A vehicle-mounted CAN bus abnormal flow detection and tracing method and system

Abstract

The application provides a vehicle-mounted CAN bus abnormal flow detection and tracing method and system, which solves the technical problem that the existing vehicle-mounted network abnormal detection method cannot realize abnormal ECU tracing; comprising: acquiring CAN bus flow data and processing to generate a node feature matrix, a feature adjacency matrix and a mapping table of CAN ID and sending source ECU; inputting the node feature matrix and the feature adjacency matrix into a graph convolution network GCN for learning and training; and tracing the abnormal ECU according to the trained graph convolution network GCN and the mapping table of CAN ID and sending source ECU. The application is widely applied in the technical field of vehicle-mounted network abnormal detection.

Description

Technical Field

[0001] This application relates to a method for detecting anomalies in vehicle networks, and more specifically, to a method and system for detecting and tracing abnormal traffic on a vehicle CAN bus. Background Technology

[0002] As an important component of vehicle-to-everything (V2X) and intelligent transportation systems, intelligent connected vehicles equipped with in-vehicle communication networks and various embedded computing devices are rapidly becoming widespread.

[0003] As the de facto in-vehicle network communication standard in the automotive industry, the Controller Area Network (CAN) bus communication protocol enables communication between various Electronic Control Units (ECUs) within the vehicle. ECUs transmit CAN protocol messages using bit-by-bit arbitration and plaintext broadcasting, thus achieving fast and efficient data exchange. However, the CAN bus lacks sufficient security features: weak communication interface access control, lack of authentication for data interaction, and the absence of source and destination addresses for messages make vehicles vulnerable to malicious attacks. Vehicle malfunctions directly impact traffic safety and passenger safety; therefore, protecting vehicle network security and defending against cyberattacks on in-vehicle networks is an urgent and crucial issue.

[0004] Research indicates that existing vehicle network anomaly detection technologies have gradually shifted from detecting the physical characteristics of ECUs to detecting the characteristics of CAN message data streams interacting between ECUs. Mainstream methods often employ deep convolutional neural networks (CNNs) or recurrent neural network (RNN) models. However, most supervised neural network models mark the entire data stream containing injected messages as an attack, weakening detection accuracy and making it impossible to definitively identify which CAN message corresponds to the ECU with the anomaly, thus hindering the tracing of malicious (abnormal) ECUs. Furthermore, current research primarily focuses on improving detection performance, such as increasing accuracy, precision, and recall, and reducing false positives, but pays insufficient attention to generalization capabilities. A few anomaly detection schemes consider the contextual information of the data stream, but fail to consider that the logical topology characteristics between ECUs and the coupling characteristics of the data stream are also crucial for improving generalization capabilities. Additionally, the use of deep learning methods such as deep convolutional neural networks generally suffers from drawbacks such as numerous network layers, many parameters, and large model size. Summary of the Invention

[0005] To address the problem that existing in-vehicle network anomaly detection methods cannot trace the source of abnormal ECUs, this application adopts the following technical solution: providing a method for detecting and tracing abnormal traffic on an in-vehicle CAN bus, including:

[0006] Acquire CAN bus traffic data and process it to generate node feature matrix, feature adjacency matrix and mapping table of CAN ID and transmitting source ECU;

[0007] The node feature matrix and feature adjacency matrix are input into the graph convolutional network GCN for learning and training.

[0008] Based on the trained graph convolutional network GCN and the mapping table between CAN ID and the sending source ECU, the abnormal ECU is traced.

[0009] Preferably, acquiring CAN bus traffic data refers to acquiring CAN bus traffic data that includes timestamps, CAN IDs, Data field values, and category labels.

[0010] Preferably, the node feature matrix is ​​generated, and the specific steps include:

[0011] The CAN bus messages are divided into several consecutive windows, and each window contains multiple CAN messages;

[0012] Construct a message sequence relationship graph for each window and extract the graph attributes;

[0013] Each CAN message retains a normal or abnormal label, and the data field values ​​of the CAN message are preprocessed to generate a feature vector;

[0014] The graph attributes and feature vectors are concatenated to generate a node feature matrix.

[0015] Preferably, a message sequence association graph is constructed for each window, with the following specific processing steps:

[0016] Treat each different CAN ID value within the window as a node, and construct an edge between the nodes corresponding to each pair of consecutive CAN messages, pointing from the next CAN ID to the previous CAN ID, to obtain the message timing relationship graph for each window.

[0017] Preferably, the characteristic adjacency matrix is ​​generated, and the specific steps include:

[0018] The CAN bus messages are divided into several consecutive windows, and each window contains multiple CAN messages;

[0019] Construct a CAN bus data flow coupling graph for each window and generate an adjacency matrix.

[0020] Preferably, a CAN bus data flow coupling diagram is constructed for each window, with the following specific processing steps:

[0021] Treat each CAN message in the window as a node;

[0022] A connection edge is constructed between two adjacent nodes, and a connection edge is constructed between nodes with the same CAN ID value to generate a data flow coupling graph for the window.

[0023] Preferably, a mapping table between CAN IDs and the transmitting source ECU is generated, and the specific steps include:

[0024] Collect CAN ID data streams with timestamps;

[0025] A pairwise clock offset tracking algorithm is used to determine whether different CAN IDs are issued by the same ECU.

[0026] Cluster CAN IDs from the same source to obtain a mapping table between CAN IDs and ECUs.

[0027] Preferably, a pairwise clock offset tracking algorithm is used to determine whether different CAN IDs are issued by the same ECU. Specific processing steps include:

[0028] The cycle of each of the two CAN IDs is counted, and the clock offset difference between the two CAN IDs at each over-cycle time is calculated. If the difference is less than the set threshold, then the two CAN IDs are issued by the same ECU.

[0029] Preferably, the abnormal ECU is traced based on the trained graph convolutional network (GCN) and the mapping table between CAN ID and the sending source ECU. Specific steps include:

[0030] The trained GCN network performs fine-grained anomaly detection on the CAN bus data stream;

[0031] Extract the CAN ID field content of the abnormal CAN message, and use it in conjunction with the mapping table between the CAN ID and the sending source ECU to find the abnormal ECU.

[0032] The present invention also provides an on-board CAN bus abnormal flow detection system, comprising:

[0033] Traffic acquisition module: used to acquire CAN bus traffic data and process it to generate node feature matrix, feature adjacency matrix and mapping table of CAN ID and transmitting source ECU;

[0034] Traffic learning module: Input the node feature matrix and feature adjacency matrix into the graph convolutional network GCN for learning and training;

[0035] Traffic tracing module: Based on the trained graph convolutional network GCN and the mapping table between CAN ID and the sending source ECU, it traces the abnormal ECU.

[0036] The beneficial effects of this invention are that it provides a method for detecting and tracing abnormal traffic on an in-vehicle CAN bus based on message timing association graphs and data flow coupling graphs. A topological structure oriented towards ECU logical associations, namely a message timing association graph, is generated from the timing characteristics of messages and the logical topology features of ECUs. Graph attributes are extracted to generate node features, and an adjacency matrix is ​​generated through the data flow coupling graph. A shallow graph convolutional network is used for learning and computation to achieve anomaly detection accurate to each in-vehicle CAN message. Combined with a pairwise clock offset tracking algorithm, the method traces the source of attacked and abnormal ECUs. This solves the problems of existing mainstream neural network-based intelligent anomaly detection algorithms, such as difficulty in ECU source tracing, insufficient generalization ability, model complexity, large size, and many parameters, thus realizing the detection and tracing of abnormal traffic on the in-vehicle CAN bus. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 Flowchart of the method for detecting and tracing abnormal traffic on the vehicle CAN bus;

[0039] Figure 2 A schematic diagram of a single window divided by messages from the CAN bus;

[0040] Figure 3 for Figure 2 Message sequence diagram for the window. Detailed Implementation

[0041] To make the technical problems, technical solutions, and beneficial effects to be solved by this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the scope of this application.

[0042] It should be noted that the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0043] This invention proposes a method for detecting and tracing abnormal traffic on an in-vehicle CAN bus based on message timing correlation graphs and data flow coupling graphs. This method considers the timing correlation of CAN messages generated by each ECU and the logical topology characteristics of the ECUs. The goal is to fuse node features and global features to replace existing methods that are solely based on data flow. An adjacency matrix is ​​constructed using the data flow coupling graph, and then learned in a shallow Graph Convolutional Network (GCN). The trained GCN and clock offset features are used to detect and trace abnormal ECUs.

[0044] To achieve high-accuracy anomaly traffic source tracing and detection, this method retains normal or anomaly attribute labels for each training data point and combines them with a mapping table of CAN ID and the sending source ECU, enabling precise ECU localization. To achieve strong generalization capability, this method extracts the ECU logical topology features of CAN messages, generates a message timing correlation graph based on continuous vehicle CAN messages, and combines the cross-correlation between adjacent CAN bus data to generate a feature adjacency matrix by extracting data flow coupling relationships, ensuring the learning of more comprehensive traffic features suitable for anomaly detection. Furthermore, using a shallow GCN reduces the computation time for data processing, achieving a more lightweight approach.

[0045] Please see Figure 1 This is a flowchart illustrating a method for detecting and tracing abnormal traffic on a vehicle CAN bus according to an embodiment of this application. For ease of explanation, only the parts relevant to this embodiment are shown, and the details are as follows:

[0046] In one embodiment, a method for detecting and tracing abnormal traffic on a vehicle CAN bus includes:

[0047] S101. Obtain CAN bus traffic data;

[0048] Specifically, within a continuous period of time, traffic data from the CAN bus, including timestamps, CAN IDs, Data field values, and category labels, is acquired for feature extraction and mapping table generation in subsequent steps.

[0049] S102. Generate a node feature matrix, a feature adjacency matrix, and a mapping table between CAN ID and the transmitting source ECU based on the CAN bus traffic data;

[0050] Specifically, the node feature matrix is ​​generated as follows:

[0051] To more effectively extract the timing characteristics and ECU logic topology features of the CAN messages generated by each ECU, node feature extraction is performed based on the vehicle CAN bus message timing association diagram.

[0052] First, construct the timing relationship diagram of the vehicle CAN bus messages.

[0053] Please see Figure 2 A "window" is defined as an appropriate range of vehicle CAN messages. A timing diagram is constructed for all messages within a window. For example, the window size in this embodiment is 9. Each CAN message includes an arbitration field (CAN ID field), a DLC field, and a Data field. The arbitration field (CAN ID field) is the unique identifier of the CAN message, and also indicates the message priority and function address; the DLC field indicates the length of the Data field; the Data field indicates the information carried by the message.

[0054] The CAN bus messages are divided into several consecutive windows, each containing multiple CAN messages. For example... Figure 2 One of the windows shown represents a single CAN message in each row. A message timing graph is constructed for each message within the window. Specifically, each distinct CAN ID value within the window is considered a node. An edge is constructed between nodes corresponding to consecutive CAN messages, pointing from the later CAN ID to the earlier CAN ID, thus deriving the relationship graph of CAN IDs throughout the entire window (see reference). Figure 3 Record this directed graph as the message timing association graph of this window, and then obtain several message timing association graphs of several windows, that is, obtain the message timing association graph of the CAN bus.

[0055] Secondly, graph attributes such as the number of nodes, edges, and maximum degree are extracted from the temporal correlation graph of each message for anomaly characterization. A normal or abnormal label is retained for each CAN message, and the values ​​in the Data field of that CAN message are preprocessed to generate feature vectors. The graph attributes of the graph containing a node are concatenated with the feature vectors of each CAN message corresponding to that node; that is, global features are concatenated with node features to generate the final node feature matrix that can be input into the GCN.

[0056] Specifically, the feature adjacency matrix is ​​generated as follows:

[0057] To model the "interaction" of data flows and extract the cross-correlation between adjacent data to generate an adjacency matrix, this method constructs a data flow coupling graph for nodes within each window to extract the coupling degree of the CAN bus data flow. The data flow coupling relationship is reflected in the following: two data messages sent consecutively have contextual association, and two data messages with the same CAN ID value have similarity. Therefore, the method for constructing a data flow coupling graph (undirected graph) for the vehicle CAN bus data within each window is as follows: The same window partitioning method is used as in constructing the message timing association graph; the difference is that each CAN message is treated as a node, meaning the number of nodes equals the window size. For example... Figure 2 The window shown has a size of 9, indicating that it contains 9 CAN messages, meaning there are 9 nodes. After determining the nodes, connections are made between them: an edge connects two adjacent CAN messages, and nodes with the same CAN ID value are connected to each other. The adjacency matrix of the generated data flow coupling graph of several windows is the feature adjacency matrix input into the GCN.

[0058] Specifically, the mapping table between CAN IDs and the transmitting source ECU is generated as follows:

[0059] Since CAN messages lack source information, tracing the origin requires unique identification features that can be associated with an ECU. Each vehicle ECU has its own local crystal clock, and the clocks of different ECUs on the vehicle CAN bus are asynchronous. Clock skew can be considered as a mechanism to identify the sending ECU. However, existing algorithms calculate clock skew that is severely affected by noise and periodicity, and the clock skew values ​​for different CAN IDs from the same ECU are not identical. Therefore, this method calculates the clock offset of two different CAN IDs to determine whether they come from the same ECU, thereby reducing the impact of noise. A normal CAN bus traffic dump over several minutes is read, recording the timestamped CAN traffic for each CAN ID. For every two different CAN IDs, a pairwise clock offset tracking algorithm is used: the period of each ID is counted, and the clock offset difference between the two CAN IDs at each over-cycle moment is calculated. If the difference is less than a pre-set threshold, the two CAN IDs are considered to have been sent by the same ECU.

[0060] Because the arbitration decision-making process in vehicle CAN bus communication affects the transmission cycle of some CAN IDs, it is necessary to collect more samples for each CAN ID and repeat the above steps five times to reduce errors. CAN IDs from the same source are clustered, thereby determining the CAN IDs transmitted by all vehicle ECUs and deriving a mapping table between CAN IDs and the transmitting source ECUs.

[0061] S103. Train the Graph Convolutional Network (GCN);

[0062] Specifically, to achieve anomaly detection for each CAN message, a 3-layer GCN network with 32 neurons in each hidden layer is first constructed. This requires only 2592 parameters for training, significantly reducing the number of hidden layers and millions of parameters required by previous neural network methods. Since step S102 has already generated the input samples needed for the GCN: node feature matrices and feature adjacency moments, the input samples are then divided into training samples and test samples. The training samples are used for training, and the GCN model with the best test results is selected for the next step of source tracing detection.

[0063] GCN networks can handle non-Euclidean space data that convolutional neural networks cannot process, and can more effectively extract features for learning and training on graph structures. Therefore, this method can achieve high-precision source detection that previous deep learning methods could not achieve. Furthermore, it can effectively capture the features representing nodes and edges while having a low parameter count. The message sequence association graph and data flow coupling graph expand the global information of the graph, giving GCN better generalization ability. Even a few shallow layers are sufficient to achieve good abnormal traffic monitoring and source tracing effects, making the model more lightweight and computationally less burdensome.

[0064] S104. Based on the trained Graph Convolutional Network (GCN) and the mapping table between CAN ID and the sending source ECU, trace the abnormal ECU.

[0065] Specifically, the trained GCN network performs fine-grained anomaly detection on the CAN bus data stream, obtaining the corresponding detection result for each CAN message. For CAN messages with anomaly detection results, the following tracing is performed: the corresponding CAN message is located, the content of the message's arbitration field (CAN ID field) is extracted, and the source ECU of the message can be found using the constructed mapping table of CAN ID and sending source ECU, thereby locating the attacked abnormal ECU. Based on this, subsequent security emergency response work can be carried out as needed.

[0066] In one embodiment, a method for detecting and tracing abnormal traffic on a vehicle CAN bus may include a step of generating a mapping table between CAN ID and the sending source ECU, which may be located between steps S103 and S104.

[0067] The second aspect of this application provides an on-board CAN bus abnormal traffic detection and tracing system, including a traffic acquisition module, a traffic learning module, and a traffic tracing module.

[0068] Traffic acquisition module: used to acquire CAN bus traffic data and process it to generate node feature matrix, feature adjacency matrix and mapping table of CAN ID and transmitting source ECU;

[0069] Traffic learning module: Input the node feature matrix and feature adjacency matrix into the graph convolutional network GCN for learning and training;

[0070] Traffic tracing module: Based on the trained graph convolutional network GCN and the mapping table between CAN ID and the sending source ECU, it traces the abnormal ECU.

[0071] It should be noted that the vehicle CAN bus abnormal flow detection and tracing system in this embodiment is an embodiment of the system corresponding to the above-mentioned vehicle CAN bus abnormal flow detection and tracing method. Therefore, for the specific implementation of the software methods in each module of the flow abnormality detection and tracing system, please refer to... Figures 1-3 The specific implementation examples are not described in detail here.

[0072] This invention provides a method for detecting and tracing anomalies in vehicle CAN bus traffic based on message timing association graphs and data flow coupling graphs. A topology structure oriented towards ECU logical associations, namely a message timing association graph, is generated from the timing characteristics of messages and the logical topology features of ECUs. Graph attributes are extracted to generate node features. An adjacency matrix is ​​generated through the data flow coupling graph. A shallow graph convolutional network (GCN) is used to quickly and efficiently learn the multi-dimensional features of CAN bus traffic data, achieving fine-grained detection down to the level of each data line. A mapping table between CAN IDs generated by a pairwise clock offset algorithm and ECUs is used to trace the attacked ECUs. The combination of message timing association graphs, data flow coupling graphs, and GCN enhances detection accuracy and speed, achieving both fast and accurate anomaly traffic detection and tracing. It enables anomaly detection down to the level of each vehicle CAN message. The paired clock offset tracking algorithm is used to trace the attacked abnormal ECUs simultaneously. It solves the problems of existing mainstream neural network-based intelligent anomaly detection algorithms, such as difficulty in ECU traceability, insufficient generalization ability, complexity of deep learning models, and high computational burden.

[0073] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0074] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for detecting and tracing abnormal traffic on a vehicle-mounted CAN bus, characterized in that, include: Acquire CAN bus traffic data and process it to generate node feature matrix, feature adjacency matrix and mapping table of CAN ID and transmitting source ECU; The node feature matrix and feature adjacency matrix are input into the graph convolutional network GCN for learning and training. Based on the trained graph convolutional network GCN and the mapping table between CAN ID and the sending source ECU, the abnormal ECU is traced. The specific steps for generating the node feature matrix include: The CAN bus messages are divided into several consecutive windows, and each window contains multiple CAN messages; Construct a message sequence relationship graph for each window and extract the graph attributes; Each CAN message retains a normal or abnormal label, and the data field values ​​of the CAN message are preprocessed to generate a feature vector; Concatenate graph attributes with feature vectors to generate a node feature matrix; Constructing a message sequence diagram for each window, with specific processing steps: Treat each different CAN ID value within the window as a node, and construct an edge between the nodes corresponding to each pair of consecutive CAN messages, pointing from the next CAN ID to the previous CAN ID, to obtain the message timing relationship graph for each window; The specific steps for generating the feature adjacency matrix include: The CAN bus messages are divided into several consecutive windows, and each window contains multiple CAN messages; Construct a CAN bus data flow coupling graph for each window and generate an adjacency matrix; Constructing the CAN bus data flow coupling diagram for each window, with specific processing steps: Treat each CAN message in the window as a node; A connection edge is constructed between two adjacent nodes, and a connection edge is constructed between nodes with the same CAN ID value to generate a data flow coupling graph for the window.

2. The method for detecting and tracing abnormal traffic on a vehicle-mounted CAN bus as described in claim 1, characterized in that: The acquisition of CAN bus traffic data refers to acquiring traffic data of the CAN bus that includes timestamps, CAN IDs, Data field values, and category labels.

3. The method for detecting and tracing abnormal traffic on a vehicle-mounted CAN bus as described in claim 1, characterized in that: Generate a mapping table between CAN IDs and the transmitting source ECU. The specific steps include: Collect CAN ID data streams with timestamps; A pairwise clock offset tracking algorithm is used to determine whether different CAN IDs are issued by the same ECU. Cluster CAN IDs from the same source to obtain a mapping table between CAN IDs and ECUs.

4. The method for detecting and tracing abnormal traffic on the vehicle CAN bus as described in claim 3, characterized in that: A pairwise clock offset tracking algorithm is used to determine whether different CAN IDs are issued by the same ECU. The specific processing steps are as follows: The cycle of each of the two CAN IDs is counted, and the clock offset difference between the two CAN IDs at each over-cycle time is calculated. If the difference is less than the set threshold, then the two CAN IDs are issued by the same ECU.

5. The method for detecting and tracing abnormal traffic on a vehicle-mounted CAN bus as described in claim 1, characterized in that: Based on the trained graph convolutional network (GCN) and the mapping table between CAN ID and the transmitting source ECU, the abnormal ECU is traced. The specific steps include: The trained GCN network performs fine-grained anomaly detection on the CAN bus data stream; Extract the CAN ID field content of the abnormal CAN message, and use it in conjunction with the mapping table between the CAN ID and the sending source ECU to find the abnormal ECU.

6. A vehicle-mounted CAN bus abnormal flow detection system, characterized in that, include: Traffic acquisition module: used to acquire CAN bus traffic data and process it to generate node feature matrix, feature adjacency matrix and mapping table of CAN ID and transmitting source ECU; Traffic learning module: Input the node feature matrix and feature adjacency matrix into the graph convolutional network GCN for learning and training; Traffic tracing module: Based on the pre-trained graph convolutional network GCN and the mapping table between CAN ID and the sending source ECU, it traces the abnormal ECU. The specific steps for generating the node feature matrix include: The CAN bus messages are divided into several consecutive windows, and each window contains multiple CAN messages; Construct a message sequence relationship graph for each window and extract the graph attributes; Each CAN message retains a normal or abnormal label, and the data field values ​​of the CAN message are preprocessed to generate a feature vector; Concatenate graph attributes with feature vectors to generate a node feature matrix; Constructing a message sequence diagram for each window, with specific processing steps: Treat each different CAN ID value within the window as a node, and construct an edge between the nodes corresponding to each pair of consecutive CAN messages, pointing from the next CAN ID to the previous CAN ID, to obtain the message timing relationship graph for each window; The specific steps for generating the feature adjacency matrix include: The CAN bus messages are divided into several consecutive windows, and each window contains multiple CAN messages; Construct a CAN bus data flow coupling graph for each window and generate an adjacency matrix; Constructing the CAN bus data flow coupling diagram for each window, with specific processing steps: Treat each CAN message in the window as a node; A connection edge is constructed between two adjacent nodes, and a connection edge is constructed between nodes with the same CAN ID value to generate a data flow coupling graph for the window.

Images