Private and utility enhanced intrusion detection based on attack behavior analysis with local differential privacy on IoV

Abstract

In recent years, with the escalating security demands of the Internet of Vehicles (IoV), concerns over safety have intensified. To prevent security incidents and privacy breaches, IoV must address various threats promptly and effectively. The use of deep learning methods for intrusion detection in IoV has garnered widespread attention. Compared to traditional security defenses, deep learning can learn from heterogeneous data sources, enhancing the accuracy of detecting various security threats. However, current research based on deep learning primarily focuses on constructing intrusion detection models and overlooks the analysis and processing of extensive behavioral data. Moreover, model training requires access to and transmission of sensitive data, which may lead to high communication costs and potential privacy leaks. To ensure the network security of IoV, we propose FDL-IDM, an innovative behavior-analysis-based intrusion detection model leveraging differential privacy within federated learning. It extracts driving behavior spatiotemporally and employs noise perturbation pre-aggregation, reducing communication costs and ensuring privacy without compromising accuracy. Specifically, we process data from both temporal and spatial dimensions. Data are grouped based on sender identity and then sliced according to the time sequence to create state matrices that vary over time, enhancing the performance and robustness of the detection model. Next, we incorporate an attention mechanism to merge outputs from each time step and hidden layer, strengthening the time series model and reducing information loss. Lastly, in federated learning, we add noise perturbation to the uploaded parameters, reducing the risk of privacy breaches. Additionally, we employ a random scheduling strategy during training to select clients and assign an adjusted learning rate that decreases with iterations, enhancing the stability of model training. Therefore, FDL-IDM helps prevent security attacks and protect IoV privacy. Through experiments and privacy analysis, as well as tests on vehicle-level devices, FDL-IDM achieved F1-scores of 0.9751, 0.9851, and 0.9789 on three public datasets, demonstrating not only high accuracy but also robust privacy protection capabilities.