CAN bus abnormal flow detection method based on multi-scale and frequency domain characteristics

Abstract

The invention discloses a CAN bus abnormal flow detection method based on multi-scale and frequency domain characteristics, and relates to the technical field of Internet of Vehicles security, and the method comprises the following steps: carrying out the preprocessing of the original message data of a CAN bus, dividing a continuous message sequence according to a preset time window, and constructing a time sequence sample; inputting the time sequence sample into a feature extraction and fusion model, and sequentially executing multi-scale time sequence feature extraction, time sequence correlation modeling and frequency domain feature enhancement processing to obtain feature representation fusing time domain correlation information and frequency domain structure information; and constructing a classification model based on the feature representation, and carrying out anomaly detection and classification on the CAN bus flow. According to the CAN bus abnormal flow detection method based on the multi-scale and frequency domain characteristics, effective fusion of time domain correlation enhancement and frequency domain noise suppression is realized, the detection robustness and accuracy in a complex vehicle-mounted noise environment are improved, and the false alarm rate in the complex vehicle-mounted noise environment is reduced.

Description

Technical Field

[0001] This invention relates to the field of vehicle network security technology, and in particular to a method for detecting abnormal traffic on a CAN bus based on multi-scale and frequency domain characteristics. Background Technology

[0002] With the rapid development of intelligent connected vehicles, the Controller Area Network (CAN) bus has become the core communication network for exchanging critical commands and status information between electronic control units (ECUs) within the vehicle. Originally designed for a closed, trusted in-vehicle environment, the CAN bus lacks effective encryption and authentication mechanisms, making it vulnerable to severe security threats in the context of increasingly interconnected vehicles. Attackers can inject malicious messages into the CAN bus through physical access or remote penetration, enabling attacks such as denial-of-service attacks, function tampering, and even vehicle control, seriously endangering driving safety.

[0003] Traditional CAN bus intrusion detection methods primarily rely on rule-based pattern matching or statistical threshold determination. These methods typically target known attack characteristics or fixed traffic patterns, making them ill-suited to evolving attack methods, especially advanced attacks that are dynamic, intermittent, or deceptive. Furthermore, electromagnetic interference, sensor noise, and natural variations in driving conditions within the vehicle environment can cause legitimate fluctuations in CAN traffic, further increasing the risk of false positives for rule-based or threshold-based methods.

[0004] With the development of machine learning technology, some studies have begun to introduce feature engineering and classification algorithms to achieve anomaly detection. These methods manually extract features such as timing, frequency, and payload from CAN messages and then use models like support vector machines and random forests for classification. However, the design of manually generated features heavily relies on domain knowledge and struggles to fully capture the multi-scale characteristics of attacks over time—for example, short-duration burst attacks and long-duration low-frequency attacks differ significantly in pattern but may share similar instantaneous statistical features, resulting in limited model discriminative ability.

[0005] In recent years, deep learning models have been introduced into the field of CAN bus intrusion detection due to their powerful automatic feature extraction capabilities. Convolutional Neural Networks (CNNs) can extract local spatiotemporal features from raw message sequences, while Recurrent Neural Networks (RNNs) and their variants (such as LSTMs) excel at modeling time dependencies. However, directly deploying these standard deep learning models on resource-constrained automotive embedded platforms faces significant challenges: First, the model parameters and computational complexity are high, making it difficult to meet the stringent requirements of real-time performance and low power consumption in the automotive environment; second, complex automotive noise can easily mask the true attack patterns in the time domain, leading to a decrease in the model's generalization ability; and third, single-scale feature extraction structures are insufficient to simultaneously and effectively capture differentiated attack cycle features.

[0006] To address these challenges, existing technologies have explored various improvement directions: lightweight network architectures (such as depthwise separable convolutions) have been used to reduce the computational burden on models; attention mechanisms have been introduced to enhance key features and suppress noise interference; and frequency domain transformation methods have been attempted to separate noise from attack signals. However, these techniques are often used in isolation or simply chained together, failing to achieve organic integration and a good balance has not yet been reached between the comprehensiveness of feature extraction, model efficiency, and noise robustness.

[0007] Therefore, there is an urgent need in this field for a CAN bus intrusion detection method that can balance detection accuracy, real-time performance, lightweight design, and strong noise immunity to address the security challenges faced by intelligent connected vehicles. In future practical applications, the trained detection model can be flexibly deployed at different levels of the vehicle network according to the computational resource constraints and real-time requirements of the target system. For core security scenarios with high real-time requirements, the lightweight advantage of this model can be leveraged to directly deploy the optimized version in the electronic control unit (ECU) or vehicle gateway, achieving millisecond-level local real-time detection and response. For collaborative security analysis scenarios that require further integration of multi-vehicle and multi-road segment information, the enhanced computing power of edge computing devices or cloud platforms can be relied upon to deploy this model to support large-scale traffic analysis, threat correlation, and policy coordination, thereby improving the overall security protection capabilities of the vehicle network on a larger scale. Summary of the Invention

[0008] The purpose of this invention is to provide a method for detecting abnormal traffic on a CAN bus based on multi-scale and frequency domain characteristics, thereby solving the problems mentioned in the background art.

[0009] To achieve the above objectives, this invention provides a method for detecting abnormal traffic on a CAN bus based on multi-scale and frequency domain characteristics, comprising the following steps: S1. Preprocess the raw CAN bus message data and divide the continuous message sequence according to the preset time window to construct timing samples; S2. Input the time-series samples into the feature extraction and fusion model, and sequentially perform multi-scale time-series feature extraction, time-series correlation modeling and frequency domain feature enhancement processing to obtain a feature representation that integrates time-domain correlation information and frequency domain structure information. S3. Construct a classification model based on the feature representation to perform anomaly detection and classification on CAN bus traffic.

[0010] Preferably, the specific steps of S1 are as follows: S11. Data loading and partitioning: Merge different types of abnormal traffic in the dataset and perform stratified sampling to divide it into training and test sets. S12. Data Encoding and Normalization: Binary bit vector encoding is used for CAN ID, byte splitting and numerical encoding are used for data field, and time intervals are extracted from the timestamp of CAN message. Min-Max normalization is performed on continuous numerical features. S13. Serialization and Windowing: The continuous message sequence is segmented using the sliding time window method to obtain windowed CAN.

[0011] Preferably, the specific steps of S2 are as follows: S21. Multi-scale feature extraction: Preliminary feature extraction is performed through parallel depthwise separable one-dimensional convolution; S22. Multi-scale feature channel dimension splicing: Features at different time scales are fused along the feature channel dimension to form a multi-scale temporal feature representation; S23. Attention Fusion and Feature Fusion: The self-attention features and frequency domain features are fused to obtain the final attention fusion features.

[0012] Preferably, the specific steps of S21 are as follows: S211. Input data definition: Construct a timing feature matrix from the windowed CAN message sequence, where the time step corresponds to the message order and the feature dimension is composed of message encoding information. S212. Preliminary feature extraction: Construct three parallel depthwise separable one-dimensional convolutional branches with different kernel sizes, namely branch 1, branch 2 and branch 3. Each branch performs preliminary feature extraction through depthwise separable one-dimensional convolution. S213, Feature Normalization and Nonlinear Activation: Preliminary Feature Maps of the Three Branch Outputs , , Batch normalization and nonlinear activation are performed separately to enhance the expressive power and nonlinear fitting ability of the features. The specific formulas are as follows: ; Among them, F k Let X be the feature map at the k-th time scale obtained after standardization and nonlinear activation processing, and let X be the input windowed CAN bus traffic feature matrix. For the kth parallel branch, is the depth-separable one-dimensional convolution operation, and BN is the batch normalization operation. S214. Obtain feature maps F1, F2, and F3 for short, medium, and long time scales.

[0013] Preferably, each branch in S212 has corresponding symmetrical padding in the deep convolutional layer, specifically: Branch 1: Kernel size = 3, padding size = 1; Branch 2: Kernel size = 5, padding size = 2; Branch 3: Kernel size = 7, padding size = 3.

[0014] Preferably, step S22 involves concatenating feature maps F1, F2, and F3 along the channel dimension to integrate complete feature information at short, medium, and long scales, while keeping the time step dimension unchanged. The channel numbers of the three feature maps are then superimposed to form a unified multi-scale fusion feature matrix. , The specific formula is as follows: .

[0015] Preferably, the specific steps of S23 are as follows: S231. Use the multi-scale fused feature matrix as the input of the temporal correlation modeling unit to model the global dependency relationship between packets at different time steps and enhance the correlation and aggregation of attack-related packets in the feature space. S232. Perform frequency domain transformation on the features enhanced by time-series correlation to suppress random noise components by utilizing frequency domain characteristics; S233. The temporal correlation features and frequency domain features are fused to obtain the final fused feature representation.

[0016] Preferably, the specific steps of S231 are as follows: S2311, through three sets of independent feature mapping units, The query matrix Q, key matrix K, and value matrix V are mapped to the low-dimensional feature space respectively to construct three types of feature representations to characterize the correlation between time steps, thereby enhancing the structural dependencies between messages; S2312. The scaling dot product attention formula is used to calculate the correlation strength between message features at different time steps. The formula is as follows: ; in, It is a scaling factor that can prevent the gradient vanishing problem caused by excessively large dot product values. This represents the correlation between each time step feature and other time step features; after softmax normalization, it is weighted with the value matrix V to obtain the self-attention features. .

[0017] Preferably, the specific steps of S232 are as follows: S2321. Perform a one-dimensional Discrete Fourier Transform (DFT) along the feature dimension, followed by a one-dimensional Discrete Fourier Transform along the sequence dimension. The specific formula for the Discrete Fourier Transform is as follows: ; in, It is the k-th component in the transformed frequency domain feature sequence, and N is the sequence length in this dimension. It consists of n elements in the time-domain sequence, where n is the time-domain sequence index, k is the frequency-domain sequence index, and j is the imaginary unit; S2322. Discard the imaginary part of the transformation result and retain only the real part. By preserving the stable components in the frequency domain, natural suppression of random high-frequency noise is achieved, thus obtaining the frequency domain features. The FNet feature transformation formula is as follows: ; in, These are optimized features output by FNet. It is a real part operation. It is the discrete Fourier transform along the feature dimension. It is the discrete Fourier transform along the sequence dimension.

[0018] Preferably, the specific steps of S3 are as follows: S31. Classification Model Construction: Fusing Feature Vectors The input is fed into a fully connected neural network. Each neuron in the fully connected neural network receives all the outputs of the previous layer and multiplies them with their respective learnable weights. All the multiplications are then summed up to form a weighted sum. S32. Classification: The output layer of the classifier uses the Sigmoid function, receiving features from the previous hidden layer. The formula for calculating the Sigmoid function is as follows: ; in, The output value after mapping by the Sigmoid function has a range of [0,1], where e is the base of the natural logarithm, and z is the original logical value, generated by a single neuron. S33. Judgment: The system presets an anomaly detection threshold. ; if > The abnormal probability output by the model If the data sample exceeds this threshold, it is considered abnormal traffic. if ≤ The abnormal probability output by the model If the data sample is less than or equal to the threshold, it is considered normal traffic.

[0019] Therefore, the above-mentioned CAN bus abnormal traffic detection method based on multi-scale and frequency domain characteristics, adopted in this invention, has the following beneficial effects: (1) By constructing a message window that covers the entire CAN scheduling cycle, each sample contains both the complete normal scheduling mode and the disturbance behavior of the attack within the scheduling cycle, so that the attack manifests as damage to the scheduling structure rather than just statistical anomalies, thus improving the distinguishability of the abnormal mode.

[0020] (2) By setting feature extraction paths with different time perception ranges, the disturbance characteristics of short-cycle, medium-cycle and long-cycle attacks on the normal scheduling mode can be characterized simultaneously within the same time window, so as to realize the unified modeling of the periodic characteristics of multiple types of attacks.

[0021] (3) By first performing temporal correlation enhancement and then performing frequency domain feature mapping, the attack-related features are represented as stable frequency band components in the frequency domain, while random noise is represented as high-frequency discrete components, thereby achieving natural suppression of random noise in the vehicle environment, significantly improving the detection robustness in complex noise environments and reducing the false alarm rate.

[0022] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0023] Figure 1 This is a framework diagram of an embodiment of the CAN bus abnormal traffic detection method based on multi-scale and frequency domain characteristics according to the present invention; Figure 2 This is a diagram showing the matrix dimension parameters of each module in the network layer of an embodiment of the CAN bus abnormal traffic detection method based on multi-scale and frequency domain characteristics according to the present invention. Detailed Implementation

[0024] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0025] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0026] Example Please see Figures 1-2This invention provides a method for detecting abnormal traffic on a CAN bus based on multi-scale and frequency domain characteristics, comprising the following steps: S1. Data preprocessing and time window division.

[0027] S11, Data Loading and Partitioning.

[0028] S111. Load the raw traffic data of the vehicle-to-everything (V2X) CAN bus, and merge different types of abnormal traffic in the dataset into a unified category of "abnormal traffic". All messages are clearly marked as "normal traffic" or "abnormal traffic" according to their nature, and a binary classification labeling system is constructed for subsequent supervised learning.

[0029] S112. Stratified sampling and partitioning of the entire dataset. This invention employs stratified sampling to partition the dataset. This method ensures that the ratio of normal to abnormal traffic in the training and test sets remains consistent with the original dataset. Ultimately, 80% of the data is used as the training set, and 20% as the test set, for model training and performance evaluation.

[0030] S12, Data Encoding and Normalization: S121. Given the discrete and classifiable nature of CAN ID, binary bit vector encoding is used for CAN ID, directly converting the hexadecimal ID into the corresponding binary bit vector; for the data field, byte splitting + numerical encoding is used, splitting the 8-byte data field into 8 independent numerical features, with each byte corresponding to an integer from 0 to 255.

[0031] S122. To effectively capture the dynamic behavior and timing patterns of attacks in CAN traffic, the Inter-Arrival Time (IAT) is extracted from the original message timestamps as a key timing feature. Let the timestamp of the i-th message be... Then its time interval The calculation formula is as follows: ; S123. For continuous numerical features in CAN messages (such as timestamps, numerical information extracted from data fields, etc.), this invention uses Min-Max normalization. This method linearly scales all numerical features to a uniform interval of [0,1]. The normalization formula is as follows: ; Where X is the original value. and These are the minimum and maximum values ​​of the feature in the entire training dataset, respectively. Normalization effectively eliminates the impact of feature scale differences on model training stability and convergence speed.

[0032] S13. Serialization and Windowing: The sliding time window segmentation method is used to capture the dynamic characteristics of CAN traffic and the context information of attacks. Each fixed-length window is considered an independent sample, containing 100 consecutive CAN messages. Each CAN message includes an encoded CAN ID, timing characteristics, and a data payload. The sliding step size S of the window is adjustable to control the overlap between samples. If a specific abnormal message is included, the window is marked as belonging to that specific abnormal type; otherwise, it is marked as "normal traffic".

[0033] S1 is used to preprocess datasets with different feature types and adjust them to a format suitable for input into the model.

[0034] S2. Based on the partitioned training set, perform multi-scale feature extraction and frequency domain attention fusion to obtain the weighted fused features of the input sequence. This involves training a neural network with a fixed-length sequence matrix to extract features from similar traffic data, including the following steps: S21. Multi-scale feature extraction: S211. Input data definition: Construct a timing feature matrix from the windowed CAN message sequence obtained in step C of S1, where the time step corresponds to the message order and the feature dimension is composed of message encoding information. S212. Construct three parallel depthwise separable one-dimensional convolutional branches (denoted as branch 1, branch 2, and branch 3) with identical structures but different kernel sizes. Each branch performs preliminary feature extraction through depthwise separable one-dimensional convolution. To maintain the output sequence length consistent with the input (100), each branch sets corresponding symmetrical padding in the depthwise convolutional layer: Branch 1: kernel size = 3, padding size = 1; Branch 2: kernel size = 5, padding size = 2; Branch 3: kernel size = 7, padding size = 3.

[0035] Taking branch 1 as an example, the input feature matrix X is input into a depth-separable one-dimensional convolutional layer of branch 1. This convolutional layer uses a one-dimensional convolutional kernel of size 3, padded with 1s, and finally obtains the preliminary feature map of branch 1. The remaining branch operations are similar, ultimately yielding a preliminary feature map. , .

[0036] S213, Feature normalization and nonlinear activation, preliminary feature maps output from the above three branches. , , Batch normalization and nonlinear activation are performed separately to enhance the expressive power and nonlinear fitting ability of the features, as shown in the following formula: ; Finally, feature maps at short, medium, and long time scales were obtained. , , .

[0037] S22, Multi-scale feature channel dimension splicing.

[0038] feature map , , The feature maps are concatenated along the channel dimension, integrating complete feature information at short, medium, and long scales while keeping the time step dimension constant. The channel counts of the three feature maps are then superimposed to form a unified multi-scale fusion feature matrix. The formula is: ; S23. Attention fusion and frequency domain feature enhancement processing: S231, will As input to the self-attention layer, it models global dependencies between time steps. Specifically, the multi-scale fused features are projected using three independent linear mapping units (excluding bias terms) to map the original features to a feature space with a dimension lower than the original channel dimension, generating query feature Q, key feature K, and value feature V, respectively. Subsequently, the scaling dot product attention formula is used to calculate the correlation strength between features, as follows: ; in, It is a scaling factor that can prevent the gradient vanishing problem caused by excessively large dot product values. This represents the correlation between each time step feature and other time step features; after softmax normalization, it is weighted with the value matrix V to obtain the self-attention features. This process reinforces key timing patterns associated with attacks, such as local correlations between dense packets in short burst attacks, or persistent dependencies in long-term flood attacks.

[0039] S232. To suppress environmental noise and enhance the perception of periodic and global frequency domain patterns, self-attention features are used. Perform a frequency domain transformation. First, perform a one-dimensional Discrete Fourier Transform (DFT) along the feature dimension, followed by a one-dimensional Discrete Fourier Transform along the sequence dimension. The general formula for the Discrete Fourier Transform along either dimension is expressed as: ; in, It is the k-th component in the transformed frequency domain feature sequence, and N is the sequence length in this dimension. These are n elements in a time-domain sequence, where n is the time-domain sequence index, k is the frequency-domain sequence index, and j is the imaginary unit. To reduce computational complexity and retain key spectral information, the imaginary part of the transformation result is discarded, and only the real part is retained, yielding the frequency-domain features. The FNet feature transformation formula is as follows: ; in, These are optimized features output by FNet. It is a real part operation. It is the discrete Fourier transform along the feature dimension. It is a discrete Fourier transform along the sequence dimension. Through this transform, the attention-weighted time-domain features are mapped to the frequency domain, enabling the model to analyze global characteristics of the signal, such as periodicity and stability, in the frequency domain. This helps to effectively separate low-frequency or specific frequency band components induced by attacks from high-frequency random noise in the vehicle environment, thereby enhancing the robustness of the model in complex electromagnetic interference environments.

[0040] S233, Feature weighted fusion, combining self-attention features Frequency domain characteristics of FNet Perform feature fusion to obtain the final fused feature. The formula is: ; in, It is an element-level addition method that retains the key temporal correlations captured by self-attention and incorporates frequency domain noise reduction features, achieving dual optimization of "temporal correlation enhancement" and "frequency domain noise robustness".

[0041] S3. Based on the fusion features obtained in S2, a classifier is constructed and trained to classify anomalies in CAN bus traffic.

[0042] S31. Classification Model Construction: After S2, a global feature representation of the entire time series can be obtained, with the value in each dimension reflecting the importance of a specific feature channel in the entire sequence. Then, a classifier is trained for attack detection of CAN bus traffic.

[0043] The fusion feature vector generated in S2 The input is fed into a fully connected neural network. Each neuron receives all the outputs of the previous layer, multiplies them by their corresponding learnable weights, and then sums all the multiplications to form a weighted sum, as shown in the following formula: ; in, Indicates the first The first layer The weighted sum of inputs to each neuron, Indicates the first The number of neurons in the layer, Indicates the connection of the first The first layer The first neuron to the second The first layer The weights of each neuron, Indicates the first The first layer ReLU activation output of 1 neuron Indicates the first The first layer The bias terms of each neuron. Through the above layer-by-layer calculation, the fully connected layer can learn and extract more abstract and discriminative high-level patterns from the fused feature vector, thereby mapping complex input features to a classifiable representation.

[0044] S32. Classification: Input the feature representation into a fully connected classifier, output the abnormal probability through the Sigmoid function, and determine whether the traffic is normal or abnormal based on a preset threshold.

[0045] The classifier's output layer uses the Sigmoid function and receives features from the previous hidden layer (these features are formed by fusing feature vectors). (Originated through multiple nonlinear transformations), and then generated into an original logical value through a single neuron. This logical value It is obtained by summing the output of the previous layer with the learnable weights and adding the bias term: ; in, It is the first hidden layer of the classifier. The activation output of each neuron These are the weights connecting the neuron to the output neuron. It is the bias term of the output neuron. This is the number of neurons in the last hidden layer. Then, this logical value... Will pass Function transformation, mapping to a probability value This probability value This indicates the probability that the current CAN message sequence belongs to abnormal traffic, and its value ranges from [0,1]. The formula for calculating the function is as follows: ; The system presets an anomaly detection threshold. =0.5. If the model outputs anomaly probability Greater than this threshold (i.e.) > If the model outputs an abnormal probability, then the data sample is considered abnormal traffic. Less than or equal to this threshold (i.e. ≤ If the data sample is normal traffic, then the data sample is determined to be normal traffic.

[0046] Therefore, this invention employs the aforementioned CAN bus abnormal traffic detection method based on multi-scale and frequency domain features. By using multi-scale depthwise separable convolution to capture attack patterns of different periods with extremely low parameter counts, and combining self-attention mechanism and Fourier transform, it achieves an effective fusion of temporal correlation enhancement and frequency domain noise suppression, significantly improving the detection robustness and accuracy in complex vehicle noise environments and reducing the false alarm rate in such environments. Furthermore, the lightweight network structure and parallel computing characteristics ensure the system's high real-time response capability and operational reliability on real vehicle embedded platforms.

[0047] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A CAN bus abnormal traffic detection method based on multi-scale and frequency domain features, characterized in that, Includes the following steps: S1. Preprocess the raw CAN bus message data and divide the continuous message sequence according to the preset time window to construct timing samples; S2. Input the time-series samples into the feature extraction and fusion model, and sequentially perform multi-scale time-series feature extraction, time-series correlation modeling and frequency domain feature enhancement processing to obtain a feature representation that integrates time-domain correlation information and frequency domain structure information. S3. Construct a classification model based on the feature representation to perform anomaly detection and classification on CAN bus traffic.

2. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain features according to claim 1, characterized in that, The specific steps of S1 are as follows: S11. Data loading and partitioning: Merge different types of abnormal traffic in the dataset and perform stratified sampling to divide it into training and test sets. S12. Data Encoding and Normalization: Binary bit vector encoding is used for CAN ID, byte splitting and numerical encoding are used for data field, and time intervals are extracted from the timestamp of CAN message. Min-Max normalization is performed on continuous numerical features. S13. Serialization and Windowing: The continuous message sequence is segmented using the sliding time window method to obtain windowed CAN.

3. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain features according to claim 1, characterized in that, The specific steps of S2 are as follows: S21. Multi-scale feature extraction: Preliminary feature extraction is performed through parallel depthwise separable one-dimensional convolution; S22. Multi-scale feature channel dimension splicing: Features at different time scales are fused along the feature channel dimension to form a multi-scale temporal feature representation; S23. Attention Fusion and Feature Fusion: The self-attention features and frequency domain features are fused to obtain the final attention fusion features.

4. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain features according to claim 3, characterized in that, The specific steps of S21 are as follows: S211. Input data definition: Construct a timing feature matrix from the windowed CAN message sequence, where the time step corresponds to the message order and the feature dimension is composed of message encoding information. S212. Preliminary feature extraction: Construct three parallel depthwise separable one-dimensional convolutional branches with different kernel sizes, namely branch 1, branch 2 and branch 3. Each branch performs preliminary feature extraction through depthwise separable one-dimensional convolution. S213, Feature Normalization and Nonlinear Activation: Preliminary Feature Maps of the Three Branch Outputs , , Batch normalization and nonlinear activation are performed separately to enhance the expressive power and nonlinear fitting ability of the features. The specific formulas are as follows: ； Among them, F k Let X be the feature map at the k-th time scale obtained after standardization and nonlinear activation processing, and let X be the input windowed CAN bus traffic feature matrix. For the kth parallel branch, is the depth-separable one-dimensional convolution operation, and BN is the batch normalization operation. S214. Obtain feature maps F1, F2, and F3 for short, medium, and long time scales.

5. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain features according to claim 4, characterized in that, Each branch in S212 has corresponding symmetrical padding in the deep convolutional layer, specifically: Branch 1: Kernel size = 3, padding size = 1; Branch 2: Kernel size = 5, padding size = 2; Branch 3: Kernel size = 7, padding size = 3.

6. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain characteristics according to claim 4, characterized in that, S22 integrates complete feature information at short, medium, and long scales by concatenating feature maps F1, F2, and F3 along the channel dimension, while keeping the time step dimension unchanged, and superimposing the channel numbers of the three feature maps to form a unified multi-scale fusion feature matrix. , The specific formula is as follows: 。 7. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain features according to claim 6, characterized in that, The specific steps of S23 are as follows: S231. Use the multi-scale fused feature matrix as the input of the temporal correlation modeling unit to model the global dependency relationship between packets at different time steps and enhance the correlation and aggregation of attack-related packets in the feature space. S232. Perform frequency domain transformation on the features enhanced by time-series correlation to suppress random noise components by utilizing frequency domain characteristics; S233. The temporal correlation features and frequency domain features are fused to obtain the final fused feature representation.

8. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain features according to claim 7, characterized in that, The specific steps of S231 are as follows: S2311, through three sets of independent feature mapping units, The query matrix Q, key matrix K, and value matrix V are mapped to the low-dimensional feature space respectively to construct three types of feature representations to characterize the correlation between time steps, thereby enhancing the structural dependencies between messages; S2312. The scaling dot product attention formula is used to calculate the correlation strength between message features at different time steps. The formula is as follows: ； in, It is a scaling factor that can prevent the gradient vanishing problem caused by excessively large dot product values. This indicates the correlation between each time step feature and other time step features; After softmax normalization, the value matrix V is weighted to obtain the self-attention feature .

9. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain features according to claim 8, characterized in that, The specific steps of S232 are as follows: S2321. Perform a one-dimensional Discrete Fourier Transform (DFT) along the feature dimension, followed by a one-dimensional Discrete Fourier Transform along the sequence dimension. The specific formula for the Discrete Fourier Transform is as follows: ； in, It is the k-th component in the transformed frequency domain feature sequence, and N is the sequence length in this dimension. It consists of n elements in the time-domain sequence, where n is the time-domain sequence index, k is the frequency-domain sequence index, and j is the imaginary unit; S2322. Discard the imaginary part of the transformation result and retain only the real part. By preserving the stable components in the frequency domain, natural suppression of random high-frequency noise is achieved, thus obtaining the frequency domain features. The FNet feature transformation formula is as follows: ； wherein, is an optimized feature output by the FNet, is a take real operation, is a discrete Fourier transform along the feature dimension, is a discrete Fourier transform along the sequence dimension.

10. The CAN bus abnormal traffic detection method based on multi-scale and frequency domain characteristics according to claim 9, characterized in that, The specific steps of S3 are as follows: S31. Classification Model Construction: Fusing Feature Vectors The input is fed into a fully connected neural network. Each neuron in the fully connected neural network receives all the outputs of the previous layer and multiplies them with their respective learnable weights. All the multiplications are then summed up to form a weighted sum. S32. Classification: The output layer of the classifier uses the Sigmoid function, receiving features from the previous hidden layer. The formula for calculating the Sigmoid function is as follows: ； wherein, is the output value mapped by the Sigmoid function, the value range is [0, 1], e is the base of natural logarithm, z is the original logic value, and is generated by a single neuron; S33, judging: the system presets an abnormality detection threshold ; if > The abnormal probability output by the model If the data sample exceeds this threshold, it is considered abnormal traffic. if ≤ The abnormal probability output by the model If the data sample is less than or equal to the threshold, it is considered normal traffic.

Images