Vehicle-mounted network CAN bus intrusion detection method and system based on GMM-HMM

Abstract

The invention discloses a vehicle-mounted network CAN bus intrusion detection method based on a GMM-HMM, and the method comprises the following steps: obtaining normal messages of a vehicle-mounted network CAN bus, carrying out the statistics of the periods of all messages of each CAN ID according to a time sequence, i.e., the time difference between two frames of messages of the same CAN ID, and forming a period sequence as the input of an algorithm; according to the algorithm, the periodic sequence of each CAN ID is divided into a fixed length, then a GMM-HMM model is trained for each CAN ID, and the likelihood probability of a normal periodic sequence is obtained; and for a tested message sequence, the periodic sequence of each CAN ID is also counted, the likelihood probability for generating the sequence is calculated after the periodic sequence is input into the model, and whether the message sequence is abnormal or not is judged by comparing the likelihood probability with the threshold value of the likelihood probability obtained in the previous step. According to the method, the problem of CAN bus message period anomaly detection is solved, and attack behaviors such as DoS, fuzziness, replay and the like of inserting messages into the bus can be found.

Description

technical field [0001] The invention belongs to the technical field of vehicle intrusion detection, and relates to a GMM-HMM-based vehicle network CAN bus intrusion detection method and system. Background technique [0002] In recent years, the Internet of Vehicles has entered a period of rapid development. The on-board equipment on the vehicle connects to the network through wireless communication technology to obtain richer services and powerful functions, and also provides more possibilities for network attacks. Attackers can attack the vehicle electronic system through various means, and launch DoS, fuzzy, replay, tampering and other attacks on the vehicle CAN bus, which may seriously affect the driving safety of the vehicle and threaten the personal safety of the driver and other traffic participants. safety and security of property. Therefore, it is necessary to monitor the communication status and content of the CAN bus in real time, and report abnormal situations i...

AI Technical Summary

Problems solved by technology

[0003] In the past, many of the methods for CAN bus intrusion monitoring were machine learning methods based on deep learning and neural networks. These methods have poor interpretability, high computational requirements, and relatively weak practicability; for CAN bus message cycle The anomaly detection method of features often only focuses on the cycle size itself, without considering the relationship between different cycles, resulting in a decrease in the detection accuracy of packets with multiple cycles

Images