CAN (Controller Area Network) bus intrusion detection method and system and electronic equipment

Abstract

The invention belongs to the technical field of industrial control network communication security protection, and particularly relates to a CAN bus intrusion detection method and system and electronic equipment. The method comprises the following steps: acquiring voltage sampling points on a CAN bus, and extracting a voltage sampling point with an identifier and a voltage sampling point with an IDE bit from the voltage sampling points; converting the voltage sampling point with the identifier into a message label; determining dominant voltage sampling points from dominant positions in the voltage sampling points of the IDE positions, calculating average voltage of the dominant voltage sampling points, comparing the average voltage with a preset threshold value, and judging whether invasion occurs or not according to a comparison result. According to the method, the threshold is established and intrusion is detected by using the key IDE bit voltage signal in the CAN message, so that a large number of signals which are not influenced by attacks in the CAN message are prevented from being collected, the number of sampling points is reduced, and the accuracy of detecting hidden attacks such as DUET attacks is also remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of industrial control network communication security protection, and particularly relates to a CAN bus intrusion detection method, system and electronic device. Background Art

[0002] The Controller Area Network (CAN) bus includes a pair of twisted pairs, CAN High and CAN Low, which has good anti-interference ability and is widely used in fields such as ships, vehicles, and airplanes. Since the CAN bus lacks encryption and authentication mechanisms, after a hacker controls an electronic control unit, they can further attack other ECUs (Electrical Control Unit) through the CAN bus and control their functions, threatening the safety of people's lives and property. Therefore, it is necessary to perform intrusion detection on the CAN bus.

[0003] Intrusion detection systems based on voltage can identify the attack source and have received extensive attention from researchers. These solutions are very effective in detecting ordinary spoofing attacks (i.e., an attacker ECU sends malicious messages with the identifier of the victim ECU). However, mainstream voltage-based intrusion detection systems need to collect most of the voltage signals of CAN messages to detect intrusions, making it difficult to detect some covert attacks such as DUET (Dual ECU Voltage Tampering Attack) attacks, because this attack only damages a small amount of voltage signals each time, thus affecting the ability of the voltage-based intrusion detection system to detect intrusions. In addition, considering the limited resources of ECUs on the CAN bus, while mainstream voltage-based intrusion detection systems need to calculate a large number of voltage features and establish a system using machine learning, on the one hand, this will make it difficult to detect CAN messages in a timely manner, and on the other hand, it will affect the real-time processing and real-time communication of ECUs for CAN messages. Summary of the Invention

[0004] The purpose of the present invention is to provide a CAN bus intrusion detection method, system and electronic device to solve the problems of difficult detection of covert DUET attacks and high detection time cost in the prior art.

[0005] To achieve the above purpose, the present invention adopts the following technical solutions: In the first aspect of the present invention, a CAN bus intrusion detection method is provided, including: Obtain voltage sampling points on the CAN bus, and extract a first sampling point and a second sampling point; wherein, the first sampling point is a voltage sampling point with an identifier; the second sampling point is a voltage sampling point of the IDE bit; Convert the first sampling point into a message label; determine the dominant voltage sampling points belonging to the dominant bits from the second sampling points, and calculate the average voltage of the dominant voltage sampling points; Compare the average voltage with a preset threshold, and determine whether there is an intrusion on the CAN bus according to the comparison result; when an intrusion occurs, identify the invaded ECU according to the message label.

[0006] Preferably, the voltage sampling points on the CAN bus are differential signals.

[0007] Preferably, the conversion of the first sampling point into a message label is specifically: converting the first sampling point into a digital signal representation form, and using the digital signal representation form as the message label.

[0008] Preferably, the comparison of the average voltage with the preset threshold and the determination of whether an intrusion occurs according to the comparison result are specifically: If the average voltage is lower than the preset threshold, there is no intrusion on the CAN bus; If the average voltage is not lower than the preset threshold, there is an intrusion on the CAN bus.

[0009] Preferably, the preset threshold is obtained through the following steps: Obtain the voltage sampling points on the CAN bus, and extract a number of first sampling points and a number of second sampling points from the voltage sampling points; where each first sampling point corresponds to a second sampling point; Convert the first sampling point into a message label; calculate the average voltage of the second sampling points; where each message label corresponds to an average voltage; classify the average voltages according to different types of message labels to obtain a fixed number of average voltages; the fixed number of average voltages and the message labels constitute a training sample; Use the following formula to calculate the training sample to obtain the preset threshold:

[0010]

[0011] In the formula, is the preset threshold; is the upper quartile of the training sample; is a preset parameter, taking 8 - 70; is the lower quartile of the training sample; is the interquartile range.

[0012] In the second aspect of the present invention, a CAN bus intrusion detection system is provided, including: An acquisition unit, configured to acquire voltage sampling points on the CAN bus and extract a first sampling point and a second sampling point; wherein, the first sampling point is a voltage sampling point with an identifier; the second sampling point is a voltage sampling point of the IDE bit; A sample unit, configured to convert the first sampling point into a message label; determine dominant voltage sampling points belonging to dominant bits from the second sampling point, and calculate the average voltage of the dominant voltage sampling points; An intrusion detection unit, configured to compare the average voltage with a preset threshold, and determine whether an intrusion occurs on the CAN bus according to the comparison result; when an intrusion occurs, identify the invaded ECU according to the message label.

[0013] Preferably, in the intrusion detection unit, comparing the average voltage with a preset threshold and determining whether an intrusion occurs according to the comparison result is specifically as follows: If the average voltage is lower than the preset threshold, no intrusion occurs on the CAN bus; If the average voltage is not lower than the preset threshold, an intrusion occurs on the CAN bus.

[0014] Preferably, in the sample unit, converting the first sampling point into a message label is specifically as follows: converting the first sampling point into a digital signal, and using the digital signal as the message label.

[0015] In a third aspect of the present invention, an electronic device is provided, including a processor and a memory, where the processor is configured to execute a computer program stored in the memory to implement the CAN bus intrusion detection method described in any one of the above.

[0016] In a fourth aspect of the present invention, a computer-readable storage medium is provided, where the computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, the CAN bus intrusion detection method described in any one of the above is implemented.

[0017] Compared with the prior art, the beneficial effects of the present invention are as follows: 1) Technical innovation and detection of covert attacks The present invention uses the key IDE (Identifier Extension) bit voltage signal in the CAN message to establish a threshold and detect intrusion, avoiding collecting a large number of signals in the CAN message that are not affected by attacks. This technical innovation not only reduces the number of sampling points, but also significantly improves the accuracy of detecting covert attacks such as DUET attacks. By learning the distribution of the average voltage of the IDE bits of normal CAN messages and establishing a threshold for the average voltage of the IDE bits for each identifier, the present invention can effectively distinguish normal messages and messages damaged by attacks. This makes the present invention more accurate in detecting covert attacks.

[0018] 2) Improved detection speed and reduced hardware requirements Instead of using complex machine learning algorithms to train models, a threshold-based intrusion detection method is used to model normal packets, significantly reducing the time overhead of intrusion detection in the present invention. The test results on a specific dataset show that the time for feature extraction, model training, and intrusion detection in the present invention is significantly reduced compared to traditional methods. Since only the voltage sampling points of the IDE bit need to be obtained during the sampling process, the sampling rate required by the present invention is not high compared to traditional methods. This means that the present invention can be deployed on resource-constrained devices, further reducing the deployment cost of the intrusion detection system on the CAN bus. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings forming a part of this application are used to provide a further understanding of the present invention. The schematic embodiments and descriptions thereof of the present invention are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings: Figure 1 is a flowchart of the method according to an embodiment of the present invention; Figure 2 is an example diagram of a hidden DUET attack according to an embodiment of the present invention; Figure 3 is a system block diagram according to an embodiment of the present invention; Figure 4 is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] The present invention will be described in detail below with reference to the drawings and in conjunction with the embodiments. It should be noted that, without conflict, the embodiments and features in this application can be combined with each other.

[0021] The following detailed descriptions are all exemplary descriptions, aiming to provide further detailed descriptions of the present invention. Unless otherwise specified, all technical terms used in the present invention have the same meaning as commonly understood by those of ordinary skill in the art to which this application belongs. The terms used in the present invention are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention.

[0022] See Figure 1 , this application discloses a CAN bus intrusion detection method, including: S1: Obtain the voltage sampling points on the CAN bus, and extract the first sampling point and the second sampling point; wherein, the first sampling point is the voltage sampling point with an identifier; the second sampling point is the voltage sampling point of the IDE bit; Extract the voltage sampling point with an identifier and the voltage sampling point of the IDE bit from the collected voltage sampling points, because this application discovers that for hidden attacks, such as the DUET attack, it will surely cause the signal of the IDE bit to be affected by both the victim ECU and the attacker ECU at the same time.

[0023] S2: Convert the first sampling point into a message label; Determine the dominant voltage sampling points belonging to the dominant bits from the second sampling point, and calculate the average voltage of the dominant voltage sampling points; S3: Compare the average voltage with a preset threshold, and judge whether an intrusion has occurred according to the comparison result; When an intrusion occurs, identify the intruded ECU according to the message label.

[0024] Using the key IDE (Identifier Extension) bit voltage signal in the CAN message to establish a threshold and detect intrusion, it avoids collecting a large number of signals on the CAN message that are not affected by the attack. This technological innovation not only reduces the number of sampling points, but also significantly improves the accuracy of detecting hidden attacks such as the DUET attack. By learning the distribution of the average voltage of the IDE bits of normal CAN messages, a threshold of the average voltage of the IDE bits is established for each identifier, and the present invention can effectively distinguish normal messages from messages damaged by attacks. This makes the present invention more accurate when detecting hidden attacks.

[0025] In some embodiments, the voltage sampling points on the CAN bus are differential signals, and the CAN bus includes a CAN high line and a CAN low line; The voltage sampling point on the CAN high line is the high sampling point, and the voltage sampling point on the CAN low line is the low sampling point; Then the acquisition method of the differential signal is specifically: Subtract the voltage value of the low sampling point on the CAN bus from the voltage value of the high sampling point on the CAN bus at the same moment to obtain the differential signal.

[0026] In some embodiments, the conversion of the voltage sampling point with an identifier into a message label is specifically: According to the sampling rate when collecting the voltage sampling points, convert the voltage sampling point with an identifier into a digital signal expression form (that is, the signal expression composed of 0 and 1) to obtain the message label. When an intrusion occurs, identify the intruded ECU according to the identifier corresponding to the message label. The vehicle manufacturer knows the mapping table between each ECU and the identifier. After obtaining the identifier from the message label, the vehicle manufacturer can know the corresponding ECU through the mapping table.

[0027] In some embodiments, the mean voltage is compared with a preset threshold, and whether an intrusion occurs is judged according to the comparison result. The mean voltage within the sample of a normal message is lower than the threshold, while the mean voltage within the sample of a malicious message exceeds the threshold. Only one voltage sampling point with an identifier and one voltage sampling point of the IDE bit can be extracted from one message. Then: If the mean voltage is lower than the preset threshold, the message is a normal message and no intrusion occurs on the CAN bus; If the mean voltage is not lower than the preset threshold, the message is an abnormal message and an intrusion occurs on the CAN bus.

[0028] In some embodiments, the preset threshold is obtained through the following steps: Obtain the voltage sampling points on the CAN bus, and extract a plurality of first sampling points and a plurality of second sampling points from the voltage sampling points; only one voltage sampling point with an identifier and one voltage sampling point of the IDE bit can be extracted from one message; therefore, each first sampling point obtained on the CAN bus corresponds to a second sampling point; Convert the first sampling point into a message label; calculate the mean voltage of the second sampling point; wherein, each message label corresponds to a mean voltage; classify the mean voltages according to different types of message labels to obtain a fixed number of mean voltages; the fixed number of mean voltages and the corresponding message labels form a training sample; Use the following formula to calculate the training sample to obtain the preset threshold:

[0029]

[0030] In the formula, is the preset threshold; is the upper quartile of the training sample; is a preset parameter, taking values from 8 to 70, preferably 8 to 38; is the lower quartile of the training sample; is the interquartile range.

[0031] Embodiment 1 A CAN bus intrusion detection method includes the following steps: Collect the voltage sampling points of the messages on a normal CAN bus. The voltage sampling points are differential signals. Subtract the voltage value of the low sampling point on the CAN bus from the voltage value of the high sampling point on the CAN bus at the same moment to obtain the voltage sampling points. The number of sampling points is determined by the sampling rate. The higher the sampling rate, the more the number of sampling points. Preferably, the sampling rate can be 3.4 MS / s. Extract the voltage sampling points with identifiers and the voltage sampling points of the IDE bit from the collected voltage sampling points.

[0032] Convert the voltage sampling points with identifiers into message tags; on a 500 kbit / s CAN bus, the time to send a 1-bit signal is 2 microseconds. Divide consecutive dominant sampling points (higher than 0.8V) and recessive sampling points (lower than or equal to 0.8V) by 6.8 to obtain the number of bits of the dominant bit (logical signal 0) and the number of bits of the recessive bit (logical signal 1), so as to convert the voltage sampling points with identifiers into message tags. Determine the dominant voltage sampling points that belong to the dominant bits among the voltage sampling points of the IDE bit, and calculate the average voltage of the dominant voltage sampling points.

[0033] Compare the average voltage with a preset threshold, and judge whether an intrusion has occurred according to the comparison result. For example, assume that there are 5 types of messages with identifiers A, B, C, D, and E on the CAN, and their thresholds are 2.73, 2.51, 2.79, 2.57, and 2.63 respectively. If a message with identifier B is detected on the CAN bus, and the average voltage of its IDE bit is 2.21, which is lower than the threshold 2.51, it means that this message is a normal message. If a message with identifier C is detected, and the average voltage of its IDE bit is 3.02, which is higher than the threshold 2.79, it means that this message has been attacked and damaged, and an intrusion has occurred on the CAN bus. At this time, the victim ECU is the ECU corresponding to identifier C. It should be noted that although the present invention cannot directly know the identity of the victim ECU, the present invention can obtain the identifier corresponding to the victim ECU, and according to this identifier, it can help the manufacturer know the identity of the victim ECU.

[0034] The preset threshold is obtained through the following steps: Obtain the voltage sampling points on the CAN bus, and extract the voltage sampling points with identifiers and the voltage sampling points of the IDE bit from the voltage sampling points; Calculate the average voltage of the voltage sampling points of the IDE bit, and convert the voltage sampling points with identifiers into message tags; according to different types of message tags, classify the corresponding average voltages to obtain a fixed number of average voltages and the message tags corresponding to the average voltages; the fixed number of average voltages and the message tags corresponding to the average voltages constitute a training sample; for example, assume that there are 5 types of message tags on the CAN: A, B, C, D, and E. Classify the average voltages according to the 5 types of message tags so that each type of message tag has a fixed number of average voltages; the fixed number of average voltages and the message tags corresponding to the average voltages constitute a training sample; Among them, calculate the training sample to obtain a preset threshold, and the calculation method is as follows:

[0035]

[0036] In the formula, is the preset threshold; is the upper quartile of the training samples; is a preset parameter, taking 38; is the lower quartile of the training samples; is the interquartile range.

[0037] For example, the number of training samples is 400. The preset threshold of the average voltage of each identifier IDE bit calculated is ( ). The IQR is the difference between the upper quartile ( ) and the lower quartile ( ) of the data set, expressed as IQR = - . Where k is a set parameter, taking 8 to 70. Preferably, k can be set from 8 to 38.

[0038] Embodiment 2 See Figure 3 , a CAN bus intrusion detection system, including: An acquisition unit, configured to acquire voltage sampling points on the CAN bus and extract a first sampling point and a second sampling point; wherein, the first sampling point is a voltage sampling point with an identifier; the second sampling point is a voltage sampling point of the IDE bit; A sample unit, configured to convert the first sampling point into a message label; determine the dominant voltage sampling points belonging to the dominant bit from the second sampling points, and calculate the average voltage of the dominant voltage sampling points; An intrusion detection unit, which compares the average voltage with a preset threshold, and determines whether an intrusion occurs on the CAN bus according to the comparison result; when an intrusion occurs, it identifies the invaded ECU according to the message label.

[0039] Further preferably, the system disclosed in the present application further includes an alarm module and a display module. When no intrusion is detected, the next message is detected. When an intrusion is detected, the identifier of the victim ECU is determined, and the alarm module is activated to issue an alarm through the display module or a buzzer, and display the identifier information of the victim ECU.

[0040] In some embodiments, inside the intrusion detection unit, comparing the average voltage with a preset threshold and determining whether an intrusion occurs according to the comparison result is specifically: If the average voltage is lower than the preset threshold, no intrusion occurs on the CAN bus; If the average voltage is not lower than the preset threshold, an intrusion occurs on the CAN bus.

[0041] In some embodiments, inside the sample unit, converting the first sampling point into a message label is specifically: converting the first sampling point into a digital signal, and using the digital signal as the message label.

[0042] Example 3 The error handling mechanism of the CAN bus stipulates that if multiple ECUs transmit different logical signals simultaneously after the CAN message arbitration field, it will cause bit errors. The voltage-based intrusion detection system is vulnerable to environmental changes, resulting in a decrease in accuracy. Therefore, the voltage-based intrusion detection system needs to be retrained frequently to update the fingerprints. The DUET attack is a poisoning attack against the retraining process of the voltage-based intrusion detection system. The DUET attack destroys the signals bit by bit during retraining, quietly poisons the model over a long period of time, and finally causes malicious messages sent by the attacker ECU not to trigger an alarm. Since the mainstream voltage-based intrusion detection system collects most of the signals after the arbitration field to detect intrusions, the few signals damaged by the DUET attack are masked by other normal signals collected, resulting in the failure to detect the attack. Figure 2 An example of the DUET attack is shown. Since the signal of the IDE bit is the first bit after the arbitration field, the DUET attack will destroy the signal of the IDE bit in the first round. The damaged IDE bit signal means that the signal no longer comes from a single ECU, but from the attacker ECU and the victim ECU. Therefore, the present invention can distinguish the attacked message by learning the voltage mean value of each IDE bit of the normal CAN message.

[0043] The more sampling points, the higher the time cost of calculating the sampling points. Therefore, the present invention uses a lower sampling rate to obtain voltage sampling points. In addition, the method of the present invention avoids using complex machine learning algorithms to train the model and selects a threshold-based intrusion detection method. Thus, the resource overhead required by the present invention is reduced.

[0044] Experimental environment: Prototype system: The present application constructs a prototype system composed of seven ECUs. Given that the ECUs in a real CAN network may come from different manufacturers, the prototype system integrates various devices. Specifically, two Arduino UNOs and one Arduino Nano constitute three ECUs, and each device is connected to an MCP2515 CAN controller and a TJA1050 CAN transceiver. In addition, one USBCAN-II Pro and three STM32F103 development boards with CAN modules constitute the remaining four ECUs. The prototype system includes two CAN High and CAN Low lines with a speed of 500 kbit / s.

[0045] Real Vehicles: This application considers electric vehicles (BYD Dolphin), hybrid vehicles (Buick Regal), and gasoline vehicles (Luxgen U5). In this application, three ECUs are connected to the CAN bus through the OBD-II port of the vehicle. During the experiment, these three ECUs served as two attackers and a victim in the DUET attack, respectively, and the technical solution disclosed in US11683323B2 was used as the comparative solution.

[0046] Table 1

[0047] Referring to Table 1, this application uses three evaluation metrics (accuracy, recall, and F1-score) to present the performance of the comparative solution in detecting DUET attacks. The number of normal messages and messages damaged by DUET attacks used for testing is 2000 each. Accuracy represents the proportion of messages correctly identified by the present invention among all messages. Recall represents the proportion of damaged messages correctly identified by the present invention. The F1-score combines precision and recall to provide a balanced performance metric. Although the comparative solution detected a small number of damaged messages during the DUET attack. It can be seen that the present invention is superior to the comparative solution in all three evaluation metrics during all rounds of the DUET attack. Although the accuracy of the comparative solution is around 50%, this is mainly because the comparative solution can accurately identify normal signals. The recall rate of the comparative solution reflects its weak ability to identify messages damaged by DUET attacks. The present invention can accurately identify messages damaged by DUET attacks and normal messages by using the signal of the IDE bit.

[0048] Table 2

[0049] The resources of the ECU on the CAN bus are limited, and the time for intrusion detection affects the real-time processing and real-time communication of messages by the ECU. To compare the time overhead of the present invention and the comparative solution, this application deploys both solutions on a RaspberryPi 4B. Since the present invention only calculates the average voltage of the IDE bit, the time cost related to feature extraction is reduced. The present invention avoids using complex machine learning algorithms to train the model and selects a threshold-based intrusion detection method. Referring to Table 2, it can be seen that, compared with the comparative solution, the time for feature extraction, model training, and intrusion detection of the present invention is lower than that of the comparative solution.

[0050] Example 4 As Figure 4 shown, the present invention also provides an electronic device 100 for implementing the CAN bus intrusion detection method; The electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0051] The memory 101 can be used to store the computer program 103. The processor 102 realizes the steps of Embodiment 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101.

[0052] The memory 101 mainly includes a program storage area and a data storage area. Among them, the program storage area can store an operating system, application programs required for at least one function (such as a sound playback function, an image playback function, etc.); the data storage area can store data created according to the use of the electronic device 100 (such as audio data, etc.). In addition, the memory 101 can include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a Flash Card, at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices.

[0053] The at least one processor 102 can be a Central Processing Unit (CPU), or can also be other general-purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field-Programmable Gate Arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 102 can be a microprocessor or the processor 102 can also be any conventional processor, etc. The processor 102 is the control center of the electronic device 100 and connects all parts of the entire electronic device 100 through various interfaces and lines.

[0054] The memory 101 in the electronic device 100 stores multiple instructions to implement a CAN bus intrusion detection method. The processor 102 can execute the multiple instructions to thereby implement: S1: Obtain voltage sampling points on the CAN bus, and extract voltage sampling points with identifiers and voltage sampling points of the IDE bit from the voltage sampling points; S2: Convert the voltage sampling points with identifiers into message tags; determine the dominant voltage sampling points from the dominant bits among the voltage sampling points of the IDE bit, calculate the average voltage of the dominant voltage sampling points, and form a sample with the message tag. S3: Compare the sample with a preset threshold, and determine whether an intrusion has occurred according to the comparison result.

[0055] Embodiment 5 If the modules / units integrated in the electronic device 100 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, to implement all or part of the processes in the above method embodiments of the present invention, it can also be completed by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by a processor, the steps of the above method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in the form of source code, object code, executable file or some intermediate form, etc. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory and read-only memory (ROM, Read-Only Memory).

[0056] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, system, or computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0057] The present invention is described with reference to the flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram can be implemented by computer program instructions, and the combination of the processes and / or blocks in the flowchart and / or block diagram can also be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate a device for implementing the specified functions in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0058] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including an instruction device that implements the functions specified in one or more of the procedures Figure 1 or steps and / or Figure 1 boxes or multiple boxes.

[0059] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus, such that a series of operational steps are performed on the computer or other programmable apparatus to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one or more of the procedures Figure 1 or steps and / or Figure 1 boxes or multiple boxes.

[0060] In the description of this specification, the descriptions with reference to the terms "one embodiment", "example", "specific example", etc. mean that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: it is still possible to modify the specific implementation manners of the present invention or make equivalent replacements, and any modification or equivalent replacement that does not depart from the spirit and scope of the present invention shall be covered by the protection scope of the claims of the present invention.

Claims

1. A CAN bus intrusion detection method, characterized in that Including: Obtain voltage sampling points on the CAN bus, and extract the first sampling point and the second sampling point; wherein, the first sampling point is a voltage sampling point with an identifier; The second sampling point is the voltage sampling point of the IDE bit; Convert the first sampling point into a message label; determine the dominant voltage sampling points belonging to the dominant bit from the second sampling points, and calculate the average voltage of the dominant voltage sampling points; Compare the average voltage with a preset threshold, and judge whether there is an intrusion on the CAN bus according to the comparison result; when an intrusion occurs, identify the invaded ECU according to the message label.

2. The CAN bus intrusion detection method according to claim 1, wherein, The voltage sampling points on the CAN bus are differential signals.

3. The CAN bus intrusion detection method according to claim 1, characterized in that The conversion of the first sampling point into a message label is specifically: converting the first sampling point into a digital signal expression form, and using the digital signal expression form as the message label.

4. The CAN bus intrusion detection method according to claim 1, characterized in that The comparison of the average voltage with the preset threshold and the judgment of whether an intrusion occurs according to the comparison result are specifically: If the average voltage is lower than the preset threshold, there is no intrusion on the CAN bus; If the average voltage is not lower than the preset threshold, there is an intrusion on the CAN bus.

5. A CAN bus intrusion detection method according to claim 1, characterized in that, The preset threshold is obtained through the following steps: Obtain voltage sampling points on the CAN bus, and extract a plurality of first sampling points and a plurality of second sampling points from the voltage sampling points; wherein, each first sampling point corresponds to a second sampling point; Convert the first sampling point into a message label; calculate the average voltage of the second sampling points; wherein, each message label corresponds to an average voltage; classify the average voltages according to different types of message labels to obtain a fixed number of average voltages; the fixed number of average voltages and message labels constitute a training sample; Use the following formula to calculate the training sample to obtain the preset threshold: Wherein, is a preset threshold; is the upper quartile of the training samples; is a preset parameter, taking values from 8 to 70; is the lower quartile of the training samples; is the interquartile range.

6. A CAN bus intrusion detection system, characterized in that, Including: An acquisition unit for obtaining voltage sampling points on the CAN bus, and extracting the first sampling point and the second sampling point; wherein, the first sampling point is a voltage sampling point with an identifier; the second sampling point is the voltage sampling point of the IDE bit; A sample unit for converting the first sampling point into a message label; determining the dominant voltage sampling points belonging to the dominant bit from the second sampling points, and calculating the average voltage of the dominant voltage sampling points; An intrusion detection unit for comparing the average voltage with the preset threshold, and judging whether there is an intrusion on the CAN bus according to the comparison result; when an intrusion occurs, identifying the invaded ECU according to the message label.

7. An intrusion detection system for a CAN bus according to claim 6, characterized in that, Inside the intrusion detection unit, the comparison of the average voltage with the preset threshold and the judgment of whether an intrusion occurs according to the comparison result are specifically: If the average voltage is lower than the preset threshold, there is no intrusion on the CAN bus; If the average voltage is not lower than the preset threshold, there is an intrusion on the CAN bus.

8. An intrusion detection system for a CAN bus according to claim 6, characterized in that, Inside the sample unit, the conversion of the first sampling point into a message label is specifically: converting the first sampling point into a digital signal, and using the digital signal as the message label.

9. An electronic device, characterized in that, Including a processor and a memory, the processor is used to execute the computer program stored in the memory to implement the CAN bus intrusion detection method according to any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, and when the at least one instruction is executed by a processor, it implements the CAN bus intrusion detection method described in any one of claims 1 to 5.

Images