CAN bus network anomaly detection method and device based on machine learning

Abstract

The invention relates to the technical field of Internet of Vehicles automobile safety detection, and aims to detect an attack message (abnormal message) sent by a malicious attacker to an automobileCAN bus. The invention discloses a CAN bus network anomaly detection method based on machine learning. The method comprises the following steps: collecting a vehicle-mounted CAN bus message sample, and normalizing a CAN bus message; dividing the messages according to the categories of the normalized CAN bus message serial number IDs, taking each category of messages as a training sample, obtaininga decision tree model of the category, and obtaining a plurality of decision tree models corresponding to the number of the categories; in a CAN bus message exception detection stage, classifying themessages to be detected, and inputting the classified messages to be detected into the decision tree model of the corresponding category to obtain a CAN bus normal message and a CAN bus exception message. According to the scheme, analysis is carried out through the supervised decision tree model in the scheme, and abnormal session connection messages, malicious attack traffic and abnormal data messages existing in the CAN bus network can be effectively discovered.

Description

technical field [0001] The invention relates to the technical field of car safety detection for the Internet of Vehicles, in particular to a machine learning-based CAN bus network abnormality detection method and device. Background technique [0002] The risk of Internet of Vehicles attacks is prominent, and the personal safety of drivers and passengers is threatened. At present, there have been many cyber-attacks against the Internet of Vehicles at home and abroad. In some cases, malicious attackers have exploited the loopholes in the vehicle body control electronic devices and vehicle service electronic devices to invade the vehicle CAN bus control network or automotive electronic components to realize sensitive Data acquisition, vehicle remote control (or some functions), etc., affect the functional safety of the car, threatening the life safety of the driver and passengers. There is an urgent need for research on vehicle CAN bus control network security protection techno...

AI Technical Summary

Problems solved by technology

[0015] (1) Some methods require the introduction of remote servers, which increases the cost of use and maintenance;

[0016] (2) Through the gateway forwarding mechanism, it is necessary to add a special gateway device in each car, which will obviously increase the cost;

[0017] (3) The method of collecting data for calculation after the car is powered on and then dynamically building a detection model requires a lot of computing resources;

[0018] (4) There is no clear early warning method or early warning treatment means when an abnormality is detected in the above methods;

[0019] (5) The data of the CAN bus protocol message can be used for classification with fewer attributes, and the number of bytes changed in the CAN bus abnormal message is less, so the effect of the artificial intelligence classification method with higher parameterization requirements is not necessarily good;

[0020] (6) The vehicle-mounted CAN bus environment is a real-time environment, which has high requirements for detection speed;

[0021] (7) From the legality of the data frame alone, it is difficult to cover all types of attack packets, such as counterfeiting, replay, malicious construction, denial of service (DOS) attacks and other attacks that appear in the form of normal packets

Images