Abnormal behavior detection method for false information injection in vehicle networks

Abstract

The present invention detects abnormal behaviors of false data injection in data with changes in message volume, constructs an abnormal data set of false data injection in vehicle networks, and performs deep learning on the difference features of labeled abnormal data in vehicle networks. The collected abnormal data set of false data injection in vehicle networks is detected by the CNN classification algorithm, which mainly includes three stages: data preprocessing, model framework design, and data testing. In order to solve the problems of high false alarm rate caused by complex and difficult-to-identify behaviors and high missed alarm rate caused by simple and easy-to-identify behaviors during the detection process, an abnormal behavior detection algorithm for vehicle networks based on the fusion of distance features and CNN networks and an abnormal behavior detection method for vehicle networks based on timestamp features and classification learning algorithms are proposed respectively. A more accurate method is provided to improve the performance of abnormal behavior detection in vehicle networks.

Description

Technical Field

[0001] The present invention relates to the field of automobile information security technology, and is applicable to in-vehicle network information security detection research, and specifically relates to an in-vehicle network false information injection abnormal behavior detection method based on multivariate data feature fusion. Background Art

[0002] As the level of automobile intelligence and networking becomes higher and higher, there are more and more complex and changeable ways for automobiles to communicate with the outside world. Due to the uncertainty of automobile security threat sources and the differences in vehicle systems, the information security of intelligent and connected vehicles and user safety are facing major security threats. Therefore, it is necessary to improve the initiative of risk identification, eliminate safety hazards, and ensure the information security of intelligent and connected vehicles.

[0003] Abnormal behavior detection in vehicle networks is an important method for active protection of automobile information security. It ensures system security by judging, warning and responding to suspicious behaviors or behaviors that violate safety regulations in the network. It can not only perceive external threats, but also monitor internal abnormal behaviors. However, there is still no systematic solution for abnormal behavior detection in vehicle networks in terms of detection range, detection performance and detection mechanism, and it cannot cope with complex and changeable vehicle network information security threats. In addition, there is little research on performance evaluation and experimental verification of abnormal behavior detection in vehicle networks, resulting in a certain distance for the application of intrusion detection system technology in the vehicle. Therefore, strengthening active protection measures for automobile information security, finding effective detection methods and detection mechanisms, and improving the scope of application and detection performance of abnormal behavior in vehicle networks have become topics that urgently need to be studied.

[0004] In vehicle network anomaly detection, the normal data and abnormal data with labels are known, and the detection of abnormal data is required. This is a typical classification problem. The application of classification algorithms in anomaly detection needs to be determined in combination with actual scenarios and the types of test objects. Classification algorithms are widely used in anomaly detection in different fields, and researchers have also conducted a series of studies in the field of automotive information security. Although there are many types of classification algorithms and there are many applications of anomaly detection in the field of automotive information security, the scope and detection types of classification algorithms in vehicle network anomaly detection need to be improved due to factors such as the way data sets are constructed, data differences and diversity, and the versatility of detection methods is poor. The existing abnormal behavior features can no longer meet the performance requirements of detection. It is necessary to analyze other abnormal behavior features and explore new classification algorithms in combination with new features to improve the detection range and detection accuracy. Summary of the invention

[0005] In order to achieve in-depth mining of abnormal behavior characteristics of vehicle networks and accurately identify abnormal behaviors, the present invention proposes a method for detecting abnormal behaviors of vehicle network false information injection based on multivariate data feature fusion. The technical implementation scheme of the present invention is: first, analyze the changes in abnormal data of the vehicle network, and design an abnormal behavior detection algorithm for the vehicle network based on CNN classification. Then, obtain vehicle data through external acquisition equipment, and use test tools to perform data analysis to construct an abnormal data set for the injection of false information into the vehicle network. Finally, for the detection of abnormal behaviors that are difficult to identify in the vehicle network, an abnormal behavior detection algorithm for the vehicle network based on the fusion of distance features and CNN network features is proposed. For the problem of high missed reporting rate caused by simple and easy-to-identify behaviors in the vehicle network, an abnormal behavior classification algorithm for the vehicle network based on the fusion of timestamp features and CNN network features is proposed to realize the detection of abnormal behaviors of false information injection into the vehicle network.

[0006] To achieve the above object, the present invention provides the following technical solution: a method for detecting abnormal behavior of false information injection in a vehicle network, comprising the following steps:

[0007] Step 1: Based on the basic structure of the CNN network and the characteristics of the vehicle network detection data, a CNN network based on vehicle network anomaly detection is established.

[0008] Step 2, extracting the features of vehicle network detection data through CNN network;

[0009] Step 3: Through the vehicle network attack experiment platform, data is collected from the real vehicle with the help of data acquisition equipment, and the collected normal data is analyzed through the simulation test software to obtain the abnormal data set of false information injection into the vehicle network, and complete the abnormal behavior detection of false information injection into the vehicle network;

[0010] Among them, the CNN algorithm hyperparameters are trained, the messages and their field contents sent at fixed periods in the vehicle network are selected, the classification algorithm analysis is performed by building a vehicle network anomaly model, and the anomaly data set is constructed according to the actual message change rules.

[0011] As a further improvement of the present invention, the method of extracting the features of the vehicle network detection data in step 2 is to combine the information of automotive electronic components, vehicle network communication protocols, and driving scenarios to analyze some features existing in the vehicle network communication data.

[0012] As a further improvement of the present invention, in the process of extracting some features in step 2, the Hamming distance and the CNN network are first selected according to the signal characteristics of the message timing to classify and detect abnormal behaviors.

[0013] As a further improvement of the present invention, the CNN network in step 1 includes a 5-level structure: an input layer, a convolutional layer, an activation layer, a pooling layer, and an output layer, and the specific steps of using the CNN network for self-learning and classification of data features are as follows:

[0014] Step 11, preprocessing the data at the input layer, converting the two-dimensional matrix of the input data into a three-dimensional matrix;

[0015] Step 12, perform local perception through the convolution layer to extract data features;

[0016] Step 13, using the ReLU function in the excitation layer to perform nonlinear mapping on the output of the convolutional layer;

[0017] Step 14: Perform feature dimensionality reduction in the pooling layer to compress the number of data and parameters, reduce overfitting, and improve the fault tolerance of the model;

[0018] Step 15: In the fully connected layer, the network traffic features generated from different angles are integrated together, and the learned multiple features are mapped to the sample label space;

[0019] Step 16, using the softmax function to output the final classification, judging whether the output two-dimensional test set identification matrix is ​​abnormal, and realizing self-learning and classification of data features in the vehicle network.

[0020] As a further improvement of the present invention, the CNN algorithm hyperparameters include epoch, number of iterations, time overhead, small batch loss, small batch accuracy and basic learning rate.

[0021] As a further improvement of the present invention, the steps of constructing an abnormal data set according to the actual message change rules are as follows:

[0022] Step 4: First, select the message whose field content changes in a certain fixed period, and perform classification algorithm analysis by building an abnormal model;

[0023] Step 5, then convert the single-precision timestamp into a binary sequence by dividing the integer part by 2, taking the remainders in turn, and then arranging them from high to low, multiplying the decimal part by 2, taking the integer part in turn, and then arranging them in reverse order;

[0024] Step 6: Finally, anomaly detection and analysis comparison of different classification algorithms are performed based on the preprocessed sequence matrix to construct an anomaly data set.

[0025] The beneficial effects of the present invention are as follows: (1) The present invention proposes a label-based vehicle network false data injection abnormal behavior detection method, designs a CNN network abnormal behavior detection algorithm through the vehicle network semantic features, and realizes high-precision identification and detection of false information injection attacks on vehicle network message field contents.

[0026] (2) The present invention proposes an algorithm for detecting abnormal behavior in vehicle networks based on the fusion of distance features and CNN, which can solve the problem of high false negative rate caused by simple and easy-to-identify behaviors in vehicle networks and improve the detection accuracy of abnormal and difficult-to-identify behaviors in false information injection attacks in vehicle networks.

[0027] (3) This paper proposes a vehicle network classification algorithm based on timestamp features. Through comparative analysis of the performance of multiple classification algorithms, it is found that the classification algorithm that integrates timestamp features with random forests has better detection performance and effect.

[0028] (4) The present invention aims to solve the problem of false information detection vulnerabilities and false alarms in labeled vehicle network abnormal data, and provides a vehicle network abnormal behavior detection method based on the fusion of multivariate features and classification algorithms based on field content timing features and timestamp features. At the same time, it provides a feasible high-precision detection method for difficult-to-identify attack behaviors such as forgery and false injection. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flow chart of vehicle network data anomaly detection based on CNN network design in the present invention;

[0030] Figure 2 This is a flow chart of an algorithm for detecting abnormal behavior of an in-vehicle network based on the fusion of Hamming distance and CNN network in the present invention;

[0031] Figure 3 It is a comparison chart of ROC curves of vehicle network anomaly detection of CNN and HammDist+CNN classification algorithms in the present invention;

[0032] Figure 4 This is a comparison chart of ROC curves of different classification detection algorithms for simple and easy identification of abnormal behaviors in the vehicle network based on message timestamp features in the present invention. DETAILED DESCRIPTION

[0033] The present invention will be further described below in conjunction with the embodiments given in the accompanying drawings.

[0034] The present invention proposes a method for detecting abnormal behavior of vehicle network false information injection based on multivariate data feature fusion. First, the changes in abnormal data of the vehicle network are analyzed, and a CNN network based on vehicle network anomaly detection is established according to the basic structure of the CNN network and the characteristics of the vehicle network detection data. Then, data collection is performed with the help of a data acquisition tool, and the collected normal data is analyzed through a simulation test tool. Finally, a vehicle network abnormal behavior detection algorithm based on distance feature and CNN fusion and a vehicle network classification algorithm based on timestamp feature are proposed for complex and difficult to identify abnormal behaviors and simple and easy to identify behaviors, respectively, which provides a method for improving the detection rate of false information injection attacks and solving the problem of high false negative rate.

[0035] When carrying out the invention patent, the specific implementation steps are as follows:

[0036] 1) In order to achieve in-depth mining of abnormal behavior characteristics, this patent analyzes the changes in abnormal data of the vehicle network and designs an abnormal behavior detection algorithm for the vehicle network based on CNN classification. The CNN network includes 5 hierarchical structures: input layer, convolution layer, activation layer, pooling layer and output layer. First, the data is preprocessed in the input layer. For the binary message frame field content, a 64*n two-dimensional matrix (n is the number of message frames) is input. In order to use the convolution network, the two-dimensional matrix needs to be converted into a three-dimensional matrix. The present invention converts the input data into a 8*8*n three-dimensional binary data matrix, and uses the convolution network to convert the two-dimensional matrix of the input information into a three-dimensional matrix; similarly, for the decimal input mode, a 16*n two-dimensional matrix is ​​input. In order to perform convolution operations, the present invention converts the input data into a 4*4*n three-dimensional matrix, and performs convolution operations on the 16-bit decimal position value of each frame message. Then, local perception is performed through the convolution layer to extract data features; the ReLU function is used in the excitation layer to perform nonlinear mapping on the output results of the convolution layer; the feature dimension is reduced in the pooling layer to compress the number of data and parameters, reduce overfitting, and improve the fault tolerance of the model; the network traffic features generated from different angles are combined in the fully connected layer, and the learned multiple features are mapped to the sample label space; finally, the softmax function is used to output the final classification, determine whether the output two-dimensional test set identification matrix is ​​abnormal, and realize self-learning and classification of data features in the vehicle network. The flowchart of vehicle network data anomaly detection based on CNN network design is as follows: Figure 1 shown.

[0037] 2) In order to study the detection of abnormal behavior of false data injection in vehicle networks based on label data, the present invention builds a vehicle network attack experimental platform, firstly uses the automobile bus acquisition equipment to collect data from the real vehicle bus, and uses the bus simulation test software to analyze the collected normal data, including message type, change frequency, field content change rules, etc., and then uses the vehicle network attack experimental platform to construct an abnormal data set of false information injection in the vehicle network with certain message forgery rules, thereby realizing the maximum design and construction of abnormal data in the vehicle network.

[0038] 3) Considering that the characteristics of the Hamming distance are relatively close to the number of vehicle network message frames, the present invention selects the Hamming distance according to the message characteristics to optimize the CNN detection algorithm. When calculating the Hamming distance, a segmented calculation is performed, and a two-dimensional matrix of Hamming distance is obtained from the data set of the message frame. The matrix is ​​converted into a three-dimensional matrix using the decimal conversion method. In order to maximize the detection performance of the classification algorithm, the ratio of normal data and abnormal data in the constructed data set is close to 1:1, and the period of abnormal message transmission is set to be consistent with the normal message. By analyzing the characteristics of the Hamming distance of the binary field of the vehicle network data frame, the transmission period of the abnormal message frame is set to 3 times that of the normal message frame, and a message is sent at 3 times the period to implement a false data injection attack. A multi-message anomaly data set based on the Hamming distance is constructed through data analysis, and then anomaly detection is performed according to the designed CNN network architecture, such as Figure 2 The CNN detection algorithm based on the Hamming distance feature is used to compare the detection performance of complex and difficult-to-identify messages. The ROC analysis and comparison of the CNN and HammDist+CNN classification algorithms are performed on messages with different fields in different periods. Figure 3 As shown in the figure, the CNN algorithm based on Hamming distance extraction has better detection performance than the CNN algorithm based on original data features, and the AUC values ​​are all greater than 0.9. The HammDist+CNN classification algorithm has a high detection rate for abnormal vehicle network data generated by false information injection attacks.

[0039] 4) In order to solve the problem of high false negative rate in the process of simple and easy-to-identify behavior detection in vehicle networks, this patent proposes a classification algorithm based on timestamp features for anomaly detection. In order to ensure the consistency of the test data set, CNN algorithm hyperparameters are used for model training, mainly including epoch, number of iterations, time overhead, small batch loss, small batch accuracy, and basic learning rate. These six CNN training hyperparameters. First, select the message whose field content changes in a fixed period, and analyze the classification algorithm by building an anomaly model. According to the analysis of abnormal behavior characteristics, the timestamp, which can characterize the timing information of the message, can be used to identify these abnormal information. Then the timestamp of the single-precision numerical value is converted into a binary series. Specifically, the integer part needs to be divided by 2, the remainders are taken in turn, and then arranged from high to low. The decimal part is multiplied by 2, the integer part is taken in turn, and then arranged in reverse order. Finally, the anomaly detection and analysis of different classification algorithms are compared based on the preprocessed series matrix. By Figure 4 The ROC curve comparison of different classification detection algorithms for simple and easy identification of abnormal behaviors in vehicle networks based on message timestamp features shows that the detection performance of random forest and KNN algorithms has improved when adding timestamp features, especially the random forest algorithm has better detection performance, while the other classification algorithms have no obvious changes. Therefore, the random forest classification algorithm can achieve high recognition rate and low false negative rate detection performance for the simple and easy to identify planning period field content in this vehicle network under the consideration of message timestamp features.

[0040] The above steps introduce in detail the specific implementation steps of the patent of this invention. A convolutional neural network with good classification effect and feature self-learning is selected to analyze the changes in abnormal data of the vehicle network, and an abnormal behavior detection algorithm for the vehicle network based on CNN classification is designed. Data is collected with the help of automobile data acquisition equipment and the collected normal data is analyzed through simulation test software to construct an abnormal data set for false information injection. In order to solve the problem of high false alarm rate caused by complex and difficult to identify behaviors during the detection process, an abnormal behavior detection algorithm for the vehicle network based on the fusion of distance features and CNN networks is proposed. In order to solve the problem of high false alarm rate caused by simple and easy to identify behaviors, a method for detecting abnormal behavior of the vehicle network based on timestamp features and classification algorithms is proposed, which provides methods and technical support for high performance and high applicability of vehicle network intrusion detection.

[0041] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for detecting abnormal behavior of false information injection in a vehicle network, characterized by: The steps include: Step 1: Based on the basic structure of the CNN network and the characteristics of the vehicle network detection data, a CNN network based on vehicle network anomaly detection is established. Step 2, extracting the features of vehicle network detection data through CNN network; Step 3: Through the vehicle network attack experiment platform, data is collected from the real vehicle with the help of data acquisition equipment, and the collected normal data is analyzed through the simulation test software to obtain the abnormal data set of false information injection into the vehicle network, and complete the abnormal behavior detection of false information injection into the vehicle network; Among them, the model training of CNN algorithm hyperparameters is carried out, the messages and their field contents sent at fixed periods in the vehicle network are selected, the classification algorithm analysis is carried out by building a vehicle network anomaly model, and the anomaly data set is constructed according to the actual message change rules; The CNN network in step 1 includes a five-layer structure: input layer, convolution layer, activation layer, pooling layer and output layer, and the specific steps of using the CNN network for self-learning and classification of data features are as follows: Step 11, preprocessing the data at the input layer, converting the two-dimensional matrix of the input data into a three-dimensional matrix; Step 12, perform local perception through the convolution layer to extract data features; Step 13, using the ReLU function in the excitation layer to perform nonlinear mapping on the output of the convolutional layer; Step 14: Perform feature dimensionality reduction in the pooling layer to compress the number of data and parameters, reduce overfitting, and improve the fault tolerance of the model; Step 15: In the fully connected layer, the network traffic features generated from different angles are integrated together, and the learned multiple features are mapped to the sample label space; Step 16, using the softmax function to output the final classification, judging whether the output two-dimensional test set identification matrix is ​​abnormal, and realizing self-learning and classification of data features in the vehicle network.

2. The method for detecting abnormal behavior of false information injection in vehicle network according to claim 1, characterized in that: The method of extracting the features of the vehicle network detection data in step 2 is to combine the information of automotive electronic components, vehicle network communication protocols, and driving scenarios to analyze some features of the vehicle network communication data.

3. The method for detecting abnormal behavior of false information injection in vehicle network according to claim 1 or 2, characterized in that: In the process of extracting some features in step 2, the Hamming distance and CNN network are first selected according to the signal characteristics of the message timing to classify and detect abnormal behaviors.

4. The method for detecting abnormal behavior of false information injection in vehicle network according to claim 1 or 2, characterized in that: The CNN algorithm hyperparameters include epoch, number of iterations, time overhead, mini-batch loss, mini-batch accuracy and basic learning rate.

5. The method for detecting abnormal behavior of false information injection in vehicle network according to claim 4 is characterized in that: The steps of constructing an abnormal data set according to the actual message change rules are as follows: Step 4: First, select the message whose field content changes in a certain fixed period, and perform classification algorithm analysis by building an abnormal model; Step 5, then convert the single-precision timestamp into a binary sequence by dividing the integer part by 2, taking the remainders in turn, and then arranging them from high to low, multiplying the decimal part by 2, taking the integer part in turn, and then arranging them in reverse order; Step 6: Finally, anomaly detection and analysis comparison of different classification algorithms are performed based on the preprocessed sequence matrix to construct an anomaly data set.

Images