Sybil-TraceGuard: Traceability-enhanced Sybil Guardian for Connected and Autonomous Vehicles Using Dynamic Semi-supervised GNN

2026-09-17

AI Summary

针对CAVs中的Sybil攻击问题，提出了一种基于动态半监督图神经网络的Sybil-TraceGuard框架，通过四个模块有效链接分散身份到源头攻击者。

Abstract

Connected and autonomous vehicles (CAVs) face severe Sybil attacks, where attackers exploit privacy-preserving pseudonym-switching mechanisms to anomaly alternate identities while forging Basic Safety Messages (BSMs). Although existing schemes can flag suspicious behaviors, these temporally fragmented Sybil identities render traditional single-point and sequence-based deep learning methods ineffective. Linking these fragmented identities back to the source attacker is essential for root-cause elimination, particularly under extreme label scarcity. Therefore, the Sybil-TraceGuard is proposed as a dynamic semi-supervised spatio-temporal GNN framework for Sybil Guardian, prioritizing "who is responsible" over "whether an attack is happening". It comprises four tightly coupled modules: Incremental Stream Attack Detection (ISAD) for efficient Sybil attack pre-screening; the Dynamic Topology-aware Constructor (DTC) for constructing spatio-temporal dynamic graphs; the Spatial GAT-Encoder with Multi-head Attention (SGEM) to capture multi-identity logical conflicts in spatial interactions; and the Multi-scale Spatio-Temporal Audit (MSTA) to audit short-term and long-term temporal inconsistencies. These modules are optimized within a semi-supervised Mean-Teacher framework via feature-edge shuffling perturbations, regularizing the latent feature space using minimal labels. Experiments across four Sybil attack scenarios demonstrate that Sybil-TraceGuard effectively links fragmented pseudonyms to source attackers. It outperforms state-of-the-art baselines across unlabeled ratios of 0.70-0.95, maintaining high stability and sensitivity despite extreme class imbalance and varying hyperparameter settings.

Problem

• Sybil Attacks
• Connected and Autonomous Vehicles
• Pseudonym-switching
• Basic Safety Messages
• Label Scarcity

Innovation

• dynamic semi-supervised spatio-temporal GNN
• Incremental Stream Attack Detection (ISAD)
• Dynamic Topology-aware Constructor (DTC)
• Spatial GAT-Encoder with Multi-head Attention (SGEM)
• Multi-scale Spatio-Temporal Audit (MSTA)