An intrusion detection method and system for charging pile CAN networks

Abstract

This invention discloses an intrusion detection method and system for charging pile CAN networks. By monitoring and analyzing message data in real time, it issues alarms and takes countermeasures to block attacks and reduce attack risks when abnormal messages are detected. It also provides an intrusion detection model for charging pile CAN networks, which includes: a data acquisition and processing module, comprising a message listening module and a protocol data packet parsing module; an intrusion detection engine module, comprising a finite state machine detection module and a Mahalanobis distance detection module; and an event processing module, comprising an error alarm module and a log recording module. The intrusion detection method proposed in this invention can improve the security of charging pile CAN networks, detect attack behaviors that cause charging pile system failures, help the charging pile system take effective defensive measures to block attacks, and ensure the safe and stable operation of charging, vehicle, and power grid.

Description

Technical Field

[0001] This invention relates to the field of CAN network security technology for charging piles, and in particular to an intrusion detection method and system for CAN networks of charging piles. Background Technology

[0002] Intrusion detection technology for charging pile CAN networks can help charging pile systems resist network attacks, block attacks in a timely manner, and minimize the threat of attacks. Controller Area Network (CAN), as the charging communication protocol for charging piles and smart electric vehicles, has insufficient security considerations. Hackers have already infiltrated charging pile CAN networks, leading to problems such as power theft and abnormal charging pile functions. Currently, there is a lack of research on security measures specifically for charging pile CAN networks. Traditional intrusion detection algorithms have insufficient coverage of attack types detected in charging pile CAN networks, and for the current Raspberry Pi hardware environment of charging piles, complex algorithms have high computational overhead, affecting the real-time performance of detection. Therefore, it is necessary to propose an intrusion detection model suitable for charging piles to resist network attacks and ensure the safe and stable operation of charging, vehicle, and power grid. Summary of the Invention

[0003] This invention proposes an intrusion detection method and system for charging pile CAN networks, which can detect various network attacks such as DoS, drop, spoofing, tampering and replay, and block attacks in a timely manner to ensure charging safety.

[0004] To achieve the above objectives, the technical solution of the present invention is as follows:

[0005] The first aspect provides an intrusion detection method for charging pile CAN networks, including:

[0006] S1: Collect CAN network messages of the charging pile and parse the collected CAN network messages of the charging pile;

[0007] S2: Security detection is performed on the parsed CAN network messages of the charging pile by combining CAN ID field detection based on finite state machine and CAN data field detection based on Mahalanobis distance;

[0008] S3: Handle abnormal events detected during the safety inspection process.

[0009] Based on the same inventive concept, a second aspect of the present invention provides an intrusion detection system for a charging pile CAN network, comprising:

[0010] The data packet acquisition and processing module is used to acquire CAN network messages of the charging pile and parse the acquired CAN network messages of the charging pile.

[0011] The intrusion detection engine module is used to perform security detection on the parsed CAN network messages of the charging pile by combining CAN ID field detection based on finite state machine and CAN data field detection based on Mahalanobis distance.

[0012] The event handling module is used to process abnormal events detected during the security detection process.

[0013] In one implementation, the data packet acquisition and processing module includes:

[0014] The monitoring module is used to collect raw messages from the charging pile's CAN network, configure the CAN interface's port number, baud rate, and mode, collect CAN bus interface message data from the charging pile, and read it into the CAN frame structure.

[0015] The protocol packet parsing module is used to parse the fields according to the charging pile CAN network message frame format and analyze the actual meaning of each field in the data field according to the charging pile CAN network message ID. The charging pile CAN network message frame format includes priority P, source address, destination address, message PGN number, DLC and data field Data.

[0016] In one implementation, the intrusion detection engine module includes:

[0017] The finite state machine detection module is used to detect the CAN ID field. It includes a state machine creation phase and a detection phase. In the state machine creation phase, a finite state machine model of the charging pile is constructed, abstracting the normal charging process of the charging pile into a finite state machine transition process. The protocol state set, initial state, input-output set, state transition function, and output function are defined, and a message matching state transition table is obtained. The message matching state transition table stores information including the current state, the next state, and the event. The event is stored in an event structure, which specifically includes the received message sequence number and the message data field. In the detection phase, the current state and the event in the message matching state transition table are analyzed to determine whether it is a normal state transition process. If it is a normal state transition process, it enters the Mahalanobis distance detection module; otherwise, it enters the event processing module.

[0018] The Mahalanobis distance detection module is used to detect the CAN data field, including an index calibration stage and a detection stage. In the index calibration stage, the Mahalanobis distance confidence interval and adjacent change threshold for different CAN IDs are obtained by analyzing CAN sample data from normal charging piles. In the detection stage, the first Mahalanobis distance between the current message data field and the training sample is calculated and compared with the Mahalanobis distance confidence interval for the corresponding CAN ID calculated in the index calibration stage. If the distance exceeds the corresponding CAN ID's Mahalanobis distance confidence interval, the process proceeds to the event handling module. Then, the second Mahalanobis distance between the current message data field and the adjacent message data field with the same ID is calculated and compared with the adjacent change threshold calculated in the index calibration stage. If the distance exceeds the adjacent change threshold, the process proceeds to the event handling module.

[0019] In one implementation, the state machine creation phase of the finite state machine detection module specifically includes the following steps:

[0020] S2.1.1: Analyze the CAN protocol message types of the charging pile and construct a frame ID whitelist;

[0021] S2.1.2: Map the CAN protocol command states to the constructed finite state machine states, forming a state set S.

[0022]

[0023] Among them, Start represents the initial state, Handshaking represents the handshaking state, Recognizing represents the recognition state, Configuring represents the configuration state, Unready_Charge represents the charging not ready state, Charging represents the charging state, Acconting represents the data statistics state, and Finish represents the ending state.

[0024] S2.1.3: Define the charging pile off state as the initial state s0 of the FSM;

[0025] S2.1.4: Combine the instructions received to reach each state into a set, defined as the input set, denoted as I.

[0026] I = {BHM, BRM} 00 BCP, BRO 00 BRO AA ,BCL,BCS,BSM,BST,BSD}#;

[0027] Where BHM represents the BMS handshake message, and BRM represents the BMS handshake message. 00 BCP represents the BMS and vehicle identification message, BRO represents the power battery charging parameter message, and BRO represents the power battery charging parameter message. 00This indicates that the BMS is ready for charging, BRO AA BMS charging ready message indicates BMS charging ready message, BCL indicates battery charging request message, BCS indicates battery charging status message, BSM indicates BMS sending power battery status information message, BST indicates BMS stopping charging message, and BSD indicates BMS statistics message.

[0028] S2.1.5: Combine the instructions sent for transitioning from each state to other states into a set, defined as the output set, denoted as O.

[0029] O={CHM,CRM 00 CRM AA CTS, CRO 00 CRO AA ,CCS,CST,CSD}#;

[0030] CHM represents the charger handshake message, and CRM... 00 This indicates the charger identification message, CRM AA CTS indicates the charger identification message, CRO indicates the charger sends a time synchronization information message. 00 This indicates that the charger is ready to output a CRO message. AA The first message indicates that the charger is ready to output a message; the second message indicates that the charger is charging; the third message indicates that the charger has stopped charging; and the fourth message indicates that the charger has statistical data.

[0031] S2.1.6: The process of transitioning from one state to the next in a control command and the corresponding input I. n Defined as a state transition function, denoted as δ;

[0032] S2.1.7: The process of transitioning from one state to the next in a control command and the corresponding output Q. n Defined as an output function, denoted by λ.

[0033] In one implementation, the detection phase of the finite state machine detection module specifically includes the following steps:

[0034] S2.1.8: For each frame, match the ID whitelist. If the format of the frame conforms to the CAN protocol specification, enter the state machine.

[0035] S2.1.9: Get the current state of the state machine. If it is the initial state, clear all records and set it to the initial state.

[0036] S2.1.10: Find the event corresponding to the current frame by matching the event structure of the finite state machine through the ID field;

[0037] S2.1.11: Match the state transition table based on the current state, event, and message, and call the event handling function;

[0038] S2.1.12: Determine if the state after migration is a valid state: If it is a valid state, update the current state and enter the Mahalanobis distance detection stage; if it is an invalid state, enter the event handling module.

[0039] In one implementation, the index calibration stage in the Mahalanobis distance detection module includes the following steps:

[0040] S2.2.1: Divide the CAN data samples into different sample groups based on the CAN ID field, X i X represents the i-th byte of the sample. i =(x 1i ,x 2i ,…x mi ) T Let the ID sample data of this group be denoted as X=(X1,X2,…,X…). m );

[0041] S2.2.2: Preprocess the CAN data field samples of each ID group, separate the data fields of the sample data and combine them into a message, and then convert it into decimal;

[0042] S2.2.3: Calculate the mean vector μ and covariance matrix Σ for each ID sample data group. The mean vector of the ID sample data group X is μ. X The covariance matrix is ​​Σ X The calculation method is as follows:

[0043] μ X =(μ X1 ,μ X2 ,…,μ Xm )

[0044]

[0045] S2.2.4: Calculate the Mahalanobis distance from each sample data point to the population sample. The Mahalanobis distance of a sample data point is equivalent to the Mahalanobis distance from the sample data point to the mean vector μ. The mean Mahalanobis distance of the sample data is then obtained.

[0046] S2.2.5: Determine the confidence interval for CAN data samples The Mahalanobis distance confidence interval for CAN data samples is used, where δ represents the standard deviation of the sample data. The Mahalanobis distance between adjacent message samples in the CAN data samples is calculated as the change in adjacent messages. The maximum value of the change in adjacent messages in normal samples is taken as the threshold of the change in adjacent messages for that ID sample.

[0047] In one implementation, the detection phase of the Mahalanobis distance detection module includes the following steps:

[0048] S2.2.6: If the data frame is found to be normal after being detected by the finite state machine, it will proceed to the Mahalanobis distance detection and convert the data field to decimal.

[0049] S2.2.7: Identify the ID field, find the Mahalanobis distance confidence interval of the CAN data sample corresponding to the frame ID, and the threshold for the change in adjacent messages;

[0050] S2.2.8: Calculate the Mahalanobis distance between the data domain and the overall sample, and compare it with the Mahalanobis distance confidence interval of the CAN data sample: if there is no abnormality, proceed to step S2.2.9; if there is an abnormality, proceed to the event handling module.

[0051] S2.2.9: Calculate the Mahalanobis distance between the data field and adjacent packets with the same ID, and compare it with the threshold of change in adjacent packets: if there is no abnormality, the detection is completed; if there is an abnormality, proceed to the event handling module.

[0052] Based on the same inventive concept, a third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method described in the first aspect.

[0053] Based on the same inventive concept, a fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect.

[0054] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0055] The intrusion detection method and system for charging pile CAN networks provided by this invention can detect a variety of attacks. By combining CAN ID field detection based on finite state machines and CAN data field detection based on Mahalanobis distance, it comprehensively covers the types of attacks that charging pile CAN networks may suffer. In addition, the algorithm in this invention has low complexity, low resource overhead, and high real-time detection performance. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1This is the Socket CAN driver model for data packet acquisition provided in this embodiment of the invention;

[0058] Figure 2 This is a state transition diagram of a charging pile for an intrusion detection engine module provided in an embodiment of the present invention;

[0059] Figure 3 This is a flowchart of a state transition algorithm for an intrusion detection engine module provided in an embodiment of the present invention;

[0060] Figure 4 This is a flowchart of the Mahalanobis distance confidence interval calibration algorithm for an intrusion detection engine module provided in an embodiment of the present invention;

[0061] Figure 5 This is a schematic diagram illustrating the calculation of Mahalanobis distance between adjacent sample data for an intrusion detection engine module, provided in an embodiment of the present invention.

[0062] Figure 6 This is a flowchart of the Mahalanobis distance detection stage algorithm for an intrusion detection engine module provided in an embodiment of the present invention;

[0063] Figure 7 This is a framework diagram of an intrusion detection system for a charging pile CAN network provided in an embodiment of the present invention. Detailed Implementation

[0064] This invention provides an intrusion detection method and system for charging pile CAN networks, which can improve the security of charging pile CAN networks, detect attack behaviors that cause charging pile system failures, help charging pile systems take effective defensive measures to block attacks, and ensure charging safety, vehicle safety and the safe and stable operation of the power grid.

[0065] To achieve the above-mentioned technical effects, the main inventive concept of this invention is as follows:

[0066] By monitoring and analyzing message data in real time, the system issues alerts and takes countermeasures to block attacks and reduce attack risks when abnormal messages are detected. The intrusion detection method described in this invention includes an intrusion detection model for charging pile CAN networks. This model comprises: a data acquisition and processing module, which includes a message listening module and a protocol data packet parsing module; an intrusion detection engine module, which includes a finite state machine detection module and a Mahalanobis distance detection module; and an event processing module, which includes an error alarm module and a log recording module.

[0067] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0068] Example 1

[0069] This invention provides an intrusion detection method for a charging pile CAN network, comprising:

[0070] S1: Collect CAN network messages of the charging pile and parse the collected CAN network messages of the charging pile;

[0071] S2: Security detection is performed on the parsed CAN network messages of the charging pile by combining CAN ID field detection based on finite state machine and CAN data field detection based on Mahalanobis distance;

[0072] S3: Handle abnormal events detected during the safety inspection process.

[0073] In practice, a Socket CAN driver can be used to collect raw messages from the charging pile's CAN network. Similar to TCP / IP Socket communication, a socket is created, the CAN interface port number and baud rate are configured, and the `read` function is called to collect charging pile CAN bus interface message data in a polling manner, reading it into the CAN frame structure. When parsing the collected charging pile CAN network messages, fields can be parsed according to the charging pile message frame format, and the meaning of each field in the data field, such as current and voltage, can be analyzed based on the message ID.

[0074] CAN ID field detection based on finite state machines primarily targets the CAN ID field, specifically addressing attacks such as DoS, data loss, and spoofing that disrupt the charging process of charging stations. CAN data field detection based on Mahalanobis distance primarily targets the CAN data field, specifically addressing attacks such as tampering and replay that affect the data field of charging station messages.

[0075] When processing abnormal data, abnormal events detected by the intrusion detection engine are handled. First, an error message is sent to notify the charging pile system to stop charging; second, information such as the current timestamp, message sequence, and event structure is recorded for later analysis.

[0076] This invention proposes a lightweight intrusion detection method capable of detecting a variety of attacks. By combining CAN ID domain detection based on finite state machines and CAN data domain detection based on Mahalanobis distance, it comprehensively covers the types of attacks that charging pile CAN networks may suffer. In addition, the algorithm in this invention has low complexity, low resource overhead, and high real-time detection performance.

[0077] Example 2

[0078] Based on the same inventive concept, this invention discloses an intrusion detection system for charging pile CAN networks. Please refer to [link to relevant documentation]. Figure 7 The system includes:

[0079] The data packet acquisition and processing module is used to acquire CAN network messages of the charging pile and parse the acquired CAN network messages of the charging pile.

[0080] The intrusion detection engine module is used to perform security detection on the parsed CAN network messages of the charging pile by combining CAN ID field detection based on finite state machine and CAN data field detection based on Mahalanobis distance.

[0081] The event handling module is used to process abnormal events detected during the security detection process.

[0082] This invention provides an intrusion detection system for a charging pile CAN network, such as... Figure 1 The diagram shows a Socket CAN driver model used for CAN bus data acquisition in charging piles. Figure 2 The diagram shown illustrates the state transitions of the charging station within the intrusion detection engine module, illustrating the state transitions between the charging station and the BMS during the charging process. Figure 3 As shown, an intrusion detection method for a charging pile CAN network based on a finite state machine is illustrated. Figure 4 and Figure 5 The diagram illustrates the calibration method for the confidence interval and change threshold of Mahalanobis distance detection. Figure 6 As shown, an intrusion detection method for a charging pile CAN network based on Mahalanobis distance is presented.

[0083] In one implementation, the data packet acquisition and processing module includes:

[0084] The monitoring module is used to collect raw messages from the charging pile's CAN network, configure the CAN interface's port number, baud rate, and mode, collect CAN bus interface message data from the charging pile, and read it into the CAN frame structure.

[0085] The protocol packet parsing module is used to parse the fields according to the charging pile CAN network message frame format and analyze the actual meaning of each field in the data field according to the charging pile CAN network message ID. The charging pile CAN network message frame format includes priority P, source address, destination address, message PGN number, DLC and data field Data.

[0086] Specifically, in the data packet acquisition and processing module, firstly, in the listening program module, by configuring the port number and baud rate of the CAN interface, the read function is called to collect the charging pile CAN bus interface message data in a polling manner. Then, in the protocol packet parsing module, the data packets are parsed based on the charging pile CAN protocol specification, including priority P, source address and destination address, message PGN number, DLC and data field Data, etc., and the data field is converted into decimal data.

[0087] In one implementation, the intrusion detection engine module includes:

[0088] The finite state machine detection module is used to detect the CAN ID field. It includes a state machine creation phase and a detection phase. In the state machine creation phase, a finite state machine model of the charging pile is constructed, abstracting the normal charging process of the charging pile into a finite state machine transition process. The protocol state set, initial state, input-output set, state transition function, and output function are defined, and a message matching state transition table is obtained. The message matching state transition table stores information including the current state, the next state, and the event. The event is stored in an event structure, which specifically includes the received message sequence number and the message data field. In the detection phase, the current state and the event in the message matching state transition table are analyzed to determine whether it is a normal state transition process. If it is a normal state transition process, it enters the Mahalanobis distance detection module; otherwise, it enters the event processing module.

[0089] The Mahalanobis distance detection module is used to detect the CAN data field, including an index calibration stage and a detection stage. In the index calibration stage, the Mahalanobis distance confidence interval and adjacent change threshold for different CAN IDs are obtained by analyzing CAN sample data from normal charging piles. In the detection stage, the first Mahalanobis distance between the current message data field and the training sample is calculated and compared with the Mahalanobis distance confidence interval for the corresponding CAN ID calculated in the index calibration stage. If the distance exceeds the corresponding CAN ID's Mahalanobis distance confidence interval, the process proceeds to the event handling module. Then, the second Mahalanobis distance between the current message data field and the adjacent message data field with the same ID is calculated and compared with the adjacent change threshold calculated in the index calibration stage. If the distance exceeds the adjacent change threshold, the process proceeds to the event handling module.

[0090] In one implementation, the event handling module includes:

[0091] The error alarm module is used to send an alarm to the charging pile when the intrusion detection engine module detects an abnormal message, send the charging pile error message, take blocking measures, and stop the charging pile charging process.

[0092] The logging module writes abnormal events to a log file, facilitating error analysis by technical personnel. The log includes information such as timestamps, event structures, and current status.

[0093] In one implementation, the state machine creation phase of the finite state machine detection module specifically includes the following steps:

[0094] S2.1.1: Analyze the CAN protocol message types of the charging pile and construct a frame ID whitelist;

[0095] S2.1.2: Map the CAN protocol command states to the constructed finite state machine states, forming a state set S.

[0096]

[0097] Among them, Start represents the initial state, Handshaking represents the handshaking state, Recognizing represents the recognition state, Configuring represents the configuration state, Unready_Charge represents the charging not ready state, Charging represents the charging state, Acconting represents the data statistics state, and Finish represents the ending state.

[0098] S2.1.3: Define the charging pile off state as the initial state s0 of the FSM;

[0099] S2.1.4: Combine the instructions received to reach each state into a set, defined as the input set, denoted as I.

[0100] I = {BHM, BRM} 00 BCP, BRO 00 BRO AA ,BCL,BCS,BSM,BST,BSD}#;

[0101] Where BHM represents the BMS handshake message, and BRM represents the BMS handshake message. 00 This indicates the BMS and vehicle identification message (value 0x00), BCP indicates the power battery charging parameter message, and BRO... 00 This indicates that the BMS is ready for charging (value 0x00), BRO AABMS charging ready message (value 0xAA), BCL message indicates battery charging request message, BCS message indicates battery charging status message, BSM message indicates BMS sending power battery status information message, BST message indicates BMS stopping charging message, and BSD message indicates BMS statistics message.

[0102] S2.1.5: Combine the instructions sent for transitioning from each state to other states into a set, defined as the output set, denoted as O;

[0103] O={CHM,CRM 00 CRM AA CTS, CRO 00 CRO AA ,CCS,CST,CSD}#;

[0104] CHM represents the charger handshake message, and CRM... 00 This indicates a charger identification message (value 0x00), CRM AA This indicates a charger identification message (value 0xAA), CTS indicates a charger sending a time synchronization information message, and CRO... 00 This indicates that the charger is ready to output a message (value 0x00), CRO AA The value 0xAA indicates that the charger is ready to output a message; CCS indicates that the charger is charging status; CST indicates that the charger has stopped charging; and CSD indicates that the charger is displaying statistics.

[0105] S2.1.6: The process of transitioning from one state to the next in a control command and the corresponding input I. n Defined as a state transition function, denoted as δ;

[0106] S2.1.7: The process of transitioning from one state to the next in a control command and the corresponding output Q. n Defined as an output function, denoted by λ.

[0107] Specifically, in the state machine creation phase of the intrusion detection module, firstly, intrusion detection is performed on the CAN ID field based on the finite state machine. Data frames from the data packet acquisition and processing module are received, the ID whitelist is matched, the PF field is identified, the state machine is entered, the current charging pile status is obtained, and the event structure array is matched through the ID field. Based on the event and the state transition diagram, the event handling function is called to determine whether it is legal (whether it is a normal state transition process). If it is, the detection phase is entered; otherwise, the event handling module is executed.

[0108] In one implementation, the detection phase of the finite state machine detection module specifically includes the following steps:

[0109] S2.1.8: For each frame, match the ID whitelist. If the format of the frame conforms to the CAN protocol specification, enter the state machine.

[0110] S2.1.9: Get the current state of the state machine. If it is the initial state, clear all records and set it to the initial state.

[0111] S2.1.10: Find the event corresponding to the current frame by matching the event structure of the finite state machine through the ID field;

[0112] S2.1.11: Match the state transition table based on the current state, event, and message, and call the event handling function;

[0113] S2.1.12: Determine if the state after migration is a valid state: If it is a valid state, update the current state and enter the Mahalanobis distance detection stage; if it is an invalid state, enter the event handling module.

[0114] Specifically, when an abnormal transition state process is detected during the state machine creation phase, the detection phase is initiated. This phase performs intrusion detection on the CAN data domain based on Mahalanobis distance. It receives data detected by the CAN ID domain intrusion detection module based on a finite state machine, retrieves the corresponding ID domain mean vector μ and covariance matrix Σ through the ID domain, converts the data domain to decimal, calculates the Mahalanobis distance of the current frame domain's overall samples and the Mahalanobis distance of adjacent and identical ID packets, and ends the detection process if both are within a reasonable range. If there is an anomaly, the process is transferred to the event handling module.

[0115] In one implementation, the index calibration stage in the Mahalanobis distance detection module includes the following steps:

[0116] S2.2.1: Divide the CAN data samples into different sample groups based on the CAN ID field, X i X represents the i-th byte of the sample. i =(x 1i ,x 2i ,…x mi ) t Let the ID sample data of this group be denoted as X=(X1,X2,…,X…). m );

[0117] S2.2.2: Preprocess the CAN data field samples of each ID group, separate the data fields of the sample data and combine them into a message, and then convert it into decimal;

[0118] S2.2.3: Calculate the mean vector μ and covariance matrix Σ for each ID sample data group. The mean vector of the ID sample data group X is μ. X The covariance matrix is ​​Σ X The calculation method is as follows:

[0119] μ X =(μ X1 ,μ X2 ,…,μ Xm )

[0120]

[0121] S2.2.4: Calculate the Mahalanobis distance from each sample data point to the population sample. The Mahalanobis distance of a sample data point is equivalent to the Mahalanobis distance from the sample data point to the mean vector μ. The mean Mahalanobis distance of the sample data is then obtained.

[0122] S2.2.5: Determine the confidence interval for CAN data samples The Mahalanobis distance confidence interval for CAN data samples is used, where δ represents the standard deviation of the sample data. The Mahalanobis distance between adjacent message samples in the CAN data samples is calculated as the change in adjacent messages. The maximum value of the change in adjacent messages in normal samples is taken as the threshold of the change in adjacent messages for that ID sample.

[0123] Among them, there are n sample vectors X under a certain ID. n×m Each row represents a CAN data field sample, and each sample has m dimensions:

[0124]

[0125] In one implementation, the detection phase of the Mahalanobis distance detection module includes the following steps:

[0126] S2.2.6: If the data frame is found to be normal after being detected by the finite state machine, it will proceed to the Mahalanobis distance detection and convert the data field to decimal for easier calculation.

[0127] S2.2.7: Identify the ID field, find the Mahalanobis distance confidence interval of the CAN data sample corresponding to the frame ID, and the threshold for the change in adjacent messages;

[0128] S2.2.8: Calculate the Mahalanobis distance (first Mahalanobis distance) between the data domain and the overall sample, and compare it with the Mahalanobis distance confidence interval of the CAN data sample: if there is no abnormality, proceed to step S2.2.9; if there is an abnormality, proceed to the event handling module.

[0129] S2.2.9: Calculate the Mahalanobis distance (second Mahalanobis distance) between the data field and adjacent packets with the same ID, and compare it with the threshold of change in adjacent packets: if there is no abnormality, the detection is completed; if there is an abnormality, the event handling module is entered.

[0130] Since the system described in Embodiment 2 of this invention is the same system used to implement the intrusion detection method for the CAN network of charging piles in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this system based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All systems used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0131] Example 3

[0132] Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method described in Embodiment 1.

[0133] Since the computer-readable storage medium described in Embodiment 3 of this invention is the same computer-readable storage medium used in implementing the intrusion detection method for the CAN network of charging piles in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable storage medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable storage media used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0134] Example 4

[0135] Based on the same inventive concept, this application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method in Embodiment 1.

[0136] Since the computer device described in Embodiment 4 of this invention is the same computer device used to implement the intrusion detection method for the CAN network of charging piles in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer device based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer devices used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0137] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0138] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0139] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. An intrusion detection method for a charging pile CAN network, characterized in that, include: S1: Collect CAN network messages of the charging pile and parse the collected CAN network messages of the charging pile; S2: Security checks are performed on the parsed CAN network messages of the charging pile by combining CAN ID field detection based on finite state machines and CAN data field detection based on Mahalanobis distance. This includes finite state machine detection and Mahalanobis distance detection. Finite state machine detection is used to detect the CAN ID field, including a state machine creation phase and a detection phase. In the state machine creation phase, a finite state machine model of the charging pile is constructed, abstracting the normal charging process of the charging pile into a finite state machine transition process. The protocol state set, initial state, input-output set, state transition function, and output function are defined, and a message matching state transition table is obtained. The message matching state transition table stores information including the current state, the next state, and the event. The event is stored through an event structure, specifically including the received message sequence number and the message data field. In the detection phase, the current state and the event in the message matching state transition table are analyzed to determine whether it is a normal state transition process. If it is a normal state transition process, the process enters the Mahalanobis distance detection module; otherwise, it enters the event processing module. Mahalanobis distance detection is used to detect CAN data fields, including a calibration phase and a detection phase. The calibration phase analyzes CAN sample data from normal charging piles to obtain the Mahalanobis distance confidence intervals and adjacent variation thresholds for different CAN IDs. The detection phase calculates the first Mahalanobis distance between the current message data field and the training samples, and compares it with the Mahalanobis distance confidence interval for the corresponding CAN ID calculated in the calibration phase. If the distance exceeds the corresponding CAN ID's confidence interval, the detection phase will detect the difference. If the Mahalanobis distance confidence interval for the ID is found, the process proceeds to the event processing module. Then, the second Mahalanobis distance between the current message data field and the adjacent data field of a message with the same ID is calculated and compared with the adjacent change threshold calculated in the indicator calibration stage. If the adjacent change threshold is exceeded, the process proceeds to the event processing module. The detection stage in the Mahalanobis distance detection module includes the following steps: S2.2.6: If the data frame is found to be normal after finite state machine detection, the process proceeds to Mahalanobis distance detection, converting the data field to decimal. S2.2.7: Identify the ID field and find the Mahalanobis distance confidence interval and adjacent message change threshold for the corresponding frame ID CAN data sample. S2.2.8: Calculate the Mahalanobis distance between the data field and the overall sample and compare it with the Mahalanobis distance confidence interval of the CAN data sample. If there is no abnormality, proceed to step S2.2.9; if there is an abnormality, proceed to the event processing module. S2.2.9: Calculate the Mahalanobis distance between the data field and adjacent messages with the same ID and compare it with the adjacent message change threshold. If there is no abnormality, the detection is complete; if there is an abnormality, proceed to the event processing module. S3: Handle abnormal events detected during the safety inspection process.

2. An intrusion detection system for a charging pile CAN network, characterized in that, include: The data packet acquisition and processing module is used to acquire CAN network messages of the charging pile and parse the acquired CAN network messages of the charging pile. The intrusion detection engine module is used to perform security checks on the parsed CAN network messages of the charging pile by combining CAN ID field detection based on finite state machines and CAN data field detection based on Mahalanobis distance. The intrusion detection engine module includes: The finite state machine detection module is used to detect the CAN ID field. It includes a state machine creation phase and a detection phase. In the state machine creation phase, a finite state machine model of the charging pile is constructed, abstracting the normal charging process of the charging pile into a finite state machine transition process. The protocol state set, initial state, input-output set, state transition function, and output function are defined, and a message matching state transition table is obtained. The message matching state transition table stores information including the current state, the next state, and the event. The event is stored in an event structure, which specifically includes the received message sequence number and the message data field. In the detection phase, the current state and the event in the message matching state transition table are analyzed to determine whether it is a normal state transition process. If it is a normal state transition process, it enters the Mahalanobis distance detection module; otherwise, it enters the event processing module. The Mahalanobis distance detection module is used to detect the CAN data field, including an index calibration stage and a detection stage. In the index calibration stage, the Mahalanobis distance confidence interval and adjacent change threshold for different CAN IDs are obtained by analyzing CAN sample data from normal charging piles. In the detection stage, the first Mahalanobis distance between the current message data field and the training samples is calculated and compared with the Mahalanobis distance confidence interval for the corresponding CAN ID calculated in the index calibration stage. If it exceeds the Mahalanobis distance confidence interval for the corresponding CAN ID, the process enters the event handling module. Then, the second Mahalanobis distance between the current message data field and the adjacent message data field with the same ID is calculated and compared with the adjacent change threshold calculated in the index calibration stage. If it exceeds the adjacent change threshold, the process enters the event handling module. The detection stage of the Mahalanobis distance detection module includes the following steps: S2.2.6: The data frame is detected without anomalies by the finite state machine and enters the Mahalanobis distance detection stage, converting the data field to decimal. S2.2.7: Identify the ID field, find the Mahalanobis distance confidence interval of the CAN data sample corresponding to the frame ID, and the threshold for the change in adjacent messages; S2.2.8: Calculate the Mahalanobis distance between the data field and the overall sample, and compare it with the Mahalanobis distance confidence interval of the CAN data sample: if there is no abnormality, proceed to step S2.2.9; if there is an abnormality, proceed to the event handling module; S2.2.9: Calculate the Mahalanobis distance between the data field and adjacent messages with the same ID, and compare it with the threshold for the change in adjacent messages: if there is no abnormality, the detection is completed; if there is an abnormality, proceed to the event handling module; The event handling module is used to process abnormal events detected during the security detection process.

3. The intrusion detection system for a charging pile CAN network as described in claim 2, characterized in that, The data packet acquisition and processing module includes: The monitoring module is used to collect raw messages from the charging pile's CAN network, configure the CAN interface's port number, baud rate, and mode, collect CAN bus interface message data from the charging pile, and read it into the CAN frame structure. The protocol packet parsing module is used to parse the fields according to the charging pile CAN network message frame format and analyze the actual meaning of each field in the data field according to the charging pile CAN network message ID. The charging pile CAN network message frame format includes priority P, source address, destination address, message PGN number, DLC and data field Data.

4. The intrusion detection system for a charging pile CAN network as described in claim 2, characterized in that, The state machine creation phase of the finite state machine detection module specifically includes the following steps: S2.1.1: Analyze the CAN protocol message types of the charging pile and construct a frame ID whitelist; S2.1.2: Map the CAN protocol command states to the constructed finite state machine states, forming a state set S. ； Among them, Start represents the initial state, Handshaking represents the handshaking state, Recognizing represents the recognition state, Configuring represents the configuration state, Unready_Charge represents the charging not ready state, Charging represents the charging state, Acconting represents the data statistics state, and Finish represents the ending state. S2.1.3: Define the charging station off state as the initial state of the FSM. ; S2.1.4: Combine the instructions received to reach each state into a set, defined as the input set, denoted as I. ； in, This indicates a BMS handshake message. This indicates BMS and vehicle identification messages. This indicates a message displaying the charging parameters of the power battery. This indicates that the BMS is ready for charging. This indicates that the BMS is ready for charging. This indicates a battery charging request message. This message indicates the overall battery charging status. This indicates that the BMS is sending a power battery status information message. This indicates that the BMS has stopped charging. This indicates BMS statistical data messages; S2.1.5: Combine the instructions sent for transitioning from each state to other states into a set, defined as the output set, denoted as O. ； in, This indicates a charger handshake message. This indicates the charger identification message. This indicates the charger identification message. This indicates that the charger is sending a time synchronization information message. This indicates that the charger is ready to output a message. This indicates that the charger is ready to output a message. This message indicates the charging status of the charger. This indicates that the charger has stopped charging. This indicates a charger statistics message; S2.1.6: The process of transitioning from one state to the next in a control command and the corresponding inputs. Defined as a state transition function, denoted by . ; S2.1.7: The process of transitioning from one state to the next in a control command and the corresponding output. Defined as an output function, the set is denoted as .

5. The intrusion detection system for a charging pile CAN network as described in claim 4, characterized in that, The detection phase of the finite state machine detection module specifically includes the following steps: S2.1.8: For each frame, match the ID whitelist. If the format of the frame conforms to the CAN protocol specification, enter the state machine. S2.1.9: Get the current state of the state machine. If it is the initial state, clear all records and set it to the initial state. S2.1.10: Find the event corresponding to the current frame by matching the event structure of the finite state machine through the ID field; S2.1.11: Match the state transition table based on the current state, event, and message, and call the event handling function; S2.1.12: Determine if the state after migration is a valid state: If it is a valid state, update the current state and enter the Mahalanobis distance detection stage; if it is an invalid state, enter the event handling module.

6. The intrusion detection system for a charging pile CAN network as described in claim 2, characterized in that, The index calibration stage in the Mahalanobis distance detection module includes the following steps: S2.2.1: Divide the CAN data samples into different sample groups based on the CAN ID field. Represents the sample's first bytes, Record the ID sample data of this group as ; S2.2.2: Preprocess the CAN data field samples of each ID group, separate the data fields of the sample data and combine them into a message, and then convert it into decimal; S2.2.3: Calculate the mean vector for each ID sample data group. The covariance matrix Σ, ID sample data group The mean vector is The covariance matrix is The calculation method is as follows: ； S2.2.4: Calculate the Mahalanobis distance from each sample data point to the population sample. The Mahalanobis distance of a sample data point is equivalent to the distance from the sample data point to the mean vector. The Mahalanobis distance is used to obtain the mean Mahalanobis distance of the sample data. ; S2.2.5: Determine the confidence interval for CAN data samples , as the Mahalanobis distance confidence interval for CAN data samples, where The standard deviation of the sample data is used to calculate the Mahalanobis distance between adjacent message samples in the CAN data sample, which is taken as the change in adjacent messages. The maximum value of the change in adjacent messages in the normal sample is taken as the threshold of the change in adjacent messages for that ID sample.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements the method as described in claim 1.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in claim 1.

Images