Federated learning based sharing of features for vehicular sensor attacks

Abstract

The federated learning-based feature sharing method for sensor attack of Internet of Vehicles belongs to the technical fields of Internet of Vehicles security and distributed machine learning. Firstly, local sensor data of each participating vehicle is acquired, sensor attack features are extracted, and a local attack feature model is trained. Then, the credibility of each local model update result is calculated, and the credible local model update parameters are screened. Further, the credible local model update parameters are securely aggregated to generate a global attack feature model. The shared attack features are formed by using the global attack feature model, and the shared attack features are distributed to each participating vehicle for local attack identification. Finally, the federated attack feature sharing model is updated according to the attack identification result. The federated learning-based feature sharing method for sensor attack of Internet of Vehicles can realize the collaborative sharing of attack features among Internet of Vehicles nodes without transmitting original sensor data, improve the identification ability of unknown attack features, and reduce the risk of data leakage and communication overhead.

Description

Technical Field

[0001] This invention belongs to the field of vehicle network security and distributed machine learning technology, and particularly relates to a method for sharing sensor attack features in vehicle networks based on federated learning. Specifically, this invention relates to multi-source sensor data acquisition and unified organization in a vehicle network environment, sensor attack feature extraction, local attack feature model training, model update credibility assessment, secure aggregation of trusted parameters, global attack feature modeling, shared attack feature distribution and local attack identification, and federated model closed-loop iteration technology. It aims to solve the problem of collaboratively sharing attack features among participating vehicles in a vehicle network while protecting the privacy of original sensor data, and improving the ability to identify unknown attacks, thereby ensuring the credibility, collaborative defense capabilities, and driving safety level of the vehicle network perception system. Background Technology

[0002] With the rapid development of Vehicle-to-Everything (V2X) technology and intelligent transportation systems, modern vehicles have become highly intelligent mobile sensing nodes. Intelligent vehicles typically integrate various heterogeneous sensors, such as cameras, lidar, millimeter-wave radar, Global Navigation Satellite System (GNSS) receivers, and inertial measurement units (IMUs), to achieve comprehensive perception and accurate modeling of the surrounding environment through multi-sensor data fusion. The massive data interaction between vehicles, between vehicles and roadside infrastructure, and between vehicles and the cloud, while significantly improving perception capabilities and collaborative decision-making levels, also exposes V2X systems to increasingly severe cybersecurity threats.

[0003] Sensor attacks are among the most threatening forms of attack in the field of connected vehicle security. Attackers can launch spoofing attacks against single or multiple sensors, injecting virtual observation data, tampering with sensor outputs, or simulating environmental signals to cause the vehicle's perception system to generate incorrect environmental understanding, thereby misleading the decision-making and planning module to make dangerous driving behaviors. For example, GPS spoofing attacks transmit virtual satellite signals to give the vehicle an offset position coordinate; visual spoofing attacks interfere with camera target detection results through adversarial examples or physical patches; and radar spoofing attacks transmit jamming signals to tamper with the distance and speed measurements of millimeter-wave radar. These attacks are highly covert and destructive, directly threatening driving safety.

[0004] Existing vehicle-to-everything (V2X) sensor attack detection technologies have the following main shortcomings: (1) Limitations of isolated vehicle detection: Existing methods mostly rely on sensor data from a single vehicle to train the detection model. Due to the limited scale of data from a single vehicle and the diversity of attack samples, the model is difficult to cover a wide range of attack patterns. When a new attack first appears on a vehicle, other vehicles cannot identify it in time due to a lack of knowledge of the corresponding attack characteristics, forming "information silos" and resulting in weak overall collaborative defense capabilities.

[0005] (2) Attack features are difficult to share across nodes: Different vehicles have different sensor configurations, driving environments and types of attacks they suffer, and the attack feature knowledge accumulated locally by each vehicle is complementary. However, existing solutions lack an effective mechanism for sharing attack features across nodes, and cannot aggregate and reuse the attack identification experience distributed across vehicles, thus limiting the ability to identify unknown attack features.

[0006] (3) Data privacy risks of centralized learning: If centralized machine learning is used to aggregate the raw sensor data of each vehicle to a central server for unified training, although feature sharing can be achieved, it will introduce serious data privacy leakage risks and huge communication transmission overhead. Raw sensor data often contains sensitive information such as vehicle location, driving trajectory, and surrounding environment. Directly uploading it does not meet the data privacy protection requirements of the Internet of Vehicles.

[0007] (4) The model lacks reliable aggregation and adaptive evolution capabilities: In distributed collaborative training, some participating vehicles may submit abnormal or even harmful model updates due to poisoning attacks, sensor failures, or malicious tampering. If these updates are aggregated directly without screening, they will pollute the global model and reduce detection performance. At the same time, in the face of constantly evolving attack methods, static models lack online parameter correction and adaptive adjustment mechanisms for aggregation weights based on recognition feedback, and detection performance gradually degrades over time.

[0008] Therefore, this invention proposes a method for sharing attack features of vehicle network sensors based on federated learning. By leveraging the core idea of ​​federated learning, "data remains stationary while the model moves," and under the condition that the original sensor data does not leave the local machine, it achieves privacy-preserving collaborative sharing of attack features among vehicle network nodes through local attack feature extraction, model update credibility assessment, trusted parameter secure aggregation, global attack feature modeling, and shared attack feature distribution. Furthermore, it continuously improves the system's ability to identify and adapt to unknown attacks through a closed-loop update mechanism based on recognition feedback. Summary of the Invention

[0009] The purpose of this invention is to overcome the problems of limited single-vehicle detection capabilities, difficulty in sharing attack features across nodes, privacy leakage risks in centralized learning, and lack of reliable aggregation and adaptive evolution capabilities in existing vehicle network sensor attack detection technologies. This invention proposes a vehicle network sensor attack feature sharing method based on federated learning.

[0010] To achieve the above objectives, this invention provides a method for sharing sensor attack features in vehicle networking based on federated learning, comprising the following steps: Step 1) Obtain the raw perception data generated by the local sensors of each participating vehicle, and organize it uniformly according to the participating vehicle, sensor type and sampling time to form a local perception dataset. ; Raw perception data generated by cameras, lidar, millimeter-wave radar, global navigation satellite system sensors, and inertial measurement units from participating vehicles are collected and organized uniformly according to the participating vehicles, sensor types, and sampling times to form a local perception dataset. :

[0011] in, This represents a local sensing dataset. Indicates the first The first vehicle involved Type of sensor in the first The raw sensor data generated at each sampling time point Indicates the vehicle number involved. , Indicates the sensor category number , Indicates the sampling time number , This indicates the total number of participating vehicles. Indicates the total number of sensor categories. Indicates the r-th participating vehicle's... The number of sampled data corresponding to a type of sensor.

[0012] Step 2) Utilize the local sensing dataset formed in Step 1) Extract sensor attack features to form a local attack feature set. ; Using the local sensing dataset formed in step 1) The statistical deviation, prediction residual, and degree of change between adjacent sampling times of the sensor data of each participating vehicle are calculated to extract local sensor attack features and form a local attack feature set. :

[0013] in, This represents a local attack signature set. Indicates the first The first vehicle involved Type of sensor in the first Local attack feature values ​​corresponding to each sampling time point Indicates the first The first vehicle involved Historical average of sensor-sensed data ， This represents the historical standard deviation of the corresponding sensing data. This represents the predicted sensing data at the corresponding sampling time. This prevents positive numbers with a denominator of zero. Indicates the weight of statistical deviation. Indicates the weight of the predicted residual. This represents the weight of the degree of change between adjacent sampling times.

[0014] Step 3) Utilize the local attack signature set formed in Step 2) Train local attack feature models for each participating vehicle and generate local model update parameter sets. ; Using the local attack signature set formed in step 2) Local attack feature data is divided according to the participating vehicles, and local attack feature models are trained for each participating vehicle. Local model update parameters are calculated to form a local model update parameter set. :

[0015] in, This indicates that the local model updates the parameter set. Indicates the first Update the local model parameters for each participating vehicle. Indicates the first A subset of local attack signatures corresponding to each participating vehicle. Indicates the first Local attack signature model parameters corresponding to each participating vehicle. This represents the local model learning rate. Indicates the first The local model loss function for each participating vehicle. This represents the loss function with respect to the parameters of the local attack feature model. The gradient.

[0016] Step 4) Update the parameter set using the local model generated in Step 3). By combining the historical training status and model update differences of each participating vehicle, the local model update reliability is calculated, and a reliable model update parameter set is generated. ; Update the parameter set using the local model formed in step 3). By combining the historical training status of each participating vehicle and the difference between the local model update parameters and the average model update parameters, the reliability of the local model update is calculated. Reliable local model update parameters are then selected and weighted to form a set of reliable model update parameters. :

[0017] in, This indicates that the reliable model updates the parameter set. Indicates the first Update the parameters of the trusted model corresponding to each participating vehicle. Indicates the first The reliability of the local model update corresponding to each participating vehicle. Indicates the first The credibility of the historical training data corresponding to each participating vehicle. Indicates local model update parameter set The average value of the updated parameters for each local model. The weights representing the reliability of historical training. This indicates that the model updates the difference adjustment parameter. This indicates the local model update confidence threshold. This represents the L2 norm.

[0018] Step 5) Update the parameter set using the trusted model generated in Step 4). Perform security aggregation to generate a global attack signature model. ; Update the parameter set using the trusted model formed in step 4). The update parameters of each trusted model are updated with a cancelable random mask, and a weighted aggregation is performed based on the number of local training samples of each participating vehicle to generate a global attack feature model. :

[0019] in, This represents a global attack characteristic model. This represents the parameters of the global attack signature model. Indicates the first Global model parameters before the start of federated training. This indicates the number of parameters updated by the reliable model. Indicates the first The number of local training samples for each participating vehicle. Indicates the first A random mask added to each participating vehicle.

[0020] Step 6) Utilize the global attack feature model generated in Step 5) Extract global feature representations of various sensor attacks to form a shared attack feature set. ; Using the global attack feature model generated in step 5) Based on the feature projection relationships corresponding to different sensor attack types, global feature representations of various sensor attacks are extracted and normalized from the global attack feature model parameters to form a shared attack feature set. :

[0021] in, Indicates a shared attack signature set. Indicates the first Shared attack characteristics corresponding to sensor-like attacks Indicates the first The feature projection matrix corresponding to sensor-like attacks. Indicates the sensor attack type number and , This indicates the total number of sensor attack types. This indicates a positive number that prevents the denominator from being zero.

[0022] Step 7) Utilize the shared attack signature set formed in Step 6) Attack identification is performed on the local perception data of each participating vehicle, and local attack identification results are generated. ; Using the shared attack signature set formed in step 6) Calculate the local attack feature set formed in step 2). Similarity between local attack features and shared attack features:

[0023] Identify the sensor attack type that has the greatest similarity to local attack characteristics:

[0024] Local attack identification results are generated based on the maximum similarity and attack identification threshold. :

[0025] in, This indicates the results of local attack identification. Indicates the first The first vehicle involved Type of sensor in the first The local attack characteristics corresponding to the sampling time and the first sampling time are similar to those of the second sampling time. Similarity between shared attack features This indicates the type of sensor attack that has the greatest similarity to local attack characteristics. This indicates the corresponding local attack identification result. This represents the attack identification threshold; when the maximum similarity is not less than the attack identification threshold... This indicates that the first one has been identified. Sensor-like attacks, otherwise This indicates that no sensor attack was detected.

[0026] Step 8) Utilize the local attack identification results generated in Step 7) Adjust the local model training parameters and global model aggregation parameters to generate an updated federated attack feature sharing model. .

[0027] Using the local attack identification results generated in step 7) The local attack identification results are divided into subsets based on the participating vehicles. The local model parameters are adjusted according to the difference between the local attack identification results and the local model prediction results. The global model aggregation weights are then adjusted based on the adjusted local model loss to generate an updated federated attack feature sharing model. :

[0028] in, This represents the updated federated attack signature sharing model. This represents the updated global attack signature model parameters. Indicates the first The updated local model parameters for each participating vehicle. Indicates the results of local attack identification. The first division in the middle A subset of local attack identification results corresponding to each participating vehicle. Indicates the local model parameter update rate. Indicates the first The updated global model aggregate weights corresponding to each participating vehicle. Indicates the vehicle number participating in the global model aggregation.

[0029] Compared with the prior art, the present invention has the following beneficial effects: (1) Collaborative feature sharing under privacy protection: Based on the federated learning architecture of "data does not move, model moves", each participating vehicle only needs to upload local model update parameters without uploading original sensor data, which avoids the risk of leakage of sensitive information such as vehicle location, driving trajectory, and surrounding environment from the root. While meeting the data privacy protection requirements of the Internet of Vehicles, it realizes cross-node collaborative sharing of attack identification experience. (2) Comprehensive multidimensional attack feature extraction: It integrates three complementary attack indication features: statistical deviation, prediction residual and degree of change between adjacent sampling times. It comprehensively portrays sensor attack behavior from three dimensions: static distribution anomaly, model prediction anomaly and time series mutation anomaly. It has good characterization ability for mutation type, gradual type and continuous type attack. (3) Trustworthy aggregation ensures global model quality: By integrating historical training credibility and model update differences, a local model update credibility evaluation mechanism is constructed. Combined with a security aggregation strategy that can offset random masking and weighted by sample number, it effectively resists poisoning attacks and malicious model updates from polluting the global model and ensures the reliability of shared attack features. (4) Global feature sharing enhances the ability to identify unknown attacks: The attack feature knowledge accumulated locally by each vehicle is aggregated into a global attack feature model, and a normalized shared attack feature set is extracted and distributed to each vehicle, so that each vehicle can use the experience of attack identification across the entire network to detect new attacks that it has not encountered locally, significantly enhancing the ability to identify unknown attack features. (5) Closed-loop adaptive evolution: Construct a closed-loop update mechanism based on attack identification feedback, and at the same time correct the local model training parameters and global model aggregation weights, so that the system can continuously adapt to the evolution of attack methods and changes in the driving environment, ensuring the stability and continuous optimization of long-term detection performance.

[0030] In summary, the federated learning-based sensor attack feature sharing method for vehicle-to-everything (V2X) provided by this invention achieves highly reliable sharing and continuous evolution of attack features among V2X nodes under the premise of privacy protection by constructing a complete collaborative defense system from multi-source perception data acquisition, attack feature extraction, local model training, credibility assessment, security aggregation, global feature sharing, local attack identification to model closed-loop iteration. This provides a solid technical guarantee for the secure and reliable operation of the V2X perception layer. Attached Figure Description

[0031] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0032] This invention discloses a method for sharing sensor attack features in the Internet of Vehicles (IoV) based on federated learning, belonging to the fields of IoV security and distributed machine learning technology. The method first acquires the original perception data from the local sensors of each participating vehicle, organizing it into a local perception dataset according to the participating vehicle, sensor type, and sampling time. Then, it extracts sensor attack features by fusing statistical deviation, prediction residuals, and the degree of change between adjacent time points, training a local attack feature model. Further, it calculates the update credibility of the local model, selects reliable update parameters, and performs secure aggregation with a random mask to generate a global attack feature model. Subsequently, it extracts and normalizes the global feature representations of various attacks, forming a shared attack feature set which is distributed to each vehicle for local attack identification. Finally, it corrects the local model parameters and global aggregation weights based on the attack identification results, achieving iterative updates of the federated attack feature sharing model. This invention, through federated learning, reliable aggregation, and closed-loop iteration strategies, achieves collaborative sharing of IoV attack features without transmitting original data, effectively improving the ability to identify unknown attacks and reducing data leakage risks and communication overhead. The following detailed implementation steps further illustrate this invention.

[0033] Step 1) Obtain the raw perception data generated by the local sensors of each participating vehicle, and organize it uniformly according to the participating vehicle, sensor type and sampling time to form a local perception dataset. .

[0034] This step aims to construct a unified framework for the collection and organization of multi-source heterogeneous sensor data from participating vehicles in the Internet of Vehicles (IoV), providing a standardized data foundation for subsequent federated attack feature extraction and sharing. During IoV operation, each participating vehicle collects surrounding environmental information in real time through various sensors with different physical principles. The data output by each sensor differs fundamentally in modality, dimension, sampling frequency, and physical semantics. Therefore, a unified data organization model needs to be established to achieve structured management of multi-vehicle, multi-modal observation data.

[0035] (I) Multi-vehicle multi-source sensor data acquisition architecture

[0036] Let the total number of vehicles participating in federated learning in the vehicle-to-everything (V2X) network be . Each participating vehicle carries These sensors encompass cameras, lidar, millimeter-wave radar, Global Navigation Satellite System (GNSS) sensors, and inertial measurement units (IMUs). Each sensor independently generates raw sensing data according to its inherent sampling frequency, and this data is always stored locally in the vehicle and is not uploaded raw. The data modes and dimensions output by each sensor are fundamentally different: cameras output two-dimensional image features, lidar outputs a three-dimensional point cloud coordinate set, millimeter-wave radar outputs a target distance-velocity-angle feature vector, GNSS outputs a position coordinate vector, and IMU outputs a multi-dimensional motion state vector.

[0037] (II) Formal Definition of Local Sensing Dataset

[0038] Raw perception data generated by cameras, lidar, millimeter-wave radar, global navigation satellite system sensors, and inertial measurement units from participating vehicles are collected and organized uniformly according to the participating vehicles, sensor types, and sampling times to form a local perception dataset. :

[0039] in: Local perception dataset: This represents the collection of raw perception data collected by all participating vehicles in the Internet of Vehicles (IoV). : No. The first vehicle involved Type of sensor in the first The dimensionality of the raw sensing data generated at each sampling time depends on the sensor type and measurement mode. : Participating vehicle number, with a value range of ; Sensor category number, with a value range of: ; : Sampling time number, value range is ; The total number of participating vehicles depends on the size of the vehicle network nodes that have joined the federated learning. The total number of sensor categories depends on the vehicle's sensor configuration. : No. The first vehicle involved The amount of sampled data corresponding to a type of sensor is determined by both the sensor's sampling frequency and the observation duration.

[0040] Local perception dataset A three-level index structure of "participating vehicle-sensor category-sampling time" is adopted, which makes any raw sensing data Each element can be uniquely located, providing a clear organizational foundation for subsequent data segmentation by participating vehicles and feature extraction by sensor category.

[0041] (III) Data Organization and Privacy Constraints: In the process of data organization, raw perceived data... Always stored in the first In the local storage units of each participating vehicle, only their index relationships are recorded for subsequent feature extraction, without any raw data transmission across vehicles. This design establishes the privacy protection principle of "data is usable but not visible" from the data organization level, laying the foundation for subsequent federated learning architectures.

[0042] Finally, the local sensing dataset will be... Input step 2), used to extract local sensor attack features and form a local attack feature set. Step 2) Utilize the local sensing dataset generated in Step 1). Extract sensor attack features to form a local attack feature set.

[0043] This step aims to extract multidimensional features from locally sensed data that characterize sensor attack behavior. Under normal operating conditions, sensor observation data should fluctuate smoothly around its historical statistical distribution and maintain a consistent relationship with kinematic model-based predictions and observations at adjacent time points. Sensor attacks disrupt these patterns, manifesting as statistical deviations, abnormal prediction residuals, or abrupt changes at adjacent time points. Therefore, extracting attack features from these three complementary dimensions forms the core foundation for subsequent model training.

[0044] (a) Calculation of multi-dimensional attack features: using the local awareness dataset formed in step 1). The statistical deviation, prediction residual, and degree of change between adjacent sampling times of the sensor data of each participating vehicle are calculated to extract local sensor attack features and form a local attack feature set. The local attack signature is calculated as follows:

[0045]

[0046] in: : No. The first vehicle involved Type of sensor in the first Local attack feature value corresponding to each sampling time : No. The first vehicle involved The historical mean of sensor-sensed data reflects the normal statistical center of the sensor's observation data. The historical standard deviation of the corresponding sensing data reflects the normal fluctuation range of the sensor's observation data. The predicted sensing data corresponding to the sampling time is given by a kinematic prediction model or a time series prediction model based on historical observations; To prevent positive numbers with zero denominators and ensure the numerical stability of feature calculations when predicted values ​​or observed values ​​at adjacent times are close to zero; : Statistical deviation weight, which controls the contribution of statistical deviation terms to attack characteristics; Predicting residual weights controls the contribution of predicted residual terms to attack features; Weights of the degree of change between adjacent sampling times control the contribution of temporal mutation terms to attack features.

[0047] (II) Physical meaning of the three types of attack indication characteristics: The above formula consists of three weighted terms, which describe the attack behavior from different dimensions: 1. Statistical deviation Adopting standardization -score measures the degree to which current observations deviate from the historical normal distribution. This value increases significantly when the sensor is subjected to persistent offset attacks, effectively capturing steady-state spoofing attacks. 2. Predicting residuals : Measures the relative deviation between actual observations and predicted values. Under normal operating conditions, the predicted values ​​based on the kinematic model are in high agreement with the actual observations, and the prediction residuals are small; when the sensor is subjected to injection or tampering attacks, the actual observations will deviate from the predicted values, causing the prediction residuals to increase significantly. 3. Degree of change between adjacent sampling times This measures the relative rate of change of observations at adjacent time points. The physical characteristics of the sensor determine the temporal continuity of the observations; a sudden attack will cause this value to surge, effectively capturing transient jump attacks.

[0048] (III) Formation of Local Attack Feature Set: Combine the attack feature values ​​of all participating vehicles, all sensor types, and all sampling times to form a local attack feature set. :

[0049] in: : Local attack signature set, which contains the set of signature values ​​of all vehicles involved in sensor attacks; : No. The first vehicle involved Type of sensor in the first The local attack feature value corresponding to each sampling time corresponds to the attack state representation of a specific vehicle and a specific sensor at a specific time.

[0050] Local attack signature set By weighted fusion of three dimensions—statistical deviation, prediction residual, and temporal abrupt changes—various sensor attack behaviors in the Internet of Vehicles (IoV) are comprehensively characterized, providing high-quality training samples for subsequent local model training. Finally, the local attack feature set... Input step 3), used to train the local attack feature model for each participating vehicle and generate the local model update parameter set. Step 3) Utilize the local attack signature set formed in Step 2). Train local attack feature models for each participating vehicle and generate local model update parameter sets.

[0051] This step aims to train local attack feature models for each participating vehicle based on local attack feature sets, and generate local model update parameters for subsequent federated aggregation. The core of federated learning is that each participating vehicle trains its model locally using only its own data, and uploads the model update parameters (rather than the original data) for global aggregation, thereby achieving knowledge sharing while protecting data privacy.

[0052] (a) Local attack feature data segmentation: using the local attack feature set formed in step 2). Based on the participating vehicles, a subset of local attack features corresponding to each participating vehicle is obtained:

[0053] in Indicates the first A subset of local attack features corresponding to each participating vehicle, containing attack feature values ​​from all sensors of that vehicle at all sampling times. This partitioning ensures that each participating vehicle uses only its own data for local training, which aligns with the data locality principle of federated learning.

[0054] (ii) Training of local attack feature model: Each participating vehicle uses a subset of local attack features. Train a local attack feature model by minimizing the local model loss function. Optimize local model parameters The gradient descent method is used to calculate the local model update parameters:

[0055] in: : No. The local model update parameters for each participating vehicle represent the amount of adjustment of the local model parameters along the descent direction of the loss function. : No. Local attack signature model parameters corresponding to each participating vehicle; Local model learning rate: Controls the step size of model parameter adjustments during a single training iteration. ; : No. The local model loss function for each participating vehicle measures the deviation between the local model's prediction results and the attack feature labels; Loss function with respect to local attack feature model parameters The gradient indicates the direction of optimization of the model parameters.

[0056] (III) Formation of Local Model Update Parameter Set: The local model update parameters of all participating vehicles are summarized to form a local model update parameter set. :

[0057] in: Local model update parameter set, which contains a collection of all local model update parameters for all participating vehicles; : No. The local model update parameters for each participating vehicle encode the attack identification knowledge increment learned by the vehicle from local attack features.

[0058] Local model update parameter set Each update parameter in It carries the local attack identification experience for the corresponding vehicle and serves as the information carrier for subsequent federated aggregation and attack signature sharing. Because only model update parameters are uploaded instead of raw sensor data, data privacy and security are guaranteed from a mechanism perspective.

[0059] Finally, the local model update parameter set is performed. Input step 4), used to calculate the local model update confidence and generate a confident model update parameter set. Step 4) Update the parameter set using the local model generated in Step 3). By combining the historical training status and model update differences of each participating vehicle, the local model update reliability is calculated, and a reliable model update parameter set is generated.

[0060] This step aims to assess and filter the credibility of local model update parameters submitted by each participating vehicle, preventing vehicles affected by poisoning attacks, sensor malfunctions, or malicious tampering from submitting abnormal model updates that contaminate the global model. A credibility assessment mechanism is constructed by integrating two dimensions: historical training state and model update differences, ensuring high reliability of the model updates participating in the aggregation.

[0061] (a) Calculation of average model update parameters: using the local model update parameter set formed in step 3). First, the average value of all local model update parameters is calculated as a reference benchmark for the group update behavior:

[0062] in: Local model update parameter set The average value of the update parameters of each local model reflects the average level of the vehicle-to-everything (V2X) group model update. : No. The local model update parameters for each participating vehicle are obtained from step 3). Total number of participating vehicles.

[0063] Average model update parameters This provides a benchmark for subsequently measuring the degree of deviation between the updated parameters of each vehicle and the behavior of the group.

[0064] (II) Calculation of local model update credibility: Based on the historical training status of each participating vehicle and the difference between the local model update parameters and the average model update parameters, the credibility of the local model update is calculated.

[0065] in: : No. The reliability of the local model update corresponding to each participating vehicle, with a value range of [value range missing]. A larger value indicates that the model update for that vehicle is more reliable; : No. The credibility of the historical training of each participating vehicle is obtained by cumulatively evaluating the vehicle's behavior in historical federal training rounds. The average value of the local model update parameters, calculated in the previous step; The weight of historical training credibility, satisfying The relative importance of controlling for the difference between historical behavior and current updates in credibility assessment; The model updates the difference adjustment parameters to meet the following requirements. To control the sensitivity of credibility to differences in model updates, The larger the value, the stronger the penalty for updating parameters that deviate from the group average; : L2 norm, used to measure the Euclidean distance between the local model update parameters and the average model update parameters.

[0066] Local model update reliability The logical structure of the first term: (1) Reflecting the historical dimension, vehicles with good historical training behavior obtain higher basic credibility; (2) the second item Reflecting the current dimension, when local parameters are updated. Approximate to the group average When the exponent term approaches 1, the reliability is high; when When the index deviates significantly from the group average, it approaches 0, indicating low reliability, thus effectively identifying abnormal poisoning updates.

[0067] (III) Parameter Filtering and Weighting for Trustworthy Model Updates: Update the trustworthiness threshold based on the local model. The model update parameters for each vehicle are filtered and weighted:

[0068] in: : No. Update parameters of the trusted model corresponding to each participating vehicle; The local model update confidence threshold is set according to the system's requirements for aggregation security. : No. The reliability of the local model update corresponding to each participating vehicle. At that time, the updated parameters of the vehicle were determined to be reliable and retained with a reliability level. Weighted; when At that time, the updated parameters of the vehicle were determined to be unreliable, set to zero, and removed from subsequent aggregation.

[0069] (iv) Formation of the Trusted Model Update Parameter Set: All the selected and weighted trusted model update parameters are combined to form the trusted model update parameter set. :

[0070] in: : Trustworthy model update parameter set, containing all model update parameters that have passed the trustworthiness screening; : No. Update the parameters of the trusted model corresponding to each participating vehicle.

[0071] Trustworthy model update parameter set By eliminating potential anomalies and malicious updates through credibility assessment, a high-quality parameter source is provided for subsequent security aggregation, serving as a crucial barrier to ensure the reliability of the global attack signature model. Finally, the trusted model update parameter set is then used. Input step 5), used to perform security aggregation and generate a global attack feature model. Step 5) Update the parameter set using the trusted model generated in Step 4). Perform security aggregation to generate a global attack signature model. .

[0072] This step aims to securely aggregate the trusted model update parameters of each participating vehicle to generate a global attack feature model that incorporates experience in identifying attacks across the entire network. During the aggregation process, on the one hand, the privacy of each vehicle's model update is protected by a non-random mask, and on the other hand, the statistical reasonableness of the aggregation result is ensured by weighting the aggregation based on the number of local training samples.

[0073] (a) Random mask addition and offsetting design: Update the parameter set using the reliable model formed in step 4). Update parameters for each trustworthy model Add random mask The random mask is generated by a pairwise negotiation mechanism, satisfying the globally cancelable constraint:

[0074] in: : No. A random mask is added to each participating vehicle to obfuscate the vehicle's actual model update and prevent the aggregation server or a third party from inferring the vehicle's private data information from a single update parameter. : Indicates the number of parameters updated by the trusted model. Since the sum of all random masks is zero, the masks cancel each other out during the aggregation process, which protects the update privacy of individual vehicles without affecting the correctness of the aggregation result.

[0075] (ii) Weighted aggregation by sample size: Weighted aggregation is performed based on the number of local training samples for each participating vehicle. Global model parameters before the start of federated training Generate a global attack feature model based on this. :

[0076] in: A global attack signature model that integrates attack identification experience from all trusted participating vehicles in the Internet of Vehicles. : No. The global model parameters before the start of the first round of federated training serve as the benchmark for this round of aggregation; : Indicates the number of parameters updated in the reliable model; : No. The number of local training samples for each participating vehicle; : No. The trusted model update parameters for each participating vehicle are obtained from step 4). : No. The random mask added to each participating vehicle satisfies... .

[0077] The design principle of weighted by sample size: the number of local training samples. The larger the vehicle, the more reliable the model update parameters. The more comprehensive and statistically representative the attack characteristics knowledge contained within, the higher its weight should be in the aggregation. Because The mask terms cancel each other out after summation, and the aggregation result is equivalent to a weighted average of the updated parameters of the trusted model superimposed on the global model baseline. Finally, the global attack feature model is... Input step 6), used to extract global feature representations of sensor attacks and form a shared attack feature set. Step 6) Utilize the global attack signature model generated in Step 5) Extract global feature representations of various sensor attacks to form a shared attack feature set. .

[0078] This step aims to extract global feature representations for different sensor attack types from the global attack feature model and perform normalization processing to form a distributable, shared attack feature set. Global Attack Feature Model It encodes the attack identification experience of all participating vehicles in the Internet of Vehicles, and can decompose the feature representations corresponding to different attack types through feature projection, so that each vehicle can perform attack identification.

[0079] (a) Attack type feature projection: using the global attack feature model generated in step 5). Based on the feature projection relationships corresponding to different sensor attack types, global feature representations of various sensor attacks are extracted from the global attack feature model parameters. For the first... Sensor-like attacks, through the corresponding feature projection matrix Project:

[0080] in: : No. The feature projection matrix corresponding to sensor-like attacks will include the global attack feature model parameters. Mapped to the Feature subspace of attack class; Sensor attack type number, with a value range of: ; The total number of sensor attack types, covering various attack types such as GPS spoofing attacks, visual spoofing attacks, and radar spoofing attacks.

[0081] (ii) Feature normalization: To eliminate the differences in numerical ranges of features from different attack types and to ensure comparability in subsequent similarity calculations, the projected attack features are normalized.

[0082] in: : No. The shared attack features corresponding to sensor-like attacks are represented by unitized features. : Projection features Norms are used for normalization. To prevent positive numbers with zero denominators and ensure numerical stability when the projected characteristic norm is close to zero.

[0083] Normalization maps the global feature representations of various attacks to a unified scale space, so that subsequent similarity-based attack identification is not affected by the absolute magnitude of the features, but only focuses on the degree of matching in the feature direction.

[0084] (III) Formation of Shared Attack Feature Set: The normalized global feature representations of all sensor attack types are combined to form a shared attack feature set. :

[0085] in: Shared attack signature set, containing shared attack signatures for all sensor attack types; : No. The shared attack features corresponding to sensor-like attacks represent the typical feature patterns of this type of attack in the global model.

[0086] Shared attack signature set This is the culmination of the collective experience in vehicle attack identification within the entire Internet of Vehicles (IoV) system. It will be distributed to each vehicle for local attack identification, enabling each vehicle to utilize the knowledge from the entire network to detect various attacks it may encounter locally. Ultimately, this shared attack feature set will be... Input step 7), used to perform attack identification on the local perception data of each participating vehicle and generate local attack identification results. Step 7) Utilize the shared attack signature set formed in Step 6) Attack identification is performed on the local perception data of each participating vehicle, and local attack identification results are generated.

[0087] This step aims to match and identify the local attack features of each participating vehicle using a globally shared attack feature set, thereby determining the type of attack suffered by the local sensors. By calculating the similarity between local attack features and various shared attack features, and combining this with attack identification thresholds, a classification judgment is made to achieve accurate attack identification and type localization.

[0088] (a) Feature Similarity Calculation: Using the shared attack feature set S formed in step 6), calculate the similarity between each local attack feature and each shared attack feature in the local attack feature set F formed in step 2):

[0089] in: : No. The first vehicle involved Type of sensor in the first The local attack characteristics corresponding to the sampling time and the first sampling time are similar to those of the second sampling time. The similarity between shared attack features, with a value range of 1. The larger the value, the higher the degree of matching between the local features and the attack features of this type; Local attack signature values, derived from the local attack signature set formed in step 2). ; : No. The shared attack features corresponding to sensor-like attacks come from the shared attack feature set formed in step 6). ; These are local attack characteristics and shared attack characteristics, respectively. Norm.

[0090] The introduction of cosine similarity makes the similarity calculation depend only on the direction of the feature and independent of the magnitude of the feature. Combined with the feature normalization process in step 6), this ensures the robustness of the attack matching.

[0091] (II) Determination of the Attack Type with the Highest Similarity: After calculating the similarity between the local attack features and the features shared by all attack types, the sensor attack type with the highest similarity to the local attack features is determined:

[0092] in: : Characteristics of local attacks The sensor attack type number with the highest similarity is the attack category most likely to be assigned by local observation.

[0093] (III) Generation of local attack identification results based on threshold: Local attack identification results are generated based on the maximum similarity and the attack identification threshold. :

[0094] in: Local attack identification results, including attack identification conclusions for all participating vehicle sensors at each sampling time; : No. The first vehicle involved Type of sensor in the first Local attack identification results corresponding to each sampling time; Attack identification threshold, with a value range of: The system is configured based on a trade-off between attack detection sensitivity and false alarm rate. This is an indicator function; it takes the value 1 when the condition within the parentheses is true, and 0 otherwise. When the maximum similarity is not less than the attack detection threshold, This indicates that the first one has been identified. Sensor-like attacks, otherwise This indicates that no sensor attack was detected. Attack detection threshold. The higher the value, the stricter the judgment, the lower the false alarm rate, but the weak attacks may be missed. The lower the value, the more lenient the judgment, the higher the detection sensitivity, but the higher the false alarm rate.

[0095] Local attack identification results This process completes the mapping from shared attack features to specific attack identification conclusions, providing both a determination of whether an attack exists and a precise location of the attack type. Finally, the local attack identification results are... Input step 8), used to correct the local model training parameters and global model aggregation parameters and generate an updated federated attack feature sharing model. Step 8) Utilize the local attack identification results generated in Step 7) Adjust the local model training parameters and global model aggregation parameters to generate an updated federated attack feature sharing model.

[0096] This step aims to construct a closed-loop model update mechanism based on attack identification feedback, enabling the federated attack signature sharing system to continuously adapt to new attack methods and dynamic operating environments. Faced with the continuous evolution of attack techniques, static model parameters and fixed aggregation weights will lead to a gradual degradation in detection performance. By utilizing the deviation between actual attack identification results and local model prediction results to drive parameter correction, and adaptively adjusting the global aggregation weights based on the corrected model loss, the federated attack signature sharing model achieves online self-evolution.

[0097] (a) Classification of local attack identification results: using the local attack identification results generated in step 7). Based on the participating vehicles, a subset of local attack identification results is obtained for each participating vehicle:

[0098] in Indicates the results of local attack identification. The first division in the middle The subset of local attack identification results corresponding to each participating vehicle includes the attack identification conclusions of all sensors of that vehicle at each sampling time. This division is consistent with the local attack feature subset division in step 3), providing a basis for targeted correction of the local model.

[0099] (ii) Local Model Parameter Correction: The local model parameters are corrected based on the difference between the local attack identification results and the local model prediction results. This is based on the difference between the local attack identification results and the prediction results. The first division in the middle Subset of local attack identification results corresponding to each participating vehicle As a supervision signal, the local model loss is calculated and the local model parameters are updated along the gradient direction:

[0100] in: : No. Updated local model parameters for each participating vehicle; : No. The parameters of the local attack signature model corresponding to each participating vehicle before the update; The local model parameter update rate controls the step size of feedback corrections. ; The first segment from the local attack identification result H A subset of local attack identification results corresponding to each participating vehicle; Based on local attack identification results The local model loss function is used to supervise the signal and measures the deviation between the local model prediction and the attack identification conclusion. Loss function with respect to local model parameters The gradient.

[0101] Adaptive logic for local model parameter correction: When the attack prediction from the local model matches the attack identification result from the local model... The first division in the middle Subset of local attack identification results corresponding to each participating vehicle When a bias exists, the gradient term drives the model parameters to adjust in the direction of reducing the bias, enabling the local model to gradually acquire attack identification knowledge shared across the entire network; when the prediction is accurate, the gradient approaches zero, and the model parameters remain stable.

[0102] (iii) Global model aggregation weight adjustment: Adjust the global model aggregation weights based on the corrected local model loss, so that vehicles with excellent detection performance receive higher weights in the next round of aggregation:

[0103] in: : No. The updated global model aggregate weights corresponding to the participating vehicles satisfy the following conditions: ; : Vehicle IDs participating in global model aggregation, with values ​​ranging from .

[0104] The aggregation weight adjustment adopts a loss-based Softmax normalization mechanism: vehicles with smaller adjusted losses have higher weights. The larger the value, the higher the corresponding aggregate weight. The higher the weight, the greater its contribution to the global model construction; conversely, vehicle weights with significant losses are suppressed. This mechanism enables adaptive allocation of aggregated weights based on model quality, continuously improving the aggregated quality of the global model.

[0105] (iv) Global model parameter update and federated model construction: Based on the adjusted aggregation weights, the updated local model parameters are weighted and aggregated to obtain the updated global attack feature model parameters:

[0106] in: The updated global attack feature model parameters serve as the global baseline for the next round of federated training. The updated global model parameters are then combined with the updated local model parameters to construct an updated federated attack feature sharing model. :

[0107] in: Updated Federation Attack Signature Sharing Model; : Represents the updated global attack signature model parameters; : No. Updated local model parameters for each participating vehicle; : Indicates the first division from the local attack identification result H A subset of local attack identification results corresponding to each participating vehicle; (v) Closed-loop iteration mechanism: Finally, the updated federated attack feature sharing model will be implemented. This data is used for the next round of local attack feature extraction, local model training, and global model security aggregation, enabling continuous sharing and iterative updates of vehicle-to-everything (V2X) sensor attack features. In the next federated training round, the updated global attack feature model parameters... Replace step 5) The updated local model parameters serve as the new aggregation baseline. Replace step 3) Serving as a new starting point for local training, the system can continuously accumulate experience in identifying network-wide attacks through continuous closed-loop iteration, thereby continuously improving its ability to detect new types of sensor attacks and its collaborative defense capabilities, ensuring the long-term safe and reliable operation of the vehicle-to-everything (V2X) perception system.

Claims

1. A method for sharing sensor attack features in vehicle networking based on federated learning, characterized in that, Includes the following steps: Step 1) Obtain the raw perception data generated by the local sensors of each participating vehicle, and organize it uniformly according to the participating vehicle, sensor type and sampling time to form a local perception dataset. ; Step 2) Utilize the local sensing dataset formed in Step 1) Extract sensor attack features to form a local attack feature set. ; Step 3) Utilize the local attack signature set formed in Step 2) Train local attack feature models for each participating vehicle and generate local model update parameter sets. ; Step 4) Update the parameter set using the local model generated in Step 3). By combining the historical training status and model update differences of each participating vehicle, the local model update reliability is calculated, and a reliable model update parameter set is generated. ; Step 5) Update the parameter set using the trusted model generated in Step 4). Perform security aggregation to generate a global attack signature model. ; Step 6) Utilize the global attack feature model generated in Step 5) Extract global feature representations of various sensor attacks to form a shared attack feature set. ; Step 7) Utilize the shared attack signature set formed in Step 6) Attack identification is performed on the local perception data of each participating vehicle, and local attack identification results are generated. ; Step 8) Utilize the local attack identification results generated in Step 7) Adjust the local model training parameters and global model aggregation parameters to generate an updated federated attack feature sharing model. .

2. The method for sharing sensor attack features in vehicle networking based on federated learning according to claim 1, characterized in that, The specific method in step 1) is as follows: Raw perception data generated by cameras, lidar, millimeter-wave radar, global navigation satellite system sensors, and inertial measurement units from participating vehicles are collected and organized uniformly according to the participating vehicles, sensor types, and sampling times to form a local perception dataset. : in, This represents a local sensing dataset. Indicates the first The first vehicle involved Type of sensor in the first The raw sensor data generated at each sampling time point Indicates the vehicle number involved. , Indicates the sensor category number , Indicates the sampling time number , This indicates the total number of participating vehicles. Indicates the total number of sensor categories. Indicates the r-th participating vehicle's... The number of sampled data corresponding to a type of sensor.

3. The method for sharing sensor attack features in vehicle networking based on federated learning according to claim 1, characterized in that, The specific method in step 2) is as follows: Using the local sensing dataset formed in step 1) The statistical deviation, prediction residual, and degree of change between adjacent sampling times of the sensor data of each participating vehicle are calculated to extract local sensor attack features and form a local attack feature set. : in, This represents a local attack signature set. Indicates the first The first vehicle involved Type of sensor in the first Local attack feature values ​​corresponding to each sampling time point Indicates the first The first vehicle involved Historical average of sensor-sensed data ， This represents the historical standard deviation of the corresponding sensing data. This represents the predicted sensing data at the corresponding sampling time. This prevents positive numbers with a denominator of zero. Indicates the weight of statistical deviation. Indicates the weight of the predicted residual. This represents the weight of the degree of change between adjacent sampling times.

4. The method for sharing sensor attack features in vehicle networking based on federated learning according to claim 1, characterized in that, The specific method in step 3) is as follows: Using the local attack signature set formed in step 2) Local attack feature data is divided according to the participating vehicles, and local attack feature models are trained for each participating vehicle. Local model update parameters are calculated to form a local model update parameter set. : in, This indicates that the local model updates the parameter set. Indicates the first Update the local model parameters for each participating vehicle. Indicates the first A subset of local attack signatures corresponding to each participating vehicle. Indicates the first Local attack signature model parameters corresponding to each participating vehicle. This represents the local model learning rate. Indicates the first The local model loss function for each participating vehicle. This represents the loss function with respect to the parameters of the local attack feature model. The gradient.

5. The method for sharing sensor attack features in vehicle networking based on federated learning according to claim 1, characterized in that, The specific method in step 4) is as follows: Update the parameter set using the local model formed in step 3). By combining the historical training status of each participating vehicle and the difference between the local model update parameters and the average model update parameters, the reliability of the local model update is calculated. Reliable local model update parameters are then selected and weighted to form a set of reliable model update parameters. : in, This indicates that the reliable model updates the parameter set. Indicates the first Update the parameters of the trusted model corresponding to each participating vehicle. Indicates the first The reliability of the local model update corresponding to each participating vehicle. Indicates the first The credibility of the historical training data corresponding to each participating vehicle. Indicates local model update parameter set The average value of the updated parameters for each local model. The weights representing the reliability of historical training. This indicates that the model updates the difference adjustment parameter. This indicates the local model update confidence threshold. This represents the L2 norm.

6. The method for sharing sensor attack features in vehicle networking based on federated learning according to claim 1, characterized in that, The specific method in step 5) is as follows: Update the parameter set using the trusted model formed in step 4). The update parameters of each trusted model are updated with a cancelable random mask, and a weighted aggregation is performed based on the number of local training samples of each participating vehicle to generate a global attack feature model. : ； in, This represents a global attack signature model. This represents the parameters of the global attack signature model. Indicates the first Global model parameters before the start of federated training. This indicates the number of parameters updated by the reliable model. Indicates the first The number of local training samples for each participating vehicle. Indicates the first A random mask added to each participating vehicle.

7. The method for sharing sensor attack features in vehicle networking based on federated learning according to claim 1, characterized in that, The specific method in step 6) is as follows: Using the global attack feature model generated in step 5) Based on the feature projection relationships corresponding to different sensor attack types, global feature representations of various sensor attacks are extracted and normalized from the global attack feature model parameters to form a shared attack feature set. : ； in, Indicates a shared attack signature set. Indicates the first Shared attack characteristics corresponding to sensor-like attacks Indicates the first The feature projection matrix corresponding to sensor-like attacks. Indicates the sensor attack type number and , This indicates the total number of sensor attack types. This indicates a positive number that prevents the denominator from being zero.

8. The method for sharing sensor attack features in vehicle networking based on federated learning according to claim 1, characterized in that, The specific method in step 7) is as follows: Using the shared attack signature set formed in step 6) Calculate the local attack feature set formed in step 2). Similarity between local attack features and shared attack features: Identify the sensor attack type that has the greatest similarity to local attack characteristics: Local attack identification results are generated based on the maximum similarity and attack identification threshold. : in, This indicates the results of local attack identification. Indicates the first The first vehicle involved Type of sensor in the first The local attack characteristics corresponding to the sampling time and the first sampling time are similar to those of the second sampling time. Similarity between shared attack features This indicates the type of sensor attack that has the greatest similarity to local attack characteristics. This indicates the corresponding local attack identification result. This represents the attack identification threshold; when the maximum similarity is not less than the attack identification threshold... This indicates that the first one has been identified. Sensor-like attacks, otherwise This indicates that no sensor attack was detected.

9. The method for sharing sensor attack features in vehicle networking based on federated learning according to claim 1, characterized in that, The specific method in step 8) is as follows: Using the local attack identification results generated in step 7) The local attack identification results are divided into subsets based on the participating vehicles. The local model parameters are adjusted according to the difference between the local attack identification results and the local model prediction results. The global model aggregation weights are then adjusted based on the adjusted local model loss to generate an updated federated attack feature sharing model. : in, This represents the updated federated attack signature sharing model. This represents the updated global attack signature model parameters. Indicates the first The updated local model parameters for each participating vehicle. Indicates the results of local attack identification. The first division in the middle A subset of local attack identification results corresponding to each participating vehicle. Indicates the local model parameter update rate. Indicates the first The updated global model aggregate weights corresponding to each participating vehicle. This indicates the vehicle number that participates in the global model aggregation.

Images