Congestion Attack Detection in Intelligent Traffic Signal System: Combining Empirical and Analytical Methods

Abstract

The intelligent traffic signal (I-SIG) system aims to perform automatic and optimal signal control based on traffic situation awareness by leveraging connected vehicle (CV) technology. However, the current signal control algorithm is highly vulnerable to CV data spoofing attacks. These vulnerabilities can be exploited to create congestion in an intersection and even trigger a cascade failure in the traffic network. To avoid this issue, timely and accurate congestion attack detection and identification are essential. This work proposes a congestion attack detection approach by combining empirical prediction and analytical verification. First, we collect a range of traffic images that correspond to specific traffic snapshots which are vulnerable to potential data spoofing attacks. Based on these traffic images, an improved generative adversarial network is trained to predict whether a forthcoming attack will cause congestion with a high probability. Meanwhile, we define a group of traffic flow features. After exploring features and conducting a thorough analysis, a TGRU (tree-regularized gated recurrent unit)-based approach is proposed to verify whether congestion occurs. When we find a possible attack that can cause congestion with high probability and subsequent traffic flows also prove congestion, we can say there is a congestion attack. Thus, we can realize timely and accurate congestion attack detection by integrating empirical prediction and analytical verification. Extensive experiments demonstrate that our approach performs well in congestion attack detection accuracy and timeliness.

An Evidence Theoretic Approach for Traffic Signal Intrusion Detection

“…Xiang et al [ 11 ] applied empirical studies to detecting intrusions in traffic signals. From a range of traffic images (vulnerable to potential data spoofing attacks), the solution measures the traffic flow characteristics and predicts whether there would be any attacks that would be able to cause congestion with a certain probability.…”

“…However, in this study, a theoretical model for intrusion detection and its evaluation and validation were not specifically performed. In the current literature, there exist congestion-based attack analysis [ 11 ] and intrusion detection techniques [ 12 ] that exploit traffic image features. Additionally, with intrusion detection considering a specific attack, the other loopholes of these approaches rely on a selected set of traffic image features and an image prepossessing technique (background separation) that usually leads to being more computationally expensive.…”

“…Since our proposed IDS is based on anomaly detection, it has the ability to detect intrusions created by the spoofed vehicles proposed in [ 11 ], as our method picks up any anomaly caused by intrusions, including intrusions in roadside sensors and traffic controllers and signals. Flow rate, phase time, and vehicle speed are affected by the attacks in a traffic signal irrespective of their types.…”