A federated learning-based vehicle-mounted network intrusion detection method
By combining PKI, FA-BDS-FEA algorithms, and Paillier encryption technology with a federated learning-based intrusion detection method for vehicular networks, attack features of the CAN bus are dynamically extracted, second-order gradient signatures are generated and globally encrypted, solving the problems of data privacy leakage and low detection accuracy in vehicular networks, and achieving efficient and secure intrusion detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANDONG JIANZHU UNIV
- Filing Date
- 2026-05-12
- Publication Date
- 2026-07-21
AI Technical Summary
Existing in-vehicle network intrusion detection technologies suffer from risks of data privacy leakage, high communication and computing load, low detection accuracy, and high false alarm rate. Furthermore, existing federated learning technologies have shortcomings when applied to in-vehicle networks, such as insufficient feature optimization, weak gradient transmission security, and low computational and collaborative efficiency.
A federated learning-based approach is adopted, combined with public key infrastructure (PKI) for key distribution, the FA-BDS-FEA algorithm is used to calculate feature weights and posterior probabilities, the Paillier algorithm is used for gradient encryption, and ring signature technology is used for identity anonymity and asymmetric signature. This enables data to remain local, models to be trained collaboratively, CAN bus attack features to be dynamically extracted, second-order gradient signatures to be generated and globally encrypted and fed back.
It achieves data privacy protection and security compliance in the Internet of Vehicles, improves the accuracy and robustness of intrusion detection, reduces false alarm and false negative rates, adapts to the low computing power and high real-time requirements of vehicle terminals, and builds an edge-to-edge security link to resist attacks.
Smart Images
Figure CN122179104B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of vehicle network security technology, and specifically to a vehicle network intrusion detection method based on federated learning. Background Technology
[0002] With the rapid popularization of intelligent connected vehicles and vehicle-to-everything (V2X) technology, the in-vehicle CAN bus, as the core communication network within the vehicle, undertakes the transmission of critical commands such as engine control, braking, and steering. Its communication security is directly related to vehicle driving safety and the safety of life and property of passengers. At the same time, in-vehicle networks have characteristics such as distributed node deployment, high real-time data transmission requirements, limited terminal computing resources, and sensitive data privacy, making traditional in-vehicle network security protection solutions have obvious shortcomings.
[0003] Current in-vehicle network intrusion detection technology mainly relies on centralized machine learning models, which require uploading massive amounts of raw data from the vehicle's CAN bus to the cloud or roadside central server for unified training and detection. This presents two major problems: First, there is a risk of data privacy leakage. Sensitive information such as vehicle operation data and user behavior data are easily stolen, tampered with, or misused during transmission and centralized storage, making it difficult to meet the regulatory requirements for data security and privacy protection in the Internet of Vehicles. Second, the communication and computing load is too high. The bandwidth and computing power of the vehicle terminal are limited, and large-scale data uploads will cause network congestion. At the same time, centralized training has high latency and slow response, which cannot meet the low latency and high real-time intrusion detection requirements of in-vehicle networks.
[0004] In terms of security protection, existing solutions mostly adopt a single encryption or signature mechanism, which has poor coordination between data encryption and model training. The gradient transmission process is vulnerable to threats such as man-in-the-middle attacks and injection of forged data, making it difficult to balance detection accuracy and system security. In addition, traditional feature extraction methods are mostly fixed step sizes, which cannot adapt to the dynamic changes in CAN bus attack data, resulting in low accuracy and high false alarm rate in intrusion detection.
[0005] Federated learning, as a distributed machine learning technology, enables data to remain local and models to be trained collaboratively, effectively solving the problems of data privacy and centralized computing bottlenecks. However, when existing federated learning is applied to in-vehicle network intrusion detection, it has technical shortcomings such as insufficient feature optimization, weak encryption security of gradient transmission, and low efficiency of local computing and roadside aggregation collaboration. It lacks a lightweight, high-security, and high-precision intrusion detection solution adapted to in-vehicle scenarios. Summary of the Invention
[0006] To overcome the shortcomings of the above technologies, this invention provides a federated learning-based intrusion detection method for vehicular networks that effectively improves the accuracy of intrusion identification and reduces the false alarm rate and false negative rate.
[0007] The technical solution adopted by this invention to overcome its technical problems is: A federated learning-based intrusion detection method for vehicular networks includes vehicular users (VUs), roadside units (RSUs), and public key infrastructure (PKI), comprising: S1. Initialize key distribution for vehicle-mounted users (VU) and roadside units (RSU) through public key infrastructure (PKI); S2. The onboard user (VU) extracts data from the raw CAN bus data. One feature; S3. The vehicle user (VU) uses the FA-BDS-FEA algorithm to calculate the first... Feature weights of each feature , No. The posterior probability of each feature , using the Feature weights of each feature Passing the exam The posterior probability of each feature Calculate the first Dynamic step size of each feature The extracted feature values corresponding to each dynamic step size are combined to form a global feature set. ; S4. Based on global feature set The second gradient is calculated and a signature is generated using the second gradient. The vehicle user (VU) sends the second gradient and signature to the roadside unit (RSU). S5. The Roadside Unit (RSU) uses the Paillier algorithm to obtain the global second-order encryption gradient Aggencrypt from the second-order gradient. It adds a signature to the global second-order encryption gradient Aggencrypt through asymmetric signature operation and feeds the signed global second-order encryption gradient Aggencrypt back to the vehicle user (VU). S6. The vehicle user VU obtains the first... using the globally second-order encryption gradient Aggencrypt after signing. The probability of intrusion based on each feature.
[0008] Furthermore, step S1 includes the following steps: S1-1. Public Key Infrastructure (PKI) generates a signature private key sigsk for the vehicle user (VU); S1-2. The Public Key Infrastructure (PKI) Roadside Unit (RSU) generates an encrypted private key, encsk. S1-3. The Public Key Infrastructure (PKI) sends the signing private key sigsk to the registered vehicle user (VU), and the PKI sends the encryption private key encsk to the registered roadside unit (RSU).
[0009] Preferably, in step S1-1, the signing private key sigsk is generated based on a ring signature scheme.
[0010] Preferably, in step S1-2, the encrypted private key encsk is generated based on a ring signature scheme.
[0011] Furthermore, in step S3, the formula is used... Calculation yields the first Feature weights of each feature In the formula, For the first The class conditional probability of the occurrence of each feature , The first attack among all attacks in the vehicle CAN bus data collected for the vehicle user VU The number of times each feature appears Let be the prior probability of the attack behavior. For frequency weighting coefficients, For the first Frequency of occurrence of each feature , For the first Eigenvalues of each feature The number of times non-zero occurrences occur.
[0012] Furthermore, in step S3, the formula is used... Calculation yields the first The posterior probability of each feature In the formula To find the normal distribution, For sample variance, , , The mean is the prior variance. , , For all The sum of the eigenvalues of each feature.
[0013] The value ranges from 0.1 to 0.3. The value is 0.3.
[0014] Furthermore, step S3 includes the following steps: S3-1. Through formula Calculate the first Dynamic step size of each feature In the formula, The initial step size, , , All of these are parameter adjustments. , ; S3-2. Using the formula Calculation yields the first Extracting feature values from each feature ; S3-3. Through formula Calculation yields the first Feature extraction error ,judge Is it less than or equal to the threshold? If so, then the first Extracting feature values from each feature Insert global feature set Otherwise, proceed to step S3-4. ; S3-4. Pass The adjusted dynamic step size was calculated. In the formula To adjust the parameters, Adjusted dynamic step size Replace the dynamic step size in step S3-3 Then repeat step S3-3.
[0015] Furthermore, step S4 includes the following steps: S4-1. Through formula Calculation yields the first The first-order gradient of each feature ; S4-2. Through formula Calculation yields the first The second gradient of each feature In the formula, For the first The predicted probability of each feature. , For the first The predicted probability of each feature. , ; S4-3. The first The second gradient of each feature The encoding is performed using bit-field concatenation encoding, and then encrypted using the Paillier algorithm to obtain the encrypted result. Gradient encoding values of each feature; S4-4. The vehicle user (VU) uses the Paillier algorithm to perform a SIGSK test on the encrypted first... The gradient encoding value of the i-th feature is used to perform an asymmetric signature to obtain the i-th feature. The signature of each feature; S4-5. Vehicle user VU will be the first The signature of the first feature and the first The second gradient of each feature Send to the roadside unit (RSU).
[0016] Furthermore, step S6 includes the following steps: S6-1. The vehicle user (VU) uses the Paillier algorithm to decrypt the signed global second-order encryption gradient Aggencrypt through encsk, and encodes the decryption result using the ASN.1 DER encoding rule to obtain the global gradient Global_G; S6-2. Input the global gradient Global_G into the Softmax function, and the output is the first... The probability of intrusion based on each feature.
[0017] The beneficial effects of this invention are: 1. Privacy security and data compliance have been significantly improved. By adopting a federated learning architecture, data is trained locally without leaving the vehicle. Combined with PKI key distribution, ring signature, and Paillier homomorphic encryption technology, the entire process protects the vehicle CAN bus data and model gradient information, preventing data leakage, tampering, and illegal abuse from the source, and meeting the requirements for data privacy protection and security compliance in the Internet of Vehicles.
[0018] 2. Enhanced accuracy and robustness of intrusion detection By dynamically calculating feature weights, posterior probabilities, and adaptive step sizes using the FA-BDS-FEA algorithm, CAN bus attack features can be accurately extracted, reducing interference from invalid features. Combined with second-order gradient optimization and Softmax probability output, the accuracy of intrusion identification is effectively improved, while the false alarm rate and false negative rate are reduced.
[0019] 3. Lightweight design adapts to vehicle terminal resource limitations The distributed mode of gradient local computation and roadside encrypted aggregation significantly reduces the computing power and communication bandwidth consumption of vehicle users (VUs), adapts to the low computing power, narrow bandwidth and high real-time operation conditions of vehicle terminals, and has low detection latency and fast response speed.
[0020] 4. More reliable transmission and aggregation security protection Ring signatures are used to ensure anonymous and unforgeable identities, Paillier encryption is used to achieve gradient density aggregation, and asymmetric signatures are used to prevent transmission hijacking and injection attacks. An end-to-edge secure link is built throughout the federated learning collaborative training process to resist malicious behaviors such as man-in-the-middle attacks and gradient forgery.
[0021] 5. Higher efficiency in model co-optimization The roadside unit (RSU) completes global gradient aggregation and signature feedback, and the vehicle terminal quickly decrypts and updates the model. Multi-node model co-evolution can be achieved without centralized training, which improves the generalization ability and convergence speed of the intrusion detection model while ensuring security. Attached Figure Description
[0022] Figure 1 Diagram of vehicle network structure Figure 2 This is a flowchart of the method of the present invention. Detailed Implementation
[0023] The following is in conjunction with the appendix Figure 1 Appendix Figure 2 The present invention will be further described below.
[0024] A federated learning-based intrusion detection method for vehicular networks includes vehicular users (VUs), roadside units (RSUs), and public key infrastructure (PKI), comprising: S1. Initialize key distribution for vehicle-mounted users (VU) and roadside units (RSU) through public key infrastructure (PKI).
[0025] S2. The onboard user (VU) extracts data from the raw CAN bus data. One characteristic.
[0026] S3. The vehicle user (VU) uses the FA-BDS-FEA algorithm to calculate the first... Feature weights of each feature , No. The posterior probability of each feature , using the Feature weights of each feature Passing the exam The posterior probability of each feature Calculation yields the first Dynamic step size of each feature The extracted feature values corresponding to each dynamic step size are combined to form a global feature set. .
[0027] S4. Based on global feature set The second gradient is calculated and a signature is generated using the second gradient. The vehicle user (VU) sends the second gradient and signature to the roadside unit (RSU).
[0028] S5. The Roadside Unit (RSU) uses the Paillier algorithm to obtain the global second-order encryption gradient Aggencrypt from the second-order gradient. It adds a signature to the global second-order encryption gradient Aggencrypt through asymmetric signature operation and feeds the signed global second-order encryption gradient Aggencrypt back to the Vehicle User (VU).
[0029] S6. The vehicle user VU obtains the first... using the globally second-order encryption gradient Aggencrypt after signing. The probability of intrusion based on each feature.
[0030] By combining PKI key distribution, ring signature, and Paillier homomorphic encryption technology, the system protects the vehicle CAN bus data and model gradient information throughout the entire process, preventing data leakage, tampering, and illegal abuse from the source, and meeting the requirements for data privacy protection and security compliance in the Internet of Vehicles.
[0031] In one embodiment of the present invention, step S1 includes the following steps: S1-1. Public Key Infrastructure (PKI) generates a signature private key sigsk for the vehicle user (VU); S1-2. The Public Key Infrastructure (PKI) Roadside Unit (RSU) generates an encrypted private key, encsk. S1-3. The Public Key Infrastructure (PKI) sends the signing private key sigsk to the registered vehicle user (VU), and the PKI sends the encryption private key encsk to the registered roadside unit (RSU).
[0032] In one embodiment of the present invention, the signing private key sigsk in step S1-1 is generated based on a ring signature scheme. The encryption private key encsk in step S1-2 is generated based on a ring signature scheme.
[0033] In one embodiment of the present invention, step S3 is performed using the formula Calculate the first Feature weights of each feature In the formula, For the first The class conditional probability of the occurrence of each feature , The first attack among all attacks in the vehicle CAN bus data collected for the vehicle user VU The number of times each feature appears Let be the prior probability of the attack behavior. For frequency weighting coefficients, For the first Frequency of occurrence of each feature , For the first Eigenvalues of each feature The number of times non-zero occurrences occur.
[0034] In one embodiment of the present invention, step S3 is performed using the formula Calculate the first The posterior probability of each feature In the formula To find the normal distribution, For sample variance, , , The mean is the prior variance. , , For all The sum of the eigenvalues of each feature.
[0035] The value ranges from 0.1 to 0.3. The value is 0.3.
[0036] In one embodiment of the present invention, step S3 includes the following steps: S3-1. Through formula Calculation yields the first Dynamic step size of each feature In the formula, The initial step size, , , All of these are parameter adjustments. , .
[0037] S3-2. Using the formula Calculation yields the first Extracting feature values from each feature .
[0038] S3-3. Through formula Calculation yields the first Feature extraction error ,judge Is it less than or equal to the threshold? If so, then the first Extracting feature values from each feature Insert global feature set Otherwise, proceed to step S3-4. .
[0039] S3-4. Pass The adjusted dynamic step size was calculated. In the formula To adjust the parameters, Adjusted dynamic step size Replace the dynamic step size in step S3-3 Then repeat step S3-3.
[0040] In one embodiment of the present invention, step S4 includes the following steps: S4-1. Through formula Calculation yields the first The first-order gradient of each feature .
[0041] S4-2. Through formula Calculation yields the first The second gradient of each feature In the formula, For the first The predicted probability of each feature. , For the first The predicted probability of each feature. , .
[0042] S4-3. The first The second gradient of each feature The encoding is performed using bit-field concatenation encoding, and then encrypted using the Paillier algorithm to obtain the encrypted result. The gradient encoding value of each feature.
[0043] S4-4. The vehicle user (VU) uses the Paillier algorithm to perform a SIGSK test on the encrypted first... The gradient encoding value of the i-th feature is used to perform an asymmetric signature to obtain the i-th feature. A signature of each feature.
[0044] S4-5. Vehicle user VU will be the first The signature of the first feature and the first The second gradient of each feature Send to the roadside unit (RSU).
[0045] In one embodiment of the present invention, step S6 includes the following steps: S6-1. The vehicle user (VU) uses the Paillier algorithm to decrypt the signed global second-order encryption gradient Aggencrypt through encsk, and encodes the decryption result using the ASN.1 DER encoding rule to obtain the global gradient Global_G; S6-2. Input the global gradient Global_G into the Softmax function, and the output is the first... The probability of intrusion based on each feature.
[0046] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A method for intrusion detection in vehicular networks based on federated learning, comprising vehicular user (VU), roadside unit (RSU), and public key infrastructure (PKI), characterized in that, include: S1. Initialize key distribution for vehicle-mounted users (VU) and roadside units (RSU) through public key infrastructure (PKI); S2. The onboard user (VU) extracts data from the raw CAN bus data. One feature; S3. The vehicle user (VU) uses the FA-BDS-FEA algorithm to calculate the first... Feature weights of each feature , No. The posterior probability of each feature , using the Feature weights of each feature Passing the exam The posterior probability of each feature Calculation yields the first Dynamic step size of each feature The extracted feature values corresponding to each dynamic step size are combined to form a global feature set. ; S4. Based on global feature set The second gradient is calculated and a signature is generated using the second gradient. The vehicle user (VU) sends the second gradient and signature to the roadside unit (RSU). S5. The Roadside Unit (RSU) uses the Paillier algorithm to obtain the global second-order encryption gradient Aggencrypt from the second-order gradient. It adds a signature to the global second-order encryption gradient Aggencrypt through asymmetric signature operation and feeds the signed global second-order encryption gradient Aggencrypt back to the vehicle user (VU). S6. The vehicle user VU obtains the first... using the globally second-order encryption gradient Aggencrypt after signing. The probability of intrusion for each feature; Step S1 includes the following steps: S1-1. Public Key Infrastructure (PKI) generates a signature private key sigsk for the vehicle user (VU); S1-2. The Public Key Infrastructure (PKI) Roadside Unit (RSU) generates an encrypted private key, encsk. S1-3. The Public Key Infrastructure (PKI) sends the signing private key sigsk to the registered vehicle user (VU), and the Public Key Infrastructure (PKI) sends the encryption private key encsk to the registered roadside unit (RSU). In step S3, the formula is used. Calculation yields the first Feature weights of each feature In the formula, For the first The class conditional probability of the occurrence of each feature , The first attack among all attacks in the vehicle CAN bus data collected for the vehicle user VU The number of times each feature appears Let be the prior probability of the attack behavior. For frequency weighting coefficients, For the first Frequency of occurrence of each feature , For the first Eigenvalues of each feature The number of non-zero occurrences; In step S3, the formula is used. Calculation yields the first The posterior probability of each feature In the formula To find the normal distribution, For sample variance, , , The mean is the prior variance. , , For all The sum of the eigenvalues of each feature; Step S3 includes the following steps: S3-1. Through formula Calculation yields the first Dynamic step size of each feature In the formula, The initial step size, , , All of these are parameter adjustments. , ; S3-2. Using the formula Calculation yields the first Extracting feature values from each feature ; S3-3. Through formula Calculation yields the first Feature extraction error ,judge Is it less than or equal to the threshold? If so, then the first Extracting feature values from each feature Insert global feature set Otherwise, proceed to step S3-4. ; S3-4. Pass The adjusted dynamic step size was calculated. In the formula To adjust the parameters, Adjusted dynamic step size Replace the dynamic step size in step S3-3 Then repeat step S3-3.
2. The intrusion detection method for vehicular networks based on federated learning according to claim 1, characterized in that: In step S1-1, the signing private key sigsk is generated based on the ring signature scheme.
3. The intrusion detection method for vehicular networks based on federated learning according to claim 1, characterized in that: In step S1-2, the encrypted private key encsk is generated based on the ring signature scheme.
4. The intrusion detection method for vehicular networks based on federated learning according to claim 1, characterized in that: The value ranges from 0.1 to 0.
3. The value is 0.
3.
5. The intrusion detection method for vehicular networks based on federated learning according to claim 1, characterized in that, Step S4 includes the following steps: S4-1. Through formula Calculation yields the first The first-order gradient of each feature ; S4-2. Through formula Calculation yields the first The second gradient of each feature In the formula, For the first The predicted probability of each feature. , For the first The predicted probability of each feature. , ; S4-3. The first The second gradient of each feature The encoding is performed using bit-field concatenation encoding, and then encrypted using the Paillier algorithm to obtain the encrypted result. Gradient encoding values of each feature; S4-4. The vehicle user (VU) uses the Paillier algorithm to perform a SIGSK test on the encrypted first... The gradient encoding value of the i-th feature is used to perform an asymmetric signature to obtain the i-th feature. The signature of each feature; S4-5. Vehicle user VU will be the first The signature of the first feature and the first The second gradient of each feature Send to the roadside unit (RSU).
6. The intrusion detection method for vehicular networks based on federated learning according to claim 1, characterized in that, Step S6 includes the following steps: S6-1. The vehicle user (VU) uses the Paillier algorithm to decrypt the signed global second-order encryption gradient Aggencrypt through encsk, and encodes the decryption result using the ASN.1 DER encoding rule to obtain the global gradient Global_G; S6-2. Input the global gradient Global_G into the Softmax function, and the output is the first... The probability of intrusion based on each feature.