Network attack path active prediction and blocking method and device based on threat propagation simulation

Abstract

The invention discloses a network attack path active prediction and blocking method and device based on threat propagation simulation. The method comprises the following steps: collecting physical motion state and network space security state data of a vehicle; predicting a vehicle space-time trajectory and calculating a physical contact window; estimating the time delay required for completing the attack by using the vulnerability; constructing a space-time reachability attack graph based on a constraint condition that the physical contact window duration is greater than or equal to the time delay required by the attack; and predicting an attack path based on the attack graph, and generating and executing an active blocking strategy. According to the method, coupling constraint is carried out on the attack time delay and the vehicle physical contact duration, the space-time reachability attack graph is constructed, false attack paths which cannot be realized due to insufficient contact time can be effectively filtered, hidden threats of vehicle mobility are accurately predicted and utilized, the accuracy of attack path prediction in an Internet of Vehicles scene is remarkably improved, and the attack path prediction efficiency is improved. And a self-adaptive active blocking strategy can be generated, so that the overall safety of the system is improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, specifically to a method and apparatus for proactively predicting and blocking network attack paths based on threat propagation simulation. Background Technology

[0002] With the development of vehicle-to-everything (V2X) technology, vehicles are transforming into highly interconnected intelligent nodes. V2X improves traffic efficiency and driving safety through communication between vehicles and other entities, such as other vehicles, roadside infrastructure, pedestrians, and cloud platforms. However, this high degree of interconnectivity also brings new cybersecurity risks. Malicious code can spread through short-range wireless communication channels between vehicles, forming large-scale controlled networks that pose a serious threat to transportation systems.

[0003] Existing cybersecurity threat propagation simulation technologies are mostly applied to traditional information technology network environments with relatively static topologies. These technologies often employ attack graph models based on static graph theory or discrete-time snapshot simulation methods, predicting attack paths by analyzing the logical connectivity and vulnerability exploitation relationships between nodes. However, the Internet of Vehicles (IoV) is a special network environment characterized by high dynamism, frequent topological changes, and intermittent connections. The high-speed movement of vehicles results in extremely short communication links between nodes, potentially lasting only a few seconds.

[0004] Current technologies, when assessing attack feasibility, typically focus only on logical reachability, neglecting a crucial physical constraint: the necessary time required for the attack to complete. A network attack process, including vulnerability scanning, connection establishment, malicious payload transmission, and execution, consumes considerable time. For example, transmitting a multi-megabyte malicious firmware packet over a wireless channel might take tens of seconds, while the effective communication window between two vehicles passing each other at high speeds could be far shorter. In such cases, even if a theoretical topological connection exists, the attack cannot be completed due to insufficient physical contact time. Existing technologies fail to effectively combine the microscopic temporal characteristics of the attack process with the macroscopic physical motion trajectory of the vehicle, resulting in predictions containing numerous pseudo-attack paths that are physically impossible, or overlooking covert attack patterns that exploit vehicle mobility for "store-carry-forward" operations. Therefore, a method is needed that integrates physical motion trajectory prediction with network attack time consumption analysis to address the security challenges of highly dynamic vehicle-to-everything (V2X) scenarios. Summary of the Invention

[0005] The technical problem this invention aims to solve is to overcome the shortcomings of existing technologies in predicting attack paths in the context of vehicle-to-everything (V2X) scenarios due to neglecting the constraints of physical contact duration. To this end, this invention provides a method and apparatus for proactively predicting and blocking network attack paths based on threat propagation simulation.

[0006] One aspect of the present invention provides a method for proactive prediction and blocking of network attack paths based on threat propagation simulation, comprising the following steps: Step 1: Collect multi-dimensional status data of vehicles within the target area. The multi-dimensional status data includes the physical motion status data of the vehicles and the cyberspace security status data. Step 2: Based on the physical motion state data, a deep learning trajectory prediction model is constructed to generate the position coordinate sequence of each vehicle within the future prediction period. Based on the position coordinate sequence and the effective communication radius of the vehicle wireless communication module, the physical contact window formed between any two vehicles is calculated, and the duration of the physical contact window is obtained. Step 3: Based on the vulnerabilities identified in the cyberspace security status data, construct an attack latency model for the vulnerabilities to calculate the total latency required to complete an attack. Step 4: Construct a physical-network coupled spatiotemporal reachability attack graph. The construction process is based on the comparison between the duration of the physical contact window and the total delay to determine the directed connection relationship between vehicle nodes. Step 5: Based on the spatiotemporal reachability attack graph, use a graph search algorithm to search for and predict potential attack paths that can reach the predetermined target node, starting from the known infection source node. Step 6: Based on the potential attack path, generate an active blocking strategy and distribute it to network units or vehicles related to the potential attack path for execution.

[0007] Furthermore, in step one, collecting the physical motion state data includes collecting the vehicle's unique identifier, three-dimensional spatial coordinates, three-dimensional velocity vector, acceleration vector, and historical driving trajectory sequence; collecting the cyberspace security state data includes collecting the operating system version, firmware version, currently open network port list, known unpatched security vulnerabilities, and their corresponding general vulnerability scoring system scores for the in-vehicle infotainment system and telematics processor.

[0008] Preferably, in step two, constructing the deep learning trajectory prediction model specifically involves: constructing a model based on an encoder-decoder architecture, wherein the encoder part adopts a spatiotemporal graph convolutional network to capture the spatial interaction relationships and temporal dependencies of the vehicle group; the decoder part adopts a long short-term memory network or a Transformer network structure to generate the position coordinate sequence of each vehicle within the future prediction period; step two further includes: for each physical contact window, combining the relative speed and distance change rate of the two vehicles with a preset channel environment model, estimating the average packet loss rate and average available bandwidth within the window.

[0009] Optionally, in step three, calculating the total latency required to complete an attack specifically includes summing the scanning and handshake time, payload transmission time, and execution time; wherein the payload transmission time is calculated based on the attack payload size required to exploit the vulnerability, the average available bandwidth within the physical contact window, and the average packet loss rate.

[0010] Furthermore, in step four, constructing the spatiotemporal reachability attack graph specifically includes: defining nodes in the spatiotemporal reachability attack graph as spatiotemporal nodes, where each spatiotemporal node represents the safe state of a vehicle at a specific absolute moment related to a physical contact window; establishing directed edges between the spatiotemporal nodes corresponding to the attacking vehicle and the attacked vehicle, and marking the attack opportunity window, if and only if the duration of the physical contact window is greater than or equal to the total delay; and establishing internal state transition edges between state nodes of the same vehicle at different times, in order to model the process of the attack payload being physically carried by the vehicle.

[0011] Furthermore, step five also includes: for each predicted potential attack path, calculating an evaluation index, the evaluation index including the path existence probability, the earliest arrival time of the attack payload propagating along the path to the target node, and identifying bottleneck vehicle nodes on the path.

[0012] Optionally, in step six, the proactive blocking strategy includes a proactive maneuvering avoidance strategy. The generation of the proactive maneuvering avoidance strategy specifically includes: establishing a spatiotemporal repulsion potential field around the predicted trajectory of the identified infected vehicle, the strength of which is proportional to the threat level of the infected vehicle; and establishing a cost function for vulnerable vehicles downstream of the potential attack path, where vulnerable vehicles refer to vehicles downstream of the attack path that have vulnerabilities that can be exploited. The cost function is in the form of... , where P def (t) represents the defense trajectory, P orig (t) represents the original navigation trajectory, Risk(P) def (t) represents the instantaneous risk value of the vehicle at time t in the spatiotemporal repulsive potential field. For the current moment, The future prediction period is defined as α and β, which are weighting coefficients. The cost function is solved by an optimization method. Under the constraint of compressing the potential physical contact time with the infected vehicle to below the total delay, the optimized fine-tuning trajectory with the minimum cost is found and the susceptible vehicle is instructed to execute it.

[0013] Optionally, in step six, the proactive blocking strategy includes a targeted micro-patch distribution strategy. The generation of the targeted micro-patch distribution strategy specifically includes: identifying bridge node vehicles where multiple potential attack paths intersect, and using the time window during which the bridge node vehicle has a connection with a roadside unit or trusted vehicle with a bandwidth greater than a preset threshold at a certain time in the future, prioritizing the push of security micro-patches for fixing specific vulnerabilities to it; wherein, trusted vehicles are vehicles whose certified security status meets preset standards.

[0014] Optionally, in step six, the active blocking strategy includes at least one of a spatiotemporal virtual isolation strategy and a honeypot deception and redirection strategy; wherein, the generation of the spatiotemporal virtual isolation strategy specifically includes: sending a defense instruction to vulnerable vehicles downstream of the potential attack path, causing them to temporarily shut down specific network service ports or reduce wireless transmission power during the attack opportunity window time period corresponding to the physical contact window; the generation of the honeypot deception and redirection strategy specifically includes: at key nodes of the potential attack path, instructing vehicles or roadside units with honeypot service deployment capabilities to dynamically activate a high-interaction honeypot service simulating the functions of a complete operating system, wherein the high-interaction honeypot service simulates the characteristics of vulnerable vehicles to induce attackers to connect and capture attack behavior characteristics.

[0015] In another aspect, the present invention provides a device for actively predicting and blocking network attack paths, the device comprising: The data acquisition module is configured to collect multi-dimensional status data of vehicles within the target area, including physical motion status data and cyberspace security status data of the vehicles. The trajectory prediction module is configured to construct a deep learning trajectory prediction model based on the physical motion state data to generate a sequence of position coordinates of each vehicle within a future prediction period, and to calculate the physical contact window formed between any two vehicles based on the position coordinate sequence and the effective communication radius of the vehicle wireless communication module, thereby obtaining the duration of the physical contact window. The attack latency estimation module is configured to construct an attack latency model for the identified vulnerabilities in the cyberspace security status data, so as to calculate the total latency required to complete an attack. The attack graph construction module is configured to construct a physical-network coupled spatiotemporal reachability attack graph. The construction process is based on the comparison between the duration of the physical contact window and the total delay to determine the directed connection relationship between vehicle nodes. The attack path prediction module is configured to search and predict potential attack paths that can reach the predetermined target node based on the spatiotemporal reachability attack graph using a graph search algorithm, starting from the known infection source node. The proactive blocking policy generation module is configured to generate a proactive blocking policy based on the potential attack path and distribute it to network units or vehicles related to the potential attack path for execution.

[0016] The technical solution provided by this invention establishes a spatiotemporal reachability attack graph model that accurately reflects the high dynamic characteristics of vehicle-to-everything (V2X) networks by introducing a coupling constraint between the physical contact window duration and the attack completion delay. This method jointly models microscopic vulnerabilities using temporal characteristics and macroscopic vehicle physical motion trajectories, effectively filtering out false attack paths that cannot complete the attack due to insufficient physical contact time, significantly improving the accuracy of threat prediction. Simultaneously, through explicit modeling of the "store-carry-forward" attack pattern, this method can effectively discover hidden threats propagating using vehicle physical mobility. Finally, based on accurate path prediction, this method can generate various adaptive proactive blocking strategies, including optimized maneuver avoidance, to intervene before threats occur, thereby improving the overall security of intelligent connected vehicle systems. Attached Figure Description

[0017] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0018] Figure 1 This is a flowchart illustrating a method for proactively predicting and blocking network attack paths based on threat propagation simulation, provided in an embodiment of the present invention.

[0019] Figure 2 This is a schematic diagram illustrating the physical contact window calculation process in an embodiment of the present invention.

[0020] Figure 3 This is a schematic diagram of the spatiotemporal reachability attack graph constructed in an embodiment of the present invention.

[0021] Figure 4 This is a schematic diagram of the trajectory of the active maneuvering avoidance strategy in an embodiment of the present invention.

[0022] Figure 5 This is a comparative analysis chart of the accuracy of vehicle trajectory prediction provided in the embodiments of the present invention.

[0023] Figure 6 This is a histogram showing the duration distribution of the physical contact window in the Internet of Vehicles provided in this embodiment of the invention.

[0024] Figure 7 This is a real-world schematic diagram of the vehicle-to-everything (V2X) dynamic communication environment provided in an embodiment of the present invention.

[0025] Figure 8 This is a physical process diagram of the "store-carry-forward" attack mode provided in the embodiments of the present invention.

[0026] Figure 9 This is a schematic diagram of the vehicle's active maneuvering evasion and defense actions provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the present invention clearer, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0028] Example 1 This embodiment provides a method for proactively predicting and blocking network attack paths based on threat propagation simulation. (Refer to...) Figure 1 This method is a process executed in a computer system, and its detailed steps are as follows.

[0029] Step S100: Construct a multi-dimensional state perception and data acquisition system for the Internet of Vehicles.

[0030] To achieve accurate modeling of the highly dynamic vehicle-to-everything (V2X) environment, this step aims to comprehensively and in real-time collect multi-dimensional state data of vehicles within the target area. This multi-dimensional state data is divided into two main categories: physical motion state data and cyberspace security state data.

[0031] Specifically, the acquisition of physical motion state data can rely on various data sources. A preferred approach is to continuously track and identify vehicles within the coverage area using high-precision sensing devices deployed on roadside units (RSUs) along the roadside, such as LiDAR, millimeter-wave radar, and high-definition cameras, thereby obtaining precise physical state information. Another approach is to passively listen to V2X Basic Safety Messages (BSMs) exchanged between vehicles or between vehicles and infrastructure. These messages typically contain information such as the vehicle's declared position and speed. The acquired physical motion state data items may include: a unique vehicle identifier (ID) to uniquely identify the vehicle within the system; three-dimensional spatial coordinates (x, y, z) describing the vehicle's precise position in the global coordinate system; a three-dimensional velocity vector (vx, vy, vz) describing the vehicle's speed magnitude and direction; an acceleration vector (ax, ay, az) describing its velocity change trend; a heading angle indicating the vehicle's orientation; vehicle dimensions for more accurate calculation of communication coverage; and historical driving trajectory sequences as input for subsequent trajectory prediction models. To capture fleeting interaction opportunities of vehicles in highly dynamic scenarios, the frequency of data acquisition is a key parameter. Preferably, the data acquisition frequency should not be lower than 10 Hz to ensure that potential communication contacts with extremely short durations can be recorded.

[0032] The collection of cybersecurity status data combines terminal agents and cloud management platforms. Lightweight intrusion detection system (IDS) agents can be deployed in vehicle terminals, such as in-vehicle infotainment systems (IVI) or telematics processors (T-Boxes), to monitor the terminal's operational status in real time. Simultaneously, static security configuration information from the asset database of the Security Operations Center (SOC) in the cloud can be obtained, either at the time of the vehicle's manufacture or after the most recent update. Specific cybersecurity status data items collected may include: the operating system and firmware versions of the IVI and T-Box, which are the basis for determining the existence of known vulnerabilities; a list of currently open network ports and running background services, which constitute the potential attack surface; a list of known unpatched security vulnerabilities, typically identified by Common Vulnerability Disclosure (CVE) numbers and accompanied by their corresponding Common Vulnerability Scoring System (CVSS) scores to assess vulnerability severity; and information such as the vehicle's current network load and remaining storage space, which may affect the transmission and execution efficiency of attack payloads.

[0033] Step S200: Predict vehicle trajectory and dynamic contact window based on deep learning.

[0034] The core of this step is to use artificial intelligence algorithms to process the physical motion state data collected in step S100 in order to predict the vehicle's trajectory in the future and to deduce the possible communication opportunities between vehicles based on the prediction results.

[0035] Specifically, this step constructs a deep learning trajectory prediction model based on an encoder-decoder architecture. The input to this model is the historical trajectory sequence of all vehicles within the target area over a past period. Preferably, the encoder part employs a spatiotemporal graph convolutional network (ST-GCN), which can simultaneously learn the spatial interactions of vehicle groups, such as following behavior among vehicles in the same lane and lane-changing intentions of vehicles in adjacent lanes, as well as the temporal continuity dependencies of motion. This ability to model group behavior significantly improves prediction accuracy in dense traffic flow scenarios. The decoder can employ a Long Short-Term Memory (LSTM) network or a more advanced Transformer network structure. Its task is to autoregressively generate the position coordinate sequence P_seq_i = P_i(t), t ∈ [t_now, t_now + T_pred] for each vehicle V_i within the future prediction period T_pred based on the spatiotemporal features extracted by the encoder. Here, P_i(t) = (x_t, y_t) represents the coordinate vector of vehicle V_i at time t, where t_now is the current time.

[0036] After obtaining the predicted trajectories of each vehicle, such as Figure 5 As shown in the figure, this comparison illustrates the performance of the Spatiotemporal Graph Convolutional Network (ST-GCN) prediction model used in this invention with the traditional LSTM model and Kalman filtering method in predicting vehicle lateral displacement. The results show that, within the same prediction time step, the predicted trajectory generated by the method of this invention has the highest fit with the ground truth trajectory and the smallest error, effectively improving the prediction reliability in high-dynamic scenarios.

[0037] Based on the high-precision trajectory prediction results described above, the system proceeds to the calculation stage of the physical contact window. (Refer to...) Figure 2 For any pair of vehicles V_i and V_j, the system calculates their relative Euclidean distance D_ij(t) = || P_i(t) - P_j(t) ||_2 at each discrete time t within the future prediction period. Then, based on the nominal effective communication radius R of the wireless communication module on the vehicle (this value depends on the specific communication technology; for example, it can be set to 300 meters for Dedicated Short Range Communication (DSRC) technology and 500 meters for Cellular Vehicle-to-Everything (C-V2X) technology), the system iterates through all prediction times and identifies all continuous time intervals that satisfy the communication condition D_ij(t) ≤ R. Each such continuous interval is defined as a physical contact window (denoted as W_ij_k = [t_start_k, t_end_k]), representing the contact opportunity between V_i and V_j predicted in the kth time. Furthermore, to make the subsequent attack feasibility assessment more accurate, the system can also estimate the average communication quality within each physical contact window. This can be achieved by combining the relative speed and distance change rate of the two vehicles within the window with a preset channel environment model (e.g., the Nakagami-m fading model that can simulate multipath effects in urban environments), and finally estimating the average packet loss rate L_avg and the average available bandwidth B_avg within the window.

[0038] Step S300: Attack latency estimation and vectorized modeling based on vulnerability characteristics.

[0039] This step aims to establish a quantitative latency model for each potential exploit, calculating the minimum theoretical time required to successfully execute an attack. This latency is a key criterion for determining whether an attack is feasible within a short physical contact window.

[0040] Specifically, for each identified vulnerability vul_k collected from step S100, the system constructs its attack latency model T_attack(vul_k). This model decomposes the complex attack process into three main stages and estimates the time consumption of each stage.

[0041] The first phase, T_scan, represents the time spent on scanning and handshaking. This part indicates the preparation overhead before the attack, including the attacker's vehicle scanning to discover the target vehicle's open ports and establishing a network transport layer connection, such as the TCP three-way handshake. This time is usually fixed, in the millisecond range, but in a high packet loss rate wireless environment, the actual time will increase accordingly due to possible retransmissions.

[0042] The second stage is the payload transmission time T_transfer, which is the part of the entire attack process most strongly constrained by the duration of physical contact. Its calculation formula can be expressed as T_transfer = S_payload / (B_avg × (1 - L_avg)). Here, S_payload represents the size of the attack payload required to exploit the vulnerability, such as the size of a malicious data packet containing shellcode or a complete malicious firmware update packet, in bits. B_avg is the average available bandwidth within the contact window predicted in step S200, in bits per second. L_avg is the predicted average packet loss rate, and (1 - L_avg) represents the effective data transmission rate.

[0043] The third stage is the execution time T_exec, which refers to the processing time required for the attack payload to complete its intended malicious function after successful transmission to the target vehicle system. This includes code decompression, injection into specific memory addresses, and exploiting vulnerabilities to perform privilege escalation operations. This parameter can be obtained by conducting offline sandbox environment testing on hardware devices of the same model as the target vehicle.

[0044] Ultimately, the total latency required to complete a single-step attack using the vulnerability vul_k is calculated as T_req(vul_k) = T_scan + T_transfer + T_exec. This quantified T_req value provides the core criterion for subsequently constructing an attack graph coupled with physical constraints.

[0045] Step S400: Construct a physical-network coupled spatiotemporal reachability attack graph.

[0046] An important aspect of this step is that a dynamic spatiotemporal reachability attack graph (STRAG) is constructed by strictly coupling the physical contact window predicted in step S200 with the attack time estimated in step S300.

[0047] Reference Figure 3 The rules for constructing this graph are as follows: First, the nodes in the graph are defined as spatiotemporal nodes N(V_i, t), which represent the safety state of vehicle V_i at absolute time t. This representation explicitly introduces the time dimension into the graph.

[0048] Secondly, the core constraint for establishing directed edges in the graph is: for any two vehicles V_i (attacker) and V_j (victim), a directed edge from N(V_i, t_start_k) to N(V_j, t_start_k) is established in the graph only if the system predicts in step S200 that there is a physical contact window W_ij_k = [t_start_k, t_end_k] between them, and the duration of this window ΔT_contact = t_end_k - t_start_k is greater than or equal to the total delay T_req(vul_k) required to attack V_j from V_i using a known vulnerability vul_k. In other words, the key inequality ΔT_contact ≥ T_req(vul_k) must be satisfied. This constraint effectively filters out all attack paths that are physically impossible to complete due to insufficient contact time. Figure 6 As shown, the distribution of physical contact window durations in a vehicle-to-everything (V2X) environment is statistically analyzed. The dashed lines in the figure indicate the total latency T_req required to complete a specific attack. The left region represents invalid window areas with a duration less than T_req; such contacts cannot support the completion of an attack. The right region represents valid window areas with a duration greater than or equal to T_req. This distinction effectively filters out physically infeasible false attack paths.

[0049] Next, rich attribute markers are added to each successfully established directed edge. These markers include the vulnerability it exploits, vul_k, and the "attack opportunity window" in which the attack can occur, i.e., the absolute time interval [t_start_k, t_end_k]. This indicates that the attack can only be initiated and completed within this specific time period.

[0050] Furthermore, to accurately capture "store-carry-forward" attack patterns that exploit vehicle physical mobility, this invention introduces internal state transition edges in the diagram. For example... Figure 3 As shown, for the same vehicle V_i, the system establishes internal directed edges between its state nodes at different times, for example, from N(V_i, t1) to N(V_i, t2) (where t2>t1). This edge represents the vehicle V_i being infected at time t1, carrying a malicious payload, and physically moving on the road until it encounters a new attack target at time t2. This modeling method allows for the discovery of covert attack paths that involve multiple hops and span long time intervals. Figure 8 As shown in the figure, this diagram vividly illustrates the three-stage process of a cross-temporal and spatial attack utilizing the physical mobility of vehicles. Time t1 (Injection Stage): The source vehicle (V_A) successfully injects a malicious payload into the relay vehicle (V_C); Time t2 (Carrying and Transport Stage): The infected V_C, without network connectivity, physically carries and stores the malicious payload while moving; Time t3 (Contact and Propagation Stage): V_C encounters the target vehicle (V_B) and releases the attack while meeting the attack time consumption requirements. This diagram visually explains the modeling mechanism of the covert propagation path in this invention.

[0051] Step S500: Proactive prediction and threat assessment of attack paths.

[0052] After constructing the dynamic spatiotemporal reachability attack graph, this step uses a graph search algorithm to analyze the graph in order to predict potential attack paths and assess their threat level.

[0053] Specifically, the system can employ a breadth-first search (BFS) algorithm or a time-optimized Dijkstra algorithm to traverse the STRAG starting from one or more known infection source nodes (e.g., malicious vehicles flagged by security intelligence). The goal of the search is to find all paths that can reach predefined high-value target nodes, which could be autonomous driving domain controllers that control the core driving functions of the vehicle, or specific vehicles that can access the cloud core gateway.

[0054] For each potential attack path identified, the system calculates a series of key evaluation metrics for quantitative assessment. These metrics may include: path existence probability, which combines the success probability of each hop (i.e., each edge) on the path, and the success probability of each hop depends on the confidence score of the vehicle trajectory prediction that constitutes the hop and the success probability of establishing a communication connection within the physical contact window; earliest arrival time, which is the earliest possible moment when the attack starts from the source and propagates along the path to the target node. This metric is crucial for the security response system because it defines the available defense time window; and bottleneck analysis, which identifies vehicle nodes or communication links shared by multiple high-risk paths by analyzing all paths. These "single-point-dependent" bottlenecks are the highest priority targets for implementing blocking strategies.

[0055] Step S600: Generate and execute the adaptive blocking strategy.

[0056] Based on the prediction results of step S500, this step aims to generate and execute the optimal proactive blocking strategy to effectively intervene before the attack actually occurs.

[0057] Optionally, the blocking strategy may include several types, and the system may select one or more combinations to execute based on the severity of the threat, available resources, and impact on traffic efficiency.

[0058] The first method is targeted micro-patch distribution. Once a critical "bridge node" vehicle is identified, the system predicts that this vehicle will have a high-quality, high-bandwidth connection opportunity with a trusted roadside unit or other patched vehicles at a future time. Utilizing this time window, the system prioritizes pushing lightweight security micro-patches (hotpatches) specifically designed to fix the vulnerabilities exploited on the path to this vehicle. This approach avoids distributing large, complete firmware, achieving rapid and accurate vulnerability fixes, thereby effectively "melting down" critical attack edges in the attack graph.

[0059] The second method is spatiotemporal virtual isolation. The system sends defense commands to vehicles downstream of the predicted attack path that are not yet infected but have vulnerabilities. These commands temporarily disable specific network service ports or adjust firewall policies within the predicted "attack opportunity window," thereby logically avoiding potential attack connections. Alternatively, the command could temporarily reduce wireless transmission power, physically shortening the communication distance so that the physical contact window is insufficient to complete the attack.

[0060] The third type is active maneuvering avoidance, a physical layer defense mechanism, particularly suitable for highly automated vehicles. (See reference...) Figure 4 This method is implemented by introducing a defensive trajectory fine-tuning algorithm based on spatiotemporal gradients. Specifically, the algorithm first establishes a virtual spatiotemporal repulsion potential field around the predicted trajectory of the identified infected vehicles. The strength of the potential field is directly proportional to the threat level of the infected vehicle and inversely proportional to the spatiotemporal distance. Then, a cost function is established for susceptible vehicles, which can take the form of... The first term represents the defense trajectory P. def Compared to the original navigation trajectory P orig The physical deviation cost is used to ensure driving smoothness and passenger comfort. The second term represents the instantaneous risk value of the vehicle in the threat potential field. α and β are adjustable weight coefficients. The algorithm solves this cost function using optimization methods such as gradient descent, finding the optimal fine-tuning trajectory with the minimum cost while satisfying the safety constraint of compressing the potential physical contact time with the infected vehicle to below the attack delay T_req. Figure 4 and Figure 9 As shown, the final defense trajectory P def It is possible that by subtly adjusting vehicle speed or making a gentle lane change in advance, the necessary conditions for an attack could be actively and physically disrupted without affecting traffic safety. For example... Figure 9The diagram details an active defense mechanism based on a spatiotemporal repulsion potential field. Concentric circles in the diagram represent the potential field constructed around the attacking vehicle (V_A). The original navigation trajectory of the vulnerable vehicle (gray dashed line) is assessed as dangerous because it crosses a high-risk zone. The system generates an evasive trajectory (green solid line) that actively decelerates or changes lanes by optimizing the objective function (min Cost = α·deviation + β·risk value). The results show that V_B successfully avoids the effective attack range of V_A, resulting in the destruction of the physical contact window (contact duration ΔT is less than the attack delay T_req), thus achieving active defense at the physical level.

[0061] The fourth method involves honeypot deception and redirection. At key nodes of the predicted attack path, the system can instruct certain qualified vehicles or roadside units to dynamically activate a highly interactive honeypot service. This honeypot simulates a vulnerable vehicle system to induce attackers to connect and consume their resources and time. Simultaneously, the security system can fully capture the attacker's behavioral characteristics, attack payload, and technical methods, providing valuable intelligence for subsequent threat attribution and upgrades to the overall defense system.

[0062] Example 2 This embodiment provides a device for proactively predicting and blocking network attack paths. This device can be a hardware entity deployed on a cloud server, edge computing node, or integrated into a roadside unit, or a set of functions implemented through software. This device is used to execute the method described in Embodiment 1.

[0063] The device specifically includes: The data acquisition module is configured to perform the function described in step S100, namely, to collect multi-dimensional status data of the vehicle network environment in the target area in real time, including vehicle physical motion status data and cyberspace security status data.

[0064] The trajectory prediction module is configured to perform the function described in step S200, namely, to use artificial intelligence algorithms, such as deep learning models based on ST-GCN and LSTM, to perform in-depth analysis on the collected physical motion state data, predict the spatiotemporal trajectory of the vehicle in the future, and calculate the potential physical communication contact window between vehicles and its communication quality parameters accordingly.

[0065] The attack latency estimation module is configured to perform the function described in step S300, namely, to analyze cyberspace security status data, construct time consumption models for different vulnerability exploitation behaviors, and calculate the minimum theoretical latency required for a successful attack according to the formula T_req(vul_k) = T_scan + T_transfer + T_exec.

[0066] The attack graph construction module is configured to perform the function described in step S400, namely, to construct a physical-network coupled spatiotemporal reachability attack graph (STRAG) based on the coupling constraint condition of physical contact window duration and attack completion delay (ΔT_contact ≥ T_req(vul_k)) and to model the "store-carry-forward" pattern.

[0067] The path prediction module is configured to perform the function described in step S500, namely, based on the constructed spatiotemporal reachability attack graph, using a graph search algorithm to predict all potential attack paths from known infection sources to high-value targets, and to perform threat assessment.

[0068] And a blocking strategy generation module, which is configured to perform the function described in step S600, namely, to generate and distribute one or more optimized proactive blocking strategies based on the predicted set of effective attack paths and threat assessment results, such as targeted micro-patch distribution, spatiotemporal virtual isolation, proactive maneuvering avoidance, or honeypot deception and redirection.

[0069] Example 3 This embodiment illustrates, through a specific application scenario, how the method of the present invention can be applied to an urban expressway environment to identify and block a complex attack that exploits vehicle mobility and is difficult to detect using traditional methods.

[0070] In this scenario, assume the initially infected vehicle V_A carries a malicious firmware update package targeting the in-vehicle infotainment system. This firmware package exploits the CVE-202X-AAAA vulnerability, with a payload size S_payload of 10 megabytes (MB). The target vehicle V_B also has this vulnerability. An intermediate vehicle V_C also has this vulnerability in its system.

[0071] First, in step S100, the system collects physical motion data and cybersecurity status data of vehicles V_A, V_B, and V_C through the sensing devices of the roadside unit. Physical data shows that V_A and V_B are traveling towards each other on an eight-lane, two-way urban expressway at a relative speed of 160 km / h. V_C is traveling in the same direction as V_A and is behind V_A. Cybersecurity data shows that V_A has been identified as the source of infection, and both V_B and V_C have the vulnerability CVE-202X-AAAA.

[0072] Next, step S200 is executed, where the trajectory prediction module processes the collected data. The model predicts that V_A and V_B will intersect in 15 seconds. Based on the predicted trajectories of the two vehicles and the DSRC communication radius of 300 meters, the duration ΔT_contact(AB) of the physical contact window W_AB^(1) between them is calculated to be only 11.2 seconds. At the same time, the model predicts that V_A and V_C traveling in the same direction will maintain a stable distance and will maintain a communication connection for several minutes in the future, with the duration ΔT_contact(AC) of their physical contact window W_AC^(1) exceeding 180 seconds.

[0073] Subsequently, step S300 is executed, and the attack latency estimation module analyzes the vulnerability CVE-202X-AAAA. Considering the payload size of 10MB, and the predicted average available bandwidth B_avg of 2 megabits per second (Mbps) in the urban expressway wireless channel environment, and the average packet loss rate L_avg of 5%, the payload transmission time T_transfer = (10 MB * 8 bits / byte) / (2 Mbps * (1 - 0.05)) ≈ 42.1 seconds is calculated. Adding the scanning handshake and execution time, the total attack latency T_req(CVE-202X-AAAA) is estimated to be 43 seconds.

[0074] Then, step S400 is executed, and the system constructs a spatiotemporal reachability attack graph. For the interaction between V_A and V_B, since the predicted physical contact window duration ΔT_contact(AB) is 11.2 seconds, which is less than the total attack latency T_req of 43 seconds, the condition ΔT_contact ≥ T_req is not satisfied. Therefore, a direct attack edge from V_A to V_B will not be established in the spatiotemporal reachability attack graph. For example... Figure 7 The diagram illustrates the dynamic communication environment in an urban expressway scenario. It includes roadside units (RSUs), attacking vehicles (V_A), vulnerable vehicles (V_B), and relay vehicles (V_C). Dashed arrows indicate unstable V2V links established between V_A and V_B, clearly indicating that their "physical contact window < attack latency," thus the system judges them as invalid attack windows and intercepts them. Solid blue arrows indicate stable V2V links between V_B and V_C. This diagram visually illustrates the crucial role of physical contact duration in attack detection. This step eliminates false alarms that may arise from existing technologies that rely solely on network connectivity; that is, at the physical level, V_A cannot complete an attack on V_B within a short contact window. However, for V_A and V_C, their contact window duration ΔT_contact(AC) is much greater than the attack latency T_req, satisfying the conditions for establishing an attack edge. Therefore, an effective attack edge from V_A to V_C is established in the diagram.

[0075] Furthermore, the trajectory prediction module continues to run and predicts that after vehicle V_C is infected by V_A, it will leave the expressway after 5 minutes and drive alongside target vehicle V_B for a long time at a traffic light intersection. The predicted physical contact window W_CB^(1) duration ΔT_contact(CB) is 75 seconds. Since 75 seconds is also longer than the 43 seconds required for the attack, the system establishes an attack edge from V_C to V_B in the spatiotemporal reachability attack graph.

[0076] Finally, steps S500 and S600 are executed. Using a graph search algorithm, the system discovers a complete, two-stage "store-carry-forward" attack path: V_A -> V_C -> V_B. This path reveals that the attacker first utilizes a long window of time when V_A and V_C travel in the same direction to complete the infection, then uses V_C as a springboard to pass the threat to V_B in its subsequent journey. Based on this accurate prediction, the system generates a proactive blocking strategy. Before predicting that V_A will infect V_C, the system queries that V_C's planned path will pass through an area deployed with a high-bandwidth roadside unit. The strategy generation module immediately decides to prioritize pushing a lightweight security micro-patch for CVE-202X-AAAA to V_C through this roadside unit. After V_C successfully receives and applies the patch, its vulnerability is fixed, thus rendering the attack edges from V_A to V_C and subsequently from V_C to V_B ineffective, fundamentally blocking this potential attack path.

[0077] The above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for proactive prediction and blocking of network attack paths based on threat propagation simulation, characterized in that, Includes the following steps: Step 1: Collect multi-dimensional status data of vehicles within the target area. The multi-dimensional status data includes the physical motion status data of the vehicles and the cyberspace security status data. Step 2: Based on the physical motion state data, a deep learning trajectory prediction model is constructed to generate the position coordinate sequence of each vehicle within the future prediction period. Based on the position coordinate sequence and the effective communication radius of the vehicle wireless communication module, the physical contact window formed between any two vehicles is calculated, and the duration of the physical contact window is obtained. Step 3: Based on the vulnerabilities identified in the cyberspace security status data, construct an attack latency model for the vulnerabilities to calculate the total latency required to complete an attack. Step 4: Construct a physical-network coupled spatiotemporal reachability attack graph. The construction process is based on the comparison between the duration of the physical contact window and the total delay to determine the directed connection relationship between vehicle nodes. Step 5: Based on the spatiotemporal reachability attack graph, use a graph search algorithm to search for and predict potential attack paths that can reach the predetermined target node, starting from the known infection source nodes. Step 6: Based on the potential attack path, generate an active blocking strategy and distribute it to network units or vehicles related to the potential attack path for execution.

2. The method according to claim 1, characterized in that, In step one, the physical motion state data is collected, including the vehicle's unique identifier, three-dimensional spatial coordinates, three-dimensional velocity vector, acceleration vector, and historical driving trajectory sequence; the cyberspace security state data is collected, including the operating system version and firmware version of the in-vehicle infotainment system and telematics processor, the list of currently open network ports, known unpatched security vulnerabilities, and their corresponding general vulnerability scoring system scores.

3. The method according to claim 1, characterized in that, In step two, constructing the deep learning trajectory prediction model specifically involves: constructing a model based on an encoder-decoder architecture, wherein the encoder part uses a spatiotemporal graph convolutional network to capture the spatial interaction relationships and temporal dependencies of the vehicle group; the decoder part uses a long short-term memory network or a Transformer network structure to generate the position coordinate sequence of each vehicle within the future prediction period; step two also includes: for each physical contact window, combining the relative speed and distance change rate of the two vehicles with a preset channel environment model, estimating the average packet loss rate and average available bandwidth within the window.

4. The method according to claim 1, characterized in that, In step three, calculating the total latency required to complete an attack specifically includes summing the scanning and handshake time, payload transmission time, and execution time; wherein, the payload transmission time is calculated based on the attack payload size required to exploit the vulnerability, the average available bandwidth within the physical contact window, and the average packet loss rate.

5. The method according to claim 1, characterized in that, In step four, constructing the spatiotemporal reachability attack graph specifically includes: defining nodes in the spatiotemporal reachability attack graph as spatiotemporal nodes, where each spatiotemporal node represents the safe state of a vehicle at the corresponding absolute moment related to the physical contact window; establishing directed edges between the spatiotemporal nodes corresponding to the attacking vehicle and the attacked vehicle, and marking the attack opportunity window, if and only if the duration of the physical contact window is greater than or equal to the total delay; and establishing internal state transition edges between state nodes of the same vehicle at different times, in order to model the process of the attack payload being physically carried by the vehicle.

6. The method according to claim 1, characterized in that, Step five further includes: for each predicted potential attack path, calculating evaluation metrics, including the path existence probability, the earliest arrival time of the attack payload propagating along the path to the target node, and identifying bottleneck vehicle nodes on the path.

7. The method according to claim 1, characterized in that, In step six, the active blocking strategy includes an active maneuvering avoidance strategy, and the generation of the active maneuvering avoidance strategy specifically includes: A spatiotemporal repulsion potential field is established around the predicted trajectory of the identified infected vehicle, and the strength of the potential field is proportional to the threat level of the infected vehicle. A cost function is established for vulnerable vehicles downstream of the potential attack path, where a vulnerable vehicle is a vehicle downstream of the attack path that has a vulnerability that can be exploited. The cost function is of the form: , where P def (t) represents the defense trajectory, P orig (t) represents the original navigation trajectory, Risk(P) def (t) represents the instantaneous risk value of the vehicle at time t in the spatiotemporal repulsive potential field. For the current moment, The future prediction period is defined as α and β, which are weighting coefficients. The cost function is solved by an optimization method. Under the constraint of compressing the potential physical contact time with the infected vehicle to below the total delay, the optimized fine-tuning trajectory with the minimum cost is found and the susceptible vehicle is instructed to execute it.

8. The method according to claim 1, characterized in that, In step six, the proactive blocking strategy includes a targeted micro-patch distribution strategy. The generation of the targeted micro-patch distribution strategy specifically includes: identifying bridge node vehicles where multiple potential attack paths intersect, and taking advantage of the time window in which the bridge node vehicles have a connection with roadside units or trusted vehicles with bandwidth greater than a preset threshold at a certain time in the future, prioritizing the push of security micro-patches to them to fix the relevant vulnerabilities; wherein, trusted vehicles are vehicles whose certified security status meets preset standards.

9. The method according to claim 1, characterized in that, In step six, the active blocking strategy includes at least one of a spatiotemporal virtual isolation strategy and a honeypot deception and redirection strategy. The generation of the spatiotemporal virtual isolation strategy specifically includes: sending a defense command to vulnerable vehicles downstream of the potential attack path, causing them to temporarily shut down a preset network service port or reduce wireless transmission power during the physical contact window. The generation of the honeypot deception and redirection strategy specifically includes: at key nodes of the potential attack path, instructing vehicles or roadside units with honeypot service deployment capabilities to dynamically activate a highly interactive honeypot service that simulates the functions of a complete operating system. The highly interactive honeypot service simulates the characteristics of vulnerable vehicles to induce attackers to connect and capture attack behavior characteristics.

10. A device for actively predicting and blocking network attack paths, characterized in that, include: The data acquisition module is configured to collect multi-dimensional status data of vehicles within the target area, including physical motion status data and cyberspace security status data of the vehicles. The trajectory prediction module is configured to construct a deep learning trajectory prediction model based on the physical motion state data to generate a sequence of position coordinates of each vehicle within a future prediction period, and to calculate the physical contact window formed between any two vehicles based on the position coordinate sequence and the effective communication radius of the vehicle wireless communication module, thereby obtaining the duration of the physical contact window. The attack latency estimation module is configured to construct an attack latency model for the identified vulnerabilities in the cyberspace security status data, so as to calculate the total latency required to complete an attack. The attack graph construction module is configured to construct a physical-network coupled spatiotemporal reachability attack graph. The construction process is based on the comparison between the duration of the physical contact window and the total delay to determine the directed connection relationship between vehicle nodes. The attack path prediction module is configured to search and predict potential attack paths that can reach the predetermined target node based on the spatiotemporal reachability attack graph using a graph search algorithm, starting from the known infection source node. The proactive blocking policy generation module is configured to generate a proactive blocking policy based on the potential attack path and distribute it to network units or vehicles related to the potential attack path for execution.

Images