A cloud-vehicle linkage intrusion detection method and system based on multi-dimensional features

Abstract

This invention discloses a cloud-vehicle linkage intrusion detection method and system based on multi-dimensional features. The method involves collecting data generated by vehicles under normal conditions; mapping the data to three dimensions—time, data stream, and voltage—to obtain a feature set, which is then uploaded to a cloud server; constructing an intrusion detection model based on the XGBoost method and training the model on the cloud server; distributing the trained intrusion detection model to vehicles; and predicting whether a vehicle has been intruded based on whether the current data matches the vehicle's label. This invention can be directly applied to different vehicles without requiring model retraining or transfer learning, and its detection accuracy is unaffected by the attack type.

Description

Technical Field

[0001] This invention belongs to the field of unmanned aerial vehicle (UAV) communication technology, specifically relating to a cloud-vehicle linkage intrusion detection method and system based on multi-dimensional features. Background Technology

[0002] With the rapid development of digitalization processes such as artificial intelligence, 5G, and cloud computing, modern intelligent vehicles have integrated an increasing number of functional interfaces. While these technologies improve the user's driving experience, they also open up numerous interfaces for connection to the external network, making the in-vehicle network more vulnerable to malicious attacks. The CAN bus, as a typical in-vehicle network bus, is directly linked to vehicle security. However, its initial design environment was physically isolated, thus lacking any encryption or authentication defenses, making it a prime target for hackers. To address various attacks, researchers have proposed various types of intrusion detection systems (IDS) to protect vehicle security, but most IDS have limitations that restrict their practical application.

[0003] First, most IDS are designed based on the parameter characteristics of specific vehicles, making them difficult to apply directly to other types of vehicles, and the performance of the model after application cannot be guaranteed.

[0004] Second, these IDSs detect attacks based on changes in features within a single dimension, which limits their ability to detect other types of attacks. For example, traffic-based IDSs are good at detecting attacks related to data modification but have difficulty tracing the attack source; voltage-based IDSs can identify the attack source but cannot detect attacks related to the time dimension, such as bus-off attacks; and time-based IDSs can capture attacks related to time changes but have difficulty identifying data modifications.

[0005] Third, many IDS are built on machine learning or deep learning (ML / DL) algorithms, and they are deployed on vehicles for both training and detection. Vehicles with limited resources cannot meet their high computing power requirements. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a cloud-vehicle linkage intrusion detection method and system based on multi-dimensional features to address the shortcomings of the prior art. This method and system solve the technical problems of low universality of IDS designed based on a single vehicle parameter, limited single-dimensional feature detection capability, and the fact that ML-based IDS increases the computational burden on vehicles.

[0007] The present invention adopts the following technical solution:

[0008] A cloud-vehicle linkage intrusion detection method based on multi-dimensional features includes the following steps:

[0009] S1. Collect data generated under normal vehicle conditions;

[0010] S2. Map the data obtained in step S1 to the three dimensions of time, data stream and voltage to obtain the feature set and upload it to the cloud server.

[0011] S3. Construct an intrusion detection model based on the XGBoost method and train the intrusion detection model using a cloud server;

[0012] S4. Distribute the intrusion detection model trained in step S3 to the vehicles and predict whether the vehicle has been intruded based on whether the current data matches the vehicle label.

[0013] Specifically, in step S1, the data frame is transmitted on the CAN bus using a broadcast mechanism, and the content, time, and voltage signal of the transmitted data frame are obtained. The voltage signal is sampled at a rate of 12.5 MS / s.

[0014] Specifically, in step S2, the features calculated in the time dimension include message period, clock offset, and each The cumulative clock offset of the data frame;

[0015] In the data stream dimension, the information entropy of the payload is calculated to capture the change pattern of the data field in consecutive CAN frames; the Hamming distance of the message data field with the same ID is calculated to obtain the change pattern of the data content of the same ID under normal circumstances; and the Euclidean distance of the ID field in the data frame is calculated to reflect the change of consecutive ID sequences.

[0016] Choose the mean, standard deviation, and skewness for the voltage dimension.

[0017] Furthermore, message cycle Clock offset and each Cumulative clock offset of data frames Specifically:

[0018]

[0019]

[0020]

[0021] in, and This is the index of the current message. Specifically refers to the calculation of cumulative clock offset. The location within the message.

[0022] Furthermore, the changing patterns of the data field in consecutive CAN frames. The pattern of data content changes for the same ID Changes in consecutive ID sequences Specifically:

[0023]

[0024]

[0025]

[0026] in, and These represent the lengths of the Data and ID fields in the current data frame, respectively. and These represent the number of 0s and 1s in the data frame payload, respectively. and They represent the first The first of the Data and ID fields of the data frame Bit element.

[0027] Furthermore, the mean Standard deviation and skewness Specifically:

[0028]

[0029]

[0030]

[0031] in, Indicates voltage signal, This indicates the time range for recording the voltage signal in the current data frame.

[0032] Specifically, in step S3, during the training process, the intrusion detection model processes the input data by establishing weak classifiers with different features. The final prediction result is the cumulative result of all weak classifiers during the training process. During the training process, new weak classifiers are continuously added through feature splitting in each iteration. A prediction value is given in each iteration, and a new function is added in the next iteration to fill the gap between the true value and the prediction result.

[0033] Furthermore, the objective function of the intrusion detection model as follows:

[0034]

[0035] in, For the first The loss function between the actual value and the predicted value. The number of rounds in the training process. For the first The penalty function for the structural complexity of the weak classifier built in the round.

[0036] Furthermore, the maximum height of the weak classifier is 3, and the learning rate is 0.1.

[0037] Secondly, embodiments of the present invention provide a cloud-vehicle linkage intrusion detection system based on multi-dimensional features, comprising:

[0038] The data module collects data generated under normal vehicle conditions.

[0039] The feature module maps the data obtained from the data module to three dimensions: time, data stream, and voltage, and obtains a feature set which is then uploaded to the cloud server.

[0040] The training module constructs an intrusion detection model based on the XGBoost method and trains the intrusion detection model using a cloud server.

[0041] The detection module distributes the intrusion detection model trained by the training module to the vehicles and predicts whether the vehicle has been intruded based on whether the current data matches the vehicle's label.

[0042] Compared with the prior art, the present invention has at least the following beneficial effects:

[0043] A cloud-based vehicle-to-everything (V2X) intrusion detection method is proposed. Utilizing multiple features across three dimensions—data flow, time, and voltage—of the CAN bus, it can detect attacks from multiple perspectives and angles, not limited to detecting only certain attacks. By leveraging the time characteristics of CAN bus data, a mapping is established between Electronic Control Units (ECUs) and message IDs, enabling rapid tracing of the attacked ECU upon detection. The method utilizes cloud server resources for model training. Once trained, the model is deployed to various vehicles, requiring minimal computational resources for data detection. It can be directly applied to vehicles to monitor CAN network data transmission in real time, thereby protecting vehicle security.

[0044] Furthermore, by leveraging the characteristics of CAN bus data streams, the different data meanings designed by different car manufacturers can be abstracted to the feature level, enabling data from different vehicles to be processed in a single model, thus solving the problem of data heterogeneity.

[0045] Furthermore, the actions performed by intelligent vehicles are controlled by data exchanged between electronic control units (ECUs) on the CAN bus. The characteristics in the three dimensions of time, data, and voltage can essentially depict most of the information in the CAN data and the ECUs themselves, thus distinguishing different vehicles. In the time dimension, this product calculates three characteristics: message period, clock offset, and the cumulative clock offset for each N data frames. Most CAN messages appear periodically on the bus, so calculating the period can partially detect attacks such as interference message frequency and periodicity. CAN is an asynchronous serial communication protocol, so the CAN bus does not have a unified clock; instead, each ECU carries its own clock. However, due to the unique manufacturing process, each ECU will have a tiny clock offset. This characteristic can uniquely identify an ECU for tracking, but because the clock offset of a single message is very small, it can easily lead to large errors. Therefore, the cumulative clock offset of N messages is calculated to reduce the error when identifying the ECU. In the data flow dimension, the information entropy of the payload of consecutive data frames, the Hamming distance between the data fields of messages with the same ID, and the Euclidean distance between the ID fields of consecutive data frames are calculated. Because the ID field in a CAN data frame indicates the message type and priority, and the Data field indicates the actions performed by the vehicle, messages on the CAN bus exhibit specific patterns during normal vehicle operation. Calculating information entropy helps determine the data field change patterns of consecutive messages; calculating identical IDs helps determine the range of data field changes within the same ID; and calculating the Euclidean distance between consecutive message IDs helps determine the ID change patterns under normal conditions. These three characteristics reflect most of the information in a normal CAN data frame. When the CAN bus is attacked, the changes in these characteristics are likely to exceed normal ranges. Mean, standard deviation, and skewness are calculated in the voltage dimension. Since vehicles of the same brand but different versions may have identical data meanings, cycles, and other design features, relying solely on the ECU-based clock offset may be insufficient to distinguish vehicles of the same brand. Therefore, an ECU-based physical signal dimension (voltage) is added for detection. This allows for the identification of not only vehicles of different brands but also different vehicles of the same brand.

[0046] Furthermore, to process data from multiple vehicles simultaneously, this product extracts different features across three dimensions—time, data stream, and voltage—from different vehicles according to the same rules. These features are then used as input to unify the data format for model recognition. This shifts the focus of model learning from the meaning and distribution of the source data to the changing patterns of features across different vehicles, avoiding model confusion. The XGBoost method excels at handling feature-based input data. During training, it first selects the most influential features to build a new weak classifier to fit the residual between the previous prediction and the true value. This algorithm is well-suited to the current application scenario of this product. Based on the importance of the extracted features, weak classifiers are built for prediction. The final result is the sum of all weak classifier predictions. This operation allows for vehicle identification based on features from different data sets.

[0047] It is understandable that the beneficial effects of the second aspect mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0048] In summary, this invention can be directly applied to different vehicles without the need for model retraining and transfer learning, and its detection accuracy is not affected by the type of attack.

[0049] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0050] Figure 1 The diagram shows the standard data frame format and extended data frame format in the CAN bus, where (a) is the standard frame and (b) is the extended frame.

[0051] Figure 2 The diagram shows the voltage signals for CAN bus data, where (a) represents the voltage signals for CAN-high and CAN-low, and (b) represents the differential voltage signals.

[0052] Figure 3 This is a diagram of the feature extraction process;

[0053] Figure 4 This is a flowchart illustrating the process framework and system model of the invention.

[0054] Figure 5 Here is the ROC curve of the monitoring model of this invention;

[0055] Figure 6 The invention identifies confusion matrix diagrams for Luxgen U5, Buick Regal, and Toyota Camry. Detailed Implementation

[0056] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0057] In the description of this invention, it should be understood that the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0058] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0059] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Additionally, the character " / " in this invention generally indicates that the preceding and following objects have an "or" relationship.

[0060] It should be understood that although terms such as first, second, third, etc., may be used in the embodiments of the present invention to describe the preset range, these preset ranges should not be limited to these terms. These terms are only used to distinguish the preset ranges from one another. For example, without departing from the scope of the embodiments of the present invention, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0061] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0062] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0063] Please see Figure 4 This invention discloses a cloud-vehicle linkage intrusion detection method based on multi-dimensional features. It utilizes multiple features from three dimensions—data flow, time, and voltage—on the vehicle's CAN bus. The Intrusion Detection System (IDS) is trained on a cloud server and distributed to various vehicles for direct attack detection, eliminating the need for retraining or additional transfer learning. The entire intrusion detection process is divided into vehicle data acquisition, feature extraction, intrusion detection model construction, and intrusion detection. The specific steps are as follows:

[0064] S1. Collect data generated under normal vehicle conditions;

[0065] Please see Figure 1 The vehicle's actions are controlled by the data frames exchanged on the CAN network. The CAN data frame format is shown in the figure. Therefore, the vehicle's data pattern is regular under normal circumstances.

[0066] The Data field contains the transmitted payload, while the ID field determines the CAN data frame type and transmission priority. The Data and ID fields are two important fields that reflect the potential patterns in the CAN bus data flow. Most CAN data frames have their own cycle, meaning that a message with a certain ID appears periodically on the CAN bus. Furthermore, due to the non-replicable nature of the manufacturing process, the clock offset of each ECU is unique. Therefore, time-related features can not only detect related attacks but also be used to trace the source of the attack.

[0067] At the physical level, the CAN bus is a twisted pair cable, divided into CAN-high and CAN-low. Logical 0s and 1s are transmitted on the bus through the differential voltage between the two, forming CAN frames. Therefore, voltage data is also important in the scheme of this invention. CAN-high, CAN-low, and their differential voltage are as follows: Figure 2 As shown.

[0068] Connect the CAN-high and CAN-low lines of the Pipscope device to the corresponding pins of the OBD-II interface. Utilize the characteristic of data frames being transmitted on the CAN bus in a broadcast mechanism to obtain the content, time, and voltage signal of the transmitted data frames. The voltage signal is sampled at a rate of 12.5 MS / s.

[0069] S2. Extract features from three dimensions: time, data stream, and voltage to form a feature set. Each vehicle uses its unique device code as a label for the feature set. Different vehicles upload their feature sets to the cloud server in the order in which the features are generated.

[0070] Due to data heterogeneity, source data from different vehicles cannot be directly fed into the ML model. Otherwise, the patterns and features hidden in different vehicles will cause confusion and lead to poor model performance.

[0071] Therefore, this invention abstracts source data with different meanings into the same feature space, thereby facilitating the identification of data patterns by ML models. Since most existing IDS use features that can be divided into three dimensions—time, data flow, and voltage—this invention maps the collected vehicle data to these three dimensions.

[0072] Please see Figure 3 This invention extracts three main features from each dimension, for a total of nine features.

[0073] Regarding the time dimension, a prominent feature is clock skew. Due to unique manufacturing processes, each ECU produces a slight clock skew that is different, thus it can be used to uniquely identify the ECU. Furthermore, most messages are periodic, which can partially reflect the regularity of data frames in the data flow dimension.

[0074] Therefore, the features calculated in the time dimension of this invention are message period, clock offset, and each The cumulative clock offset of the data frame, these three characteristics are calculated based on messages with the same ID, and the specific formula is described as follows:

[0075] (1)

[0076] (2)

[0077] (3)

[0078] in, and This is the index of the current message. Specifically refers to the position within the N messages used to calculate the cumulative clock offset. and These represent the calculated clock offset and the cumulative clock offset, respectively. Because the cumulative clock offset cannot be calculated unconditionally indefinitely, otherwise it would be an infinite number, it is calculated per... Each message is counted repeatedly.

[0079] At the data flow level, many existing IDS (Intrusion Detection Systems) utilize the information entropy of data fields, ID sequences, or patterns hidden within these fields to identify anomalies. Building upon this, this invention calculates the information entropy of the payload to capture change patterns in the data fields of consecutive CAN frames; calculates the Hamming distance between the data fields of messages with the same ID to obtain the variation patterns of the data content of the same ID message under normal conditions; and calculates the Euclidean distance of the ID fields in the data frame to reflect the changes in consecutive ID sequences. The calculation expressions are as follows:

[0080] (4)

[0081] (5)

[0082] (6)

[0083] in, and These represent the lengths of the Data and ID fields of the current data frame, respectively. Since the Data field of a CAN frame varies from 1 to 8 bytes, in order to ensure a uniform data format, the Data field of all CAN frames is filled to 8 bytes before calculation. Since the content of the Data field is a hexadecimal number and the probability of each number appearing is uncertain, this invention converts the 8-byte hexadecimal number of the Data field into a 64-bit binary number for ease of calculation. and These represent the number of 0s and 1s in the data frame payload, respectively. and They represent the first The first of the Data and ID fields of the data frame Bit elements, in the function Adding 1 is to prevent the occurrence of The situation.

[0084] For the voltage dimension, many mature and usable features already exist in current IDS research, such as mean, standard deviation, skewness, and kurtosis. Therefore, this invention selects three basic and important features to apply to the scheme of this invention: mean, standard deviation, and skewness. The specific expressions are as follows:

[0085] (7)

[0086] (8)

[0087] (9)

[0088] in, Indicates voltage signal, This indicates the time range of the current data frame voltage signal recording. Since the dominant differential voltage is around 2.5V and the recessive differential voltage is around 0V, the dominant voltage signal contains more signal than the recessive voltage signal. Therefore, this invention only extracts the dominant voltage signal during signal processing, using the voltage signal from the RTR field. For example... Figure 2 As shown, the voltage signal contains three parts: dominant edge, recessive edge, and transition process. The system needs a threshold to determine the state of the voltage signal. This invention specifies that when the voltage is greater than 0.08V, the voltage signal starts to transition from recessive edge to dominant edge, and vice versa.

[0089] S3. Construct an intrusion detection model. The cloud server is responsible for training the intrusion detection model, reducing the computational burden on vehicles. Since the first step abstracts the data from different vehicles into the same feature space, solving the problem of data heterogeneity, feature sets from different vehicles can be directly processed by a single model.

[0090] Most intrusion prevention systems are deployed in vehicles and are limited to detecting specific types of attacks. Furthermore, due to data differences between vehicles, models must be retrained to learn new data features when ported to other vehicles for detection. In addition, detection principles designed for specific vehicle data features may not be applicable to other vehicles, and the performance of IDS cannot be guaranteed. Many IDS rely on ML / DL algorithms to identify hidden patterns in the data, and the computational requirements of machine learning algorithms increase the computational burden on vehicles.

[0091] The trained intrusion detection model is built using the XGBoost method. During training, this model processes input data by building trees (i.e., weak classifiers) with different features. The final prediction result is the cumulative result of all weak classifiers during training. During training, each iteration continuously adds new weak classifiers through feature splitting, such as... Figure 4 As shown in Part 3. The purpose of adding a new tree is to learn a new function to fit the residual between the previous prediction and the true value.

[0092] In other words, the system provides a predicted value in each iteration and adds a new function in the next iteration to fill the gap between the actual value and the predicted result. To achieve higher accuracy in predicting vehicles under normal conditions, the model attempts to minimize this gap. Furthermore, given the massive amount of data received by cloud servers in reality, the system needs to reduce computational complexity. Therefore, the objective function for model optimization consists of two parts, expressed as:

[0093]

[0094] in, This function is used to penalize the complexity of the tree, making the model more inclined to choose a simpler prediction function during the iteration process. It is the loss function between the true value and the predicted value. This invention uses softmax as the specific form of this function, setting... and The values ​​are 0.1 and 0.9 respectively. To prevent the model from overfitting, this invention selects a feature sampling rate of 0.8 for the tree. The deeper the tree splits, the more detailed the learning of certain features, and the easier it is to cause overfitting. Therefore, the maximum height of the tree is set to 3, and the learning rate is 0.1.

[0095] When an attack occurs, the features exhibited by the attack data are inconsistent with the range of the data features in the feature space during model training, thus causing the prediction results to be inconsistent with the actual results.

[0096] Furthermore, there may be cases where the attack data features deviate only slightly from the original feature space, causing the model to predict them as the original data type with a low probability. Therefore, this invention sets a threshold. When the model predicts correctly, but its probability is lower than... In this case, the present invention modifies this result into attack data.

[0097] S4. Distribute the trained intrusion detection model to each vehicle. No additional operations such as retraining and transfer are required. The vehicle uses the model to detect intrusions and trace the source of the attack. The IDS determines whether the current data is under attack based on the trained data feature space. If the data is normal, the IDS continues to detect. If the predicted data label is inconsistent with the vehicle's real label, the IDS considers it to be under attack.

[0098] After the intrusion detection model is trained, it is distributed to each vehicle. Once the intrusion detection system is installed on the vehicle, it is only necessary to predict whether the current data matches the vehicle label. Since vehicle A only has data for A, if the model gives a different vehicle type label instead of label A, it can be determined that an intrusion has occurred.

[0099] In another embodiment of the present invention, a cloud-vehicle linkage intrusion detection system based on multi-dimensional features is provided. This system can be used to implement the above-mentioned cloud-vehicle linkage intrusion detection method based on multi-dimensional features. Specifically, the cloud-vehicle linkage intrusion detection system based on multi-dimensional features includes a data module, a feature module, a training module, and a detection module.

[0100] The data module collects data generated under normal vehicle conditions.

[0101] The feature module maps the data obtained from the data module to three dimensions: time, data stream, and voltage, and obtains a feature set which is then uploaded to the cloud server.

[0102] The training module constructs an intrusion detection model based on the XGBoost method and trains the intrusion detection model using a cloud server.

[0103] The detection module distributes the intrusion detection model trained by the training module to the vehicles and predicts whether the vehicle has been intruded based on whether the current data matches the vehicle's label.

[0104] In another embodiment of the present invention, a terminal device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of a cloud-vehicle linkage intrusion detection method based on multi-dimensional features, including:

[0105] Data generated under normal vehicle conditions is collected; the data is mapped to three dimensions: time, data stream, and voltage, to obtain a feature set, which is then uploaded to a cloud server; an intrusion detection model is built based on the XGBoost method, and the intrusion detection model is trained using the cloud server; the trained intrusion detection model is distributed to vehicles, and the vehicle is predicted to have been intruded based on whether the current data matches the vehicle's label.

[0106] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory). This computer-readable storage medium is a memory device in a terminal device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and extended storage media supported by the terminal device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device.

[0107] One or more instructions stored in a computer-readable storage medium can be loaded and executed by a processor to implement the corresponding steps of the cloud-vehicle linkage intrusion detection method based on multi-dimensional features in the above embodiments; one or more instructions in the computer-readable storage medium are loaded and executed by the processor in the following steps:

[0108] Data generated under normal vehicle conditions is collected; the data is mapped to three dimensions: time, data stream, and voltage, to obtain a feature set, which is then uploaded to a cloud server; an intrusion detection model is built based on the XGBoost method, and the intrusion detection model is trained using the cloud server; the trained intrusion detection model is distributed to vehicles, and the vehicle is predicted to have been intruded based on whether the current data matches the vehicle's label.

[0109] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0110] Experimental environment:

[0111] (1) Experimental equipment: In order to reflect the heterogeneity of the data, three real vehicles of different brands were selected for the experiment. In order to obtain the characteristics of the data stream and time dimension, CANalyst-II was used to connect to the CAN bus through the OBD-II interface to collect data frames and record the reception time. The voltage signals of these CAN frames were collected by Picoscop.

[0112] (2) Hardware and software environment of the experiment: This invention is based on the XGBoost method, and training and testing are carried out in the cloud and on the vehicle, respectively. This invention uses an ASUS workstation to simulate a cloud server as the training platform. The testing process is performed on a computer for data detection. The integrated development environment is Python, Scikit-learn, and the XGBoost framework.

[0113] (3) Training Samples and Parameter Settings: Nine features were calculated from the collected voltage signals, time, and data frames, including message period, clock offset, and cumulative clock offset in the time dimension; data entropy, payload Hamming distance, and ID Euclidean distance in the data flow dimension; and mean, standard deviation, and skewness in the voltage dimension. These features abstract the specific meaning of the data construction into the same space, eliminating the influence of data heterogeneity, and are directly input into the ML model. 107,778 samples were used as training data to train the model on the workstation. To detect attacks, each vehicle contained 3,000 test samples, with normal and abnormal data evenly distributed.

[0114] Experimental results:

[0115] (1) ROC curve of the model

[0116] Figure 5 The ROC curves and AUC values ​​of Buick Regal, Luxgen U5, and Toyota Camry in multi-class classification are plotted, along with the micro-average ROC curve and AUC value of the detection model itself. In the ROC curves, the horizontal axis represents the false positive rate (FPR), and the vertical axis represents the true positive rate (TPR). On the micro-average ROC curves for the three vehicle classifications, when the FPR approaches 0.03, the TPR reaches 1, and its AUC is 0.99949. The AUC values ​​for Buick, Luxgen, and Toyota are 0.99894, 0.99956, and 0.99996, respectively. Toyota's TPR is close to 1 from the beginning, Luxgen's initial TPR is 0.92, reaching 1 when the FPR is 0.02, and Buick's performance falls between Toyota and Luxgen. In summary, under normal circumstances, the robustness and effectiveness of this invention are sufficient to classify different vehicles based on multi-dimensional features.

[0117] (2) Confusion matrix of the model

[0118] Figure 6The accuracy of this invention's vehicle classification ability is described. During training, 4316 samples were used for each vehicle to evaluate classification performance. As shown in the figure, Buick was correctly classified 4251 times, indicating an accuracy of 98.49% in identifying Buick vehicles. Luxgen and Toyota were correctly classified 4246 and 4311 times respectively, indicating accuracy rates of 98.37% and 99.88% for Luxgen and Toyota, respectively. Experimental results demonstrate that this invention can correctly classify and identify Buick, Luxgen, and Toyota vehicles.

[0119] (3) Detection results of different attacks in different vehicles

[0120] This invention posits that the distribution range of normal CAN data from different vehicles varies in the feature space, and that the features of attack data deviate from the original position of the corresponding vehicle in the feature space, leading to misclassification. Therefore, in this section, this invention simulates a vehicle computing environment and provides samples that mix normal and abnormal data for intrusion detection. Tables I, II, and III show the intrusion detection results for Luxgen U5, Buick Regal, and Toyota Camry, respectively. The attacks selected in this invention include bus-off attacks, spoofing attacks, SOME attacks, fuzzy attacks, disguise attacks, and replay attacks; these are typical attacks related to time, data stream, and voltage. In each vehicle, the data used for testing comes only from the vehicle itself. If the data is classified as a tag of another vehicle, this invention considers the vehicle to be under attack. The intrusion detection results are evaluated using five metrics: accuracy, precision, recall, FPR, and false negative rate (FNR).

[0121] Table 1

[0122]

[0123] Table 1 shows the results of attack detection for Luxgen vehicles, which outperforms the other two vehicles. The precision for detecting the six attacks were 0.9839, 0.9903, 0.9584, 0.9541, 0.9887, and 0.9593, respectively. The corresponding recall rates were 0.9927, 0.9943, 0.9927, 0.9984, 0.9916, and 0.9968. Although the detection model showed differences in performance in identifying normal and abnormal data, the differences were small. The lowest FPR was 0.0097 for spoofing attacks and the highest FPR was 0.0479 for fuzzy attacks. Compared to Buick and Toyota, Luxgen's performance in detecting normal and abnormal data was more balanced.

[0124] Table 2

[0125]

[0126] Table 2 shows the attack detection results for the Buick Regal. The accuracy rates for bus-off attacks, spoofing attacks, SOME attacks, fuzzy attacks, disguise attacks, and replay attacks are 0.9966, 0.9856, 0.9482, 0.9199, 0.9479, and 0.9966, respectively. The accuracy rates for bus-off and replay attacks are both 1, indicating that these two attacks have obvious characteristics in normal data. The FPR and FNR for all attacks are less than 0.1551 and 0.0068, respectively. The worst performance for the Buick was in detecting fuzzy attacks, with an accuracy of 0.8651, a recall rate of 0.9949, an FPR of 0.1551, and an FNR of 0.0051. The accuracy rates for all attacks are higher than 0.9199, indicating that the performance of this invention in Buick vehicles is quite good.

[0127] Table 3

[0128]

[0129] Table 3 shows the attack detection results for the Toyota Camry. The accuracies for detecting the six attacks were 0.9091, 0.9666, 0.9140, 0.9123, 0.9649, and 0.9718, respectively. The accuracies for bus-off attacks, fuzzy attacks, and SOME attacks were all less than 0.9, at 0.8449, 0.8517, and 0.8541, respectively. The detection accuracies for the other three attacks were 0.9392, 0.9350, and 0.9496, respectively. As mentioned earlier, the ability to identify anomalous data is slightly weaker than that for normal data. This invention infers that this is because the invention only trains on normal data in the cloud, and the features of different vehicles are in the same feature space and are learned by the model, leading to overfitting of some vehicle features. The FNR for all attacks was less than 0.0028. These experimental results confirm that the invention is feasible for detecting vehicle intrusion in real-world scenarios and has good robustness and effectiveness.

[0130] (4) Model training and testing time

[0131] The detection time of this invention can be divided into two parts: the cloud server training stage and the vehicle intrusion detection stage, as shown in Table 4.

[0132] Table 4

[0133]

[0134] Because this invention uses data from different vehicles, and all vehicle data is processed by a single model, it only needs to be trained once in the cloud. The model training process takes 102,886.2405 ms per 2000 iterations, with a training set of 107,778 samples. After training, the model is downloaded to different vehicles for intrusion detection. The detection times per data frame for Luxgen U5, Buick Regal, and Toyota Camry are 0.1186 ms, 0.0807 ms, and 0.0968 ms, respectively. The short attack detection time meets the high responsiveness requirements of vehicles.

[0135] Through testing in three different real vehicles, the experimental results show that the present invention is applicable to different vehicles and has good robustness.

[0136] In summary, the cloud-vehicle linkage intrusion detection method and system based on multi-dimensional features of this invention can accurately detect a variety of advanced attack methods such as bus-off attacks, deception attacks, same-origin attacks (SOME), fuzzy attacks, disguise attacks, and replay attacks, with a detection accuracy rate of over 91%.

[0137] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0138] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0139] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0140] In the embodiments provided by this invention, it should be understood that the disclosed devices / terminals and methods can be implemented in other ways. For example, the device / terminal embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0141] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0142] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0143] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM). Only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0144] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0145] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0146] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0147] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A cloud vehicle linkage intrusion detection method based on multi-dimensional features, characterized in that, Comprising the following steps: S1, collecting data frames generated under normal state of the vehicle; S2, mapping the data frame obtained in step S1 to three dimensions of time, data stream and voltage to obtain a feature set and upload a cloud server, the features calculated in the time dimension include message period, clock offset and cumulative clock offset of each data frame; On the dimension of data stream, the information entropy of the payload is calculated to capture the change pattern of the data field in the continuous CAN frame; the Hamming distance of the data field of the same ID message is calculated to obtain the change rule of the data content of the same ID under normal conditions; the Euclidean distance of the ID field in the data frame is calculated to reflect the change of the continuous ID sequence; The mean, standard deviation and skewness are selected on the voltage dimension; Message cycle Clock offset And each Cumulative clock offset of data frame Specifically: wherein, and is an index of the current message, specifically the position in the messages where the cumulative clock skew is calculated. Change pattern of data field in continuous CAN frame ; change rule of data content of same ID under normal condition ; change condition of continuous ID sequence Specifically: in, and These represent the lengths of the Data and ID fields in the current data frame, respectively. and These represent the number of 0s and 1s in the data frame payload, respectively. and They represent the first The first of the Data and ID fields of the data frame Bit element; S3, constructing an intrusion detection model based on the XGBoost method, and training the intrusion detection model by using a cloud server; S4, distributing the intrusion detection model trained in step S3 to the vehicle, and predicting whether the vehicle is intruded according to whether the current data matches the vehicle label.

2. The multi-dimensional feature based cloud vehicle federated intrusion detection method according to claim 1, wherein, In step S1, the data frame is transmitted on the CAN bus in a broadcast mechanism, the content, time and voltage signal of the transmitted data frame are obtained, and the voltage signal is sampled at a rate of 12.5MS / s. 3.The multi-dimensional feature based cloud vehicle federated intrusion detection method of claim 1, wherein, Mean Standard deviation And skewness Specifically: wherein, represents a voltage signal, represents the time range of the current data frame voltage signal record.

4. The multi-dimensional feature based cloud vehicle federated intrusion detection method of claim 1, wherein, In step S3, in the training process of the intrusion detection model, weak classifiers with different features are established to process the input data, and the final prediction result is the cumulative result of all weak classifiers in the training process; in the training process, new weak classifiers are continuously added through feature splitting in each iteration, a prediction value is given in each iteration, and a new function is added in the next iteration to fill the gap between the true value and the prediction result.

5. The multi-dimensional feature based cloud vehicle federated intrusion detection method according to claim 4, wherein, Objective function of intrusion detection model As follows: wherein, is the number of rounds of training, is the loss function between the true and predicted values, is the number of rounds in the training process, is the penalty function for the complexity of the weak classifier structure established for the round.

6. The multi-dimensional feature based cloud vehicle association intrusion detection method according to claim 5, wherein, The maximum height of the weak classifier is 3, and the learning rate is 0.

1.

7. A multi-dimensional feature based cloud vehicle coordinated intrusion detection system, characterized in that, Comprising: a data module for collecting data frames generated under normal state of the vehicle; The feature module maps the data frame obtained by the data module to three dimensions of time, data flow and voltage, obtains a feature set and uploads the cloud server, the features calculated in the time dimension include message cycle, clock offset and cumulative clock offset of each data frame ​ On the dimension of data stream, the information entropy of the payload is calculated to capture the change pattern of the data field in the continuous CAN frame; the Hamming distance of the data field of the same ID message is calculated to obtain the change rule of the data content of the same ID under normal conditions; the Euclidean distance of the ID field in the data frame is calculated to reflect the change of the continuous ID sequence; The mean, standard deviation and skewness are selected on the voltage dimension; Message cycle Clock offset And each Cumulative clock offset of data frames Specifically: wherein and is an index of the current message, specifically the position in the messages where the cumulative clock skew is calculated. Change pattern of data field in continuous CAN frame ; change rule of data content of same ID under normal condition ; change condition of continuous ID sequence Specifically: in, and These represent the lengths of the Data and ID fields in the current data frame, respectively. and These represent the number of 0s and 1s in the data frame payload, respectively. and They represent the first The first of the Data and ID fields of the data frame Bit element; a training module for constructing an intrusion detection model based on the XGBoost method, and training the intrusion detection model by using a cloud server; a detection module for distributing the intrusion detection model trained by the training module to the vehicle, and predicting whether the vehicle is intruded according to whether the current data matches the vehicle label.

Images