Sybil-TraceGuard: Traceability-enhanced Sybil Guardian for Connected and Autonomous Vehicles Using Dynamic Semi-supervised GNN
Sybil-TraceGuard, a dynamic semi-supervised spatio-temporal GNN, links fragmented Sybil pseudonyms in connected vehicles back to their source attackers.
The paper proposes Sybil-TraceGuard to attribute Sybil attacks in connected and autonomous vehicles, where adversaries exploit pseudonym-switching while forging Basic Safety Messages. It combines incremental stream detection, dynamic topology-aware graph construction, a spatial GAT encoder, and multi-scale spatio-temporal auditing within a Mean-Teacher semi-supervised framework. Across four attack scenarios with unlabeled ratios of 0.70-0.95, it outperforms state-of-the-art baselines despite extreme class imbalance.
- Focuses on attributing Sybil identities to source attackers, not just detection
- Uses dynamic spatio-temporal graphs with GAT multi-head attention
- Semi-supervised Mean-Teacher training handles minimal labels
- Evaluated across four Sybil attack scenarios with high imbalance
Full article203 words · extracted from arxiv.org · click to collapse
Connected and autonomous vehicles (CAVs) face severe Sybil attacks, where attackers exploit privacy-preserving pseudonym-switching mechanisms to anomaly alternate identities while forging Basic Safety Messages (BSMs). Although existing schemes can flag suspicious behaviors, these temporally fragmented Sybil identities render traditional single-point and sequence-based deep learning methods ineffective. Linking these fragmented identities back to the source attacker is essential for root-cause elimination, particularly under extreme label scarcity. Therefore, the Sybil-TraceGuard is proposed as a dynamic semi-supervised spatio-temporal GNN framework for Sybil Guardian, prioritizing "who is responsible" over "whether an attack is happening". It comprises four tightly coupled modules: Incremental Stream Attack Detection (ISAD) for efficient Sybil attack pre-screening; the Dynamic Topology-aware Constructor (DTC) for constructing spatio-temporal dynamic graphs; the Spatial GAT-Encoder with Multi-head Attention (SGEM) to capture multi-identity logical conflicts in spatial interactions; and the Multi-scale Spatio-Temporal Audit (MSTA) to audit short-term and long-term temporal inconsistencies. These modules are optimized within a semi-supervised Mean-Teacher framework via feature-edge shuffling perturbations, regularizing the latent feature space using minimal labels. Experiments across four Sybil attack scenarios demonstrate that Sybil-TraceGuard effectively links fragmented pseudonyms to source attackers. It outperforms state-of-the-art baselines across unlabeled ratios of 0.70-0.95, maintaining high stability and sensitivity despite extreme class imbalance and varying hyperparameter settings.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.19791