CN103036874B - The guard method of prevention data injection attacks in gathering for car networking data - Google Patents

The guard method of prevention data injection attacks in gathering for car networking data Download PDF

Info

Publication number
CN103036874B
CN103036874B CN201210496879.4A CN201210496879A CN103036874B CN 103036874 B CN103036874 B CN 103036874B CN 201210496879 A CN201210496879 A CN 201210496879A CN 103036874 B CN103036874 B CN 103036874B
Authority
CN
China
Prior art keywords
data
traffic flow
injection attacks
vehicle
flow
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201210496879.4A
Other languages
Chinese (zh)
Other versions
CN103036874A (en
Inventor
丁男
谭国真
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Dalian University of Technology
Original Assignee
Dalian University of Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Dalian University of Technology filed Critical Dalian University of Technology
Priority to CN201210496879.4A priority Critical patent/CN103036874B/en
Publication of CN103036874A publication Critical patent/CN103036874A/en
Application granted granted Critical
Publication of CN103036874B publication Critical patent/CN103036874B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Mobile Radio Communication Systems (AREA)

Abstract

In gathering for car networking data, a guard method for prevention data injection attacks, belongs to car networked information security technology area.It is characterized in that first utilizing cusp catastrophe theory to set up two-dimentional Traffic Flow Modeling to Vehicle Speed and traffic flow flow; Secondly, based on this model, the analysis of injection attacks, identification and process are carried out to the Vehicle Speed from vehicle received in trackside infrastructure and the traffic flow flow added up in trackside infrastructure; Finally, when data are detected as the data that injection attacks produces, these data are abandoned, and shield all data that its owning user sends later.Effect of the present invention and benefit to utilize traffic flow data own characteristic to identify Data Injection Attacks, and authentication that need not be complicated, for a large number of users in car networking and the situation of depositing provides the safety method effectively preventing Data Injection Attacks.<!--1-->

Description

The guard method of prevention data injection attacks in gathering for car networking data
Technical field
The invention belongs to car networked information security technology area, relating to a kind of guard method for utilizing car networking to carry out preventing in traffic flow data sampling process Data Injection Attacks.
Background technology
Car networking is a data-centered network.Wherein, be numerous bases based on car working application based on the car traffic flow data (speed, flow etc.) obtained of networking, such as, traffic signal control system, vehicle collision avoidance, Traffic flow guidance etc. are all based on above-mentioned traffic flow data.Therefore, particularly important based on the network fail safe of the traffic flow data obtained of car.Then, because the network of car networking is open relative to user, but this opening, also provides possibility for numerous network attack.Wherein, the injection attacks of data is particularly important relative to problem of data safety.Data Injection Attacks, is mainly reflected in inject mistake in car networking or invalid traffic flow data, affects the normal work of the traffic application service based on these traffic flow datas.Meanwhile, the accumulation of these misdata, may cause more serious malicious attack, affects the normal work of whole car networking, even jeopardizes the person and the property safety of car on-line customer.
At present, the main two kinds data major embodiments illegally injected are: (1) false data, by the data of assailant's stochastic generation.(2) fraudulent copying data, intercept and capture valid data by assailant, directly copy and injection network.
Current, prevent the safety method of Data Injection Attacks mainly based on the method for the mechanism of breaking the wall of mistrust, be subscriber authorisation or distribute key.These methods all need to be identity and the verification method of user's allocative efficiency in advance.But due to, the enormous amount of car on-line customer, in each car networking sub-network, vehicle is random, fast-changing.All there is hypothesis in existing method: legal identity or password once authorize, for a long time effectively.And its concrete behavior of user having lawful authority whether legal lack follow the tracks of with analyze.Simultaneously, existing method lacks effective solution equally from the angle of data validation, the method of the quality of data conventional is at present difficult to distinguish invalid data, because these data with reference to the data characteristics of some valid data in forgery process, the scope of such as valid data or directly copy the valid data of intercepting and capturing.But the above-mentioned method based on the mechanism of breaking the wall of mistrust is difficult to effectively prevent Data Injection Attacks.
For the deficiency of said method, in conjunction with formation and the signature analysis thereof of invalid data, be different from the method based on the mechanism of breaking the wall of mistrust, also there is the data-oriented technology for car networking data safety at present.People [the Aifeng Wu such as the Aifeng Wu of Fudan University; Jianqing Ma; Shiyong Zhang. RATE:A RSU-Aided Scheme for Data-Centric Trust Establishment in VANETs. International Conference on Wireless Communications; Networking and Mobile Computing (WiCOM). 2011; 1-6.] propose a data-oriented protection car and to network the security mechanism preventing illegal node from invading, RATE.This mechanism operates in trackside infrastructure, utilize the confidence level of the methods analyst data of ant group optimization, but this mechanism does not indicate the type of institute's protected data, does not particularly provide the concrete safeguard measure to traffic flow data (speed and flow).People [the S nziana Mazilu such as the S nziana Mazilu of Rumanian Bucharest Polytechnics, Mihaela Teler, Ciprian Dobre.Securing Vehicular Networks based on Data-Trust Computation. International Conference on P2P, Parallel, Grid, Cloud and Internet Computing. 2011,51-58.] propose data-oriented security mechanism equally, the transport information that this mechanism is transmitted in networking mainly for car, as traffic congestion, traffic accident etc.The method mainly utilizes small-world network to be that each information calculates a credible index, and recipient needs the data that the user involved by same to this index and other event sends to mate, and can confirm the validity of this information.The method needs multiple user collaborative to realize, and does not also provide effective solution to the legitimacy analysis of traffic flow data simultaneously.
Summary of the invention
When the object of the invention is to utilize trackside infrastructure that the traffic flow data that each vehicle in car networking sends out is carried out to data access and gathers, provide a kind of guard method preventing Data Injection Attacks, as shown in Figure 1.The method mainly utilizes in trackside infrastructure carries out two-dimentional modeling based on cusp catastrophe theory model to Vehicle Speed and these two kinds of traffic flow datas of the magnitude of traffic flow, and utilize this model to by real-time reception in trackside infrastructure to traffic flow data carry out Data Injection Attacks analysis, identification, exist once find to attack, then the process such as the data carry out abandoning data, shielding the follow-up transmission of this invasion user.The method mainly operates in be had in the trackside infrastructure of computing and disposal ability, as semaphore, trackside gateway etc., as long as it can obtain real-time vehicle running speed and this two classes traffic flow data of traffic flow flow.
Technical scheme of the present invention is:
First, cusp catastrophe theory is utilized to set up two-dimentional Traffic Flow Modeling to Vehicle Speed and traffic flow flow, secondly, based on this model, injection attacks analysis, identification and process are carried out to the Vehicle Speed from vehicle received in trackside infrastructure and the traffic flow flow added up in trackside infrastructure, finally, when received Vehicle Speed is detected as the data that injection attacks produces, these data are abandoned, and shields all data that its owning user sends later.The step of carrying out injection attacks analysis to each traffic flow data bag is as follows:
Step 1. data prediction, be about in trackside infrastructure, obtain the real time data generation vehicle that each vehicle sends speed and the magnitude of traffic flow, and normalization process is carried out to data, the speed of vehicle, v, be the instantaneous velocity that this vehicle provides, unit is meter per second (m/s), directly obtains in the packet that can be sent by vehicle; The magnitude of traffic flow, q, between when statistics receives this packet in 5 minutes the vehicle number of process, these data convert to/hour (/h) again, namely obtain traffic flow flow.The statistical method of the magnitude of traffic flow is when infrastructure receives the Vehicle Speed that vehicle sends out, the packet absolute time (actual time) received and user ID are recorded, the magnitude of traffic flow of adding up in 5 minutes is exactly the quantity that different I D appears in 5 minutes in statistics;
Step 2. data analysis and identification, namely in Catastrophic Theory Model, calculate mutation distance.According to this mutation distance, identify whether to there is Data Injection Attacks behavior;
Step 3. processes, namely when identify in step 2 received Vehicle Speed be injection attacks produce data time, these data are abandoned, and shield all data that its owning user sends later;
The self-adjusting of step 4. model coefficient, namely according to legal traffic flow data, utilizes patch estimation theory model to carry out on-line tuning to the system of model, makes it automatically adjust according to traffic flow feature, guarantee the actual effect of model.
Effect of the present invention and benefit are: the first identifies utilizing traffic flow data own characteristic Data Injection Attacks, and authentication that need not be complicated, for a large number of users in car networking and the situation of depositing provides the safety method effectively preventing Data Injection Attacks; It two is that data validation analysis is simple, meets that urban traffic flow is non-linear, the traffic stream characteristics of sudden change simultaneously, and Data Injection Attacks is detected more has practicality; It three utilizes the coefficient of patch estimation theory model to model automatically to adjust renewal, make it can guarantee the validity of model analysis in actual application, and without the need to artificial setting, on-line automatic adjustment is carried out to the traffic stream characteristics in the car networking sub-network of different traffic stream characteristics.
Accompanying drawing explanation
The flow chart that accompanying drawing 1 is Data Injection Attacks analysis, identifies and process.
Accompanying drawing 2 is car networking schematic diagrames.
In Fig. 2: 1 based on trackside infrastructure car networking subnet.
Accompanying drawing 3 is the car networking subnet schematic diagrames based on trackside infrastructure.
In Fig. 3: 2 trackside infrastructure.
Embodiment
The specific embodiment of the present invention is described in detail below in conjunction with technical scheme and accompanying drawing.
1, car intranet communication modes and network topology
As shown in Figure 2, between car and trackside communication can be mainly based on short distance communication technology (DSRC) this programme main it is considered that 802.11p or Zigbee as the communication modes of communication media.Concrete network topology is, is fixed on roadside by the trackside infrastructure in Fig. 2, and distance 1 meter-10 meters, roadside, ensures communication distance about 100 meters.In car networking sub-network, when there being malicious data assailant to invade, its car networking sub-network schematic diagram as shown in Figure 3.
2, the expression of the interior testing vehicle register (ID) of car networking
In order to distinguish each car, this method mainly utilizes the physical communication layer MAC address used in vehicle communication.Because be no matter 802.11x or zigbee as communication media, its communication node chip has a unique address when dispatching from the factory, and in communication process, this address is available, does not also need again to authorize simultaneously.
3, Data Injection Attacks model needs data parameters and form normalization
The method mainly will use speed, 3 information such as traffic flow flow and vehicle heading of vehicle.Wherein the speed of vehicle and traffic flow flow are used for the differentiation of Data Injection Attacks, and vehicle heading is mainly used for determining concrete travel direction on two-way lane, because be utilize the data analysis in same travel direction in the method.For the ease of analyzing, need data format (unit) to standardize.The speed of vehicle, v is the instantaneous velocity that this vehicle provides, and unit is meter per second (m/s); The magnitude of traffic flow, q, be infrastructure be taken in receive speed data that vehicle sends time, between when statistics receives this packet in 5 minutes the vehicle number of process, these data convert to/hour (/h) again, namely obtain traffic flow flow.The statistical method of concrete traffic flow flow is when infrastructure receives the Vehicle Speed that vehicle sends out, the packet absolute time (actual time) received and user ID are recorded, the magnitude of traffic flow of adding up in 5 minutes is exactly the quantity that different I D appears in 5 minutes in statistics.In order to the unit to convert to/hour, namely in these 5 minutes calculating vehicle number basis on be multiplied by 12, can obtain.
4, based on the traffic flow data flow model of catastrophe theory
According to cusp catastrophe theory model, the relation between traffic speed and flow is described, as shown in Equation (1):
412v 6+108mv 3q+27m 2q 2+2m 3q 3=0(1)
Wherein m is coefficient, and its initial value scope is, m ∈ (-1000 ,-500).
According to formula (1), the analytical model utilizing the Data Injection Attacks of v and q is proposed, as shown in Equation (2):
f(v,q)=412v 6+108mv 3q+27m 2q 2+2m 3q 3(2)
Bring formula (2) into according to each normalized data (v, q), can obtain | f (v, q) |, this numerical value as mutation distance, for the identification of Data Injection Attacks is as foundation.
5, the analysis of Data Injection Attacks behavior and identification
According to the mutation distance that formula (2) calculates, carry out analyzing to Data Injection Attacks behavior and identify, concrete grammar is:
(1) as | f (v, q) |≤ε, represent that (v, q) has been data, the packet at its place is effective data packets;
(2) as | f (v, q) | > ε, represents that (v, q) is bad data, illustrates there is Data Injection Attacks simultaneously.
Wherein, ε is tolerance coefficient, ε ∈ (1,1.0).
It should be noted that the velocity accuracy that vehicle obtains is very high, simultaneously also very high to the statistical accuracy of vehicle flowrate, unless self paralysis of car networking, cannot normally work, no person does not exist due to data precision error and causes | f (v, q) | and > ε situation occurs.
6, the process after Data Injection Attacks behavior generation
When Data Injection Attacks occurs, the owner ID of record data bag in trackside infrastructure, and abandon the packet at this place, if receive the packet of this ID transmission again, directly abandon.
7, the self-adjusting of model coefficient
When having received data, based on patch estimation theory model, utilize formula (1), ask (v, q) value substitutes into, using m as variable, the value of m can be obtained, if the value of result of calculation m is multiple, select and the immediate value of current m, as new value, m is adjusted, and the value of new m is brought in formula (2), carry out data analysis next time.The formula wherein related to is as shown in Equation (3):
&epsiv; i - 1 = m i - 1 2 - m &prime; 2 ; &epsiv; i - 2 = m i - 2 2 - m &prime; 2 ; m i = &epsiv; i - 2 2 &epsiv; i - 1 2 + &epsiv; i - 2 2 m i - 1 + &epsiv; i - 1 2 &epsiv; i - 1 2 + &epsiv; i - 2 2 \ m i - 2 - - - ( 3 )
Wherein, m i-1, m i-2be respectively the value of first twice, m ' is m i-1and m i-2mean value.

Claims (1)

1. the guard method for prevention data injection attacks in the collection of car networking data, to car networking in traffic flow data acquisition process, whether there is Data Injection Attacks and carry out on-line analysis, identify and process, the method operate in there is computing and disposal ability trackside infrastructure semaphore or trackside gateway on, as long as it can obtain real-time vehicle running speed and this two classes traffic flow data of traffic flow flow, it is characterized in that: first, cusp catastrophe theory is utilized to set up two-dimentional Traffic Flow Modeling to Vehicle Speed and traffic flow flow, secondly, based on this model, injection attacks analysis is carried out to the Vehicle Speed from vehicle received in trackside infrastructure and the traffic flow flow added up in trackside infrastructure, identify and process, finally, when data are detected as the data that injection attacks produces, these data are abandoned, and shield all data that its owning user sends later, the concrete steps of carrying out injection attacks analysis to each traffic flow data bag are as follows:
Step 1. data prediction, namely standardizes to received Vehicle Speed and traffic flow data on flows; Described normalization adopts the speed of vehicle, v, and be the instantaneous velocity that this vehicle provides, unit is meter per second, directly obtains in the packet that can be sent by vehicle; The magnitude of traffic flow, q, between when statistics receives this packet in 5 minutes the vehicle number of process, these data convert to/hour again, namely obtain traffic flow flow; The statistical method of the magnitude of traffic flow is when infrastructure receives the Vehicle Speed that vehicle sends out, the packet absolute time received and user ID are recorded, the magnitude of traffic flow of adding up in 5 minutes is exactly the quantity that different I D appears in 5 minutes in statistics;
Step 2. data analysis and identification, namely utilize the two-dimentional Traffic Flow Modeling of Vehicle Speed and the traffic flow flow set up to carry out carrying out Data Injection Attacks analysis to the Vehicle Speed received by trackside infrastructure; Carry out analyzing to Data Injection Attacks behavior and identify, concrete grammar is:
(1) as | f (v, q) |≤ε, represent that (v, q) has been data, the packet at its place is effective data packets;
(2) as | f (v, q) | > ε, represents that (v, q) is bad data, illustrates there is Data Injection Attacks simultaneously;
Wherein, ε is tolerance coefficient;
Step 3. processes, and namely when identifying Data Injection Attacks behavior in step 2, abandons current data packet, and Packet Generation person identity is carried out record, refuses all data that supervention thereafter send;
The self-adjusting of step 4. model coefficient, namely according to legal traffic flow data, utilizes patch estimation theory model to carry out on-line tuning to the system of model, makes it automatically adjust according to traffic flow feature, guarantee the actual effect of model;
Utilize cusp catastrophe theory model to set up two dimensional model to real-time vehicle running speed and traffic flow flow, describe the relation between traffic speed and flow according to cusp catastrophe theory model, as shown in formula (1):
412v 6+108mv 3q+27m 2q 2+2m 3q 3=0 (1)
Wherein m is coefficient, and its initial value scope is, m ∈ (-1000 ,-500);
According to formula (1), the analytical model utilizing the Data Injection Attacks of v and q is proposed, as shown in formula (2):
f(v,q)=412v 6+108mv 3q+27m 2q 2+2m 3q 3(2)
Bring formula (2) into according to each normalized data (v, q), can obtain | f (v, q) |, this numerical value as mutation distance, for Data Injection Attacks analysis provides theoretical foundation.
CN201210496879.4A 2012-11-28 2012-11-28 The guard method of prevention data injection attacks in gathering for car networking data Active CN103036874B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201210496879.4A CN103036874B (en) 2012-11-28 2012-11-28 The guard method of prevention data injection attacks in gathering for car networking data

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201210496879.4A CN103036874B (en) 2012-11-28 2012-11-28 The guard method of prevention data injection attacks in gathering for car networking data

Publications (2)

Publication Number Publication Date
CN103036874A CN103036874A (en) 2013-04-10
CN103036874B true CN103036874B (en) 2015-10-28

Family

ID=48023357

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201210496879.4A Active CN103036874B (en) 2012-11-28 2012-11-28 The guard method of prevention data injection attacks in gathering for car networking data

Country Status (1)

Country Link
CN (1) CN103036874B (en)

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104219309B (en) * 2014-09-04 2018-02-16 江苏大学 Vehicle identity authentication method based on certificate in car networking
WO2016046819A1 (en) * 2014-09-25 2016-03-31 Tower-Sec Ltd. Vehicle correlation system for cyber attacks detection and method thereof
CN104333596B (en) * 2014-11-11 2017-06-16 安徽大学 Information reliability assessment method in Internet of vehicles environment
JP6298021B2 (en) * 2015-07-30 2018-03-20 トヨタ自動車株式会社 Attack detection system and attack detection method
CN106211349A (en) * 2016-06-23 2016-12-07 桂林电子科技大学 Car networked devices cut-in methods based on big data
JP6750485B2 (en) * 2016-12-01 2020-09-02 住友電気工業株式会社 Detection device, detection method, and detection program
CN109391660B (en) * 2017-08-10 2022-05-06 中兴通讯股份有限公司 Data processing method and device in Internet of vehicles system and storage medium
CN107948172B (en) * 2017-11-30 2021-05-25 恒安嘉新(北京)科技股份公司 Internet of vehicles intrusion attack detection method and system based on artificial intelligence behavior analysis
CN108696516B (en) * 2018-05-08 2021-06-08 成都信息工程大学 Soeks-based intelligent networked vehicle multi-domain information security mechanism cooperation method
CN109241736B (en) * 2018-10-11 2021-03-23 浙江工业大学 Estimation method for attack of Internet of vehicles actuator and sensor
CN111447165B (en) * 2018-12-29 2023-10-31 北京奇虎科技有限公司 Vehicle safety protection method and device

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101719315A (en) * 2009-12-23 2010-06-02 山东大学 Method for acquiring dynamic traffic information based on middleware
CN101739828A (en) * 2009-11-18 2010-06-16 大连理工大学 Urban traffic area jamming judgment method by combining road traffic and weather state

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101739828A (en) * 2009-11-18 2010-06-16 大连理工大学 Urban traffic area jamming judgment method by combining road traffic and weather state
CN101719315A (en) * 2009-12-23 2010-06-02 山东大学 Method for acquiring dynamic traffic information based on middleware

Also Published As

Publication number Publication date
CN103036874A (en) 2013-04-10

Similar Documents

Publication Publication Date Title
CN103036874B (en) The guard method of prevention data injection attacks in gathering for car networking data
CN110300107B (en) Vehicle networking privacy protection trust model based on block chain
Arshad et al. A survey of local/cooperative-based malicious information detection techniques in VANETs
Lo et al. A reputation system for traffic safety event on vehicular ad hoc networks
Chen et al. A robust detection of the sybil attack in urban vanets
Hubaux et al. The security and privacy of smart vehicles
Studer et al. Efficient mechanisms to provide convoy member and vehicle sequence authentication in VANETs
Grover et al. A novel defense mechanism against sybil attacks in VANET
CN111223195A (en) City level wisdom parking system platform
CN107276983A (en) A kind of the traffic security control method and system synchronous with cloud based on DPI
CN102752130A (en) Mechanism for discovering malicious vehicles in vehicular ad-hoc network
Deng et al. Vulnerabilities and countermeasures–a survey on the cyber security issues in the transmission subsystem of a smart grid
Al Mutaz et al. Leveraging platoon dispersion for sybil detection in vehicular networks
Sumithra et al. An overview of various trust models for VANET security establishment
Didouh et al. Eve, you shall not get access! A cyber-physical blockchain architecture for electronic toll collection security
CN117202203A (en) Multi-factor comprehensive trust evaluation method in Internet of vehicles environment
CN116913071A (en) Automatic driving vehicle formation method based on vehicle Lu Yun cooperation
Goyal et al. Systematic study of VANET: Applications, challenges, threats, attacks, schemes and issues in research
Al-Mutaz et al. Detecting Sybil attacks in vehicular networks
Kamel et al. Feasibility study of misbehavior detection mechanisms in cooperative intelligent transport systems (C-ITS)
Ta Automated road traffic congestion detection and alarm systems: Incorporating V2I communications into atcss
Hadded et al. Augmented Perception by V2X Cooperation (PAC-V2X): Security issues and misbehavior detection solutions
Abu-Elkheir et al. Position verification for vehicular networks via analyzing two-hop neighbors information
Ghaleb et al. Mobility pattern based misbehavior detection in vehicular adhoc networks to enhance safety
Papa et al. A transfer function based intrusion detection system for SCADA systems

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant