TLDR: This paper explores the vulnerabilities of Distributed Federated Learning (DFL) in vehicular networks to sophisticated cyberattacks like targeted data poisoning and backdoor attacks. It demonstrates that DFL offers greater resilience compared to individual learning and proposes effective defense mechanisms based on clustering and statistical analysis to detect and mitigate these threats, improving malicious-label detection accuracy significantly.
In the rapidly evolving landscape of connected and autonomous vehicles, technologies like Dedicated Short-Range Communications (DSRC) and Cellular Vehicle-to-Everything (C-V2X) are driving a new era of real-time data sharing and collaborative decision-making. However, this increased connectivity also brings heightened vulnerabilities to cyber threats, system faults, and environmental disruptions. Traditional centralized monitoring systems often fall short in these dynamic environments due to latency, bandwidth limitations, and infrastructure dependence, making timely anomaly detection a significant challenge.
To address these critical security and resilience needs, decentralized solutions are becoming essential. This is where Distributed Federated Learning (DFL) emerges as a powerful approach. Unlike conventional Federated Learning (FL), which relies on a central server, DFL eliminates this single point of failure by enabling peer-to-peer model sharing and collaborative consensus-building among nodes. This architecture significantly enhances scalability, resilience to node failures, and overall learning robustness, making it particularly well-suited for securing vehicular networks without exposing sensitive raw data.
Despite its advantages, DFL is not immune to sophisticated cyberattacks. This research paper delves into the design of advanced targeted training data poisoning and backdoor (Trojan) attacks, characterizing the vulnerabilities they introduce in vehicular networks. It also analyzes how DFL inherently provides resilience against such attacks compared to individual learning and, crucially, presents effective defense mechanisms to further strengthen DFL against these emerging cyber threats.
Understanding the Attacks
The paper focuses on two primary types of targeted attacks:
-
Targeted Poisoning Attacks: In this scenario, an adversary deliberately alters training labels from ‘Malicious’ to ‘Benign’ to prevent the network from detecting actual incoming attacks. The attacker aims to deceive the system into misclassifying malicious inputs as benign. The research shows that as attack intensity and the number of attacked nodes increase, predictions shift towards ‘Benign’, making the attack successful. However, DFL demonstrates greater resilience, requiring an adversary to compromise more resources to achieve the same level of impact compared to individual learning.
-
Backdoor (Trojan) Attacks: These are stealthier attacks where an adversary inserts ‘triggers’ into the training dataset by selectively altering both training data features (e.g., vehicle position parameters) and their corresponding labels. During test time, activating these hidden triggers forces the learned model to incorrectly classify malicious inputs as benign. The study reveals that even a small portion of poisoned training data can make a backdoor attack successful in individual learning. In contrast, DFL provides substantial resilience, requiring a significantly larger number of attacked nodes to achieve a similar fooling rate.
The research utilizes the VeReMi Extension Dataset, which contains basic safety messages (BSMs) exchanged within a simulated vehicular network, to conduct comprehensive experiments. The dataset includes 100 vehicles, with 94 providing training and test data, and features 64,779 samples, each with 22 features, focusing on Denial of Service (DoS) attacks.
Also Read:
- New Framework Enhances Detection of Unseen Jailbreak Attacks in Vision-Language Models
- Accelerating Automotive Crashworthiness Design with AI-Powered Simulations
Defense Mechanisms
To bolster DFL’s resilience, the paper introduces two key defense mechanisms:
-
Defense against Targeted Poisoning Attacks (Clustering-based): This defense employs k-means clustering (k=2) on each node’s samples after reducing features using Principal Component Analysis (PCA). It identifies ‘Malicious’ and ‘Benign’ centroids. A sample is flagged as poisoned if a benign-labeled point is closer to the ‘Malicious’ centroid. Once detected, these poisoned samples are either removed or their labels are corrected before the next DFL training round. This clustering approach significantly improves malicious-label detection accuracy by an average of 23% across the network.
-
Defense against Backdoor Attacks (MAD-based Statistical Method): To counter backdoor attacks, the Median Absolute Deviation (MAD)-based method is adapted. MAD quantifies data dispersion, and points with a normalized anomaly index exceeding a certain threshold (e.g., 2) are flagged as outliers (attacked) and removed from the training set. Focusing on vulnerable features like position parameters, this defense mechanism yields a 38.8% improvement in detecting malicious labels over a no-defense baseline.
In conclusion, this research highlights the critical benefits and resilience of DFL in securing vehicular networks against sophisticated cyberattacks. By enabling vehicles to train models locally and share updates directly, DFL conserves bandwidth and reduces power consumption, making it ideal for congested and remote environments. The study, detailed in the paper available at arXiv:2510.15109, demonstrates DFL’s superior resilience compared to individual learning and validates the effectiveness of clustering- and statistical-analysis–based defense mechanisms in significantly improving malicious-label detection accuracy.
