Vehicle-mounted can bus anomaly detection method based on lightweight network MobileViT

Abstract

The application provides a kind of vehicle CAN bus anomaly detection method based on lightweight network MobileViT, it is related to network and information security field. By data cleaning and dimension transformation to the original data set, obtain the behavior sample picture data set;An improved lightweight network model MobileViT is constructed and trained to realize the classification of generated behavior sample pictures, so as to convert the vehicle CAN bus anomaly detection problem into a picture classification problem. Use GELU as the activation function of MV2 module in lightweight MobileViT network model, effectively solve the neuron death problem, improve the model convergence speed;In the training process of the model, the learning rate is automatically updated using exponential decay, which prevents the model from falling into local optimum and reduces the training time. The application first applies lightweight network MobileViT to vehicle CAN bus anomaly detection, which can efficiently detect vehicle CAN bus anomalies under the condition of consuming less hardware resources.

Description

Technical Field

[0001] This invention belongs to the field of network and information security, specifically relating to a method for detecting anomalies in an in-vehicle CAN bus based on the lightweight network MobileViT. Background Technology

[0002] Currently, CAN (Controller Area Network) bus anomalies are a major threat to vehicle-to-everything (V2X) security. A CAN bus anomaly refers to a situation where, during normal vehicle operation, hackers, without the driver's knowledge or permission, use illegal technical means to attack the CAN bus, causing it to malfunction. CAN bus anomaly detection aims to identify all data passing through the CAN bus to prevent CAN bus anomalies from posing a greater threat to driving safety.

[0003] Traditional methods for detecting anomalies in automotive CAN buses include those based on information entropy and those based on information feature classification. The information entropy-based method calculates the information entropy of the CAN bus under normal conditions and sets it as a baseline for anomaly detection. Then, it calculates the information entropy of the CAN bus at each time slice and compares it to the baseline to determine if an anomaly has occurred. A drawback of this method is the difficulty in defining a clear baseline; a slightly higher or lower baseline can significantly impact the accuracy of the detection results. The information feature classification method targets anomalies that occur after an attack on the CAN bus. It selects easily calculated key features of these anomalies as the basis for detection. However, this method struggles to calculate the key features of certain anomalies, thus failing to detect all CAN bus anomalies. Furthermore, both information entropy-based and information feature classification-based methods require complex calculations, consuming significant hardware resources.

[0004] Given the successful applications of deep learning in image processing, speech recognition, natural language processing, and other fields, research on deep learning-based anomaly detection methods for in-vehicle CAN buses has become a hot topic in the field of network and information security. Javed et al. combined convolutional neural networks with gated recurrent units incorporating attention mechanisms to construct an anomaly detection model for in-vehicle CAN buses, and tested it on real in-vehicle CAN buses, ultimately identifying abnormal behavior. However, this method still has significant drawbacks, namely the model's complexity and size, making it difficult to deploy on in-vehicle CAN buses. Lo et al. proposed an intrusion detection method based on convolutional neural networks and long short-term memory networks, utilizing the feature extraction capabilities of convolutional neural networks and the applicability of long short-term memory networks to temporal data. Experiments were conducted on actual in-vehicle CAN buses, showing that this method significantly improves detection accuracy and false alarm rate compared to traditional machine learning methods. However, it suffers from slow model training convergence and long response time.

[0005] In summary, while existing deep learning-based methods for detecting anomalies in automotive CAN buses have certain detection capabilities, they often suffer from problems such as bloated models, numerous parameters, slow convergence speed, and excessively long response times. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide an anomaly detection method for vehicle CAN bus based on the lightweight network MobileViT, which addresses the shortcomings of the prior art.

[0007] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0008] Step 1: Obtain the original dataset and preprocess the behavioral traffic samples in the original dataset to convert the behavioral traffic samples into corresponding behavioral sample images to obtain the image dataset. Divide the image dataset into training set and test set.

[0009] Step 2: Construct a lightweight network model MobileViT, input the training set, initialize its network parameters to obtain the initial vehicle CAN bus anomaly detection model, and perform hyperparameter optimization;

[0010] Step 3: Train the initial vehicle CAN bus anomaly detection model to obtain the trained vehicle CAN bus anomaly detection model;

[0011] Step 4: Using F1 score, precision, recall, and accuracy as evaluation metrics, the trained vehicle CAN bus anomaly detection model is evaluated using a test set. The obtained metric results are compared with those of existing models to verify the detection effect of the vehicle CAN bus anomaly detection model.

[0012] Furthermore, step 1 includes:

[0013] Step 1.1: Obtain the Car-Hacking Dataset dataset as the original dataset;

[0014] Step 1.2: Preprocess the behavioral traffic samples in the original dataset: perform data cleaning and dimensionality transformation on the original dataset to convert the behavioral traffic samples into corresponding behavioral sample images;

[0015] Step 1.3: Generate an image dataset based on the preprocessed behavioral sample images, and randomly divide the image dataset into a training set and a test set in an 8:2 ratio.

[0016] Furthermore, step 2 includes:

[0017] Step 2.1: Construct the lightweight network model MobileViT, whose structure includes: convolutional layers, MV2 modules, MVIT modules, global pooling layers, and fully connected layers;

[0018] Furthermore, step 2.1 also includes:

[0019] The MV2 module is an inverse residual structure, comprising: a convolutional layer with a kernel size of 1×1 and an activation function layer of GELU; a depthwise separable convolutional layer with a kernel size of 3×3 and an activation function layer of GELU; and a convolutional layer with a kernel size of 1×1 and an activation function layer of linear activation function. This inverse residual structure can only have a shortcut connection when the stride is 1 and the input feature matrix and the output feature matrix have the same shape.

[0020] The MVIT module consists of three functional sub-modules: a local feature modeling module, a global feature modeling module, and a feature fusion module. Specifically: the local feature modeling module includes convolutional layers with 3×3 kernels and convolutional layers with 1×1 kernels; the global feature modeling module uses an Unfold->Transformer->Fold structure; and the feature fusion module includes convolutional layers with 1×1 kernels, a concatenation operation, and convolutional layers with 3×3 kernels.

[0021] Step 2.2: Input the training set, initialize the lightweight network model MobileViT, obtain the initial vehicle CAN bus anomaly detection model, and obtain the hyperparameters after model initialization;

[0022] Step 2.3: Use the exponential decay algorithm to automatically update the learning rate, train and update the hyperparameters of the model after initialization, and optimize the initial vehicle CAN bus anomaly detection model. The principle of the exponential decay algorithm is as follows:

[0023] lr t =lr×gamma epoch

[0024] Where lr represents the initial learning rate; lr t This represents the current learning rate; gamma represents the learning rate decay factor, i.e., the base of the learning rate adjustment factor; epoch represents the training epoch.

[0025] Furthermore, step 3 includes:

[0026] Step 3.1: Input the divided training set into the optimized initial vehicle CAN bus anomaly detection model;

[0027] Step 3.2: Train using stochastic gradient descent based on the error calculated from the loss function. In each iteration of stochastic gradient descent, a random and uniform index m, m∈{1,…,n}, is sampled from the data samples, and the gradient is calculated. The trained vehicle CAN bus anomaly detection model is obtained by updating x, as shown in the following formula:

[0028]

[0029] Among them, f m (x) is the loss function for training samples with index m, where x is a parameter vector. f m (x) represents the gradient of the objective function, and η represents the learning rate;

[0030] Compared with the prior art, the technical solution proposed in this invention has the following beneficial effects:

[0031] (1) The improved lightweight MobileViT network model is used to classify the behavioral sample images generated based on the Car-Hacking Dataset dataset, thereby transforming the vehicle CAN bus anomaly detection problem into an image classification problem, thus achieving the detection of abnormal behavior and realizing efficient identification of behavioral traffic samples. This makes the vehicle CAN bus anomaly detection no longer consume a lot of computing resources, improves the detection efficiency, and is very suitable for application scenarios with poor computing power such as vehicle networking.

[0032] (2) This invention is the first to apply the lightweight network model MobileViT to anomaly detection in vehicle CAN bus. The MVIT module in the lightweight network model MobileViT can fully extract image information using only a few parameters; the MV2 module is an inverse residual structure, where depthwise separable convolutions significantly reduce computational load and parameter count while maintaining the feature matrix depth. Furthermore, GELU is used to replace the conventional ReLU6 in the MV2 module as its activation function, effectively solving the neuron death problem and improving model convergence speed. During model training, exponential decay is used to automatically update the learning rate, preventing the model from getting stuck in local optima and reducing training time. Therefore, this invention solves the problems of bloated, numerous parameters, and long response times in existing deep learning-based vehicle CAN bus anomaly detection models, and can efficiently detect anomalies in vehicle CAN bus with relatively low hardware resource consumption. Attached Figure Description

[0033] To more clearly illustrate the specific methods in the embodiments of the present invention, the relevant drawings involved in the embodiments will be briefly described below. The drawings below are only preferred embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative changes.

[0034] Figure 1 This is a flowchart illustrating the vehicle CAN bus anomaly detection method based on the lightweight network MobileViT in this embodiment.

[0035] Figure 2 This is a schematic diagram of the lightweight network MobileViT in this embodiment;

[0036] Figure 3 The following is a schematic diagram of the structure of the MV2 module in this embodiment: (a) MV2 module with shortcut; (b) MV2 module without shortcut;

[0037] Figure 4 The images shown are behavioral sample images generated based on the Car-Hacking Dataset dataset in this embodiment; (a) an image generated based on normal behavior; (b) an image generated based on RPM-Spoofing; (c) an image generated based on Gear-Spoofing; (d) an image generated based on a Denial-of-Service (DoS) attack; and (e) an image generated based on a fuzzy attack.

[0038] Figure 5 This is a schematic diagram of the MVIT module in this embodiment. Detailed Implementation

[0039] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0040] The core idea of ​​this invention is as follows: By cleaning and transforming the Car-Hacking Dataset, one normal behavior and four attack behaviors in the Car-Hacking Dataset are converted into corresponding behavior sample images, resulting in a behavior sample image dataset. This dataset is then divided into training and testing sets. An improved lightweight network model, MobileViT, is constructed and trained using this dataset to classify the behavior sample images generated from the Car-Hacking Dataset. This transforms the problem of detecting anomalies in the vehicle CAN bus into an image classification problem, thereby achieving the detection of anomalies in the vehicle CAN bus. The MVIT module in the lightweight network model MobileViT can fully extract image information using only a few parameters; the MV2 module is an inverse residual structure, where depthwise separable convolutions significantly reduce computation and the number of parameters while maintaining the depth of the feature matrix. The improved lightweight MobileViT network model integrates the feature extraction capabilities of convolutional neural networks and the multi-head attention mechanism of Transformers, enabling the network model to capture different features and patterns in the input data in parallel. By improving the activation function of the MV2 module in the lightweight MobileViT network model, replacing the conventional ReLU6 in the MV2 module with GELU, the neuron death problem is effectively solved, improving the model's convergence speed. During model training, exponential decay is used to automatically update the learning rate, preventing the model from getting stuck in local optima and reducing training time. This invention is the first to apply the lightweight MobileViT network to anomaly detection in automotive CAN buses, enabling efficient anomaly detection in automotive CAN buses with relatively low hardware resource consumption.

[0041] like Figure 1 As shown, this embodiment provides a method for detecting anomalies in an in-vehicle CAN bus based on the lightweight network MobileViT, including the following steps:

[0042] Step 1: Obtain the original dataset and preprocess the behavioral traffic samples in the original dataset to convert the behavioral traffic samples into corresponding behavioral sample images to obtain the image dataset. Divide the image dataset into training set and test set.

[0043] Step 1.1: Obtain the Car-Hacking Dataset dataset as the original dataset;

[0044] In this embodiment, a Car-Hacking Dataset based on a real vehicle environment was obtained from the HCRL Lab at Korea University. The specific behavioral traffic sample types and quantities are shown in Table 1.

[0045] Table 1 Car-Hacking Dataset

[0046]

[0047] Step 1.2: Preprocess the behavioral traffic samples in the original dataset by cleaning the original data, transforming the dimensions, and converting the behavioral traffic samples into corresponding behavioral sample images.

[0048] Step 1.3: Generate an image dataset based on the preprocessed behavioral sample images, and randomly divide the image dataset into a training set and a test set in an 8:2 ratio.

[0049] In this embodiment, the behavioral traffic samples of the Car-Hacking Dataset are preprocessed: First, the Car-Hacking Dataset is cleaned to remove dirty data; then, quantile normalization is used to transform the cleaned behavioral traffic samples to the range of 0-255; finally, based on the feature size and timestamp of the behavioral traffic samples, the transformed 0-255 range behavioral traffic samples are converted into color behavioral sample images with 3 channels, such as... Figure 4 As shown in Table 2, a mapping relationship between behavioral traffic samples and behavioral sample images is finally established. Five behavioral traffic samples correspond to five behavioral sample images, labeled with numbers 0-4.

[0050] Table 2 Correspondence between behavioral traffic samples and numerical data

[0051]

[0052]

[0053] After the above preprocessing, each behavior traffic sample in the acquired Car-Hacking Dataset is transformed into a corresponding behavior sample image with a specific style. An image dataset is then generated based on the behavior style images, thus transforming the vehicle CAN bus anomaly detection problem into an image classification problem, which simplifies the complexity of the problem.

[0054] Step 2: Construct a lightweight network model MobileViT, input the training set, initialize its network parameters to obtain the initial vehicle CAN bus anomaly detection model, and perform hyperparameter optimization;

[0055] Step 2.1: Construct the lightweight network model MobileViT;

[0056] In this embodiment, the lightweight network model MobileViT is constructed as follows: Figure 2 As shown, this network model combines the outstanding feature extraction capabilities of convolutional neural networks with the multi-head attention mechanism in Transformer. Its structure includes: convolutional layers, MV2 modules, MViT modules, global pooling layers, and fully connected layers.

[0057] In this embodiment, the MV2 module structure is as follows: Figure 3 As shown, this module is an inverse residual structure. First, the feature map, i.e., the input behavioral sample image, is processed by the output of the previous module. Then, it is passed through a convolutional layer with a kernel size of 1×1 and activated by the GELU function. Next, a depthwise separable convolutional layer with a kernel size of 3×3 is used for convolution, activated by the GELU function. Unlike traditional convolution, depthwise separable convolution can significantly reduce the amount of computation and the number of parameters while maintaining the depth of the feature matrix. Finally, it is passed through a convolutional layer with a kernel size of 1×1 and activated by a linear activation function. This inverse residual structure can only have a shortcut connection when the stride is 1 and the input feature matrix and the output feature matrix have the same shape.

[0058] In this embodiment, the structure of the MobileViT module is as follows: Figure 5As shown, the module consists of three functional sub-modules: a local feature modeling module, a global feature modeling module, and a feature fusion module. The feature map is first modeled locally using the local feature modeling module with a 3×3 convolutional layer, followed by a 1×1 convolutional layer to adjust the number of channels. Next, the global feature modeling module performs global feature modeling using an Unfold->Transformer->Fold structure, followed by a 1×1 convolutional layer to adjust the number of channels to the initial size. Then, a Shortcut branch is used to concatenate the feature map with the original input feature map along the channel direction. Finally, a 3×3 convolutional layer is used for feature fusion to obtain the output. This module achieves the function of fully extracting image feature information with only a few parameters.

[0059] In this embodiment, the modules through which the training set data is input into the MobileViT model, the operations performed, and the number of output channels are shown in Table 3.

[0060] Table 3 MobileViT Model Details

[0061]

[0062] Where, input represents the data input size; operator represents the type of operation module performed on the data; out represents the number of output channels after passing through the operation module; L represents the number of transformer modules in the MVIT module; s represents the stride of the operation; conv represents the convolution operation; MV2 represents the MobileNetV2 module, and MVIT represents the MobileViT module; avgpool8×8 represents an average pooling layer of size 8×8; FC represents a fully connected layer.

[0063] Step 2.2: Input the training set, initialize the lightweight network model MobileViT, obtain the initial vehicle CAN bus anomaly detection model, and obtain the hyperparameters after model initialization;

[0064] In this embodiment, the Xavier method is used for network parameter initialization. To ensure consistent variance across layers during forward and backward propagation, the variance of activation values ​​remains constant during forward propagation, and the variance of gradient values ​​remains constant during backward propagation. The distribution range of the randomly initialized parameters is determined by the number of inputs and outputs of each layer, resulting in a uniform distribution within the range obtained from the number of input and output parameters for that layer. To ensure that the variance of each layer is as equal as possible and to facilitate better information flow in the network, the weights of each layer are initialized to a uniform distribution within the following range, as shown in the formula:

[0065]

[0066] Where W~U represents a uniform distribution within a symmetrical interval; n j This indicates that the j-th convolutional layer has n parameters;

[0067] Step 2.3: Use the exponential decay algorithm to automatically update the learning rate, train the hyperparameters after model initialization, and optimize the initial vehicle CAN bus anomaly detection model. The principle of the exponential decay algorithm is as follows:

[0068] lr t =lr×gamma epoch

[0069] Where lr represents the initial learning rate; lr t This represents the current learning rate; gamma represents the learning rate decay factor, i.e., the base of the learning rate adjustment factor; epoch represents the training epoch.

[0070] Using this learning rate update strategy ensures the training speed of the model, prevents the learning rate from being set too high in the early stage of model training, and avoids oscillations at stationary points during gradient descent. It also prevents the model from converging to a local optimum due to setting the learning rate too low at the beginning.

[0071] Step 3: Train the initial vehicle CAN bus anomaly detection model to obtain the trained vehicle CAN bus anomaly detection model;

[0072] Step 3.1: Input the divided training set into the optimized initial vehicle CAN bus anomaly detection model;

[0073] Step 3.2: Train using stochastic gradient descent based on the error calculated from the loss function. In each iteration of stochastic gradient descent, a random and uniform index m, m∈{1,…,n}, is sampled from the data samples, and the gradient is calculated. The trained vehicle CAN bus anomaly detection model is obtained by updating x, as shown in the following formula:

[0074]

[0075] Among them, f m (x) is the loss function for training samples with index m, where x is a parameter vector. f m (x) represents the gradient of the objective function, and η represents the learning rate.

[0076] In this embodiment, the cross-entropy loss function is chosen to measure the error between the classification result of the behavior sample image and the actual result during training. It is a non-negative function; the smaller the loss function, the better the robustness of the model. The cross-entropy loss function is expressed as follows:

[0077]

[0078] Where, p i Represents a probability distribution, i = 0, 1, ..., c-1, where each element p i y represents the probability that a sample belongs to the i-th class of behavior sample images; i The labels are represented in vector form, i = 0, 1, ..., c-1. When the behavior sample image belongs to category i, y i =1, otherwise y i =0; c represents the label of the behavioral sample image.

[0079] Step 4: Using F1 score, precision, recall and accuracy as evaluation metrics, evaluate the trained vehicle CAN bus anomaly detection model using the test set, and compare the obtained metric results with the metrics of existing models to verify the detection effect of the vehicle CAN bus anomaly detection model.

[0080] In this embodiment, the F1 score, precision, recall, and accuracy, all recognized in the field, are used as evaluation metrics. Precision is used to assess the accuracy of each model by comparing their values. Recall is used to assess the stability of each model by comparing how many true values ​​it correctly predicts out of all correct data. Precision is used to assess the robustness of each model by comparing the proportion of true values ​​it correctly predicts out of all correct data. The F1 score is used to assess the binary classification performance of each model by comparing the proportion of normal traffic and attack traffic it correctly classifies.

[0081] In addition, this embodiment also compares three indicators: number of parameters, training time, and testing time. The number of parameters of each model is compared to evaluate the size of the trained vehicle CAN bus anomaly detection model, and the training time and testing time of each model are compared to evaluate the detection efficiency of the vehicle CAN bus anomaly detection model.

[0082] In this embodiment, to verify the effectiveness of the method of the present invention, VGG16, Inception, Xception, ResNet, and Vision-Transformer are used to represent complex network models, while ShuffleNetV2, MobileNetV3, MobileViT, and the improved network model MobileViT are used to represent lightweight network models. Comparative experiments are conducted, and the experimental results are shown in Table 4.

[0083] Table 4. Experimental results of the evaluation of the vehicle-mounted CAN bus anomaly detection model.

[0084]

[0085]

[0086] The experimental results lead to the following conclusions: the improved vehicle CAN bus anomaly detection model provided in this embodiment has the lowest number of parameters, only 2.12M, and the shortest test time indicates a fast response. Moreover, its detection accuracy is the same as that of complex models, thus it is suitable for anomaly detection of vehicle CAN bus.

[0087] In summary, this embodiment achieves efficient identification of behavioral traffic samples, solving the problems of bloated, numerous parameters, and long response times in existing deep learning-based vehicle CAN bus anomaly detection models. Furthermore, this embodiment is the first to apply the lightweight network MobileViT to anomaly detection on the vehicle CAN bus, and the trained model is only 2.12M in size, making it easy to deploy on low-computing-power platforms such as vehicle-to-everything (V2X) networks.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein; therefore, these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope defined by the claims of the present invention.

Claims

1. A method for detecting anomalies in an in-vehicle CAN bus based on the lightweight network MobileViT, characterized in that: The process includes the following: Step 1: Obtain the original dataset and preprocess the behavioral traffic samples in the original dataset to convert the behavioral traffic samples into corresponding behavioral sample images to obtain the image dataset. Divide the image dataset into training set and test set. Step 2: Construct a lightweight network model MobileViT, input the training set, initialize its network parameters to obtain the initial vehicle CAN bus anomaly detection model, and perform hyperparameter optimization; Step 2.1: Construct the lightweight network model MobileViT, whose structure includes: convolutional layers, MV2 modules, MVIT modules, global pooling layers, and fully connected layers; Step 2.2: Input the training set, initialize the lightweight network model MobileViT, obtain the initial vehicle CAN bus anomaly detection model, and obtain the hyperparameters after model initialization; Step 2.3: Use the exponential decay algorithm to automatically update the learning rate, train and update the hyperparameters of the model after initialization, and optimize the initial vehicle CAN bus anomaly detection model. The principle of the exponential decay algorithm is as follows: ； in, Indicates the initial learning rate; Indicates the current learning rate; This represents the learning rate decay factor, which is the base of the learning rate adjustment factor; Indicates the training round; Step 3: Train the initial vehicle CAN bus anomaly detection model to obtain the trained vehicle CAN bus anomaly detection model; Step 4: Using F1 score, precision, recall, and accuracy as evaluation metrics, the trained vehicle CAN bus anomaly detection model is evaluated using a test set. The obtained metric results are compared with those of existing models to verify the detection effect of the vehicle CAN bus anomaly detection model.

2. The method for detecting anomalies in an in-vehicle CAN bus based on the lightweight network MobileViT as described in claim 1, characterized in that: Step 1 includes: Step 1.1: Obtain the Car-Hacking Dataset dataset as the original dataset; Step 1.2: Preprocess the behavioral traffic samples in the original dataset: perform data cleaning and dimensionality transformation on the original dataset to convert the behavioral traffic samples into corresponding behavioral sample images; Step 1.3: Generate an image dataset based on the preprocessed behavioral sample images, and randomly divide the image dataset into a training set and a test set in an 8:2 ratio.

3. The method for detecting anomalies in an in-vehicle CAN bus based on the lightweight network MobileViT as described in claim 1, characterized in that: The MV2 module in step 2.1 is an inverted residual structure, including: a convolutional layer with a kernel size of 1×1 and an activation function layer of GELU; a depthwise separable convolutional layer with a kernel size of 3×3 and an activation function layer of GELU; and a convolutional layer with a kernel size of 1×1 and an activation function layer of linear activation function. This inverted residual structure can only be connected by a shortcut when the stride is 1 and the input feature matrix and the output feature matrix have the same shape.

4. The method for detecting anomalies in an in-vehicle CAN bus based on the lightweight network MobileViT as described in claim 1, characterized in that: The MVIT module in step 2.1 consists of three functional sub-modules: a local feature modeling module, a global feature modeling module, and a feature fusion module. Specifically: the local feature modeling module includes convolutional layers with a 3×3 kernel and convolutional layers with a 1×1 kernel; the global feature modeling module uses an Unfold->Transformer->Fold structure; and the feature fusion module includes convolutional layers with a 1×1 kernel, a concatenation operation, and convolutional layers with a 3×3 kernel.

5. The method for detecting anomalies in an in-vehicle CAN bus based on the lightweight network MobileViT as described in claim 1, characterized in that: Step 3 includes: Step 3.1: Input the divided training set into the optimized initial vehicle CAN bus anomaly detection model; Step 3.2: Train using stochastic gradient descent based on the error calculated from the loss function. In each iteration of stochastic gradient descent, a random and uniform index is sampled from the data samples. , And calculate the gradient To update The trained vehicle CAN bus anomaly detection model is obtained, and the formula is as follows: ； in, It's about indexes. The loss function for the training samples, where It is a parameter vector. The gradient of the objective function. This is the learning rate.

Images