基于流量统计的车联网Sybil攻击行为检测

摘要

在传统的VANETS (Vehicle Ad-hoc Networks)向IoV (Internet of Vehicles)转变的过程中，车联网范围不断扩大以及车联网内流量不断增加，使得传统入侵检测系统难以识别攻击信息或者无法及时给出反馈。Sybil攻击作为车联网环境中的一种重要攻击类型，通过模拟正常车辆的运行特性造成道路信息混乱、阻塞，为车辆的安全驾驶带来巨大挑战。本文面向车联网环境中的sybil攻击行为，使用基于流量统计的入侵检测分析方法来对sybil攻击行为进行鉴别。在数据收集方面，利用仿真工具Veins模拟实际车联网环境中的信息传输过程；在分类器选用方面，利用机器学习中的MLP (Multilayer Perceptron)神经网络，训练能够识别sybil攻击的入侵检测模型；在可视化方面，设计具有便捷交互性的用户界面来进行展示和预警。检测实验表明，本文所设计的入侵检测系统在区分正常流量和sybil攻击行为上平均达到了85%以上的准确率，同时能够在可视化界面上及时地反馈预测结果。 In the process of transforming traditional VANETS (Vehicle Ad-hoc Networks) to IoV (Internet of Vehicles), the scope of the Internet of Vehicles continues to expand and the traffic within the Internet of Vehicles continues to increase, making it difficult for traditional intrusion detection systems to identify attack information or provide timely information Feedback. As an important type of attack in the Internet of Vehicles environment, Sybil attacks cause confusion and obstruction of road information by simulating the operating characteristics of normal vehicles, which brings huge challenges to the safe driving of vehicles. This article is oriented to Sybil attacks in the Internet of Vehicles environment, and uses traffic statistics-based intrusion detection and analysis methods to identify Sybil attacks. In terms of data collection, the simulation tool Veins is used to simulate the information transmission process in the actual car networking environment; in terms of classifier selection, the use of MLP (Multilayer Perceptron) neural network in machine learning is used to train an intrusion detection model that can identify Sybil attacks; in terms of visualization, we design a convenient and interactive user interface for display and warning. Detection experiments show that the intrusion detection system designed in this paper achieves an average accuracy of over 85% in distinguishing between normal traffic and sybil attacks, and can provide timely feed-back on the prediction results on the visual interface.