用智能算法检测车联网未知攻击，提升自动驾驶车安全。
Zero-Day Botnet Attack Detection in IoV: A Modular Approach Using Isolation Forests and Particle Swarm Optimization
- 多隔离森林模型分工识别不同僵尸网络攻击
- 粒子群优化融合模型，对已知攻击检出率92.80%，未知攻击达77.32%
- 适合车联网安全防护研究者与边缘计算安全工程师
车联网（IoV）通过增强连接性推动交通变革，但也引入新安全隐患。僵尸网络恶意软件和网络攻击威胁联网与自动驾驶汽车（CAVs），已有真实案例显示远程系统被攻破。为此，我们提出一种基于边缘的入侵检测系统（IDS），实时监控车辆进出网络流量。检测模型采用元集成分类器，可识别已知（N-day）攻击并发现未知（zero-day）攻击。在多接入边缘计算（MEC）服务器上训练多个专精于特定僵尸网络攻击类型的隔离森林（IF）模型，这些模型可本地训练或由其他MEC节点共享。随后使用基于粒子群优化（PSO）的堆叠策略聚合各IF，构建鲁棒的元分类器。在车载僵尸网络数据集上的评估显示，该系统对已知攻击平均检出率达92.80%，对未知攻击达77.32%。结果表明该方案能有效应对已知与新兴威胁，为车联网提供可扩展、自适应的安全防御机制。
原文摘要 · Abstract (English)
The Internet of Vehicles (IoV) is transforming transportation by enhancing connectivity and enabling autonomous driving. However, this increased interconnectivity introduces new security vulnerabilities. Bot malware and cyberattacks pose significant risks to Connected and Autonomous Vehicles (CAVs), as demonstrated by real-world incidents involving remote vehicle system compromise. To address these challenges, we propose an edge-based Intrusion Detection System (IDS) that monitors network traffic to and from CAVs. Our detection model is based on a meta-ensemble classifier capable of recognizing known (Nday) attacks and detecting previously unseen (zero-day) attacks. The approach involves training multiple Isolation Forest (IF) models on Multi-access Edge Computing (MEC) servers, with each IF specialized in identifying a specific type of botnet attack. These IFs, either trained locally or shared by other MEC nodes, are then aggregated using a Particle Swarm Optimization (PSO) based stacking strategy to construct a robust meta-classifier. The proposed IDS has been evaluated on a vehicular botnet dataset, achieving an average detection rate of 92.80% for N-day attacks and 77.32% for zero-day attacks. These results highlight the effectiveness of our solution in detecting both known and emerging threats, providing a scalable and adaptive defense mechanism for CAVs within the IoV ecosystem.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。