, and obtains a low-dimensional latent feature vector through encoder mapping. The reconstructed feature vector is obtained through the decoder. System calculation reconstruction error System judgment Is it less than the preset initial screening threshold for abnormalities? If yes, then the data at the current moment is considered normal, and the detection for the current cycle ends; if no, then... If so, the current time is determined to be a suspected abnormal time, and... and The data is then transmitted to subsequent steps for in-depth decision-making.

[0063] Step S3: Perform a deep decision on deception attacks based on temporal evolution.

[0064] For the suspected abnormal data identified in step S2, the system constructs an input sequence matrix containing the current time and historical time points. The system processes this sequence using a Long Short-Term Memory (LSTM) network and outputs a vector through a forgetting gate. input gate output vector Dynamically update cell state The formula is And combined with the output gate output vector Generate hidden state Ultimately, the system calculates the probability of a BeiDou signal spoofing attack at the current moment through a fully connected layer based on the hidden layer state. This probability value quantifies the confidence level that the current navigation environment has been maliciously interfered with.

[0065] Step S4: Perform local navigation dynamic isolation and response based on covariance expansion.

[0066] The system determines the decision probability based on the output of step S3. The covariance inflation coefficient is calculated using a nonlinear mapping function. The system uses this covariance inflation coefficient to correct the effective measurement noise covariance matrix of the navigation filter, i.e. This reduces the weight of contaminated measurement data in the location calculation. Simultaneously, the system monitors the decision probability in real time; if... Exceeding the critical blocking threshold The system immediately cut off the BeiDou signal input, forced the vehicle to switch to pure inertial navigation mode, and triggered a safety alarm.

[0067] Step S5: Perform vehicle network reputation management and blocking based on multi-path damage assessment.

[0068] In vehicle-to-everything (V2X) cooperative communication, the system parses location data sent by neighboring network nodes and calculates spatial consistency residuals by combining the observation results of local sensors. The system combines decision probabilities. Recursive update of the first Path damage index of each network node The updated formula is as follows When the path damage index of a certain node... When the damage blocking threshold is exceeded, the system adds the node to a dynamic blacklist and discards collaborative data from that node to prevent the risk of deception from spreading laterally through the vehicle network link.

[0069] To verify the feasibility and advancement of the intelligent system and method for detecting and mitigating BeiDou signal deception for the Internet of Vehicles proposed in this invention, this embodiment constructs a BeiDou navigation signal deception detection experimental scenario in an Internet of Vehicles simulation environment, and conducts comparative tests on the invention with a variety of existing mainstream detection methods.

[0070] In terms of experimental setup, a mixed dataset containing normal navigation data and various types of deception scenarios (such as generative deception and traction deception) was selected. The navigation features selected for the experiment were consistent with those in the aforementioned embodiments, specifically including signal-to-noise ratio (SNR), carrier-to-noise ratio density (C / N0), Doppler shift, signal arrival time, and its temporal variation characteristics.

[0071] This invention employs a deep learning joint detection module for processing. Specifically, it utilizes an autoencoder to compress and reconstruct the input features, and uses a Long Short-Term Memory (LSTM) network for temporal anomaly detection. The key model parameters for the experiment are set as follows: the hidden layer dimension of the autoencoder is set to 32, the time step size of the LSTM network is set to 10, and the decision threshold is adaptively set based on the statistical characteristics of the training set.

[0072] To quantify the model performance, four common evaluation metrics were selected: accuracy, precision, recall, and F1 score. Simultaneously, four existing state-of-the-art methods were chosen as benchmarks for comparison: the detection methods proposed by Yang et al. (2023), Rajendra et al. (2024), Mina et al. (2024), and Ivanov et al. (2024).

[0073] Please refer to the appendix. Figure 5 The horizontal axis of the graph represents four performance evaluation metrics: "Accuracy (%)", "Precision (%)", "Recall (%)", and "F1 Score (%)"; the vertical axis represents "Percentage of Results (%)". The legend section shows the different methods used for comparison, with the English labels representing existing detection algorithms proposed by corresponding scholars in different years, and "This Method" representing the intelligent detection method proposed in this invention.

[0074] The experimental results are analyzed as follows: Figure 5 As shown, the method of the present invention exhibits significant advantages in all four metrics. Specifically, the method of the present invention achieves an accuracy of approximately 95%, a precision of approximately 94%, a recall of approximately 93%, and an F1 score of approximately 94%, all of which are higher than all comparative methods.

[0075] In contrast, existing methods exhibit varying degrees of limitations: Some comparative methods (such as those by Mina et al. or Ivanov et al.) only achieve a recall rate of about 78% to 80% and a precision rate of less than 82%, which means that these methods are prone to missing spoofing attacks or generating more false positives.

[0076] Another type of method (such as the methods of Yang et al. or Rajendra et al.) can achieve a precision of about 88% to 90%, but its recall is insufficient or only barely reaches about 80%, resulting in an overall low F1 score that reflects the robustness of the model.

[0077] In summary, compared with existing technologies, the method of this invention maintains a high level in all four indicators: accuracy, precision, recall, and F1 score. This indicates that the present invention can effectively reduce the false positive rate (i.e., high precision) while improving the detection capability (i.e., high recall) for various covert deception behaviors. Experimental results fully demonstrate that the method of this invention has superior comprehensive detection performance and stability against BeiDou signal spoofing in complex vehicle-to-everything (V2X) environments, verifying its feasibility for engineering applications.

Claims

1. An intelligent system for detecting and mitigating BeiDou signal spoofing in the context of vehicle-to-everything (V2X) network, characterized in that, The intelligent system is deployed in vehicle terminals, roadside units, or edge computing devices in the vehicle-to-everything (V2X) environment, and includes a multi-dimensional data perception and preprocessing module, a deep learning joint detection module, and a security mitigation and reputation management module. The multidimensional data perception and preprocessing module is used to establish an integrity model of the BeiDou navigation signal and extract physical layer features from the original radio frequency signal, monitor network traffic related to navigation services to extract traffic stability features, and align and fuse the physical layer features with the traffic stability features to generate a multidimensional feature vector. The deep learning joint detection module is used to receive the multidimensional feature vector, perform temporal evolution analysis on the multidimensional feature vector using an autoencoder network and a long short-term memory network, identify abnormal states and deception attack behaviors of the BeiDou signal, and output the detection results. The security mitigation and reputation management module is used to receive the detection results and perform proactive defense and network management against BeiDou signal spoofing, specifically including: Based on the detection results, the confidence weight of the local navigation measurement data is dynamically adjusted or an isolation strategy is implemented. At the same time, the reputation list of network nodes in the vehicle network is maintained. The multipath damage probability of each network node is evaluated based on the detection results, and the data of abnormal nodes is blocked from participating in collaborative information fusion.

2. The intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles as described in claim 1, characterized in that, The multidimensional data perception and preprocessing module includes a signal integrity modeling unit; The signal integrity modeling unit is used to construct a mathematical model describing the real state of Beidou navigation signals in an electromagnetic environment. It formally represents the integrity state of the received signal as the signal integrity characterization value actually observed by the receiver. The signal integrity characterization value is composed of the theoretically expected legitimate navigation signal components, environmental noise and interference disturbance terms, and abnormal error terms introduced by deceiving attackers. The signal integrity modeling unit is used to construct a baseline model of the expected behavior of legitimate signals, decompose the received signal into deterministic and random components, and perform multi-dimensional physical feature acquisition and extraction based on the integrity model to form a feature set. The feature set includes signal-to-noise ratio, carrier-to-noise ratio density, Doppler frequency shift and rate of change, angle of arrival, signal arrival time and jump conditions, and navigation message consistency flags.

3. The intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles as described in claim 1, characterized in that, The multidimensional data perception and preprocessing module also includes a traffic behavior analysis unit; The traffic behavior analysis unit is used to capture BeiDou navigation data packets or collaborative messages within a preset time window, record the arrival time of the data packets, calculate the arithmetic mean of the arrival intervals of all data packets within the statistical window by summing the differences in the arrival times of adjacent data packets within the time window and dividing it by the total number of data packets, and calculate the traffic stability index that reflects the variance of the arrival intervals of data packets by dividing the sum of the squares of the differences between the arrival intervals of each data packet and the arithmetic mean by the value after subtracting one from the total number of data packets. The traffic behavior analysis unit is used to perform first-order differencing on the calculated traffic stability index sequence, remove the linear trend term in the sequence to obtain the differencing traffic feature sequence, calculate the autocorrelation function by calculating the ratio of covariance to variance under different lag orders, calculate the partial autocorrelation function by using recursive regression to remove the influence of intermediate lag terms, set the input time window length of the long short-term memory network based on the calculation results, and align and splice the traffic feature sequence with the physical layer features using timestamps.

4. The intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles as described in claim 1, characterized in that, The deep learning joint detection module includes a feature compression and initial screening unit; The feature compression and initial screening unit is used to construct a joint input feature vector, and to map the joint input feature vector to a low-dimensional latent space through an encoder network to extract low-dimensional latent feature vectors. The low-dimensional latent feature vectors are then mapped back to the original feature space through a decoder network to obtain reconstructed feature vectors. The feature compression and initial screening unit is used to calculate the reconstruction error between the joint input feature vector and the reconstructed feature vector, compare the reconstruction error with the anomaly initial screening threshold, and if the reconstruction error is greater than or equal to the anomaly initial screening threshold, determine that the current time is a suspected anomaly time, and extract the corresponding low-dimensional potential feature vector and the reconstruction error to form a cascaded sequence and transmit it to the time-series evolution decision unit.

5. The intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles as described in claim 4, characterized in that, The deep learning joint detection module also includes a temporal evolution decision unit; The temporal evolution decision unit is used to construct an input sequence matrix containing the current time and historical time, maintain the state of the memory unit using the gating mechanism of the long short-term memory network, update the cell state through the forget gate output vector and the input gate output vector, and calculate the hidden layer state by combining the output gate output vector. The temporal evolution decision unit is used to connect the hidden layer state to the fully connected layer and activation function to generate a decision probability that there is a BeiDou signal spoofing attack at the current moment. If the decision probability is greater than the decision threshold, it is determined that there is a spoofing attack at the current moment.

6. The intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles as described in claim 5, characterized in that, The security mitigation and reputation management module includes a dynamic isolation and response unit; The dynamic isolation and response unit is used to execute a hierarchical defense strategy based on the decision probability. It receives the nominal measurement noise covariance matrix preset in the vehicle positioning fusion algorithm, calculates the covariance inflation coefficient by mapping the decision probability using a preset function model, corrects the nominal measurement noise covariance matrix using the covariance inflation coefficient to obtain the effective measurement noise covariance matrix, and inputs the effective measurement noise covariance matrix into the navigation fusion filter to reduce the weight of BeiDou measurement data. The dynamic isolation and response unit is used to compare the decision probability with the critical blocking threshold. If the decision probability is greater than or equal to the critical blocking threshold, a hard isolation operation is triggered to disconnect the data transmission port of the Beidou receiver and generate a security alarm signal.

7. The intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles as described in claim 6, characterized in that, When calculating the covariance inflation coefficient, the dynamic isolation and response unit uses a nonlinear mapping relationship based on an exponential function, and the covariance inflation coefficient is positively correlated with the decision probability. The dynamic isolation and response unit is used to calculate the difference between the decision probability and the risk tolerance threshold. When the decision probability is greater than the risk tolerance threshold, the covariance inflation coefficient increases exponentially with the increase of the difference.

8. The intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles according to claim 5, characterized in that, The security mitigation and reputation management module also includes a multi-path impairment assessment unit; The multipath damage assessment unit is used to parse the location data sent by network nodes, calculate the spatial consistency residual by combining the observation results of local sensors, and establish a recursive update model to calculate the path damage index of network nodes. When calculating the path damage index, the multipath damage assessment unit uses a memory forgetting factor to adjust the weight of historical reputation records, uses a residual sensitivity coefficient to normalize the spatial consistency residual, and introduces the decision probability to modulate the path damage index.

9. The intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles as described in claim 8, characterized in that, The multi-path damage assessment unit is used to classify and manage network nodes based on the path damage index. The multi-path damage assessment unit is used to monitor the path damage index of each active node in real time. When the path damage index of a node is detected to be greater than the damage blocking threshold, it is determined that the communication path is severely damaged or the node is a malicious node. The node identifier is added to the dynamic blacklist, and data packets from the node are discarded in subsequent data fusion cycles.

10. An intelligent method for detecting and mitigating BeiDou signal spoofing in the Internet of Vehicles, characterized in that, An intelligent system for detecting and mitigating BeiDou signal spoofing for the Internet of Vehicles, as described in any one of claims 1-9, comprises the following steps: S1. Under the same time reference, physical layer signal data and network traffic data are acquired respectively. Based on the received signal integrity characterization value, a feature set is extracted. The arrival interval of statistical data packets is calculated and the traffic stability index is calculated. The first-order difference operation is performed on the traffic stability index sequence to obtain the differential traffic feature sequence. S2. Align and concatenate the feature set with the traffic feature sequence to construct a joint input feature vector. Obtain a low-dimensional potential feature vector and a reconstructed feature vector through an autoencoder network. Calculate the reconstruction error. If the reconstruction error is greater than or equal to the anomaly screening threshold, determine the current time as a suspected anomaly time. S3. Construct an input sequence matrix for the data at the suspected abnormal moment, process the input sequence matrix using a long short-term memory network, dynamically update the cell state and generate a hidden state, and calculate the probability of a BeiDou signal deception attack at the current moment based on the hidden state. S4. Calculate the covariance expansion coefficient based on the decision probability, and use the covariance expansion coefficient to correct the effective measurement noise covariance matrix of the navigation filter to reduce the weight of contaminated data. When the decision probability exceeds the critical blocking threshold, cut off the BeiDou signal input. S5. Analyze the location data of network nodes in the vehicle network and calculate the spatial consistency residual. Combine the decision probability to recursively update the path damage index of the network node. When the path damage index exceeds the damage blocking threshold, add the network node to the dynamic blacklist to block the spread of deceptive information in the vehicle network.

Images