Internet of vehicles false data injection attack detection method based on federated learning

Abstract

The invention relates to the technical field of Internet of Vehicles security, in particular to an Internet of Vehicles false data injection attack detection method based on federated learning, which comprises the following steps: firstly, remodeling the original features of a vehicle basic security message through a time window, and processing spatial input features by a sliding alignment strategy; then, a BiLSTM is used for capturing a time sequence dependency relationship, and a lightweight Transform parallel modeling global space relationship is designed; and further dynamically calculating an attention score through a feature fusion weight matrix, realizing double-branch dimension-level dynamic weighting, performing dimension reduction in combination with a difference pooling strategy, and coupling a classifier. And the road side unit performs global aggregation based on a weighting strategy of node reputation and contribution degree, and distributes the global aggregation to node vehicles for a new round of incremental training. The method effectively solves the problem that traditional centralized learning cannot give consideration to privacy protection and lightweight calculation in the detection of the false data injection attack of the Internet of Vehicles, and remarkably improves the detection effect of the false data injection attack.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, specifically to a method for detecting fake data injection attacks in vehicle networks based on federated learning. Background Technology

[0002] In wireless communication networks, based on the spatiotemporal dynamic behavior of vehicles and the collaborative perception of roadside infrastructure, vehicle-to-everything (V2X) networks can achieve real-time interaction of traffic information, providing support for intelligent transportation and autonomous driving. However, this highly distributed, heterogeneous, and interconnected nature exposes V2X networks to multi-dimensional attack surfaces. Under the control of attackers, malicious vehicles can send forged data in basic security messages, misleading other vehicles in judging the state of traffic events. For example, deliberate deception attacks such as fake data injection can inject forged traffic data packets to guide vehicles to make incorrect decisions, directly jeopardizing the security and efficiency of V2X networks.

[0003] To address the aforementioned issues, traditional methods for detecting fake data injection attacks identify potential attack behaviors by collecting and analyzing communication data streams in the Internet of Vehicles (IoV). Among these methods, machine learning-based approaches are widely used due to their superiority in network traffic classification and anomaly detection. However, compared to traditional machine learning methods, deep learning is considered to have greater potential in threat discovery due to its superior automatic feature extraction and high-dimensional representation capabilities.

[0004] However, existing systems still face two key challenges in detecting spoofed data injection attacks. First, basic security messages in the Internet of Vehicles (IoV) exhibit significant spatiotemporal dynamics, including multimodal information such as vehicle location, speed, timestamps, and signal strength. Existing attack identification methods are insufficient in modeling and fusing these spatiotemporal features, making it difficult to accurately capture complex attack behavior patterns. Second, traditional attack detection methods typically rely on centralized big data analytics architectures, which are susceptible to dynamic changes in IoV topology, surges in data volume, and network bandwidth limitations. Centralized methods also face the risk of sensitive data leakage and single points of failure during data sharing, further weakening the system's reliability and robustness, and directly contradicting data sovereignty regulations such as the EU's General Data Protection Regulation (GDPR). Summary of the Invention

[0005] The purpose of this invention is to provide a method for detecting fake data injection attacks in vehicle-to-everything (V2X) networks based on federated learning, aiming to improve the accuracy of detecting fake data injection attacks in V2X networks with significant spatiotemporal dynamic characteristics.

[0006] To achieve the above objectives, this invention provides a method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning, comprising the following steps: Step 1: Perform time window segmentation and sliding sample alignment on the original features of the vehicle basic safety message, which contains vehicle spatial location, speed information, and communication signal feature data, and then align the original feature matrix. The samples are divided into sequences based on window length T and step size S, and each feature is standardized to ensure that the temporal and spatial branches remain synchronized and aligned with the input samples in the subsequent fusion stage. Step 2: Construct a dual-branch feature extraction model on the vehicle terminal side. This model includes a bidirectional BiLSTM branch for modeling temporal dependencies and a structured-pruned Transformer encoder branch for modeling spatial relationships between vehicles. Both branches output dimensions of [dimensions to be filled in]. eigenvectors; Step 3: Design a dynamic weight matrix to perform dimensional attention weighting on spatiotemporal features, compress features from the spatiotemporal dual-branch output features through global average pooling and global max pooling, then concatenate and fuse them, and output the attack detection results through a fully connected classifier; Step 4: Each vehicle terminal uploads its local model update to the federation server. The federation server performs weighted aggregation of the model updates of each node based on a dynamic weighting strategy of node reputation to obtain a global model, and periodically distributes it to each vehicle terminal to achieve collaborative updates and dynamic adaptation to malicious environments.

[0007] Optionally, in step 1, the time window segmentation involves dividing the basic vehicle safety information into segments according to a preset time interval. The sliding sample alignment strategy uses a sliding window mechanism to ensure that the time series data and spatial data remain synchronized when inputting into the model. The specific implementation process is as follows: For the input original feature vector … For the original feature matrix N is the total number of original samples, and d is the feature dimension of each message. By window length With step size Perform overlapping segmentation to obtain the number of windows. Each window contains T consecutive time steps. For time segments shorter than T, a zero-padding strategy is used; missing time steps are padded with zeros. The temporal branch input tensor is defined as follows: its first Each window corresponds to: To ensure dimensionality consistency of the dual-branch features in subsequent fusion stages, the spatial branch employs in-window mean aggregation to form a "one sample per window" input aligned with the temporal branch. Calculate the feature mean vector within each window. : get Generate a matrix of aggregated means for all windows, with each row corresponding to the feature mean of one window, and then reshape it into... We obtain a tensor form with an increased sequence dimension of length 1, and then perform a linear projection: in, For spatial branch input, Let be the projection weight matrix. For bias vectors, To hide spatial dimensions; All features are standardized using z-scores for each column before windowing. x represents the original feature value. The mean, Standard deviation These are the standardized feature values.

[0008] Optionally, the BiLSTM network with bidirectional BiLSTM branch includes an input layer, a hidden layer, and an output layer. Each layer adopts a bidirectional long short-term memory unit structure to capture the forward and backward temporal dependencies of vehicle behavior data. BiLSTM No. The calculation process for the layer is as follows: in, and They represent the first Layer in time step The forward and backward hidden states, and For the corresponding memory unit state, and For the LSTM parameter set, The input features of the current layer are derived from the output of the previous BiLSTM layer. Each network layer is followed by a batch normalization layer and a Dropout layer, resulting in a final output tensor shape of... ,in That is, the current number The output of the layer, Given the hidden state dimension of a unidirectional LSTM, output the total dimension. Including forward LSTM 3D features and backward LSTM Dimensional features.

[0009] Optionally, the Transformer encoder branch adopts an encoder structure, reduces model parameters through pruning operations, and retains the key self-attention mechanism for modeling spatial relationships between vehicles, including: Attention head pruning: retain the head with the highest score, with at least 2 heads retained; Feedforward network intermediate layer channel pruning: prune according to channel importance, with the intermediate dimension set to [value missing]. After pruning, it should be no less than The global pruning rate is fixed between [0.3, 0.7], and the total number of parameters after pruning is ensured not to exceed the pre-set end-side budget limit. A multi-head attention mechanism with h attention heads is employed. For each attention head i, the calculation of the query, key, and value matrix is ​​defined as follows: : in , , For the corresponding parameter matrix; when the sequence length is 1, that is, each window is aggregated by mean to obtain a single element sequence, the scaling dot product attention of multi-head attention degenerates into channel recalibration of the single vector: the output is equivalent to learnable gating in the channel dimension; The output retains its dimensionality after residual connection and layer normalization. The calculation of attention weights between features is simplified to: Represents the attention weight matrix. represent Matrix inversion, As a scaling factor, the output of each attention head is calculated as follows: Multi-head attention output is obtained through concatenation and linear transformation: To output the projection matrix, the feedforward network employs a two-layer fully connected structure. The first layer introduces a nonlinear transformation through the ReLU activation function, while the second layer ensures the consistency of the output features with the input dimension through a dimension restoration operation. Each attention head is followed by a residual connection and a layer normalization module, which, together with the Dropout mechanism, forms a complete regularization chain. The final output tensor shape is... .

[0010] Optionally, during the execution of step 3, the dynamic weight matrix dynamically adjusts the weight allocation according to the importance of the input features, and the dimension-level attention weighting mechanism calculates the attention weight for each dimension of the spatiotemporal features, specifically including: Output for any branch Timing branch Spatial branch Calculate dimensional attention; In batch and sequence flattening Using trainable weight matrices and bias vector Calculate attention score: Attention score matrix By normalizing using Softmax, we obtain the probabilistic weight matrix, which allows us to determine the weight of each sample. Weight distribution on the dimension: Subsequently, the Hadamard product is used to dynamically weight the features, resulting in the weighted feature representation. Then reshape it back to its original shape to obtain .

[0011] Optional, timing branch output Output through global average pooling Spatial branch output Then output using global max pooling. When the sequence dimension is 1, the result of max pooling is equal to the tensor itself with that dimension removed. The pooled temporal and spatial features are merged into a unified feature representation through a concatenation operation: The fused feature vectors are processed sequentially through two fully connected network layers, with batch normalization and Dropout mechanisms introduced after each layer. The classification probability is output through the fully connected layer activated by Softmax, thereby classifying the input samples.

[0012] Optionally, step 4 dynamically evaluates the reputation of each participating node based on historical reputation, contribution, response latency, computational latency, and communication anomaly, employing an interval grouping cooling and callback mechanism, anti-score-cheating operations, and adaptive isolation decisions, specifically including: The dynamic evaluation and updating method for intelligent vehicle reputation incorporates historical reputation, contribution level, response timeliness, computational latency, and communication anomaly rate into the single-step dynamic reputation update. The update formula is as follows: in, To update the weights, and satisfy the following conditions: , For the first The intelligent vehicle node is at the The reputation value of a time slot, As the response factor, Adjust the time decay parameter for the response factor. This is the training round number of the node that last successfully participated in aggregation and passed the integrity check; The time spent on this round of end-side training and uploading Perform interval normalization. ,in , In the near Statistics obtained within the wheel; It is a communication connection anomaly factor, determined by packet loss rate. retransmission rate With hash consistency failure rate Linear composition: , Each proportion is fixed as a constant during system deployment; in For server-based fixed verification sets Approximate calculation of contribution, Indicates in The precision of the aggregation function is given by Agg, where Agg is the reputation-weighted aggregation function. This is the global model from the previous round before this round of aggregation. The set of nodes participating in this round of aggregation. This is the set of parameters for all local models participating in this aggregation round. To remove a node from the node set P The set of remaining node parameters; Reputation value of all nodes Normalized to [0,1], and divided into four tiers: High Reputation Group: ≥0.8; Higher credit group: 0.6≤ <0.8; Medium credit group: 0.4≤ <0.6; Low-reputation group: <0.4; For nodes that simultaneously satisfy "outlier" and "consistency anomaly" after nearest neighbor clustering and model fingerprint comparison, mark them as "under observation": do not remove them, only process their aggregation weight according to the lower limit of the low reputation group in this round; continuous Once the wheel returns to normal, the marker is removed, and the cycle continues. If a round is found to be abnormal, it will be demoted to the low-reputation group and isolated.

[0013] Optionally, in step 4, during client-side federated aggregation, a piecewise function is used for dynamic weighting based on reputation level. The global model aggregation weight is affected by the reputation of each node, with low-reputation or abnormal nodes having decreasing weights. A cooling window and a reputation increase cap are added to prevent malicious operations, specifically including: During aggregation, the weight of each client is determined by a piecewise function based on its grouping. The allocation is as follows: The global aggregation formula is as follows: in For the local model parameters uploaded by the i-th client, Set the set of participating nodes selected in this round; set a cooling window and increase limit for nodes whose reputation rises rapidly in a short period of time to prevent them from circumventing security monitoring by boosting their scores in a short period of time; W represents the cooling window length and the maximum allowed reputation jump. Maximum single-step increase ,like Therefore, the actual credit rating in this round is corrected as follows: like Then the actual credit only increases If a node reaches the single-step threshold more than twice within a window of any length W, the aggregation weight in this round will be directly processed according to the lower limit of the low reputation group, and added to the observation list for subsequent tracking.

[0014] This invention provides a federated learning-based method for detecting fake data injection attacks in connected vehicles. It reconstructs the original features of basic vehicle safety messages through a time window and processes spatial input features using a sliding alignment strategy. Then, it utilizes BiLSTM to capture temporal dependencies and designs a lightweight Transformer to model global spatial relationships in parallel. Furthermore, it dynamically calculates attention scores through feature fusion weight matrices, achieving dynamic weighting at the dual-branch dimensionality level. This is combined with differential pooling for dimensionality reduction and coupled with a classifier. Roadside units are globally aggregated based on a weighted strategy of node reputation and contribution, and distributed to node vehicles for a new round of incremental training. This invention effectively solves the problem that traditional centralized learning cannot balance privacy protection and lightweight computation in detecting fake data injection attacks in connected vehicles, and significantly improves the detection performance against such attacks. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1This is a simplified schematic diagram illustrating the execution steps of a method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning, according to the present invention. Detailed Implementation

[0017] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0018] This invention provides a method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning, comprising the following steps: Step 1: Perform time window segmentation and sliding sample alignment on the original features of the vehicle basic safety message, which contains vehicle spatial location, speed information, and communication signal feature data, and then align the original feature matrix. The samples are divided into sequences based on window length T and step size S, and each feature is standardized to ensure that the temporal and spatial branches remain synchronized and aligned with the input samples in the subsequent fusion stage. Step 2: Construct a dual-branch feature extraction model on the vehicle terminal side. This model includes a bidirectional BiLSTM branch for modeling temporal dependencies and a structured-pruned Transformer encoder branch for modeling spatial relationships between vehicles. Both branches output dimensions of [dimensions to be filled in]. eigenvectors; Step 3: Design a dynamic weight matrix to perform dimensional attention weighting on spatiotemporal features, compress features from the spatiotemporal dual-branch output features through global average pooling and global max pooling, then concatenate and fuse them, and output the attack detection results through a fully connected classifier; Step 4: Each vehicle terminal uploads its local model update to the federation server. The federation server performs weighted aggregation of the model updates of each node based on a dynamic weighting strategy of node reputation to obtain a global model, and periodically distributes it to each vehicle terminal to achieve collaborative updates and dynamic adaptation to malicious environments.

[0019] The following provides further explanation with reference to specific embodiments and execution steps: In step 1, the time window segmentation involves dividing the basic vehicle safety information into segments according to a preset time interval. The sliding sample alignment strategy uses a sliding window mechanism to ensure that the time series data and spatial data remain synchronized when inputting into the model. The specific implementation process is as follows: For the input original feature vector … For the original feature matrix N is the total number of original samples, and d is the feature dimension of each message. By window length With step size Perform overlapping segmentation to obtain the number of windows. Each window contains T consecutive time steps. For time segments shorter than T, a zero-padding strategy is used; missing time steps are padded with zeros. The temporal branch input tensor is defined as follows: its first Each window corresponds to: To ensure dimensionality consistency of the dual-branch features in subsequent fusion stages, the spatial branch employs in-window mean aggregation to form a "one sample per window" input aligned with the temporal branch. Calculate the feature mean vector within each window. : get Generate a matrix of aggregated means for all windows, with each row corresponding to the feature mean of one window, and then reshape it into... We obtain a tensor form with an increased sequence dimension of length 1, and then perform a linear projection: in, For spatial branch input, Let be the projection weight matrix. For bias vectors, To hide spatial dimensions; All features are standardized using z-scores for each column before windowing. x represents the original feature value. The mean, Standard deviation These are the standardized feature values.

[0020] The BiLSTM network with bidirectional BiLSTM branch includes an input layer, a hidden layer, and an output layer. Each layer adopts a bidirectional long short-term memory unit structure to capture the forward and backward temporal dependencies of vehicle behavior data. BiLSTM No. The calculation process for the layer is as follows: in, and They represent the first Layer in time step The forward and backward hidden states, and For the corresponding memory unit state, and For the LSTM parameter set, The input features of the current layer are derived from the output of the previous BiLSTM layer. Each network layer is followed by a batch normalization layer with a Dropout ratio of 0.3, resulting in a final output tensor shape of... ,in That is, the current number The output of the layer, Given the hidden state dimension of a unidirectional LSTM, output the total dimension. Including forward LSTM 3D features and backward LSTM Dimensional features.

[0021] Optionally, the Transformer encoder branch adopts an encoder structure, reduces model parameters through pruning operations, and retains the key self-attention mechanism for modeling spatial relationships between vehicles, including: Attention head pruning: retain the head with the highest score, with at least 2 heads retained; Feedforward network intermediate layer channel pruning: prune according to channel importance, with the intermediate dimension set to [value missing]. After pruning, it should be no less than The global pruning rate is fixed between [0.3, 0.7], and the total number of parameters after pruning is ensured not to exceed the pre-set end-side budget limit. A multi-head attention mechanism with h attention heads is employed. For each attention head i, the calculation of the query, key, and value matrix is ​​defined as follows: : in , , For the corresponding parameter matrix; when the sequence length is 1, that is, each window is aggregated by mean to obtain a single element sequence, the scaling dot product attention of multi-head attention degenerates into channel recalibration of the single vector: the output is equivalent to learnable gating in the channel dimension; The output retains its dimensionality after residual connection and layer normalization. The calculation of attention weights between features is simplified to: Represents the attention weight matrix. represent Matrix inversion, As a scaling factor, the output of each attention head is calculated as follows: Multi-head attention output is obtained through concatenation and linear transformation: To output the projection matrix, the feedforward network employs a two-layer fully connected structure with dimensionality variations of 64, 256, and 64. The first layer introduces a non-linear transformation using the ReLU activation function, while the second layer uses a dimension restoration operation to ensure consistency between the output features and the input dimensions. Each attention head is followed by a residual connection and a layer normalization module, which, together with the Dropout=0.3 mechanism, forms a complete regularization chain. The final output tensor shape is... .

[0022] During the execution of step 3, the dynamic weight matrix dynamically adjusts the weight allocation according to the importance of the input features, and the dimension-level attention weighting mechanism calculates the attention weight for each dimension of the spatiotemporal features, specifically including: Output for any branch Timing branch Spatial branch Calculate dimensional attention; In batch and sequence flattening Using trainable weight matrices and bias vector Calculate attention score: Attention score matrix By normalizing using Softmax, we obtain the probabilistic weight matrix, which allows us to determine the weight of each sample. Weight distribution on the dimension: Subsequently, the Hadamard product is used to dynamically weight the features, resulting in the weighted feature representation. Then reshape it back to its original shape to obtain .

[0023] Timing branch output Output through global average pooling Spatial branch output Then output using global max pooling. When the sequence dimension is 1, the result of max pooling is equal to the tensor itself with that dimension removed. The pooled temporal and spatial features are merged into a unified feature representation through a concatenation operation: The fused feature vectors are processed sequentially through two fully connected network layers, with batch normalization and Dropout=0.3 mechanisms introduced after each layer. The classification probability is output through the fully connected layer activated by Softmax, thereby classifying the input samples.

[0024] Step 4 dynamically evaluates the reputation of each participating node based on historical reputation, contribution, response latency, computation latency, and communication anomaly. It employs an interval grouping cooling-off and callback mechanism, anti-fraud measures, and adaptive isolation decisions. Specifically, this includes: The dynamic evaluation and updating method for intelligent vehicle reputation incorporates historical reputation, contribution level, response timeliness, computational latency, and communication anomaly rate into the single-step dynamic reputation update. The update formula is as follows: in, To update the weights, and satisfy the following conditions: The specific value is , For the first The intelligent vehicle node is at the The reputation value of a time slot, As the response factor, Adjust the time decay parameter for the response factor. This is the training round number of the node that last successfully participated in aggregation and passed the integrity check; The time spent on this round of end-side training and uploading Perform interval normalization. ,in , In the near =Statistics obtained within 10 rounds, if ,but ; It is a communication connection anomaly factor, usually determined by packet loss rate. retransmission rate With hash consistency failure rate Linear composition: , ,in =0.5, =0.3, =0.2; in For server-based fixed verification sets Approximate calculation of contribution, Indicates in The precision of the aggregation function is given by Agg, where Agg is the reputation-weighted aggregation function. This is the global model from the previous round before this round of aggregation. The set of nodes participating in this round of aggregation. This is the set of parameters for all local models participating in this aggregation round. To remove a node from the node set P The set of remaining node parameters; Reputation value of all nodes Normalized to [0,1], and divided into four tiers: High Reputation Group: ≥0.8; Higher credit group: 0.6≤ <0.8; Medium credit group: 0.4≤ <0.6; Low-reputation group: <0.4; For nodes that simultaneously satisfy "outlier" and "consistency anomaly" after nearest neighbor clustering and model fingerprint comparison, mark them as "under observation": do not remove them, only process their aggregation weight according to the lower limit of the low reputation group in this round; continuous Once the wheel returns to normal, the marker is removed, and the cycle continues. If there are 3 rounds of abnormalities, the group will be downgraded to the low-reputation group and isolated.

[0025] In step 4, during client-side federated aggregation, a piecewise function is used for dynamic weighting based on reputation level. The global model aggregation weight is affected by the reputation of each node, with low-reputation or abnormal nodes receiving decreasing weights. A cooling window and a reputation increase cap are added to prevent malicious manipulation. Specifically, this includes: During aggregation, the weight of each client is determined by a piecewise function based on its grouping. The allocation is as follows: The global aggregation formula is as follows: in For the local model parameters uploaded by the i-th client, Set the set of participating nodes selected in this round; set a cooling window and increase limit for nodes whose reputation rises rapidly in a short period of time to prevent them from circumventing security monitoring by boosting their scores in a short period of time; set up For the cooling window length, the maximum allowed reputation jump Maximum single-step increase ,like Therefore, the actual credit rating in this round is corrected as follows: like Then the actual credit only increases If a node reaches the single-step threshold more than twice within a window of any length W, the aggregation weight in this round will be directly processed according to the lower limit of the low reputation group, and added to the observation list for subsequent tracking.

[0026] Furthermore, this invention was tested on the VeReMi extended dataset. In the overall experimental design, a stratified sampling and balancing strategy was first used to divide the dataset into training and testing sets in an 8:2 ratio to ensure the scientific rigor and representativeness of training and evaluation. Subsequently, a non-independent identically distributed strategy was used to divide each data subset and distribute them to 20 different client nodes to simulate the imbalance of data collection in a real-world vehicle network environment. In each round, vehicle nodes with a participation ratio of 0.2 were randomly selected. The communication configuration for federated learning adopted a combination of 10 rounds of global aggregation and 5 rounds of local iterative training, with a learning rate of 0.001 and a batch size of 64. The model performance evaluation mainly included: accuracy, precision, recall, and F1 score. During the evaluation, TP, TN, FP, and FN represent true positives, true negatives, false positives, and false negatives, respectively.

[0027] The experimental results of this invention are better than those of FedAvg, FedProx, and FedNova federated learning aggregation strategies. The training results of the four schemes are shown in Table 1.

[0028] Table 1. Training results data of FedAvg, FedProx, and FedNova compared with the present invention. Accuracy Precision, Recall F1 Score FedAvg 0.958 0.956 0.957 0.955 FedProx 0.968 0.967 0.966 0.963 FedNova 0.973 0.969 0.972 0.970 The Invention 0.978 0.975 0.977 0.976 In summary, compared with existing technologies, it has the following beneficial effects: This invention employs a federated learning framework to achieve localized processing of vehicle data, fundamentally avoiding cross-domain transmission of sensitive information. This not only meets the stringent requirements of data sovereignty regulations such as the General Data Protection Regulation (GDPR) to a certain extent, but also enables distributed collaborative learning among multiple vehicles while protecting vehicle privacy, significantly improving the system's security, scalability, and regulatory compliance.

[0029] This invention addresses the significant spatiotemporal dynamic characteristics of basic security message data in the Internet of Vehicles (IoV). It designs a spatiotemporal dual-branch architecture, where a BiLSTM network specifically captures the temporal dependencies of vehicle behavior, and a lightweight Transformer network models the spatial interactions between vehicles in parallel, enabling in-depth mining of spatiotemporal features. Combined with an adaptive attention mechanism, dynamic weight allocation and deep fusion of features are achieved. This method can accurately identify complex attack patterns involving both temporal and spatial dimensions, including physical anomalies where speed and position changes are inconsistent, continuously evolving spoofing attacks, and abnormal events where communication patterns deviate from normal paradigms. This significantly improves the detection accuracy of multimodal spoofing attacks. The dual-branch model has a compact structure and moderate computational complexity, achieving a good balance between detection accuracy and computational efficiency. It overcomes the limitations of traditional centralized big data analysis architectures in the dynamic environment of the IoV, providing a complete technical solution for building an efficient, secure, and privacy-preserving IoV spoofing attack detection system.

[0030] This invention introduces a multi-factor reputation system based on contribution, response timeliness, computation latency, and communication anomaly within a federated learning framework. It employs a monotonic mapping-based reputation weighted aggregation and a stabilization strategy with cooling / increase constraints. This significantly improves the robustness and convergence efficiency of detecting fake data injection attacks while ensuring privacy and bandwidth friendliness.

[0031] The above description discloses only one or more preferred embodiments of the present invention, and should not be construed as limiting the scope of the present invention. Those skilled in the art will understand that all or part of the processes of the above embodiments can be implemented, and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning, characterized in that, Includes the following steps: Step 1: Perform time window segmentation and sliding sample alignment on the original features of the vehicle basic safety message, which contains vehicle spatial location, speed information, and communication signal feature data, and then align the original feature matrix. The samples are divided into sequences according to the window length T and the step size S, and each feature is standardized to ensure that the temporal branch and the spatial branch keep the input samples synchronized and aligned in the subsequent fusion stage. Step 2: Construct a dual-branch feature extraction model on the vehicle terminal side. This model includes a bidirectional BiLSTM branch for modeling temporal dependencies and a structured-pruned Transformer encoder branch for modeling spatial relationships between vehicles. Both branches output dimensions of [dimensions to be filled in]. eigenvectors; Step 3: Design a dynamic weight matrix to perform dimensional attention weighting on spatiotemporal features, compress features from the spatiotemporal dual-branch output features through global average pooling and global max pooling, then concatenate and fuse them, and output the attack detection results through a fully connected classifier; Step 4: Each vehicle terminal uploads its local model update to the federation server. The federation server performs weighted aggregation of the model updates of each node based on a dynamic weighting strategy of node reputation to obtain a global model, and periodically distributes it to each vehicle terminal to achieve collaborative updates and dynamic adaptation to malicious environments.

2. The method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning as described in claim 1, characterized in that, In step 1, the time window segmentation involves processing the basic vehicle safety information in segments according to a preset time interval. The sliding sample alignment strategy ensures that the time series data and spatial data remain synchronized and aligned when inputting into the model through the sliding window mechanism. All features are standardized using z-scores for each column of features before windowing.

3. The method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning as described in claim 2, characterized in that, The BiLSTM network with bidirectional BiLSTM branch includes an input layer, a hidden layer, and an output layer. Each layer adopts a bidirectional long short-term memory unit structure to capture the forward and backward temporal dependencies of vehicle behavior data. BiLSTM No. The calculation process for the layer is as follows: in, and They represent the first Layer in time step The forward and backward hidden states, and For the corresponding memory unit state, and For the LSTM parameter set, The input features of the current layer are derived from the output of the previous BiLSTM layer. Each network layer is followed by a batch normalization layer and a Dropout layer, resulting in a final output tensor shape of... ,in That is, the current number The output of the layer, Given the hidden state dimension of a unidirectional LSTM, output the total dimension. Including forward LSTM 3D features and backward LSTM Dimensional features.

4. The method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning as described in claim 3, characterized in that, The Transformer encoder branch adopts an encoder structure, reduces model parameters through pruning operations, and retains the key self-attention mechanism for modeling spatial relationships between vehicles, including: Attention head pruning: retain the head with the highest score, with at least 2 heads retained; Feedforward network intermediate layer channel pruning: prune according to channel importance, with the intermediate dimension set to [value missing]. After pruning, it should be no less than The global pruning rate is fixed between [0.3, 0.7], and the total number of parameters after pruning is ensured not to exceed the pre-set end-side budget limit.

5. The method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning as described in claim 4, characterized in that, During the execution of step 3, the dynamic weight matrix dynamically adjusts the weight allocation according to the importance of the input features, and the dimension-level attention weighting mechanism calculates the attention weight for each dimension of the spatiotemporal features, specifically including: Output for any branch Timing branch Spatial branch Calculate dimensional attention; In batch and sequence flattening Using trainable weight matrices and bias vector Calculate attention score: Attention score matrix By normalizing using Softmax, we obtain the probabilistic weight matrix, which allows us to determine the weight of each sample. Weight distribution on the dimension: Subsequently, the Hadamard product is used to dynamically weight the features, resulting in the weighted feature representation. Then reshape it back to its original shape to obtain .

6. The method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning as described in claim 5, characterized in that, In step 3, average pooling and max pooling operations are used to extract global and local key information of the spatiotemporal dual-branch output features, achieving feature compression and fusion. The process includes: Timing branch output Output through global average pooling Spatial branch output Then output using global max pooling. When the sequence dimension is 1, the result of max pooling is equal to the tensor itself with that dimension removed. The pooled temporal and spatial features are merged into a unified feature representation through a concatenation operation: The fused feature vectors are processed sequentially through two fully connected network layers, with batch normalization and Dropout mechanisms introduced after each layer. The classification probability is output through the fully connected layer activated by Softmax, thereby classifying the input samples.

7. The method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning as described in claim 6, characterized in that, In step 4, the reputation of each participating node is dynamically evaluated based on historical reputation, contribution, response latency, computation delay, and communication anomaly. An interval grouping cooling and callback mechanism, anti-fraud operations, and adaptive isolation decision-making are adopted.

8. The method for detecting fake data injection attacks in the Internet of Vehicles based on federated learning as described in claim 7, characterized in that, In step 4, during client-side federated aggregation, a piecewise function is used for dynamic weighting based on reputation level. The global model aggregation weight is affected by the reputation of each node, with low-reputation or abnormal nodes having decreasing weights. A cooling window and a reputation increase cap are added to prevent malicious operations.

Images