CAN abnormal intrusion detection method and computer-readable storage medium

Abstract

The present invention discloses a CAN abnormal intrusion detection method and computer-readable storage medium. The method includes: collecting CAN messages of vehicles that have not been attacked under different traffic conditions to obtain a sample data set; dividing the sample data set into a training data set and a verification data set according to a preset ratio; generating a migration matrix to be verified based on the CAN IDs of two CAN messages collected at adjacent times in the training data set; verifying the migration matrix to be verified based on the verification data set; if the verification is passed, performing CAN abnormal intrusion detection based on the migration matrix. The detection algorithm based on the migration matrix of the present invention has extremely low latency and can accurately detect CAN abnormal intrusions, which can well meet the requirements of the in-vehicle detection environment.

Description

Technical Field

[0001] The present invention relates to the field of CAN security technology, and in particular to a CAN abnormal intrusion detection method and a computer-readable storage medium. Background Art

[0002] As intelligent transportation is increasingly being proposed and implemented in various countries, more and more cars will become nodes in this intelligentization. However, this also brings security threats, necessitating in-vehicle network topologies with corresponding security mechanisms to detect and mitigate potential security threats. Traditional detection algorithms based on complex statistical models are not suitable for the current automotive sector due to the limited processing power of automotive ECUs and the high real-time requirements. Therefore, it is necessary to customize unique detection algorithms based on the existing in-vehicle network topology to meet the processing power and real-time requirements of in-vehicle hardware. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a CAN abnormal intrusion detection method and a computer-readable storage medium, which can accurately detect CAN abnormal intrusion and ensure real-time performance.

[0004] In order to solve the above technical problems, the technical solution adopted by the present invention is: a CAN abnormal intrusion detection method, comprising:

[0005] Collect CAN messages from vehicles that have not been attacked under different traffic conditions to obtain a sample data set;

[0006] Dividing the sample data set into a training data set and a validation data set according to a preset ratio;

[0007] Generate a migration matrix to be verified according to the CAN IDs of two CAN messages collected at adjacent times in the training data set;

[0008] Verifying the migration matrix to be verified according to the verification data set;

[0009] If the verification is successful, CAN abnormal intrusion detection is performed according to the migration matrix.

[0010] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which implements the above steps when the program is executed by a processor.

[0011] The beneficial effects of the present invention are as follows: by collecting CAN messages under normal conditions and analyzing the changes in the CAN IDs of these CAN messages to identify patterns, a migration matrix is ​​generated. Subsequently, by determining whether the changes in the CAN IDs of CAN messages generated during actual driving are consistent with the migration matrix, the presence of abnormal intrusions is determined; by verifying the migration matrix before detection, the reliability of the generated migration matrix is ​​ensured, thereby ensuring the accuracy of subsequent abnormality detection. The detection algorithm based on the migration matrix of the present invention has extremely low latency and can accurately detect abnormal CAN intrusions, which can well meet the requirements of in-vehicle detection environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 This is a flow chart of a CAN abnormal intrusion detection method of the present invention;

[0013] Figure 2 This is a flow chart of a method according to embodiment 1 of the present invention;

[0014] Figure 3 Schematic diagram of an n-order matrix after initialization in the first embodiment of the present invention;

[0015] Figure 4 Schematic diagram of modification of the n-order matrix in the first embodiment of the present invention;

[0016] Figure 5 Schematic diagram of the migration matrix in the first embodiment of the present invention. DETAILED DESCRIPTION

[0017] To illustrate the technical content, achieved objectives and effects of the present invention in detail, the following is a detailed description in conjunction with the embodiments and accompanying drawings.

[0018] The key concept of the present invention is to generate a migration matrix by analyzing the migration of the CAN ID sequence of the legal CAN message; after the migration matrix is ​​verified, abnormal intrusion detection is performed based on the migration matrix.

[0019] See also Figure 1 , a CAN abnormal intrusion detection method, comprising:

[0020] Collect CAN messages from vehicles that have not been attacked under different traffic conditions to obtain a sample data set;

[0021] Dividing the sample data set into a training data set and a validation data set according to a preset ratio;

[0022] Generate a migration matrix to be verified according to the CAN IDs of two CAN messages collected at adjacent times in the training data set;

[0023] Verifying the migration matrix to be verified according to the verification data set;

[0024] If the verification is successful, CAN abnormal intrusion detection is performed according to the migration matrix.

[0025] From the above description, it can be seen that the beneficial effects of the present invention are: it can accurately detect CAN abnormal intrusion and ensure real-time

[0026] Furthermore, the generation of the transition matrix to be verified according to the CAN IDs of two CAN messages collected at adjacent times in the training data set is specifically as follows:

[0027] Constructing an n-order matrix, and initializing all values ​​in the n-order matrix to a preset first value, where n is the number of CAN IDs in the CAN network of the vehicle;

[0028] Sort the CAN IDs of the CAN messages in the training data set according to the collection time sequence of the CAN messages to obtain a first ID sequence;

[0029] Traverse the first ID sequence in order;

[0030] According to the current CAN ID and the next CAN ID, the value of the corresponding position in the n-order matrix is ​​set to a preset second value, and the row of the corresponding position is the row corresponding to the current CAN ID and the column is the column corresponding to the next CAN ID;

[0031] After traversing the first ID sequence, a migration matrix to be verified is obtained.

[0032] From the above description, we can see that by analyzing the changes in the CAN ID of legitimate data, an ID sequence migration model is constructed.

[0033] Furthermore, the verifying of the migration matrix to be verified based on the verification data set is specifically as follows:

[0034] Sort the CAN IDs of the CAN messages in the verification data set according to the collection time sequence of the CAN messages to obtain a second ID sequence;

[0035] Traverse the second ID sequence in order;

[0036] Determining whether the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are the second values;

[0037] If not, the number of false alarms is accumulated once, and the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are corrected to the second value, and the initial value of the number of false alarms is zero;

[0038] After traversing the second ID sequence, if the number of false positives is zero, the verification is determined to be successful; otherwise, the verification is determined to be unsuccessful.

[0039] From the above description, it can be seen that by verifying the migration matrix, the reliability of the generated migration matrix is ​​guaranteed, thereby ensuring the accuracy of subsequent anomaly detection.

[0040] Furthermore, after verifying the migration matrix to be verified based on the verification data set, the method further includes:

[0041] If the verification fails, a new verification data set is obtained and the number of false positives is cleared;

[0042] The corrected migration matrix is ​​validated based on the new validation dataset.

[0043] As can be seen from the above description, by repeatedly verifying and correcting the migration matrix until the verification is passed, the reliability of the migration matrix is ​​further guaranteed.

[0044] Furthermore, the CAN abnormal intrusion detection according to the migration matrix is ​​specifically performed as follows:

[0045] Real-time collection of CAN messages generated by vehicles during driving;

[0046] Determining whether a value at a position in the migration matrix corresponding to the CAN ID in the last collected CAN message and the CAN ID in the currently collected CAN message is the second value;

[0047] If not, it is determined that there is an abnormal intrusion.

[0048] From the above description, it can be seen that converting anomaly detection into confirmation of values ​​in the migration matrix reduces the requirements for the hardware processing capabilities in the vehicle and can detect CAN anomaly intrusions in real time and accurately.

[0049] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which implements the above steps when the program is executed by a processor.

[0050] Example 1

[0051] Please refer to Figure 2-5The first embodiment of the present invention is: a CAN abnormal intrusion detection method, which can be applied to the automotive field. The CAN ID of the in-vehicle CAN network is unique, and the different CAN ID types are also limited. Through testing, it was found that the migration of different CAN ID sequences in the in-vehicle CAN network has some fixed rules (that is, the changes of two adjacent CAN IDs are regular), that is, the migration of CAN ID sequences is only allowed within a fixed subset range. This method implements CAN abnormal intrusion detection based on this principle.

[0052] This embodiment mainly includes five stages: data collection, data division, training, verification and detection. Figure 2 As shown, the method includes the following steps:

[0053] S1: Collect CAN messages from unattacked vehicles under different traffic conditions to obtain a sample dataset. This step, known as the data collection phase, involves collecting driving data from unattacked vehicles under different traffic conditions. The more data collected, the more accurate the subsequent migration matrix. Preferably, over 100 million CAN messages can be collected, from which 80 million consecutive CAN messages are randomly intercepted as the sample dataset.

[0054] S2: Divide the sample data set into a training data set and a validation data set according to a preset ratio. This step is the data division stage. Preferably, the first 20% of CAN messages in the sample data set are used as the training data set, and the last 80% of CAN messages are used as the validation data set.

[0055] S3: Generate a migration matrix to be verified based on the CAN IDs of two CAN messages collected at adjacent times in the training data set. This step is the training phase.

[0056] Specifically, the steps include:

[0057] S301: Construct an n-order matrix, that is, an n×n square matrix, where n is the number of all unique CAN IDs in the CAN network of the vehicle, and the rows of the matrix are used to represent the CAN ID of the previous CAN message, and the columns are used to represent the CAN ID of the current CAN message.

[0058] S302: Initialize all values ​​in the n-order matrix to a preset first value, for example, to false. The initialized matrix is ​​as follows: Figure 3 shown.

[0059] S303: Sort the CAN IDs of the CAN messages in the training data set according to the time sequence of the CAN messages to obtain a first ID sequence; that is, obtain the ID sequence of the training data set on the time trajectory.

[0060] S304: traverse the first ID sequence, that is, sequentially obtain a CAN ID from the first ID sequence as the current CAN ID.

[0061] S305: According to the current CAN ID and its adjacent next CAN ID, the value of the corresponding position in the n-order matrix is ​​set to a preset second value, that is, the value of the position where the row in the n-order matrix corresponds to the current CAN ID and the column is the column corresponding to the next CAN ID is set to the second value; preferably, the second value is true.

[0062] S306: Determine whether the first ID sequence has been traversed. If so, execute step S307. If not, continue to traverse the first ID sequence, that is, obtain the next CAN ID as the current CAN ID, and return to execute step S304.

[0063] S307: The current n-order matrix is ​​used as the migration matrix to be verified. That is, after traversing the first ID sequence, the migration matrix to be verified can be obtained.

[0064] For example, assuming that the CAN ID of the current CAN message is i and the CAN ID of the CAN message immediately following it is j, then in the n-order matrix, the value of the i-th row and j-th column is set to true, such as Figure 4 After traversing the training data set, we can get an n-order matrix consisting of true or false values, as shown in Figure 5 As shown in Figure 1, this is the migration matrix to be verified.

[0065] S4: Verify the transfer matrix based on the validation dataset to determine if it passes. If so, proceed to step S6; if not, proceed to step S5. This step, the validation phase, primarily confirms that the trained transfer matrix is ​​sufficiently complete and does not generate any false positives. During initial validation, this step verifies the transfer matrix to be validated; during revalidation, this step verifies the corrected transfer matrix.

[0066] Specifically, the steps include:

[0067] S401: Sort the CAN IDs of the CAN messages in the verification data set according to the collection time sequence of the CAN messages to obtain a second ID sequence; that is, obtain the ID sequence of the verification data set on the time trajectory.

[0068] S402: traverse the second ID sequence, that is, sequentially obtain a CAN ID from the second ID sequence as the current CAN ID.

[0069] S403: Determine whether the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are the second values. If so, execute step S405; if not, execute step S404.

[0070] S404: Accumulate the number of false positives once, i.e., set m = m + 1, where the initial value of m is 0, and correct the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified to the second values. That is, the values ​​of the positions in the migration matrix to be verified where the row corresponds to the current CAN ID and the column corresponds to the next CAN ID are corrected from the first value to the second value. Then, execute step S405.

[0071] S405: Determine whether the second ID sequence has been traversed. If so, execute step S406. If not, continue to traverse the second ID sequence, that is, obtain the next CAN ID as the current CAN ID, and return to execute step S402.

[0072] S406: Determine whether the number of false alarms is zero, that is, whether m=0 holds. If so, determine that the verification is passed and execute step S6. If not, determine that the verification is failed and execute step S5.

[0073] That is, after the verification phase, the cumulative number of false positives must be 0. This is because even a small number of false positives can still produce an unacceptable false positive rate in actual driving.

[0074] S5: Obtain a new validation dataset and reset the false positive count, setting m = 0. Then, verify the corrected migration matrix using the new validation dataset, executing step S4. If verification fails, collect CAN messages from unattacked vehicles under different traffic conditions to obtain a new validation dataset. Alternatively, randomly extract a segment of CAN messages from the over 100 million CAN messages collected in step S1 as a new validation dataset. Verify the corrected migration matrix from step S4 using the new validation dataset until verification passes.

[0075] S6: Perform CAN abnormal intrusion detection based on the migration matrix. This step is the detection stage.

[0076] After completing the above stages, a complete migration matrix is ​​obtained, which means that the migration of CAN ID sequences under different driving conditions can be clearly observed. In the detection stage, the CAN ID sequences of CAN messages generated during actual driving are observed and detected based on the migration matrix generated in the above steps.

[0077] Specifically, CAN messages generated by the vehicle during driving are collected in real time; then, it is determined in real time whether the value of the position corresponding to the CAN ID in the last collected CAN message and the CAN ID in the currently collected CAN message in the migration matrix is ​​the second value. For example, assuming that the CAN ID in the last collected CAN message is i and the CAN ID in the currently collected CAN message is j, it is determined whether the value of the i-th row and j-th column in the migration matrix is ​​true. If so, it is determined that the CAN is normal. If not, that is, the value of the i-th row and j-th column is false, it is determined that there is an abnormal intrusion in the CAN.

[0078] This embodiment collects normal CAN messages and analyzes the changes in the CAN IDs of these legitimate CAN messages to identify patterns and generate a migration matrix. Subsequently, the presence of abnormal intrusions is determined by determining whether the changes in the CAN IDs of CAN messages generated during actual driving are consistent with the migration matrix. Verifying the migration matrix before detection ensures the reliability of the generated migration matrix, thereby ensuring the accuracy of subsequent abnormality detection. The detection algorithm based on the migration matrix has extremely low latency while accurately detecting abnormal CAN intrusions, effectively meeting the requirements of in-vehicle detection environments.

[0079] Example 2

[0080] This embodiment is a computer-readable storage medium corresponding to the above embodiment, on which a computer program is stored. When the program is executed by a processor, the following steps are implemented:

[0081] Collect CAN messages from vehicles that have not been attacked under different traffic conditions to obtain a sample data set;

[0082] Dividing the sample data set into a training data set and a validation data set according to a preset ratio;

[0083] Generate a migration matrix to be verified according to the CAN IDs of two CAN messages collected at adjacent times in the training data set;

[0084] Verifying the migration matrix to be verified according to the verification data set;

[0085] If the verification is successful, CAN abnormal intrusion detection is performed according to the migration matrix.

[0086] Furthermore, the generation of the transition matrix to be verified according to the CAN IDs of two CAN messages collected at adjacent times in the training data set is specifically as follows:

[0087] Constructing an n-order matrix, and initializing all values ​​in the n-order matrix to a preset first value, where n is the number of CAN IDs in the CAN network of the vehicle;

[0088] Sort the CAN IDs of the CAN messages in the training data set according to the collection time sequence of the CAN messages to obtain a first ID sequence;

[0089] Traverse the first ID sequence in order;

[0090] According to the current CAN ID and the next CAN ID, the value of the corresponding position in the n-order matrix is ​​set to a preset second value, and the row of the corresponding position is the row corresponding to the current CAN ID and the column is the column corresponding to the next CAN ID;

[0091] After traversing the first ID sequence, a migration matrix to be verified is obtained.

[0092] Furthermore, the verifying of the migration matrix to be verified based on the verification data set is specifically as follows:

[0093] Sort the CAN IDs of the CAN messages in the verification data set according to the collection time sequence of the CAN messages to obtain a second ID sequence;

[0094] Traverse the second ID sequence in order;

[0095] Determining whether the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are the second values;

[0096] If not, the number of false alarms is accumulated once, and the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are corrected to the second value, and the initial value of the number of false alarms is zero;

[0097] After traversing the second ID sequence, if the number of false positives is zero, the verification is determined to be successful; otherwise, the verification is determined to be unsuccessful.

[0098] Furthermore, after verifying the migration matrix to be verified based on the verification data set, the method further includes:

[0099] If the verification fails, a new verification data set is obtained and the number of false positives is cleared;

[0100] The corrected migration matrix is ​​validated based on the new validation dataset.

[0101] Furthermore, the CAN abnormal intrusion detection according to the migration matrix is ​​specifically performed as follows:

[0102] Real-time collection of CAN messages generated by vehicles during driving;

[0103] Determining whether a value at a position in the migration matrix corresponding to the CAN ID in the last collected CAN message and the CAN ID in the currently collected CAN message is the second value;

[0104] If not, it is determined that there is an abnormal intrusion.

[0105] In summary, the present invention provides a CAN abnormal intrusion detection method and computer-readable storage medium. By collecting CAN messages under normal circumstances and analyzing the changes in the CAN IDs of these legal CAN messages, finding their patterns, and generating a migration matrix, the present invention then determines whether an abnormal intrusion has occurred by judging whether the changes in the CAN IDs of the CAN messages generated during actual driving are consistent with the migration matrix. By verifying the migration matrix before detection, the reliability of the generated migration matrix is ​​guaranteed, thereby ensuring the accuracy of subsequent abnormality detection. The detection algorithm based on the migration matrix of the present invention has extremely low latency, while being able to accurately detect abnormal CAN intrusions, and can well meet the requirements of the in-vehicle detection environment.

[0106] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's description and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A CAN abnormal intrusion detection method, characterized in that: include: Collect CAN messages from vehicles that have not been attacked under different traffic conditions to obtain a sample data set; Dividing the sample data set into a training data set and a validation data set according to a preset ratio; Generate a migration matrix to be verified according to the CAN IDs of two CAN messages collected at adjacent times in the training data set; Verifying the migration matrix to be verified according to the verification data set; If the verification is successful, CAN abnormal intrusion detection is performed according to the migration matrix; The generation of the migration matrix to be verified according to the CAN IDs of two CAN messages collected at adjacent times in the training data set is specifically as follows: Constructing an n-order matrix, and initializing all values ​​in the n-order matrix to a preset first value, where n is the number of CAN IDs in the CAN network of the vehicle, the rows of the matrix are used to represent the CAN ID of the previous CAN message, and the columns are used to represent the CAN ID of the current CAN message; Sort the CAN IDs of the CAN messages in the training data set according to the collection time sequence of the CAN messages to obtain a first ID sequence; Traverse the first ID sequence in order; According to the current CAN ID and the next CAN ID, the value of the corresponding position in the n-order matrix is ​​set to a preset second value, and the row of the corresponding position is the row corresponding to the current CAN ID and the column is the column corresponding to the next CAN ID; After traversing the first ID sequence, a migration matrix to be verified is obtained.

2. The CAN abnormal intrusion detection method according to claim 1, characterized in that: The verifying of the migration matrix to be verified according to the verification data set is specifically as follows: Sort the CAN IDs of the CAN messages in the verification data set according to the collection time sequence of the CAN messages to obtain a second ID sequence; Traverse the second ID sequence in order; Determining whether the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are the second values; If not, the number of false alarms is accumulated once, and the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are corrected to the second value, and the initial value of the number of false alarms is zero; After traversing the second ID sequence, if the number of false positives is zero, the verification is determined to be successful; otherwise, the verification is determined to be unsuccessful.

3. The CAN abnormal intrusion detection method according to claim 2, characterized in that: After verifying the migration matrix to be verified based on the verification data set, the method further includes: If the verification fails, a new verification data set is obtained and the number of false positives is cleared; The corrected migration matrix is ​​validated based on the new validation dataset.

4. The CAN abnormal intrusion detection method according to claim 1, characterized in that: The specific steps of performing CAN abnormal intrusion detection according to the migration matrix are as follows: Real-time collection of CAN messages generated by vehicles during driving; Determining whether a value at a position in the migration matrix corresponding to the CAN ID in the last collected CAN message and the CAN ID in the currently collected CAN message is the second value; If not, it is determined that there is an abnormal intrusion.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by the processor, the following steps are implemented: Collect CAN messages from vehicles that have not been attacked under different traffic conditions to obtain a sample data set; Dividing the sample data set into a training data set and a validation data set according to a preset ratio; Generate a migration matrix to be verified according to the CAN IDs of two CAN messages collected at adjacent times in the training data set; Verifying the migration matrix to be verified according to the verification data set; If the verification is successful, CAN abnormal intrusion detection is performed according to the migration matrix; The generation of the migration matrix to be verified according to the CAN IDs of two CAN messages with adjacent acquisition times in the training data set is specifically as follows: Constructing an n-order matrix, and initializing all values ​​in the n-order matrix to a preset first value, where n is the number of CAN IDs in the CAN network of the vehicle, the rows of the matrix are used to represent the CAN ID of the previous CAN message, and the columns are used to represent the CAN ID of the current CAN message; Sort the CAN IDs of the CAN messages in the training data set according to the collection time sequence of the CAN messages to obtain a first ID sequence; Traverse the first ID sequence in order; According to the current CAN ID and the next CAN ID, the value of the corresponding position in the n-order matrix is ​​set to a preset second value, and the row of the corresponding position is the row corresponding to the current CAN ID and the column is the column corresponding to the next CAN ID; After traversing the first ID sequence, a migration matrix to be verified is obtained.

6. The computer-readable storage medium according to claim 5, wherein: The verifying of the migration matrix to be verified according to the verification data set is specifically as follows: Sort the CAN IDs of the CAN messages in the verification data set according to the collection time sequence of the CAN messages to obtain a second ID sequence; Traverse the second ID sequence in order; Determining whether the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are the second values; If not, the number of false alarms is accumulated once, and the values ​​of the positions corresponding to the current CAN ID and the next CAN ID in the migration matrix to be verified are corrected to the second value, and the initial value of the number of false alarms is zero; After traversing the second ID sequence, if the number of false positives is zero, the verification is determined to be successful; otherwise, the verification is determined to be unsuccessful.

7. The computer-readable storage medium according to claim 6, wherein: After verifying the migration matrix to be verified based on the verification data set, the method further includes: If the verification fails, a new verification data set is obtained and the number of false positives is cleared; The corrected migration matrix is ​​validated based on the new validation dataset.

8. The computer-readable storage medium according to claim 5, wherein: The CAN abnormal intrusion detection according to the migration matrix is ​​specifically performed as follows: Real-time collection of CAN messages generated by vehicles during driving; Determining whether a value at a position in the migration matrix corresponding to the CAN ID in the last collected CAN message and the CAN ID in the currently collected CAN message is the second value; If not, it is determined that there is an abnormal intrusion.

Images