A two-stage tracing method for DDoS attacks in multi-traffic agent fusion scenarios

Abstract

The application relates to the technical field of network security, and discloses a two-stage tracing method for DDoS attacks in a multi-traffic subject fusion scene, which comprises the following steps: constructing a DDoS attack tracing network system model; constructing a suspicious vehicle node set; extracting the mean, variance and maximum of the received signal strength indication residual in an observation window; extracting the mean and continuous anomaly count of the Mahalanobis distance in the observation window; extracting the mean, variance, skewness and kurtosis of the inter-arrival time in the observation window; constructing a feature vector and inputting the feature vector into a multi-dimensional deep convolution classifier for training; obtaining the feature vectors of all vehicle nodes in each observation window, inputting the feature vectors into the trained multi-dimensional deep convolution classifier, generating the classification results of each vehicle node in each observation window, and adopting a window-by-window majority voting mechanism to make a smooth decision to obtain an attack vehicle; and the application realizes accurate locking of the real physical identity of an attacker.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a two-stage attribution method for DDoS attacks in scenarios involving multiple traffic entities. Background Technology

[0002] With the continuous evolution of intelligent transportation systems, ground-based vehicle-to-everything (V2X) networks have expanded from a single communication architecture to a multi-entity heterogeneous network integrating drones and roadside units (RSUs). The rapid development of low-altitude technology has driven the formation of vehicle-drone fusion systems. These systems achieve air-ground collaboration through various links, including vehicle-to-vehicle communication, vehicle-to-roadside unit communication, and vehicle-to-drone communication, demonstrating broad application prospects in traffic perception, collaborative control, and emergency response. However, the heterogeneous nodes, open channels, and dynamic topology changes significantly expand the network attack surface. DDoS attacks can inject massive amounts of fake requests into edge base stations using vulnerable nodes in the system, causing disruptions to critical safety services such as obstacle avoidance and map synchronization, and potentially triggering chain traffic accidents in high-speed mobile scenarios. If the source of the attack cannot be located, defensive measures can only remain at the level of passive traffic scrubbing at the victim's end, failing to fundamentally block the attack. In vehicle-drone fusion scenarios, attackers commonly employ techniques such as Internet Protocol (IP) address spoofing and Media Access Control (MAC) address tampering to conceal their true identities. Traditional attribution mechanisms relying solely on network layer information struggle to penetrate the identity deception layer, driving the development of SDN-based, full-perspective attribution methods. The centralized control capabilities of SDN controllers enable refined traffic analysis; however, relying solely on flow statistics from the logic layer significantly reduces accuracy when faced with carefully crafted adversarial examples of traffic distribution forged from the attacker's constructs, and it remains difficult to penetrate the attacker's identity masquerading layer. This limitation has prompted researchers to turn to unforgeable endogenous features at the physical layer. While physical layer features are difficult to forge, their reliability is limited by environmental factors such as channel fading and multipath effects, leading to false positives or false negatives. Furthermore, the high-speed movement of vehicles and drones causes frequent changes in network topology, making it difficult for traditional packet tagging and other attribution methods to converge during the attack's duration, and their high computational cost fails to meet the real-time requirements of vehicle-to-everything (V2X) scenarios. Summary of the Invention

[0003] To address the aforementioned shortcomings in existing technologies, this invention provides a two-stage source tracing method for DDoS attacks in scenarios involving multiple traffic entities, which solves the problems of low accuracy, high real-time requirements, and insufficient robustness in source tracing of DDoS attacks in existing methods.

[0004] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows: A two-phase attribution method for DDoS attacks in multi-transportation-entity fusion scenarios includes the following steps: Construct a network system model for tracing the source of DDoS attacks, including vehicle nodes, drone nodes, fixed infrastructure, and the core network layer; Based on the DDoS attack tracing network system model, multi-dimensional traffic features are extracted and anomaly detection is performed. When a certain traffic feature is abnormal, a weighted BFS path backtracking is performed to generate a set of suspected vehicle nodes. For each suspected vehicle node, the consistency of the received signal strength indication is checked, and the mean, variance and maximum value of the received signal strength indication residual within the observation window are extracted as residual features. For each suspected vehicle node, the trajectory continuity is checked, and the mean of Mahalanobis distance and the number of consecutive anomalies within the observation window are extracted as trajectory features. Obtain the arrival interval time series of data packets sent by each suspected vehicle node, and extract the mean, variance, skewness and kurtosis of the arrival interval time within the observation window as arrival interval time features; Based on residual features, trajectory features, and arrival interval time features, feature vectors are constructed and input into a multidimensional deep convolution classifier for training, generating a trained multidimensional deep convolution classifier. The feature vectors of all vehicle nodes in each observation window are obtained and input into a trained multidimensional deep convolutional classifier to generate the classification results of each vehicle node in each observation window. A window-by-window majority voting mechanism is used to make a smooth decision to obtain the attacking vehicle.

[0005] The present invention has the following beneficial effects: 1. The present invention proposes a two-stage source tracing method for DDoS attacks in multi-traffic subject fusion scenarios. It adopts a two-stage architecture of coarse-grained screening and fine-grained locking, and integrates the complementary advantages of traffic features and physical features. In the first stage, it uses low-overhead traffic statistics indicators and weighted reverse path backtracking to quickly narrow down the scope of suspects. In the second stage, it performs high-precision physical layer verification on only a few suspect vehicle nodes. By integrating multi-dimensional physical layer unforgeable features such as RSSI residuals, EKF trajectory prediction and IAT statistics, it uses a multi-dimensional deep convolution classifier MDDCC to learn its cooperative anomaly pattern, and achieves accurate locking of the attacker's real physical identity. 2. The two-stage DDoS attack tracing method proposed in this invention aims at a high recall rate in the first stage, ensuring no real attack paths are missed and allowing for a certain number of false positives. The second stage aims to achieve a high accuracy rate in identifying attackers. The cascading of the two stages enables the DDoS attack tracing network system to have both rapid response capabilities at the global level and precise location capabilities at the individual level. Attached Figure Description

[0006] Figure 1 This is a flowchart illustrating a two-stage source tracing method for DDoS attacks in a multi-transportation-entity fusion scenario proposed in this invention. Figure 2 This is a schematic diagram of the DDoS attack tracing network system model in the embodiment; Figure 3 This is a schematic diagram of the structure of the multidimensional depth convolution classifier in the embodiment; Figure 4 This is a schematic diagram comparing the accuracy of different feature subsets under different numbers of attackers in the embodiment; Figure 5 This is a schematic diagram comparing the recall rates of different feature subsets under different numbers of attackers in the embodiment; Figure 6 This is a schematic diagram comparing the F1 scores of different feature subsets under different numbers of attackers in the embodiment; Figure 7 This is a schematic diagram illustrating the performance comparison of classifier accuracy as the number of attackers changes in the example. Figure 8 This is a schematic diagram illustrating the performance comparison of classifier recall rate as the number of attackers changes in the example. Figure 9 This is a schematic diagram illustrating the performance comparison of the classifier F1 score as the number of attackers changes in the example. Detailed Implementation

[0007] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0008] The specific embodiments of this invention are as follows: like Figure 1 As shown, a two-stage attribution method for DDoS attacks in multi-transportation-entity fusion scenarios includes the following steps: Step 1: Construct a network system model for tracing the source of DDoS attacks, including vehicle nodes, drone nodes, fixed infrastructure, and the core network layer.

[0009] In this embodiment, Figure 2The structure of the DDoS attack attribution network system model is demonstrated, including vehicle nodes, drone nodes, fixed infrastructure, and a core network layer. Vehicle nodes include both normal vehicles and attacking vehicles. Fixed infrastructure includes roadside units (RSUs). The core network layer includes a backbone communication network, a cloud-based central server, and an SDN controller deployed on the cloud-based central server. The backbone communication network connects roadside units (RSUs), drone nodes, and the cloud-based central server in different areas. The cloud-based central server receives vehicle status information, network communication data, and traffic data uploaded by each RSU and drone node, and performs unified storage, processing, and management of the acquired data, providing global information support for the vehicle-to-everything (V2X) system.

[0010] Specifically, each vehicle node achieves information sharing and collaborative interaction through cellular vehicle-to-everything (C-V2X) communication links: vehicles exchange status data such as location and speed via vehicle-to-vehicle (V2V) links; vehicles and roadside units (RSUs) transmit traffic control information and sensor data via vehicle-to-roadside (V2R) links; and drones, acting as aerial relay nodes, forward data between ground vehicles and roadside infrastructure and provide edge computing support via vehicle-to-UAV (V2U) and UAV-to-roadside (U2R) links. Roadside units (RSUs) provide access services to vehicles and drones within their coverage area through wireless coverage zones, while also undertaking data aggregation, traffic forwarding, and edge computing tasks. Each RSU and drone node is connected to a central cloud server via a backbone communication network, where the central server performs global data processing and management scheduling.

[0011] Based on this, the network system upon which the proposed two-stage DDoS attack attribution method relies is built on an SDN architecture. The research scenario is set as a straight two-way urban highway, such as... Figure 2As shown, two Roadside Units (RSUs) are deployed as fixed infrastructure at both ends of the road, providing wireless access coverage. One OpenvSwitch (OVS) serves as a software instance of the data forwarding plane, acting as a data forwarding node between the RSUs and the SDN controller. The SDN controller, deployed as a logically centralized control platform on a cloud-based central server, communicates with the data plane switch via a southbound interface, centrally managing the flow table rules and forwarding strategies of the data plane, and is responsible for global topology management, flow table rule distribution, and traffic statistics collection. Sixty vehicle nodes are deployed on the road, each traveling at a random speed within the road area and performing a U-turn upon reaching the endpoint. A drone acts as an aerial relay node, maintaining communication with the two RSUs and the cloud server via an air-to-ground link, assisting in building a multi-layered information collection network.

[0012] like Figure 2 As shown, normal vehicles and attack vehicles (marked in red) coexist on the road. Vehicles and drones can send normal or attack traffic to other nodes or Roadside Units (RSUs). While sending DDoS attack traffic with spoofed IDs, the attack vehicle also broadcasts false location information to nearby RSUs. The source tracing model deployed on the RSUs receives information from multiple data layers, including traffic characteristics, Received Signal Strength Indication (RSSI) data, and vehicle location information. By fusing this multi-dimensional heterogeneous data, the attack source is located and tracked. The source tracing model is a multi-dimensional deep convolution classifier. Figure 2 The blue arrows indicate the tracing path, which is the logical path by which the algorithm traces back from the victim roadside unit (RSU) to the attacking vehicle. The tracing model deployed on the RSU is trained by a central cloud server and then distributed to the RSUs. It is used to analyze the attack propagation path and locate the attack source based on the communication traffic information, node interaction information, and network status information collected by the RSUs.

[0013] In the aforementioned network architecture, attackers control several vehicles on the road (the attacker percentage varies from 1.7% to 10%). These controlled vehicles simultaneously execute both traffic attacks and location spoofing to simulate a composite DDoS attack in a vehicle-to-everything (V2X) network. At the traffic level, the attacking vehicles continuously send DDoS traffic at high rates to the victim Roadside Units (RSUs), and the source IP addresses of all attack packets are forged, preventing the RSUs and SDN controllers from directly identifying the attacker's true identity through the source IP field in the packet header. At the physical level, the attacking vehicles declare false coordinates approximately ±150m offset from their actual location in their periodically broadcast security messages, aiming to disrupt location-based cooperative driving safety mechanisms.

[0014] Step 2: Based on the DDoS attack tracing network system model, extract multi-dimensional traffic features and perform anomaly detection. When a certain traffic feature is abnormal, perform weighted BFS path backtracking to generate a set of suspected vehicle nodes.

[0015] This step is the first-stage source tracing based on traffic statistics. Its core task is to quickly locate abnormal Roadside Units (RSUs) from network traffic statistics under the global view of the SDN controller and trace them backward along the transmission path of the attack traffic. This narrows the scope of subsequent analysis to a suspect set composed of the terminal nodes of highly suspicious paths and vehicles within the coverage area of ​​the victimized RSUs, thereby reducing the computational overhead of physical layer feature extraction and classification reasoning in the second stage. The specific implementation process is as follows: (1) Extract multi-dimensional traffic features based on the DDoS attack source tracing network system model.

[0016] Specifically, the multidimensional traffic characteristics include the Shannon entropy of the source IP address and the Packet-In rate ratio of the roadside unit port.

[0017] Specifically, the Shannon entropy of the source IP address is represented as:

[0018]

[0019] In the formula, Shannon entropy of the source IP address; This represents the number of different source IP addresses appearing within the current observation window; For the first The empirical probability of a source IP address appearing; It is a logarithmic function; For the first The number of times each source IP address appears; This represents the total number of data packets contained within the current observation window.

[0020] Specifically, the Packet-In rate ratio is expressed as:

[0021] In the formula, For the first The Packet-In rate ratio of each roadside unit port is used to reflect the frequency of flow table misses caused by spoofed source IPs; The number of Packet-In messages received by the SDN controller per unit time. This represents the total number of data packets received by the roadside unit port within the same time period.

[0022] In this embodiment, to achieve real-time attack detection and tracing, the network system typically employs a sliding window technique to segment and statistically analyze traffic. The controller maintains a fixed-length observation window for each Roadside Unit (RSU) port. Once the window is full, the oldest packet is removed as soon as a new packet is received. In the SDN architecture, the SDN controller periodically collects flow table statistics from each port of mobile nodes (vehicle nodes, drone nodes) via the southbound interface.

[0023] Based on this, to quantify the degree of change in network traffic distribution, this embodiment uses the Shannon entropy H of the source IP address as the core anomaly indicator; simultaneously, to ensure the normalization condition of the empirical probability. This holds true when the sum of the occurrences of each source IP address equals the total number of packets in the observation window. In normal network communication, due to the diverse access behaviors of different vehicle nodes, the distribution of source IP addresses is relatively uniform, and the entropy value remains at a high level. When a DDoS attack occurs, the source IP addresses forged by the attacker are often concentrated in a specific address pool. A large number of attack packets carrying a few forged addresses flood into the victim's Roadside Unit (RSU), causing a sharp increase in the concentration of source IP addresses and a significant decrease in entropy. When the attacker employs a strategy of randomly forging source IP addresses on a large scale, the source IP entropy may increase. In this case, each forged address appears only a very small number of times, exhibiting a highly uniform distribution. Therefore, a significant decrease or abnormal increase in entropy value serves as an attack warning signal.

[0024] Simultaneously, complementing Shannon entropy, the Packet-In rate is higher than... This is another important auxiliary detection indicator. Under normal circumstances, most packets can hit existing flow table entries in the switch for hardware forwarding, and the frequency of Packet-In messages is low. When a DDoS attack is accompanied by source IP spoofing, a large number of packets using fake source addresses cannot match any existing flow table entries, triggering a dense flow table miss (Table-Miss) event and sending Packet-In messages to the SDN controller, resulting in a Packet-In rate higher than expected. Abnormally high.

[0025] (2) Calculate the deviation of the source IP address's Shannon entropy from the historical cumulative distribution and the rate of change of the source IP address's Shannon entropy in adjacent observation windows. Determine whether the deviation is greater than the deviation threshold, the rate of change is greater than the rate of change threshold, or the Packet-In rate ratio is greater than the Packet-In rate ratio threshold. If so, perform weighted BFS path backtracking to generate a set of suspected vehicle nodes. Otherwise, continue to perform multidimensional traffic feature extraction.

[0026] In this embodiment, three anomaly detection trigger conditions are set. When any of the following anomaly detection trigger conditions are met, weighted BFS path backtracking is performed to generate a set of suspected vehicle nodes. Otherwise, multidimensional traffic features are extracted.

[0027] Specifically, the first anomaly detection trigger condition is an abnormal deviation of Shannon entropy, specifically: By calculating the deviation of the source IP address's Shannon entropy relative to its historical cumulative distribution, anomalies are detected by determining whether the deviation exceeds a deviation threshold. The deviation threshold is dynamic, meaning that when the deviation... When the dynamic value is exceeded, the current traffic is determined to be in an abnormal state, which can be expressed by the formula:

[0028]

[0029] In the formula, The Shannon entropy mean of the source IP addresses of all historical observation windows (including the current observation window) is the historical moving average. The more windows there are and the longer the history, the more "global" the mean becomes, and the marginal impact of new observation windows on the mean becomes smaller and smaller. The standard deviation of the Shannon entropy of the source IP addresses for all historical observation windows; Index for the observation window; This represents the total number of historical observation windows, including the current observation window. For the first Shannon entropy of the source IP address of each observation window; The sensitivity coefficient is set to 2.5 in this invention.

[0030] Specifically, the second anomaly detection trigger condition is an abnormal rate of change of Shannon entropy in adjacent observation windows, specifically: In addition to identifying anomalies through deviations in Shannon entropy, a mutation detection mechanism based on the time derivative is introduced. This means that abnormal increases or significant decreases in entropy are also used as attack warning signals. By judging the rate of change of entropy, the existence of mutation-type anomalies is determined, expressed by the formula:

[0031]

[0032] In the formula, The rate of change of the Shannon entropy of the source IP address in adjacent observation windows is represented by the ratio of the absolute value of the difference between the Shannon entropy of the source IP address in the current observation window and the Shannon entropy of the source IP address in the previous observation window to the duration of the observation window interval. "Time" indicates the current time. For a moment Shannon entropy of the source IP address of the observation window; For a moment Shannon entropy of the source IP address of the observation window; This refers to the duration of the observation window interval; The change rate threshold is set to 0.5 bit / s in this invention.

[0033] Therefore, if the rate of change of entropy is higher than the rate of change threshold... If so, it indicates that an anomaly exists.

[0034] Specifically, the third anomaly detection trigger condition is an anomaly in the Packet-In rate ratio, which is as follows: The formula for determining whether the Packet-In rate ratio has increased abnormally is as follows:

[0035] In the formula, The Packet-In rate ratio threshold is set to 0.8 in this invention, meaning that when the Packet-In rate ratio is greater than the Packet-In rate ratio threshold... It is judged as abnormal at that time.

[0036] In summary, during the source tracing process, the anomaly determination of the ratio of Shannon entropy to Packet-In rate of the source IP address is a prerequisite for triggering subsequent BFS path backtracking. When any of the above three indicators meets the anomaly determination, the network system initiates reverse tracing of the victim roadside unit (RSU) to achieve a high recall rate for the suspect vehicle, without missing the real attack path, and allows for a certain number of false alarms.

[0037] Specifically, the process of performing weighted BFS path backtracking to generate a set of suspected vehicle nodes is as follows: Step 1: Construct a directed graph , This is a vertex set, representing vehicle nodes, roadside unit nodes, and open flow virtual switch nodes; Let be an edge set, representing the communication link relationships between nodes.

[0038] In this embodiment, source tracing analysis requires tracking the propagation path of attack traffic from a global perspective of the network topology. To this end, the network system formalizes the network connection relationships held by the SDN controller into a directed graph. Among them, vertex set It includes all physical entities and logical nodes in the network system, namely vehicle nodes, roadside unit nodes, and open flow virtual switch nodes. Each vertex is associated with attributes such as node type, currently connected port identifier, and traffic statistics for the roadside unit port where that node resides. Edge set It represents the communication link relationship between nodes, and the direction of the edge reflects the transmission direction of the data flow.

[0039] Step 2: Based on the Shannon entropy of the source IP address and the Packet-In rate ratio of the roadside unit port, calculate the comprehensive anomaly weight of each edge, expressed as:

[0040] In the formula, For comprehensive abnormal weighting; , These are all weighting coefficients used to balance the contributions of Shannon entropy bias and Packet-In rate ratio anomalies. , , ; This represents the maximum Shannon entropy of the source IP address under normal conditions at the current roadside unit port. This represents the decrease in the current roadside unit port value relative to the normal state, reflecting the degree of traffic distribution centralization.

[0041] In this embodiment, for each edge Add a comprehensive anomaly weight This is used to quantify the suspicion that the link is carrying attack traffic, and to comprehensively assess the anomaly weight. The larger the value, the higher the suspicion that the link is used as a channel for transmitting attack traffic. For nodes With nodes The edges formed by these nodes. Because vehicle nodes are constantly moving, their relationships with roadside units change over time. The SDN controller dynamically maintains the topology by monitoring node access and departure events. The updates ensure that path backtracking is always performed based on the current network state. In the source tracing framework, the directed graph mentioned above is the search space for weighted BFS backtracking. The convergence characteristics of the attack traffic determine the direction of the backtracking search, that is, starting from the victim roadside unit, and advancing upstream layer by layer along the edge weight from high to low.

[0042] Step 3: Set the maximum search depth Path weight threshold and the number of candidate paths .

[0043] Step 4: Starting from the roadside unit port accessed by the victim vehicle, create a path record and a set of visited paths, and store the path record as a search record in the search queue.

[0044] In this embodiment, the path record includes the current node to be expanded (in the initial iteration, this refers to the roadside unit port accessed by the affected vehicle, denoted as the affected roadside unit node), the visited path (a sequence of nodes traversed from the starting point to the current node), and the cumulative edge weight of the visited path (the sum of the comprehensive anomaly weights of all edges on the visited path). The purpose of creating the visited path set is for deduplication in subsequent steps. This set records the node sequences corresponding to all path records added to the search queue. The deduplication criterion is the entire node sequence formed by all nodes traversed from the starting point to the current node in the path record, not a single node. When two path records have the same node sequence, they are considered duplicates, and only the one added to the search queue first is retained. The search queue is a first-in, first-out data structure used to cache path records to be expanded, prioritizing the expansion of paths with higher comprehensive anomaly weights.

[0045] Step 5: Following the order from the head to the tail of the search queue, first extract the search record at the head of the search queue, read the current node, visited paths, and cumulative edge weights of the search record, and determine whether the path hop count exceeds the maximum search depth. If so, stop the path expansion of the search record and discard the search record; otherwise, determine whether the current node has no upstream neighboring nodes and whether the path hop count is greater than or equal to 1. If so, use the search record as a candidate attack path; otherwise, search all upstream neighboring nodes of the current node in the reverse direction of data flow transmission, remove upstream neighboring nodes that have appeared in the visited paths of the search record, and execute Step 6 for each remaining upstream neighboring node.

[0046] In this embodiment, the purpose of removing upstream neighboring nodes that have already appeared in the visited paths of the search record is to prevent path loops. The path hop count refers to the number of edges in the current search record. Furthermore, if the current node of the search path has no upstream neighboring nodes, and the length of the traversed path is greater than or equal to 1 (i.e., the path hop count is 1), it indicates that the path of the search record has been traced back to the attack source. Therefore, the search record is treated as a complete candidate attack path, and its node sequence and cumulative edge weights are saved.

[0047] Step 6: Locate the directed edges pointing to the current node of the search record from each upstream neighboring node, obtain the comprehensive anomaly weight of the directed edge, and determine whether the comprehensive anomaly weight of the directed edge is lower than the path weight threshold. If so, skip the upstream neighboring node and do not perform path expansion; otherwise, accumulate the comprehensive anomaly weight of the directed edge to the accumulated edge weight in the visited path of the search record to generate the updated accumulated edge weight of the search record. At the same time, add the upstream neighboring node to the end of the visited path of the search record to generate the updated path record of the search record, and perform Step 7 on the updated path record.

[0048] Step 7: Use the visited path set to check if the updated path record has been visited. If so, skip the upstream neighbor node and do not store the updated path record as a new search record in the search queue. Otherwise, add the updated path record to the visited path set and store it as a new search record in the search queue.

[0049] In this embodiment, the purpose of adding the updated path record to the visited path set is to put (upstream neighboring node, new path, new cumulative weight) into the queue as a new search record, waiting for subsequent expansion.

[0050] Step 8: Repeat steps 5-7 until the search queue is empty. Sort all candidate attack paths in descending order of their cumulative edge weights. After deduplicating the sorted candidate attack paths, extract the top-ranked ones. The candidate attack paths are used as suspected propagation paths, and finally all vehicle nodes corresponding to the terminal ports of each suspected propagation path are extracted to form a set of suspected vehicle nodes.

[0051] In this embodiment, when the search queue is empty, all recorded candidate attack paths are sorted in descending order of their cumulative edge weights, with higher weights indicating a higher degree of suspicion for the attack source corresponding to that candidate attack path. Then, the sorted candidate attack paths are deduplicated by removing duplicate records. Finally, the top-ranked paths are extracted. The candidate attack paths generate the final set of suspected propagation paths. Finally, all vehicle nodes corresponding to the terminal port of each suspected propagation path are extracted to form a set of suspected vehicle nodes. Here, the edges of the directed graph are communication links. The terminal port of this path refers to the network access port of the last node (i.e., the node initiating the attack) on a complete path obtained by BFS backtracking, in the opposite direction of the attack traffic. For example: suspected propagation path: victim roadside unit RSU → first roadside unit RSU1 → vehicle A, the terminal port is the communication port between vehicle A and first roadside unit RSU1.

[0052] Step 3: Perform a consistency check on the received signal strength indication for each suspected vehicle node, and extract the mean, variance, and maximum value of the received signal strength indication residuals within the observation window as residual features.

[0053] This step is the Received Signal Strength Indication (RSSI) consistency check. The principle behind this check is that RSSI consistency checks utilize the physical law of wireless signal power attenuation with propagation distance. By comparing the theoretical signal strength of the roadside unit (RSU) corresponding to the location declared by the suspect vehicle node with the actual signal strength received by the RSU, coordinate spoofing behavior is identified. In the tracing scenario of this invention, there is approximately a discrepancy between the false coordinates declared by the attacking vehicle and its true location. The offset of m causes a systematic deviation between the theoretical RSSI calculated based on the declared location and the measured RSSI of the roadside unit (RSU). Therefore, the RSSI residual becomes a key feature for identifying coordinate spoofing. Based on this, the specific implementation process for extracting the mean, variance, and maximum value of the received signal strength indication residual is as follows: (1) Calculate the theoretical received signal strength at the roadside unit, expressed as:

[0054]

[0055] In the formula, This represents the theoretical received signal strength at the roadside unit. This refers to the transmission power. For reference distance; The path loss at the reference distance; The path loss index; It is a logarithmic function; To declare the Euclidean distance between the coordinates and the roadside unit coordinates; , These are the horizontal and vertical coordinates of the suspected vehicle node's declared coordinates, respectively. , These are the horizontal and vertical coordinates of the roadside unit coordinates, respectively.

[0056] In this embodiment, after receiving the safety message broadcast by the suspected vehicle node, the Roadside Unit (RSU) parses the declared coordinates in the message payload. Based on the logarithmic distance path loss model, the theoretical received signal strength at the roadside unit can be calculated from the declared coordinates.

[0057] (2) Based on the theoretical received signal strength at the roadside unit, the received signal strength indication residual is calculated and expressed as:

[0058] In the formula, The received signal strength indicates the residual; This represents the measured received signal strength at the roadside unit.

[0059] In this embodiment, the received signal strength indication residual is the absolute deviation between the theoretical received signal strength and the measured received signal strength. Specifically, for honest vehicle nodes, the declared coordinates are consistent with the actual location, and the theoretical received signal strength... Compared with the measured received signal strength The deviation mainly comes from shadow fading and measurement noise, residual It fluctuates within a small range around zero. For coordinate spoofers, there is an offset of approximately 150m between their claimed location and the actual physical location. The resulting difference between the theoretical distance calculated and the actual propagation distance will affect the theoretical received signal strength. Compared with the measured received signal strength Systematic deviation occurs, and the received signal strength indication residual is affected. Significantly increased.

[0060] (3) Extract the mean, variance, and maximum value of the received signal strength indication residual within the observation window.

[0061] In this embodiment, to reduce the impact of fluctuations in a single received signal strength indication (RSSI) measurement on the judgment, single-point residuals are not used. The network system performs statistical processing on the residual sequence within an observation window, extracting three features as the RSSI verification features of that node, including the mean of the received signal strength indication residual. ,variance and maximum value Among them, the mean Variance reflects the overall level of deviation. Reflects the stability of the deviation, maximum value It captures the most extreme deviations within the observation window. Furthermore, to address changes in the propagation environment over time, the network system utilizes RSSI data from verified legitimate vehicle nodes to perform online calibration of the path loss model parameters, ensuring that the baseline for residual calculations always matches the current environment.

[0062] Step 4: Perform trajectory continuity verification on each suspected vehicle node, and extract the mean of Mahalanobis distance and the continuous anomaly count within the observation window as trajectory features.

[0063] This step involves trajectory continuity verification based on the Extended Kalman Filter (EKF). RSSI consistency verification is known to identify the static deviation between the declared and physical locations from the signal strength dimension. Building upon this, EKF dynamically verifies the location information from a kinematic perspective: by establishing a vehicle kinematic model to predict the next-moment position of the suspect vehicle node, the predicted value is compared with the actual observed value to detect false trajectories that do not conform to the laws of physical motion. The jump amplitude of the false coordinate sequence declared by the attacking vehicle between adjacent time steps far exceeds the displacement change that the vehicle could produce through normal driving within the same time interval. EKF achieves dynamic detection of location deception by quantifying this deviation between the predicted and observed values. Therefore, the specific implementation process for extracting the mean Mahalanobis distance within the observation window and counting continuous anomalies is as follows: (1) Define the state vector as follows:

[0064] In the formula, This is a time index, representing the current time. For a moment The state vector; , These are the horizontal and vertical coordinates of the suspected vehicle node, respectively; Longitudinal velocity; Yaw angle; Yaw angular velocity; This is a transpose operation.

[0065] In this embodiment, in order to characterize the nonlinear motion behavior of the suspect vehicle node, such as turning, in the urban road environment, the network system adopts the Constant Turn Rate and Velocity (CTRV) kinematic model and defines the state vector; and the CTRV model can more accurately describe the state evolution of the suspect vehicle node in scenarios such as turning at intersections compared with the uniform linear assumption.

[0066] (2) Based on the state vector, calculate the state transition equation, which is expressed as:

[0067] In the formula, for The state vector at any given time; This is the state transition function; The duration of the time interval; , These are the sine and cosine functions, respectively.

[0068] In this embodiment, , and when When the suspect vehicle node is traveling in a straight line, its CTRV model degenerates into a CV model, and the corresponding state transition equation can be expressed as: .

[0069] (3) Calculate the Jacobian matrix of the state transition function with respect to the state vector, which is expressed as:

[0070] In the formula, State transition function exist The Jacobian matrix of the state vector at any given time; It is a state vector; for The estimated posterior state vector at time t.

[0071] In this embodiment, due to the state transition function of the CTRV model Since the state vector is nonlinear, the standard Kalman filter cannot be directly applied. EKF can be used to achieve a local linear approximation by performing a first-order Taylor expansion of the nonlinear function at the current estimate.

[0072] (4) Based on the Jacobian matrix, calculate the prior state vector estimate and the prior error covariance matrix at the current time, as follows:

[0073]

[0074] In the formula, for The prior state vector estimate at time t, i.e., based on Calculation of the posterior state vector estimate at time t; for The estimated posterior state vector at time t; for The prior error covariance matrix at time t; for The posterior error covariance matrix at time 1 is used to quantify the variance of the previous time step (i.e., ...). The degree of uncertainty in the state vector estimate at time (time); Let be the process noise covariance matrix.

[0075] (5) Based on the actual observed location of the suspected vehicle node collected by the roadside unit, the prior state vector estimate at the current time is corrected to generate the posterior state vector estimate at the current time, expressed as:

[0076]

[0077]

[0078] In the formula, for The estimated posterior state vector at time t; for Kalman gain at time step; for The actual observed location of the suspected vehicle node collected by the roadside unit at any given time, i.e., the location coordinates reported by the suspected vehicle node to the roadside unit (RSU) via V2X signaling, and , , These are the horizontal and vertical coordinates of the location reported by the suspected vehicle node; for The Jacobian matrix of the observation function at time step, the observation function is defined as follows: , For observation functions; for The residual covariance matrix at time step is used to represent the total uncertainty between the predicted and actual measurements; The observation noise covariance matrix; where Kalman gain Used to dynamically adjust the weighting of predicted and observed values ​​in the final estimation result.

[0079] In this embodiment, the EKF process is divided into two alternating steps: a prediction step and an update step. The prediction step, based on the posterior estimate from the previous time step, uses the kinematic model and the Jacobian matrix to calculate the prior state vector estimate for the current time step. Covariance of prior error The update step utilizes the actual observation locations collected by the roadside unit (RSU). The prior estimate is corrected using Kalman gain. A weighted fusion of the predicted and observed values ​​is performed to obtain the posterior state vector estimate for the current time step. .

[0080] (6) Based on the prior state vector estimate and the actual observation location of the suspected vehicle node collected by the roadside unit, the Mahalanobis distance between the trajectory prediction and the observation value is extracted and expressed as:

[0081] In the formula, The Mahalanobis distance between the predicted trajectory and the observed value; For observation functions.

[0082] In this embodiment, the actual observation position collected by the roadside unit is the observed value; the prior state vector estimate is the predicted value; the Mahalanobis distance considers the current uncertainty level of the system when calculating the residual size, and has stronger statistical discriminative significance than Euclidean distance. Based on this, the Mahalanobis distance between the trajectory prediction and the observed value is the core discriminant index for trajectory continuity verification. Furthermore, for real vehicles, constrained by physical inertia, the deviation of their trajectory in a short time is limited, making the Mahalanobis distance... The level remains low. When the attacker jumps between different fake locations, the forged position sequence violates the physical constraint of continuous motion, and the observations deviate from the EKF predictions far beyond the normal noise level, with Mahalanobis distance... It will increase significantly.

[0083] (7) Extract the mean of Mahalanobis distance and the number of consecutive anomalies within the observation window.

[0084] In this embodiment, in practical applications, legitimate large-scale heading changes such as normal vehicle U-turns may cause a sudden increase in Mahalanobis distance. To avoid misjudgment in such cases, the network system is equipped with a heading change detection mechanism: single... Exceeding the threshold does not immediately identify an anomaly; instead, a continuous anomaly count is defined. When the heading change in adjacent time steps exceeds hour, Incrementing the count by 1 resets the EKF state estimate and covariance matrix, allowing the filter to restart tracking from the new motion state and preventing normal turning behavior from being misjudged as trajectory abnormalities. for The Mahalanobis distance at time step 1. Based on this, two features are finally output for subsequent classifiers, including the window mean of the Mahalanobis distance. With continuous anomaly count .

[0085] Step 5: Obtain the arrival interval time series of data packets sent by each suspected vehicle node, and extract the mean, variance, skewness, and kurtosis of the arrival interval time within the observation window as arrival interval time features.

[0086] This step involves Inter-Arrival Time (IAT) analysis. Besides RSSI residuals and EKF trajectory characteristics, IAT also provides crucial information for distinguishing normal vehicle nodes from attacking vehicle nodes. Normal vehicles send data packets at relatively regular intervals according to application layer protocols, resulting in a statistically regular IAT distribution. Attacking vehicles continuously send DDoS traffic at a high rate of 200pps, exhibiting a significantly lower mean and altered variance in their IAT distribution compared to normal vehicles. In the source tracing scenario of this embodiment, IAT statistical characteristics provide independent evidence for RSSI residuals and EKF trajectory characteristics from the perspective of data packet sending behavior. Even if the attacker's location spoofing is small, resulting in insignificant RSSI residuals, their high-rate data packet sending behavior will still leave a distinguishable anomalous pattern in the IAT distribution. Based on this, the specific implementation process for extracting the mean, variance, skewness, and kurtosis of the IAT within the observation window is as follows: The network system calculates the arrival interval time series of data packets sent by each suspected vehicle node within each observation window, where the arrival interval (IAT) of the data packets is the difference between adjacent timestamps, and the timestamp sequence is... , Based on this, the arrival interval of data packets sent by each suspected vehicle node is expressed by the formula:

[0087] In the formula, , , These are suspected vehicle node 1, suspected vehicle node 2, and suspected vehicle node 3. The arrival time of the sent data packet; Assign node number to the suspected vehicle; The total number of nodes for the suspected vehicle; node for suspected vehicle The interval between the arrival of transmitted data packets; , These are the nodes of the suspected vehicle. Suspect vehicle node The arrival time of the sent data packet.

[0088] Based on the arrival interval of data packets sent by each suspected vehicle node, the mean, variance, skewness, and peak value of the arrival interval of data packets sent by each suspected vehicle node are extracted and expressed by the following formulas:

[0089]

[0090]

[0091]

[0092] In the formula, The average arrival interval of data packets sent to a suspected vehicle node; The variance of the arrival interval of data packets sent to a certain suspected vehicle node; The skewness of the arrival interval of data packets sent to a suspected vehicle node; The peak value of the arrival interval for data packets sent to a suspected vehicle node.

[0093] In this embodiment, the mean Reflects the overall level of packet sending rate, variance Reflects the degree of fluctuation in the packet sending interval, skewness Kurtosis reflects the asymmetry of the distribution. These four features reflect the sharpness of the distribution. They characterize the distribution of node packet sending behavior from different statistical perspectives, and together with RSSI residuals and EKF trajectory features, they constitute a multi-dimensional physical layer discrimination criterion.

[0094] In summary, steps three through five constitute the second stage of verification. This stage verifies the identity of each node in the suspected vehicle node set using the physically unforgeable characteristics. While attackers can tamper with IP addresses, MAC addresses, and even coordinate information at the software layer, they cannot alter the actual power attenuation of their radio signals when they reach the Roadside Unit (RSU), nor can they perfectly simulate a continuous trajectory conforming to the laws of physical motion over a long time series. The second stage leverages this fundamental constraint to penetrate the identity deception layer. This embodiment selects RSSI residuals, EKF trajectory prediction, and IAT packet transmission interval as discriminative features. These three sets of features are easy to obtain, possess strong anti-forgery capabilities, and characterize node behavior from three independent physical dimensions: signal strength, motion trajectory, and packet transmission behavior.

[0095] Step 6: Based on residual features, trajectory features, and arrival interval time features, construct feature vectors and input them into a multidimensional deep convolutional classifier for training to generate a trained multidimensional deep convolutional classifier.

[0096] Specifically, the multidimensional depth convolution classifier includes a dimension reorganization module, a first convolutional block, a second convolutional block, a third convolutional block, a flattening layer, a first fully connected layer, a second fully connected layer, a third fully connected layer, and a Softmax function layer.

[0097] The first convolutional block includes a first convolutional layer, a first batch normalization layer, a first modified linear unit activation function layer, and a first max pooling layer; the second convolutional block includes a second convolutional layer, a second batch normalization layer, a second modified linear unit activation function layer, and a second max pooling layer; the third convolutional block includes a third convolutional layer, a second batch normalization layer, and a third modified linear unit activation function layer.

[0098] The first fully connected layer includes a first linear transformation layer, a fourth modified linear unit activation function layer, and a first dropout layer; the second fully connected layer includes a second linear transformation layer and a fifth modified linear unit activation function layer; the third fully connected layer includes a third linear transformation layer.

[0099] Specifically, based on residual features, trajectory features, and arrival interval time features, a feature vector is constructed and input into a multidimensional depth convolution classifier for training. The process of generating a trained multidimensional depth convolution classifier is as follows: (1) Based on residual features, trajectory features, and arrival interval time features, a feature vector is generated, which is expressed as:

[0100] In the formula, These are the eigenvectors.

[0101] In this embodiment, after completing the above three sets of physical layer verifications, each suspect vehicle node obtains a 9-dimensional feature vector within each observation window, represented as: .

[0102] This feature vector characterizes node behavior from three independent physical dimensions: signal strength, motion trajectory, and data packet transmission behavior, providing a multi-perspective basis for the final classification decision.

[0103] (2) Based on the feature vector, set the batch number, construct the input data, and input it into the dimension reorganization module to generate tensor features.

[0104] In this embodiment, the feature vector , The set is the real number set; during the training phase, mini-batch gradient descent is used for parameter optimization, and the input batch size is set to [value missing]. (Results from the experiment) (When the effect is better) Construct input data After dimensionality reorganization, the 9-dimensional feature vector is transformed into a tensor format (batch size, number of channels, length) that meets the input requirements of a one-dimensional convolutional neural network. Specifically, a channel dimension is inserted after the batch dimension, and the number of channels is set to 1. This maps the 9 physical features into a single-channel signal sequence, resulting in tensor features. This operation only changes the dimensional structure of the data, not the numerical value or order of the data itself.

[0105] (3) Input the tensor features into the first convolution block and perform convolution, batch normalization, activation operation and max pooling operation to generate the first convolution feature vector.

[0106] In this embodiment, the first convolutional block (Block 1) is used to extract local features of the tensor features and generate the first convolutional feature vector, the structure of which is as follows: Figure 2 As shown, the model includes a first convolutional layer (1D Convolutional Layer, Conv1D), a first batch normalization (BN) layer, a first rectified linear unit (ReLU) activation function layer, and a first max pooling layer (1D MaxPool1D) connected in sequence. Specifically, the first convolutional block performs a 1D convolution operation on the input tensor features using 32 convolutional kernels of size 3, with padding of 1 to maintain the sequence length and a stride of 1. Then, batch normalization is applied to the convolutional output to accelerate model convergence and prevent gradient vanishing. Next, the ReLU activation function is applied to the batch-normalized result, introducing non-linear changes. Finally, max pooling is performed on the activation output for dimensionality reduction, with a pooling window size of 2 and a stride of 2, downsampling along the sequence length dimension to generate the first convolutional feature vector. ,and .

[0107] (4) Input the first convolution feature vector into the second convolution block and perform convolution, batch normalization, activation operation and max pooling operation to generate the second convolution feature vector.

[0108] In this embodiment, the second convolutional block (Block 2) is used to extract more abstract temporal features and generate a second convolutional feature vector, the structure of which is as follows: Figure 2 As shown, the structure includes a second convolutional layer (1D Convolutional Layer, Conv1D), a second batch normalization (BN) layer, a second rectified linear unit (ReLU) activation function layer, and a second max pooling layer (1D MaxPool1D) connected in sequence. Specifically, the second convolutional block performs 1D convolution operations on the input first convolutional feature vector using 64 convolutional kernels of size 3 with padding=1. Then, batch normalization is applied to the convolutional output, followed by the application of the ReLU activation function to the batch normalized result. Finally, max pooling is performed on the activated output for dimensionality reduction, with a pooling window size of 2 and a stride of 2, generating the second convolutional feature vector. ,and .

[0109] (5) The second convolution feature vector is input into the third convolution block for convolution, batch normalization and activation operations to generate the third convolution feature vector.

[0110] In this embodiment, the third convolutional block (Block 3) is used to extract higher-dimensional deep feature representations and generate a third convolutional feature vector, the structure of which is as follows: Figure 2 As shown, the sequence includes a third convolutional layer (a 1D convolutional layer, Conv1D), a third batch normalization (BN) layer, and a third rectified linear unit (ReLU) activation function layer connected in sequence. This third convolutional block does not contain pooling layers to avoid further compression of the sequence length, which could lead to the loss of key features. Specifically, the third convolutional block performs a 1D convolution operation on the input second convolutional feature vector using 128 convolutional kernels of size 3, with padding=1. Then, batch normalization is applied to the convolutional output, and finally, the ReLU activation function is applied to the batch normalized result to generate the third convolutional feature vector. ,and .

[0111] (6) Input the third convolution feature vector into the flattening layer to perform flattening operation and generate a flattened one-dimensional feature vector.

[0112] In this embodiment, the input third convolutional feature vector is a three-dimensional tensor. Therefore, it is input into a flattening layer for flattening operation, merging all dimensions except the batch dimension into one dimension to form a flattened one-dimensional feature vector. ,and This operation is used to convert the multi-channel temporal features extracted by the convolutional layer into a one-dimensional vector format that can be processed by the fully connected layer.

[0113] (7) The flattened one-dimensional feature vector is input into the first fully connected layer for linear mapping, activation operation and regularization operation to generate the output of the first fully connected layer.

[0114] In this embodiment, the structure of the first fully connected layer is as follows: Figure 2As shown, the fully connected layer consists of a first linear transformation layer (Linear), a fourth rectified linear unit (ReLU) activation function layer, and a first dropout layer, connected sequentially. Based on this, the functional principle of the first fully connected layer is: mapping the flattened 256-dimensional feature vector to a 128-dimensional hidden space, followed by ReLU activation and Dropout regularization. During training, the Dropout layer randomly drops some neurons with a probability of 0.5 to prevent overfitting. Specifically, the flattened one-dimensional feature vector is input to the first linear transformation layer for fully connected mapping, i.e., a linear transformation is performed on the input. Then, the ReLU activation function is applied to the linear transformation output, followed by a regularization operation (Dropout) on the activation output. During training, each neuron is set to zero with a probability of 0.5; during inference, the Dropout layer does not perform any operation, only acting as an identity mapping. The final output of the first fully connected layer is represented as: .

[0115] (8) Input the output of the first fully connected layer into the second fully connected layer and perform linear mapping, activation operation and regularization operation to generate the output of the second fully connected layer.

[0116] In this embodiment, the structure of the second fully connected layer is as follows: Figure 2 As shown, it includes a second linear transformation layer and a fifth modified linear unit activation function layer connected in sequence. The functional principle of the second fully connected layer is as follows: the second fully connected layer further maps the output of the first fully connected layer (a 128-dimensional feature vector) to a 64-dimensional space, and then introduces a non-linear transformation through the ReLU activation function, providing a more compact feature representation for the final classification decision. The final output of the second fully connected layer is as follows: .

[0117] (9) Input the output of the second fully connected layer into the third fully connected layer and perform linear mapping, activation operation and regularization operation to generate the output of the third fully connected layer.

[0118] In this embodiment, the structure of the third fully connected layer is as follows: Figure 2 As shown, this includes a third linear transformation layer connected sequentially. The functional principle of the third fully connected layer is as follows: It maps the output (64-dimensional feature vector) of the second fully connected layer to a 2-dimensional space using the third linear transformation layer, obtaining the logical score of each sample in the normal traffic category and the attack traffic category, providing a basis for the final probability output. Finally, the output of the third fully connected layer is expressed as: .

[0119] (10) Convert the output of the third fully connected layer into the Softmax function layer into a probability distribution to generate class probabilities.

[0120] In this embodiment, the 2D logistic score obtained from the output fully connected layer is converted into a probability distribution using a Softmax activation function, yielding the probability values ​​for each sample belonging to the normal and attack categories. The Softmax activation function ensures that the sum of the probabilities of the two categories is 1. Finally, the category probabilities are expressed as: .

[0121] (11) Based on the class probability, construct the weighted cross-entropy loss function, which is expressed as:

[0122]

[0123] In the formula, The weighted cross-entropy loss function; Batch size; This represents the weight of category 1, which is the normal class. For the first The true category of each sample is the true value; It is a logarithmic function; For the first The class probability of each sample is the predicted value; This represents the weight for category 0, which is the attack class. For category The weights; This represents the total number of training samples; Total number of categories; For category The number of samples; For category The number of samples.

[0124] In this embodiment, during the training of the Multidimensional Deep Convolutional Classifier (MDDCC), a weighted cross-entropy loss function is constructed based on the cross-entropy loss function and introduces moderate class weights to address the imbalance between positive and negative samples. Considering that the ratio of normal samples to attack samples in the training data is approximately 14:1, a square root scheme is used to calculate the class weights, giving appropriate attention to attack samples without excessively favoring the minority class. The class weights are expressed as follows: Furthermore, for binary classification problems, the ratio of the two types of samples in the training set is approximately 14:1, and the weight vector... It can be calculated to be .

[0125] Based on this, the weighted cross-entropy loss function is expressed as: .

[0126] Additionally, during the training of the multidimensional deep convolutional classifier, the optimizer used was Adam, and the learning rate was set to... The weight decays to .

[0127] (12) The parameters of the multidimensional deep convolution classifier are updated by backpropagation using the weighted cross-entropy loss function, and finally the trained multidimensional deep convolution classifier is generated.

[0128] Step 7: Obtain the feature vectors of all vehicle nodes in each observation window, input them into the trained multidimensional deep convolutional classifier, generate the classification results of each vehicle node in each observation window, and use a window-by-window majority voting mechanism to make a smooth decision to obtain the attacking vehicle.

[0129] In this embodiment, after obtaining the trained multidimensional deep convolutional classifier (MDDCC), during the inference phase, the MDDCC independently outputs classification results for each vehicle in each observation window. Since the judgment in a single observation window may be affected by instantaneous noise, the network system employs a window-by-window majority voting mechanism for smooth decision-making: the proportion of each vehicle judged as an attacker across all observation windows is counted; when this proportion reaches or exceeds 50%, the vehicle is ultimately judged as an attacker. Based on the attack voting proportion, the network system further maps the judgment result to a three-level confidence level: confidence level higher than... Vehicle nodes will be immediately blocked. Vehicle nodes with a confidence level between 0.7 and 0.9 will be placed on a continuous monitoring list, while vehicle nodes with a confidence level below 0.7 will be considered normal. To verify the effectiveness of the proposed two-stage attribution method for DDoS attacks in multi-traffic subject fusion scenarios, the following experiment was conducted: A software-defined vehicle network environment was built on the Ubuntu system based on the Mininet-WiFi simulation platform, and the wmediumd wireless medium daemon was used to realistically simulate the wireless channel. The data plane uses the OpenFlow 1.3 protocol for flow table management and forwarding control, while the SDN controller is responsible for global topology maintenance and traffic statistics collection. Simulation parameter settings are shown in Table 1. Table 1 Simulation Parameters

[0130] The source tracing algorithm employs a sliding window mechanism to segment continuous simulation data. The window length is set to 10 seconds, and the sliding step size is 5 seconds, meaning there is a 50% overlap between adjacent windows. In a simulation duration of 180 seconds, approximately 36 observation windows are generated per vehicle, resulting in approximately 60 × 36 = 2160 samples per simulation. Within each window, the network system extracts features from three physical layer verification modules: RSSI residual verification, EKF trajectory verification, and IAT verification, forming a total of 9-dimensional physical layer feature vectors.

[0131] The two-stage DDoS attack attribution method proposed in this invention is compared with attribution methods that remove some or all physical layer feature subsets to verify the indispensability of each physical layer feature subset. Furthermore, it is compared with methods using other classification architectures to evaluate the advantages of MDDCC compared to other classification architectures. The specific comparison method design is shown in Table 2. Table 2 Comparison Method Design Table

[0132] The performance of source tracing is measured by three metrics: precision, recall, and F1 score, as detailed below: Accuracy This represents the percentage of actual attackers among the vehicles identified as attackers, directly reflecting the false positive rate of the method, and is expressed as: ; Recall rate The proportion of real attackers successfully detected by the algorithm, corresponding to the risk of missed detection, is expressed as: ; The F1 score is the harmonic mean of precision and recall, which comprehensively reflects the trade-off between the two, and is expressed as: ; In the formula, , , These represent the number of true positive, false positive, and false negative samples, respectively.

[0133] Based on the above settings, the following comparison is made: (1) Comparison of physical layer feature methods like Figure 4 As shown, from Figure 4 It can be seen that the method of this invention maintains the highest and most stable accuracy across all attacker numbers. The accuracy of the RSSI verification method alone fluctuates between 70% and 97%, with an average of approximately 87%. False positives decrease with increasing attack sample density, but drop slightly at 3 and 5 vehicles, indicating that this method is sensitive to the spatial distribution of attackers. The accuracy of the location verification method alone ranges from 30.3% to 75.2%, which is generally low. This is because the EKF kinematic model has strong constraints, and even normal maneuvering can lead to a sudden increase in Mahalanobis distance, causing a large number of false positives. The accuracy increases with the proportion of attack samples. The first-stage method alone has an F1 score of less than 20% across all six attack proportions. When there is only one attacker, both accuracy and recall are zero. This is because its BFS edge weights use the Roadside Unit (RSU) port as the statistical granularity, sharing weights with vehicles within the same coverage area. The topology search lacks individual differentiation capabilities. Therefore, the value of the first stage is limited to locating the victim RSU and narrowing the analysis scope, and it is not suitable for direct attacker identification.

[0134] like Figure 5 As shown, Figure 5 The recall rates of four methods under different numbers of attackers are compared. The recall rate of the method of this invention is maintained between 90% and 100%, with an average recall rate of 93.4%, achieving high detection capability while maintaining high precision. The recall rate of the location-only verification method is higher than that of the method of this invention under some configurations, and it has high sensitivity. The deceptive offset of m far exceeds the normal displacement limit of the vehicle within a 5-second prediction step, allowing attackers to trigger significantly larger Mahalanobis distances in almost all cases. However, this also results in low precision for this method, far lower than the method described in this invention, failing to balance precision and recall. The recall rate of the RSSI verification method alone remains consistently low, averaging only about 66%. When the attacker's offset direction is approximately orthogonal to the RSU orientation, the actual propagation distance change is partially offset, narrowing the RSSI residual to within the noise masking range, making these attackers undetectable. The recall rate of the first-stage method alone does not exceed 25% across all configurations, confirming that coarse screening at the network layer cannot replace physical layer verification.

[0135] Therefore, the method of the present invention achieves a better overall balance between precision and recall by synergistically fusing three physical features, utilizing the high recall of EKF to compensate for the missed detections of RSSI, and at the same time using RSSI residuals and IAT features to suppress false alarms of EKF.

[0136] like Figure 6 As shown, Figure 6 The paper presents a comparison of F1 scores for four methods under different numbers of attackers. The F1 curve of the method presented in this invention is the highest across all configurations, with an average F1 of 95.8% and a lowest point of 93.6% when the number of attackers is 2, which is approximately 10 percentage points higher than the optimal value of 85.3% for a single-feature method. This advantage stems from the fact that the probability of simultaneous misclassification of multiple signals after the fusion of three physical features is far lower than that of any single feature: the RSSI residual compensates for the insufficient precision of EKF with its high precision, EKF compensates for the deficiency in RSSI recall with its extremely high recall, and IAT features provide independent corroboration from the packet sending behavior dimension. The F1 of the RSSI-only verification method ranges from 65% to 83.5%, limited by a consistently low recall; even with a precision close to that of the method presented in this paper, the F1 score still struggles to exceed 85%. The F1 score of the location verification method alone ranged from 44.7% to 85.3%. When the number of attackers was only one vehicle, although the recall rate reached 90%, the precision was only 30.3%, and the F1 score was only 44.7%, reflecting the serious drag on overall performance caused by the extremely high false positive rate. The average F1 score of the first-stage method alone was only 10.4%.

[0137] In summary, when comparing physical layer features, the value of the first-stage BFS path backtracking lies in the macroscopic anomaly localization and range reduction; the RSSI verification method is too conservative, with high precision but insufficient recall; the location verification method is too aggressive, with extremely high recall but serious false positives; only by fusing the three sets of features into a 9-dimensional input can the method of this invention achieve the highest F1 score under all attack ratio configurations.

[0138] (2) Comparison of classifier performance Under the condition of using a fixed full feature set, the performance differences of three classifier architectures are compared. All classifiers are trained only once on the training set of four attackers and used directly for all tests to examine the model's ability to generalize to different attack scales.

[0139] like Figure 7 As shown, MDDCC's accuracy remained above 97.5% across all six configurations, with a fluctuation range of approximately 2.5 percentage points, making it the most stable of the three methods. RF exhibited the greatest accuracy fluctuation, with low accuracy when the proportion of attackers was low. When the training set was fixed at four attackers, the calibrated decision boundary faced distribution shifts in low-proportion tests, increasing the relative density of normal vehicles in the feature space. RF's ensemble voting based on independent thresholds for each feature dimension was highly sensitive to such shifts; normal vehicles that were temporarily overestimated due to channel fading in a single dimension might be mistakenly classified as attackers. MLP's accuracy fluctuation range fell between the two, dropping to 95.0% when the number of attackers was two, while remaining above 97% in other configurations. Although MLP's fully connected structure offered more nonlinear mapping capabilities than RF, it lacked the local receptive field mechanism of convolutional layers, making it less resistant to single-dimensional shifts than MDDCC's multi-dimensional collaborative discrimination. The three curves tend to converge when the number of attackers reaches more than 4 vehicles, with the accuracy ranging from 97% to 98.5%. This is because 4 attackers are exactly the training configuration. After that, the deviation between the test distribution and the training distribution gradually decreases, and the decision boundaries of the three classifiers are all within a relatively reliable working range.

[0140] like Figure 8 As shown, all three curves reach a local minimum when the number of attackers is 4 vehicles, with MDDCC dropping to 90%, and RF and MLP simultaneously dropping to 85%. This local trough, occurring simultaneously across all classifiers, stems from the fact that node 40, which is fixed in the test set of 4 attackers, is assigned a starting position close to the declared RSU in the simulation. The offset was truncated to a smaller actual deception magnitude under simulation boundary constraints. After truncation, the RSSI residual and EKF Mahalanobis distance of node 40 both fell within the typical range of normal vehicles, and each of the three classifiers classified it as normal several times in 10 tests. MDDCC detected about one more vehicle than RF and MLP. This is because the convolutional layer captured a weak co-anomaly between the IAT feature and RSSI residual of node 40 in a partial window, while RF's independent feature voting and MLP's fully connected mapping failed to utilize this weak cross-dimensional correlation. A clear stratification among classifiers also appeared when the number of attackers was only one vehicle. In this configuration, the RSSI signal of the sole attacker was strong, and both MDDCC and MLP could reliably detect it. However, RF's independent dimension voting classified it as normal once, indicating that RF is more prone to missed detections due to single-dimensional fluctuations when the sample size is very small.

[0141] The difference between precision and recall is pooled into an F1 score, such as... Figure 9 As shown, the MDDCC curve is the highest or tied for the highest among the three under all configurations, with an average F1 score of 95.8%; MLP's average F1 score is 94.6%; and RF's average F1 score is 92.0%, reaching the lowest value globally when there is only one attacker. The three F1 curves are most distinct when the number of attackers is small, with MDDCC and RF differing by 10 percentage points when there is only one attacker and by 5.4 percentage points when there are three attackers. When attackers are scarce, each attacker has a limited window of samples in the test set, and single-window noise has a significant impact on the final voting result. Under these conditions, the convolutional feature fusion of MDDCC has the most prominent advantage. As the number of attackers increases to 5 and 6, the three curves converge to a gap of 1 to 2 percentage points. This is because the abundant outlier samples improve the statistical stability of the majority vote, and the influence of the classifier architecture itself on the final decision weakens. On the other hand, MLP overlaps with MDDCC when the number of attackers is 5, but falls below MDDCC by about 1.3 percentage points when the number of attackers is 6. With 6 attackers, MLP's recall rate is 91.7%, which is lower than MDDCC's 93.3%, indicating that MDDCC can maintain a more stable detection capability under higher attack density.

[0142] The performance gradient formed by the three architectures, namely MDDCC (95.8%) > MLP (94.6%) > RF (92.0%), directly corresponds to their ability to utilize the correlation information between feature dimensions. MDDCC captures local dimensional correlations through convolutional kernels, MLP achieves global feature mapping through fully connected layers but lacks a receptive field mechanism, and RF processes each feature dimension relatively independently. The collaborative patterns between dimensions in the 9-dimensional physical layer features carry discriminative information that cannot be presented by a single dimension. Fully utilizing this collaboration is the fundamental reason why MDDCC achieves better performance. Further analysis reveals that the F1 difference of the three classifiers gradually converges with the increase of the number of attackers. This is due to the statistical effect of the majority voting mechanism: when the number of attackers increases from 1 to 6, the total number of abnormal window samples contributed by each attacker in the test set increases accordingly. The statistical basis for the voting decision is more sufficient, and the classification errors caused by instantaneous noise in a single window are overwhelmed by the majority of correct decisions. Under conditions of sufficient statistical evidence, even RF (Research-Based Learning) without the ability to model inter-dimensional correlations can achieve high decision stability through ensemble voting of multiple decision trees, thus compressing the performance gap between the three classifiers. Conversely, in low-proportion scenarios with very few attackers, the window samples for each attacker are limited, and single-window noise has a significant impact on the final voting result. In this case, the convolutional structure of MDDCC can extract weak cross-dimensional cooperative signals from limited samples, such as the abnormal linkage between RSSI residuals and IAT statistics. RF's independent feature thresholding and MLP's fully connected mapping cannot effectively capture such cooperative patterns under low signal-to-noise ratios, making MDDCC's architectural advantage most prominent. This analysis shows that MDDCC is more adaptable to attribution tracing tasks in scenarios with few attackers, which is precisely the most challenging situation in actual deployment.

[0143] In summary, the two-stage DDoS attack tracing method proposed in this invention has higher stability in false positive control, and its performance is superior in terms of precision, recall, and cross-proportional generalization ability.

[0144] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

[0145] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A two-stage attribution method for DDoS attacks in scenarios involving multiple traffic entities, characterized in that, Includes the following steps: Construct a network system model for tracing the source of DDoS attacks, including vehicle nodes, drone nodes, fixed infrastructure, and the core network layer; Based on the DDoS attack tracing network system model, multi-dimensional traffic features are extracted and anomaly detection is performed. When a certain traffic feature is abnormal, a weighted BFS path backtracking is performed to generate a set of suspected vehicle nodes. For each suspected vehicle node, the consistency of the received signal strength indication is checked, and the mean, variance and maximum value of the received signal strength indication residual within the observation window are extracted as residual features. For each suspected vehicle node, the trajectory continuity is checked, and the mean of Mahalanobis distance and the number of consecutive anomalies within the observation window are extracted as trajectory features. Obtain the arrival interval time series of data packets sent by each suspected vehicle node, and extract the mean, variance, skewness and kurtosis of the arrival interval time within the observation window as arrival interval time features; Based on residual features, trajectory features, and arrival interval time features, feature vectors are constructed and input into a multidimensional deep convolution classifier for training, generating a trained multidimensional deep convolution classifier. The feature vectors of all vehicle nodes in each observation window are obtained and input into a trained multidimensional deep convolutional classifier to generate the classification results of each vehicle node in each observation window. A window-by-window majority voting mechanism is used to make a smooth decision to obtain the attacking vehicle.

2. The two-stage DDoS attack attribution method according to claim 1, characterized in that, Multidimensional traffic characteristics include the Shannon entropy of the source IP address and the Packet-In rate ratio of the roadside unit port.

3. The two-stage DDoS attack attribution method according to claim 2, characterized in that, The process of extracting multidimensional traffic features and performing anomaly detection is as follows: Calculate the deviation of the source IP address's Shannon entropy from its historical cumulative distribution and the rate of change of the source IP address's Shannon entropy in adjacent observation windows. Determine whether the deviation is greater than the deviation threshold, the rate of change is greater than the rate of change threshold, or the Packet-In rate ratio is greater than the Packet-In rate ratio threshold. If so, perform weighted BFS path backtracking to generate a set of suspected vehicle nodes; otherwise, continue with multidimensional traffic feature extraction.

4. The two-stage DDoS attack attribution method according to claim 1, characterized in that, The process of performing weighted BFS path backtracking to generate a set of suspected vehicle nodes is as follows: Step 1: Construct a directed graph , This is a vertex set, representing vehicle nodes, roadside unit nodes, and open flow virtual switch nodes; An edge set represents the communication link relationships between nodes; Step 2: Based on the Shannon entropy of the source IP address and the Packet-In rate ratio of the roadside unit port, calculate the comprehensive anomaly weight of each edge, expressed as: in, For comprehensive abnormal weighting; , All are weighting coefficients; This represents the maximum Shannon entropy of the source IP address under normal conditions at the current roadside unit port. Shannon entropy of the source IP address; For the first Packet-In rate ratio of each roadside unit port; Step 3: Set the maximum search depth Path weight threshold and the number of candidate paths ; Step 4: Starting from the roadside unit port accessed by the victim vehicle, create a path record and a set of visited paths, and store the path record as a search record in the search queue. Step 5: Following the order from the head to the tail of the search queue, first extract the search record at the head of the search queue, read the current node, visited paths, and cumulative edge weights of the search record, and determine whether the path hop count exceeds the maximum search depth. If so, stop the path expansion of the search record and discard the search record; otherwise, determine whether the current node has no upstream neighboring nodes and whether the path hop count is greater than or equal to 1. If so, use the search record as a candidate attack path; otherwise, search all upstream neighboring nodes of the current node in the reverse direction of data flow transmission, remove the upstream neighboring nodes that have appeared in the visited paths of the search record, and execute Step 6 for each remaining upstream neighboring node. Step 6: Locate the directed edges of each upstream neighboring node pointing to the current node of the search record, obtain the comprehensive anomaly weight of the directed edge, and determine whether the comprehensive anomaly weight of the directed edge is lower than the path weight threshold. If so, skip the upstream neighboring node and do not perform path expansion; otherwise, accumulate the comprehensive anomaly weight of the directed edge to the accumulated edge weight in the visited path of the search record to generate the updated accumulated edge weight of the search record. At the same time, add the upstream neighboring node to the end of the visited path of the search record to generate the updated path record of the search record, and perform Step 7 on the updated path record. Step 7: Use the visited path set to check if the updated path record has been visited. If so, skip the upstream neighbor node and do not store the updated path record as a new search record in the search queue. Otherwise, add the updated path record to the visited path set and store it as a new search record in the search queue. Step 8: Repeat steps 5-7 until the search queue is empty. Sort all candidate attack paths in descending order of their cumulative edge weights. After deduplicating the sorted candidate attack paths, extract the top-ranked ones. The candidate attack paths are used as suspected propagation paths, and finally all vehicle nodes corresponding to the terminal ports of each suspected propagation path are extracted to form a set of suspected vehicle nodes.

5. The two-stage attribution method for DDoS attacks according to claim 1, characterized in that, The process of performing a received signal strength indication consistency check on each suspected vehicle node and extracting the mean, variance, and maximum value of the received signal strength indication residuals within the observation window is as follows: The theoretical received signal strength at the roadside unit is calculated and expressed as: in, This represents the theoretical received signal strength at the roadside unit. This refers to the transmission power. For reference distance; The path loss at the reference distance; The path loss index; It is a logarithmic function; To declare the Euclidean distance between the coordinates and the roadside unit coordinates; , These are the horizontal and vertical coordinates of the suspected vehicle's node declaration coordinates, respectively. , These are the abscissa and ordinate values ​​of the roadside unit coordinates, respectively; Based on the theoretical received signal strength at the roadside unit, the received signal strength indication residual is calculated and expressed as: in, The received signal strength indicates the residual; The measured received signal strength at the roadside unit; Extract the mean, variance, and maximum value of the received signal strength indication residual within the observation window.

6. The two-stage DDoS attack attribution method according to claim 1, characterized in that, The process of verifying the trajectory continuity of each suspected vehicle node and extracting the mean of the Mahalanobis distance and the continuous anomaly count within the observation window is as follows: Define a state vector as follows: in, For time indexing; For a moment The state vector; , These are the horizontal and vertical coordinates of the suspected vehicle node, respectively; Longitudinal velocity; Yaw angle; Yaw angular velocity; This is a transpose operation; Based on the state vector, the state transition equation is calculated and expressed as: in, for The state vector at any given time; This is the state transition function; The duration of the time interval; , These are the sine and cosine functions, respectively. The Jacobian matrix of the state transition function with respect to the state vector is calculated as follows: in, State transition function exist The Jacobian matrix of the state vector at any given time; It is a state vector; for The estimated posterior state vector at time t; Based on the Jacobian matrix, the prior state vector estimate and the prior error covariance matrix at the current time are calculated and expressed as follows: in, for The prior state vector estimate at time t; for The estimated posterior state vector at time t; for The prior error covariance matrix at time t; for The posterior error covariance matrix at time t; The process noise covariance matrix; Based on the actual observed locations of suspected vehicle nodes collected by roadside units, the prior state vector estimate for the current moment is corrected to generate the posterior state estimate for the current moment, expressed as: in, for The estimated posterior state vector at time t; for Kalman gain at time step; for The actual observation location collected by the roadside unit at any given time; for The Jacobian matrix of the time-observation function; for The residual covariance matrix at time step; To observe the noise covariance matrix; Based on the prior state vector estimate, and combined with the actual observed positions of the suspected vehicle nodes collected by the roadside units, the Mahalanobis distance between the trajectory prediction and the observed values ​​is extracted and expressed as: in, The Mahalanobis distance between the predicted trajectory and the observed value; For observation functions; Extract the mean of Mahalanobis distance and the count of consecutive anomalies within the observation window.

7. The two-stage attribution method for DDoS attacks according to claim 1, characterized in that, The process of obtaining the arrival interval time series of data packets sent by each suspected vehicle node, and extracting the mean, variance, skewness, and kurtosis of the arrival interval time within the observation window is as follows: Within each observation window, the arrival interval of data packets sent by each suspected vehicle node is calculated and expressed as: in, Assign node number to the suspected vehicle; node for suspected vehicle The interval between the arrival of transmitted data packets; , These are the nodes of the suspected vehicle. Suspect vehicle node The arrival time of the sent data packet; Based on the arrival interval of data packets sent by each suspected vehicle node, the mean, variance, skewness, and peak value of the arrival interval of data packets sent by each suspected vehicle node are extracted and expressed as follows: in, The average arrival interval of data packets sent to a suspected vehicle node; The total number of nodes for the suspected vehicle; The variance of the arrival interval of data packets sent to a certain suspected vehicle node; The skewness of the arrival interval of data packets sent to a suspected vehicle node; The peak value of the arrival interval for data packets sent to a suspected vehicle node.

8. The two-stage attribution method for DDoS attacks according to claim 1, characterized in that, The multidimensional depth convolution classifier includes a dimension reorganization module, a first convolutional block, a second convolutional block, a third convolutional block, a flattening layer, a first fully connected layer, a second fully connected layer, a third fully connected layer, and a Softmax function layer; The first convolutional block includes a first convolutional layer, a first batch normalization layer, a first modified linear unit activation function layer, and a first max pooling layer; the second convolutional block includes a second convolutional layer, a second batch normalization layer, a second modified linear unit activation function layer, and a second max pooling layer; the third convolutional block includes a third convolutional layer, a second batch normalization layer, and a third modified linear unit activation function layer. The first fully connected layer includes a first linear transformation layer, a fourth modified linear unit activation function layer, and a first dropout layer; the second fully connected layer includes a second linear transformation layer and a fifth modified linear unit activation function layer; the third fully connected layer includes a third linear transformation layer.

9. The two-stage attribution method for DDoS attacks according to claim 8, characterized in that, Based on residual features, trajectory features, and arrival interval time features, a feature vector is constructed and input into a multidimensional depth convolutional classifier for training. The process of generating the trained multidimensional depth convolutional classifier is as follows: Based on residual features, trajectory features, and arrival interval time features, feature vectors are generated; Based on the feature vector, set the batch size, construct the input data, and input it into the input dimension recombination module to generate tensor features; The tensor features are input into the first convolutional block and subjected to convolution, batch normalization, activation, and max pooling operations to generate the first convolutional feature vector. The first convolutional feature vector is input into the second convolutional block for convolution, batch normalization, activation operation and max pooling operation to generate the second convolutional feature vector. The second convolutional feature vector is input into the third convolutional block for convolution, batch normalization and activation operations to generate the third convolutional feature vector. The third convolutional feature vector is input into the flattening layer for flattening operation, generating a flattened one-dimensional feature vector. The flattened one-dimensional feature vector is input into the first fully connected layer for linear mapping, activation operation and regularization operation to generate the output of the first fully connected layer; The output of the first fully connected layer is input into the second fully connected layer for linear mapping, activation operation and regularization operation to generate the output of the second fully connected layer; The output of the second fully connected layer is input into the third fully connected layer for linear mapping, activation, and regularization operations to generate the output of the third fully connected layer. The output of the third fully connected layer is converted into a probability distribution by the Softmax function layer to generate class probabilities. Construct a weighted cross-entropy loss function based on class probabilities; The parameters of the multidimensional deep convolutional classifier are updated by backpropagation using the weighted cross-entropy loss function, and finally a trained multidimensional deep convolutional classifier is generated.

10. The two-stage DDoS attack attribution method according to claim 9, characterized in that, The weighted cross-entropy loss function is expressed as: in, The weighted cross-entropy loss function; Batch size; The weight for category 1; For the first The true class probability of each sample; It is a logarithmic function; For the first The class probability of each sample; The weight for category 0; For category The weights; This represents the total number of training samples; Total number of categories; For category The number of samples; For category The number of samples.

Images