A multi-dimensional feature-based intrusion detection method and system

Abstract

The application discloses a kind of based on multi-dimensional feature intrusion detection method and system, the feature of data stream and time dimension is extracted from the data frame of CAN bus, source data with different meanings is abstracted to the same feature space;The time stamp of each message ID in the same feature space is recorded, and the average period of each message ID is calculated, when the superperiod clock offset difference value of two message IDs is less than the set threshold α, two message IDs are determined as the message sent by the same function module, the matching of message ID and function module is realized, the features are classified according to the matching relationship and are labeled;Based on XGBoost method, an intrusion detection model is constructed, and the intrusion detection model is trained based on labeled features;Based on the intrusion detection model, intrusion detection is carried out, it is determined that the current message and the comparison ID belong to the same function module, and the invaded module is obtained by using the relationship between ID and function module. From multiple angles, a variety of attacks are detected with high accuracy.

Description

Technical Field

[0001] This invention belongs to the field of unmanned aerial vehicle (UAV) communication technology, specifically relating to an intrusion detection method and system based on multi-dimensional features. Background Technology

[0002] With the rise of the concept of "unmanned equipment," new types of devices based on unmanned technology, such as drones, driverless cars, and unmanned control systems, are gradually integrating into all aspects of society. While unmanned equipment enhances advanced functions and facilitates people's lives, its advanced functions and technologies also expose a large number of communication interfaces, posing a risk of remote intrusion by hackers. Traditional cryptographic security measures (such as message frame encryption / decryption and digital signatures) consume a lot of messages and have a high data domain occupancy rate, making them difficult to effectively implement on unmanned equipment with limited bandwidth resources. Furthermore, the internal processors of unmanned equipment often lack sufficient computing power, and their high real-time data transmission requirements make it difficult for security gateways, firewalls, and other protective devices to utilize powerful security analysis methods for real-time screening, thus limiting their protective capabilities.

[0003] Furthermore, the internal bus data packets of unmanned equipment lack source and destination addresses. When attacks such as spoofing, injection, and replay occur, there are currently no relevant security protection devices that can both block the attack and locate the source of the attack in a timely manner.

[0004] Based on these limitations, this invention studies a lightweight real-time security protection technology for unmanned equipment, which solves the problem of difficult protection for unmanned equipment under high real-time requirements and limited resource constraints, and enhances the security protection capabilities of unmanned equipment. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide an intrusion detection method and system based on multi-dimensional features to address the shortcomings of the prior art, thereby solving the technical problem of the difficulty in protecting unmanned equipment under high real-time requirements and limited resource constraints.

[0006] The present invention adopts the following technical solution:

[0007] An intrusion detection method based on multidimensional features includes the following steps:

[0008] S1. Acquire data frames on the CAN bus;

[0009] S2. Extract the features of the data stream and time dimension from the data frame obtained in step S1, and abstract the source data with different meanings into the same feature space;

[0010] S3. Record the timestamp of each message ID in the same feature space in step S2, and calculate the average period of each message ID. When the difference in over-period clock offset between two message IDs is less than a set threshold... When two message IDs are determined to be messages sent by the same functional module, the message IDs are matched with the functional modules. The features extracted in step S2 are then classified and labeled according to the matching relationship.

[0011] S4. Construct an intrusion detection model based on the XGBoost method, and train the intrusion detection model based on the labeled features obtained in step S3.

[0012] S5. Based on the intrusion detection model obtained in step S4, perform intrusion detection. When attack data is detected, compare the clock offset of the current message with the clock offset of the known ID. If the difference between the two values ​​is less than a set threshold, the intrusion will be detected. At that time, it is determined that the current message and the comparison ID belong to the same functional module, and the module being invaded is obtained by using the relationship between the ID and the functional module.

[0013] Specifically, in step S2, the time dimension features include message cycle features, clock offset features, and cumulative clock offset features; the data flow dimension features include payload information entropy features, Hamming distance features of message payloads with the same ID, and Euclidean distance features of consecutive message ID domains.

[0014] Furthermore, message cycle characteristics Clock skew characteristics Cumulative clock skew characteristics Specifically as follows:

[0015]

[0016]

[0017]

[0018] in, and The index of the current message. Refers to the calculation of cumulative clock offset The location within the message.

[0019] Furthermore, payload information entropy characteristics Hamming distance features of message payloads with the same ID Euclidean distance feature of continuous message ID domain Specifically as follows:

[0020]

[0021]

[0022]

[0023] in, and These represent the lengths of the Data and ID fields in the current data frame, respectively. and These represent the number of 0s and 1s in the data frame payload, respectively. and They represent the first The first of the Data and ID fields of the data frame Bit element.

[0024] Specifically, step S4 is as follows:

[0025] S401. Perform feature extraction on the source data, and input the extracted features into the machine learning model so that the focus of the intrusion detection model's learning shifts from the meaning and distribution of the data to the changes in the data features.

[0026] S402. Match message IDs and functional modules to form a relationship mapping table. Tag the extracted features according to the mapping table of functional modules. That is, the feature tags extracted from ID messages belonging to the same functional module are the same.

[0027] S403. In each iteration, a tree (weak classifier) ​​is built. The weak classifier makes predictions based on different feature subsets and learns a new function to fit the difference between the previous prediction and the true result. The final result is the sum of the prediction results of the built weak classifiers, thus completing the training of the intrusion detection model.

[0028] Furthermore, in step S403, the objective function for training the intrusion detection model is... as follows:

[0029]

[0030] in, The leaf node of the weak classifier To obtain a subset of leaf node j from the input features, For the loss function with respect to The first-order partial derivative, The loss function between the actual value and the predicted value. For the true values ​​of the dataset, For the first The predicted value of the wheel, To control the fraction of leaf nodes, This is a penalty factor used to control the complexity of weak classifiers.

[0031] Furthermore, the feature sampling rate of the weak classifier is 0.8, the maximum weak classifier height is set to 3, the learning rate is 0.1, and the loss function is softmax.

[0032] Furthermore, the XGBoost method builds a new weak classifier in each iteration, and the prediction value of the weak classifier... The result is as follows:

[0033]

[0034] Specifically, in step S5, when an intrusion is detected, the current message clock offset is compared with the clock offsets of other message IDs to trace the source of the intrusion.

[0035] Secondly, embodiments of the present invention provide an intrusion detection system based on multi-dimensional features, comprising:

[0036] The acquisition module acquires data frames from the CAN bus.

[0037] The abstract module extracts data stream and time dimension features from the data frames obtained by the acquisition module, abstracting source data with different meanings into the same feature space;

[0038] The tag module records the timestamp of each message ID in the same feature space of the abstract module and calculates the average period of each message ID. When the difference in the over-period clock offset between two message IDs is less than a set threshold... When two message IDs are determined to be messages sent by the same functional module, the message IDs are matched with the functional modules, and the features extracted by the abstract module are classified and labeled according to the matching relationship.

[0039] The training module constructs an intrusion detection model based on the XGBoost method and trains the intrusion detection model based on the labeled features obtained from the label module.

[0040] The detection module performs intrusion detection based on the intrusion detection model obtained from the training module. When attack data is detected, it compares the clock offset of the current message with the clock offset of a known ID. If the difference between the two is less than a set threshold, the intrusion is detected. At that time, it is determined that the current message and the comparison ID belong to the same functional module, and the module being invaded is obtained by using the relationship between the ID and the functional module.

[0041] Compared with the prior art, the present invention has at least the following beneficial effects:

[0042] A multi-dimensional feature-based intrusion detection method overcomes the limited attack detection capabilities of single-dimensional feature-based methods, enabling the detection of more types of attacks from multiple perspectives. Current intrusion detection solutions primarily rely on observing the variation range of parameters contained in CAN messages under normal conditions. However, when a device is attacked, one or more parameters may exhibit variations outside the normal distribution. Therefore, this product extracts multiple parameter features from both time and traffic dimensions for observation, allowing for a more comprehensive observation of parameter changes displayed in the data on the CAN bus from different angles, thereby detecting attacks.

[0043] Furthermore, the extracted time-dimensional features include message cycle features, clock skew features, and cumulative clock skew features. Most message IDs on the CAN bus are sent periodically; therefore, extracting the message cycle as a feature can detect whether the frequency of some message cycles is normal. CAN data is sent and received by Electronic Control Units (ECUs). Since the CAN bus does not have a unified clock, each ECU has its own clock. However, due to the non-replicable nature of the manufacturing process, even ECUs from the same batch will have very subtle differences in clock speed, i.e., clock skew. This feature can serve as a unique identifier for ECU tracking. However, the clock skew of a single message is very small, which can lead to significant errors. Therefore, based on a single clock skew, we further calculated... The cumulative clock skew of each message is used to reduce errors. Extracted data stream dimensional features include payload entropy features, Hamming distance features between payloads with the same ID, and Euclidean distance between the ID fields of consecutive messages. The ID field in a CAN data frame indicates the transmission priority and CAN data frame type, while the Data field indicates the action performed by the vehicle; therefore, there is a correlation between the contents of the ID and Data fields. Calculating the payload entropy is to learn the change pattern of the Data field content between data frames on the CAN bus under normal conditions. The Hamming distance between payloads with the same ID indicates the range and situation of Data field changes within the same ID. The Euclidean distance between consecutive IDs is to understand the ID change pattern of data frames under normal conditions. These three data stream dimensional features reflect most of the information in the CAN data. Multidimensional feature detection raises the attack threshold for attackers because when an attacker wants to conceal their attack, they must conform to the changes of multidimensional features under normal conditions, which is quite difficult.

[0044] Furthermore, different devices assign different meanings to CAN data to ensure its confidentiality and raise the attack threshold. Therefore, to make this product applicable to various devices, it uses features as input instead of the raw CAN data. This shifts the model's focus from learning the meaning and distribution of the raw CAN data to learning the changing patterns of data features, making this learning principle more universal. Compared to other machine learning algorithms (such as CNN, KNN, etc.), XGBoost is better at handling feature input because the training process is based on building new weak classifiers based on features. Therefore, this product uses XGBoost as its core algorithm.

[0045] Furthermore, during training, the XGBoost method fits the residuals between the predicted and true values ​​from the previous round by building new weak classifiers. In addition, the CAN bus can generate a large amount of data in a short time; to reduce computational complexity, the XGBoost method tends to build simple weak classifiers for prediction in each round. Therefore, to minimize residuals and reduce the overall model complexity, the XGBoost objective function consists of two parts: a loss function between the true and predicted values, and a penalty function on the weak classifier (i.e., the tree) structure. Thus, the training process is essentially minimizing the objective function. The process ultimately aims to predict results more accurately using a tree structure with minimal complexity.

[0046] It is understandable that the beneficial effects of the second aspect mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here.

[0047] In summary, this invention extracts multiple features from the time and data flow dimensions to design a universal intrusion detection method that can detect various attacks with high accuracy from multiple perspectives.

[0048] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0049] Figure 1 The data frame format in the CAN protocol is shown in Figure 1, where (a) is the standard frame and (b) is the extended frame.

[0050] Figure 2 This is a schematic diagram of the feature extraction method of the present invention;

[0051] Figure 3 The diagram illustrates some patterns of change in CAN data streams, where (a) shows the pattern of change in data fields with the same ID, and (b) shows the pattern of change in data frames with the same action at different time periods.

[0052] Figure 4A schematic diagram of a superperiodic method for finding two different period IDs;

[0053] Figure 5 This is a schematic diagram of the internal network structure of the present invention;

[0054] Figure 6 This is the development board used in this invention;

[0055] Figure 7 This provides a suitable experimental testing environment for the present invention.

[0056] Figure 8 The loss curves for the training process of this invention in different vehicles;

[0057] Figure 9 This is a schematic diagram of the confusion matrix for identifying the ECU in vehicle A according to the present invention;

[0058] Figure 10 This is a schematic diagram of the confusion matrix for identifying the ECU in vehicle B according to the present invention;

[0059] Figure 11 This is a schematic diagram of the confusion matrix for identifying the ECU in vehicle C according to the present invention. Detailed Implementation

[0060] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0061] In the description of this invention, it should be understood that the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0062] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0063] It should also be further understood that the term "and / or" as used in this specification and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes such combinations. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Additionally, the character " / " in this invention generally indicates that the preceding and following objects have an "or" relationship.

[0064] It should be understood that although terms such as first, second, third, etc., may be used in the embodiments of the present invention to describe the preset range, these preset ranges should not be limited to these terms. These terms are only used to distinguish the preset ranges from one another. For example, without departing from the scope of the embodiments of the present invention, the first preset range may also be referred to as the second preset range, and similarly, the second preset range may also be referred to as the first preset range.

[0065] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0066] The accompanying drawings illustrate various structural schematic diagrams according to embodiments disclosed in this invention. These drawings are not to scale, and some details have been enlarged for clarity, and some details may have been omitted. The shapes of the various regions and layers shown in the drawings, as well as their relative sizes and positional relationships, are merely exemplary and may deviate from reality due to manufacturing tolerances or technical limitations. Furthermore, those skilled in the art can design regions / layers with different shapes, sizes, and relative positions as needed.

[0067] This invention discloses an intrusion detection method based on multi-dimensional features. It utilizes multiple features in two dimensions—data stream and time—transmitted on an unmanned equipment communication bus. The method comprises five parts: data acquisition, feature extraction, ID and functional module matching, intrusion detection model construction, and intrusion detection. The steps include:

[0068] S1, Data Acquisition

[0069] The actions of unmanned equipment are controlled by data frames exchanged on the communication bus. Using the CAN bus as the experimental subject, the data frame format of the CAN protocol is as follows: Figure 1 As shown, the data patterns of unmanned equipment under normal circumstances are regular.

[0070] The Data field contains the transmitted payload, while the ID field determines the CAN data frame type and transmission priority. The Data and ID fields are two important fields reflecting the potential patterns in the CAN bus data flow. Most CAN data frames have their own cycle, meaning a message with a specific ID appears periodically on the CAN bus. Furthermore, due to the non-replicable nature of the manufacturing process, the clock offset of each ECU is not unique. Therefore, time-related characteristics can not only detect related attacks but also be used to trace the attack source. Data acquisition equipment is used to collect data frames on the CAN bus during normal operation of the unmanned combat equipment.

[0071] S2, Feature Extraction

[0072] While CAN bus communication is similar across different unmanned devices, the meaning of the communication data can differ when using the same protocol, leading to data heterogeneity. Therefore, directly using source data for model training can cause recognition confusion when the model is transferred to other devices due to variations in data patterns and distributions across different devices, resulting in poor performance. This invention extracts multiple features from the data flow and time dimensions, abstracting source data with different meanings into a single feature space. This shifts the focus of model learning from the meaning and distribution of source data to the patterns of data change, facilitating the ML model's recognition of input data on different devices according to the same rules. Figure 2 As shown, this invention extracts six main features from two dimensions: data flow and time. Each dimension has three different features, among which the clock offset feature in the time dimension lays the groundwork for the subsequent matching of ID and functional modules.

[0073] Three features were extracted from the time dimension: message period, clock skew, and cumulative clock skew. According to the CAN protocol, most messages are periodic, meaning messages with the same ID will appear on the CAN bus periodically. Calculating the message period can initially filter out simple attacks that alter the message period. Furthermore, since there is no unified clock in the CAN bus, each functional module has an independent clock. Compared to the ideal clock, the clock of a functional module will have an offset. For example, a message with an ideal period of 1ms might actually be sent at 1.01ms. Due to the non-replicable nature of the manufacturing process, even different functional modules from the same batch will have different clock skews. Therefore, it can be used to uniquely identify the ECU. Based on the principle of minimizing errors during manufacturing, the clock skew of a single message is very small. Therefore, this product additionally calculates the cumulative clock skew as a feature. The difference in cumulative clock skew across multiple data frames from different functional modules is even more pronounced. This is calculated here... The cumulative offset of each data frame.

[0074] These three characteristics are calculated based on messages with the same ID, and the specific formula is described as follows:

[0075] (1)

[0076] (2)

[0077] (3)

[0078] in, and The index of the current message. Specifically refers to the calculation of cumulative clock offset. The position within the message, for the sake of brevity and These represent the calculated clock offset and the cumulative clock offset, respectively. Because the cumulative clock offset cannot be calculated unconditionally indefinitely, otherwise it would just be a meaningless infinitely large number, it is calculated per... The cumulative offset is calculated repeatedly for each message.

[0079] In the data flow dimension, three features were extracted: payload information entropy, Hamming distance between message payloads with the same ID, and Euclidean distance between consecutive message ID domains. For example... Figure 3 As shown, the payload of a message with the same ID will vary within a certain range, and different IDs will also exhibit certain patterns over time. In short, the ID and Data fields of a CAN data frame are context-aware, and their regular states are learnable by the model under normal circumstances. However, when the device is attacked, data states that would not normally occur will appear. Based on this, this invention calculates the information entropy of the payload to capture the change patterns of the data field in consecutive CAN frames; calculates the Hamming distance of the data field of messages with the same ID to obtain the change pattern of the data content of the same ID under normal circumstances; and calculates the Euclidean distance of the ID field in the data frame to reflect the changes in consecutive ID sequences. The calculation expressions are as follows:

[0080] (4)

[0081] (5)

[0082] (6)

[0083] in, and These represent the lengths of the Data and ID fields in the current data frame, respectively. Since the Data field of a CAN frame varies from 1 to 8 bytes, in order to ensure a uniform data format, the Data field of all CAN frames is filled to 8 bytes before calculation. Since the content of the Data field is a hexadecimal number and the probability of the number appearing is uncertain, in order to facilitate calculation, this invention converts the 8-byte hexadecimal number of the Data field into a 64-bit binary number. and These represent the number of 0s and 1s in the data frame payload, respectively. and They represent the first The first of the Data and ID fields of the data frame Bit elements, in the function Adding 1 is to prevent the occurrence of The situation.

[0084] Matching S3, ID, and functional modules

[0085] A single functional module within an unmanned device may perform multiple functions. For example, a lighting control module might control the lights in multiple parts of the device, including the front, rear, and side lights. Therefore, a single module might send multiple messages with the same ID but different data field content. To facilitate the learning of data flow and temporal characteristics of different functional modules by the machine learning model, and subsequently for attack detection, a clock skew feature mapping is used to map the matching relationship between IDs and modules. The timestamp of each message is recorded, and the average period of each message ID is calculated. Since a functional module can send multiple IDs, and these IDs may have different periods, comparing the clock skew of a single period can be affected by factors such as network latency and message transmission. Therefore, the average period of message IDs is compared pairwise to find their over-period (i.e., the least common multiple of two periods). Figure 4 As shown, comparing the clock skew of two message IDs over their expiration periods reveals that when two message IDs with different expiration periods are sent by the same functional module, the influencing factors are consistent, and the inaccuracy of the comparison results due to factors such as message transmission and network latency is greatly reduced. When the clock skew of two message IDs over their expiration periods are nearly identical, i.e., the difference is less than a set threshold... If so, it can be determined that the two IDs are messages sent by the same functional module.

[0086] S4. Intrusion Detection Model Construction

[0087] S401. Although the CAN protocol and communication are the same in different unmanned devices, the specific implementation and design meaning of communication data packets may differ between manufacturers, resulting in data heterogeneity. Directly feeding the raw data into a machine learning model for feature learning may lead to chaotic feature learning due to differences in meaning and data distribution, resulting in poor model performance. Therefore, feature extraction of the source data is performed, and the extracted features are input into the machine learning model, shifting the focus of model learning from the meaning and distribution of the data to the changes in data features.

[0088] S402. Match message IDs and functional modules to form a relationship mapping table;

[0089] S403, Train the intrusion detection model;

[0090] Each module has a fixed function, meaning the messages it sends and the characteristics they exhibit follow certain patterns. The intrusion detection model learns the characteristics of each functional module and its sent messages. It constructs a high-dimensional space of message characteristics under normal conditions based on bus messages and learns the distribution range of each functional module within this high-dimensional feature space using a mapping table. When an attacker intrudes into an unmanned device and sends an attack message, the characteristics of the attack message will differ from those under normal conditions. This causes a change in the range of the functional module sending the message within the high-dimensional feature space, making it detectable by the intrusion detection model.

[0091] The intrusion detection model trained is based on the XGBoost method, and its specific framework is as follows: Figure 5 As shown, this intrusion detection model learns the relationship between message features and functional modules to predict the functional module that sent the current message. When the prediction result matches the actual result, the data is considered normal. When the prediction result does not match the actual result, the unmanned device is considered to have been attacked.

[0092] During training, this intrusion detection model builds a new tree (weak classifier) ​​in each iteration. This tree makes predictions based on different feature subsets and learns a new function to fit the difference between the previous prediction and the true result. In other words, the final result of the model is the sum of the predictions from the built weak classifiers. The model framework is as follows: Figure 5 As shown. During training, in order to improve the model's recognition accuracy, the system attempts to minimize the difference between the predicted and true values. Furthermore, since the unmanned equipment generates a large amount of data during operation, the objective function for model training is as follows to reduce computational complexity:

[0093]

[0094] The objective function consists of two parts, where, This function is used to penalize the complexity of the tree, making the model more inclined to choose a simpler, more predictive function during the iteration process, thereby reducing the computational complexity of the model. It is the loss function between the true value and the predicted value; during training, the objective function is executed additively, the first... The overall model's prediction value during round iteration is , No. The predicted value of the tree Then the first The objective function of the round iteration is rewritten as:

[0095]

[0096] Using Taylor expansion to rewrite the loss function between the true and predicted values, the above formula is rewritten as:

[0097]

[0098] Remove the constant from the above equation, and let the leaf... The predicted value is And you can get leaves The input set is:

[0099]

[0100] in, The input is the structure relating to the leaf nodes.

[0101] The objective function for optimization is then rewritten as:

[0102]

[0103]

[0104] The XGBoost method builds a new tree in each iteration, and its predictions... That is, the result, for a tree with a known structure, i.e. Let the optimal prediction value be fixed. The calculation is as follows:

[0105]

[0106] Based on the expression for the optimal value above, the objective function is finally rewritten as:

[0107]

[0108] This invention uses softmax as a specific form of the loss function between the true value and the predicted value, and sets... and The values ​​are 0.1 and 0.9 respectively. To prevent the model from overfitting, this invention selects a feature sampling rate of 0.8 for the tree. The deeper the tree splits, the more carefully it learns certain features, which makes it easier to overfit. Therefore, the maximum height of the tree is set to 3 and the learning rate is 0.1.

[0109] Intrusion detection models learn the characteristic relationships between functional modules and data packets during communication. When a functional module is attacked, its position in the feature space will be inconsistent with the distribution shown by the original data. Therefore, the model's prediction of the data packet sending module will not match the actual situation.

[0110] S5, Intrusion Detection.

[0111] Upon detecting an attack, the clock offset of the current message is compared with the clock offset of other message IDs, based on the principle of matching message IDs with functional modules. This allows for tracing the source of the attack, locating the controlled module, and facilitating further defensive measures.

[0112] In another embodiment of the present invention, an intrusion detection system based on multidimensional features is provided. This system can be used to implement the above-mentioned intrusion detection method based on multidimensional features. Specifically, the intrusion detection system based on multidimensional features includes a data acquisition module, an abstraction module, a labeling module, a training module, and a detection module.

[0113] The acquisition module acquires data frames from the CAN bus.

[0114] The abstract module extracts data stream and time dimension features from the data frames obtained by the acquisition module, abstracting source data with different meanings into the same feature space;

[0115] The tag module records the timestamp of each message ID in the same feature space of the abstract module and calculates the average period of each message ID. When the difference in the over-period clock offset between two message IDs is less than a set threshold... When two message IDs are determined to be messages sent by the same functional module, the message IDs are matched with the functional modules, and the features extracted by the abstract module are classified and labeled according to the matching relationship.

[0116] The training module constructs an intrusion detection model based on the XGBoost method and trains the intrusion detection model based on the labeled features obtained from the label model.

[0117] The detection module performs intrusion detection based on the intrusion detection model obtained from the training module. When attack data is detected, it compares the clock offset of the current message with the clock offset of a known ID. If the difference between the two is less than a set threshold, the intrusion is detected. At that time, it is determined that the current message and the comparison ID belong to the same functional module, and the compromised module is obtained by using the relationship between the ID and the functional module.

[0118] In another embodiment of the present invention, a terminal device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions to implement a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used for the operation of an intrusion detection method based on multi-dimensional features, including:

[0119] Data stream and time dimension features are extracted from CAN bus data frames, and source data with different meanings are abstracted into the same feature space. The timestamp of each message ID in the same feature space is recorded, and the average period of each message ID is calculated. When the difference in over-period clock offset between two message IDs is less than a set threshold, the data is considered to be extracted. When two message IDs are determined to be messages sent by the same functional module, the message IDs are matched with the functional modules. The extracted features are classified and labeled according to the matching relationship. An intrusion detection model is built based on the XGBoost method and trained based on the labeled features. Intrusion detection is performed based on the intrusion detection model. When attack data is detected, the clock offset of the current message is compared with the clock offset of the known ID. When the difference between the two is less than a set threshold α, it is determined that the current message and the compared ID belong to the same functional module. The module that has been intruded is obtained by using the relationship between the ID and the functional module.

[0120] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory). This computer-readable storage medium is a memory device in a terminal device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the terminal device and extended storage media supported by the terminal device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, this storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device.

[0121] One or more instructions stored in a computer-readable storage medium can be loaded and executed by a processor to implement the corresponding steps of the intrusion detection method based on multi-dimensional features in the above embodiments; one or more instructions in the computer-readable storage medium are loaded and executed by the processor to perform the following steps:

[0122] Data stream and time dimension features are extracted from CAN bus data frames, and source data with different meanings are abstracted into the same feature space. The timestamp of each message ID in the same feature space is recorded, and the average period of each message ID is calculated. When the difference in over-period clock offset between two message IDs is less than a set threshold, the data is considered to be extracted. When two message IDs are determined to be messages sent by the same functional module, the message IDs are matched with the functional modules. The extracted features are classified and labeled according to the matching relationship. An intrusion detection model is built based on the XGBoost method and trained based on the labeled features. Intrusion detection is performed based on the intrusion detection model. When attack data is detected, the clock offset of the current message is compared with the clock offset of the known ID. When the difference between the two is less than a set threshold α, it is determined that the current message and the compared ID belong to the same functional module. The module that has been intruded is obtained by using the relationship between the ID and the functional module.

[0123] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0124] Experimental environment:

[0125] (1) Experimental equipment:

[0126] This invention was tested on three real advanced intelligent vehicles of different brands, referred to below as Vehicle A, Vehicle B, and Vehicle C. To obtain data stream and time-dimensional characteristics, CANalyst-II was used to connect to the CAN bus via the OBD-II interface to acquire data frames and record the reception time.

[0127] (2) Hardware and software environment of the experiment:

[0128] This invention is based on the XGBoost method, and the integrated development environment (IDE) is Python, Scikit-learn, and the XGBoost framework. The model software is deployed on a Rockchip RK3588 development board, flashed with an Ubuntu 22.04 operating system, as detailed below. Figure 6 As shown, the product after assembly is as follows: Figure 7 As shown.

[0129] (3) Training samples and parameter settings:

[0130] Six features are calculated from the collected time and data frames, including message period, clock offset, and cumulative clock offset in the time dimension; and data entropy, payload Hamming distance, and ID Euclidean distance in the data stream dimension. Each vehicle is trained with 100,000 samples, and the sample size is 3,000 when testing the detection rate of each attack, with normal and abnormal data evenly distributed.

[0131] Experimental results:

[0132] (1) The mlogloss curve of the model

[0133] Figure 8To test the Mlogloss value of the model during training on three vehicles, the graph shows that the model converges quickly, reaching convergence in less than 250 rounds. Car A has the highest Mlogloss value, but it is still less than 0.2. Car B's loss function value is close to 0, and Car C's Mlogloss value is slightly greater than 0, around 0.008. The experimental results in the graph indicate that the model designed for this product requires only a few rounds to converge, and the loss function value is very small, indicating good model performance.

[0134] (2) Confusion matrix of the model

[0135] This invention calculates multiple characteristics of the current message and establishes a connection between message characteristics and the ECU. By identifying the source of the current message, it determines whether the current message has been attacked. Figure 9 , Figure 10 and Figure 11 The confusion matrix of the ECU was identified during the training process on vehicles A, B, and C, respectively. The accuracy of this product in identifying 10 ECUs on vehicle A was 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 1.0, 0.97, and 0.98, all exceeding 0.97. On vehicle B, the accuracy was 0.9, 1.0, 1.0, 0.98, 0.92, 1.0, 0.92, 0.95, 0.95, and 0.93, respectively. On vehicle C, the accuracy was 1.0, 0.97, 1.0, 1.0, 1.0, 1.0, 0.99, 1.0, and 0.96, all exceeding 0.96. The experimental results demonstrate that this product can identify in-vehicle ECUs with a high accuracy rate.

[0136] (3) Detection results of different attacks in different vehicles

[0137] This invention posits that the message characteristics and clock characteristics of functional modules within an unmanned device are unique. That is, the multidimensional features of different modules are distributed differently in the high-dimensional feature space established by the model. Therefore, this invention can accurately identify different functional modules under normal circumstances. Furthermore, this invention argues that when an unmanned device is attacked, the sent attack messages will exhibit different data characteristics or inconsistent functional module characteristics, leading the detection model to incorrectly match the current attack message with its sending module. Therefore, identifying the message source can determine whether the current data has been attacked. This invention was tested on three advanced intelligent vehicles using a mixed sample of normal and abnormal data. Tables I, II, and III show the intrusion detection results for vehicles A, B, and C, respectively. The attacks selected by this invention include bus-off attacks, deception attacks, fuzzy attacks, disguise attacks, and replay attacks, which are typical attacks in current intrusion detection research. During the test, each data point was labeled based on the ID and ECU matching relationship of normal data. If the current data is labeled ECU1, but the model classifies it into another category, this invention considers the vehicle to be under attack. When a device is attacked, there will not be just one attack data point, and actual products have high requirements for false positive rates. Therefore, in actual testing, this invention is configured to only consider the device to be under attack if three consecutive errors are reported. The experimental results are evaluated using five metrics: accuracy, precision, recall, FPR, and false negative rate (FNR).

[0138] Table 1

[0139]

[0140] Table 1 shows the experimental results of attack detection on vehicle A. It can be seen that the accuracy and recall rates for bus-off attacks, spoofing attacks, and fuzzy attacks are all 1, while the FPR and FNR are both 0. The accuracy rates for spoofing attacks and replay attacks are 0.9967 and 0.9917, respectively, the recall rates are 0.9934 and 0.9836, respectively, and the FNRs are 0.0066 and 0.0164, respectively. According to the calculation formula of the experimental results, the recognition rate of this product for normal data is 100%, that is, the false positive rate is 0, and the false negative rate is slightly higher, but both are less than 0.0164.

[0141] Table 2

[0142]

[0143] Table 2 shows the experimental results of attack detection on vehicle B. The accuracy for all test samples was 1. Specifically, the accuracy and recall for bus-off attacks, fuzzy attacks, and spoofing attacks were all 1, with FPR and FNR both being 0, indicating that both normal and abnormal samples could be accurately identified when testing these three attacks. The recall for detecting spoofing attacks was 0.992 and the FNR was 0.008, while the accuracy for detecting replay attacks was 0.9901 and the FNR was 0.0091. The experimental results demonstrate that this product can detect these five attacks with high accuracy on vehicle B.

[0144] Table 3

[0145]

[0146] Table 3 shows the experimental results of this product on vehicle C. The accuracy rates for detecting camouflage attacks and replay attacks are 0.9983 and 0.9973, respectively. The FPR for both types of attacks is 0, and the FNR is less than 0.0054. The detection accuracy for all five types of attacks is 1. The experimental results from three vehicles demonstrate that this product can achieve a detection accuracy of nearly 1 with zero false alarms.

[0147] (4) Model detection time

[0148] Table 4

[0149]

[0150] The detection time of this invention is shown in Table 4. The detection sample size for each vehicle is 3000. The detection time for each sample on vehicles A, B, and C is 0.0861ms, 0.0807ms, and 0.0968ms, respectively. The attack detection time is short, which can meet the high response requirements of vehicles.

[0151] In summary, this invention provides an intrusion detection method and system based on multi-dimensional features, overcoming the limited attack detection capabilities of single-dimensional feature-based methods. It can detect more types of attacks from multiple perspectives. Current intrusion detection schemes are primarily based on observing the variation range of parameters contained in CAN messages under normal conditions. However, when a device is attacked, one or more parameters may exhibit variations outside the normal distribution. Therefore, this product extracts multiple parameter features from both time and traffic dimensions for observation, enabling a more comprehensive observation of parameter changes displayed in the data on the CAN bus from different angles, thereby detecting attacks.

[0152] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0153] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0154] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0155] In the embodiments provided by this invention, it should be understood that the disclosed devices / terminals and methods can be implemented in other ways. For example, the device / terminal embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0156] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0157] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0158] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM). Only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0159] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0160] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0161] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0162] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A method of intrusion detection based on multi-dimensional features, characterized by, The method comprises the following steps: S1, collecting data frames of a CAN bus on an unmanned device; S2, extracting data streams and time dimension features from the data frames obtained in step S1, and abstracting source data with different meanings into the same feature space, wherein the time dimension features include message cycle features, clock offset features, and cumulative clock offset features; The data stream dimension features include payload information entropy features, Hamming distance features of payloads of same ID messages, and Euclidean distance features of ID domains of consecutive messages; Message cycle feature Clock offset feature Cumulative clock offset feature As follows: wherein and is an index of the current message, refers to the position in the messages when calculating the cumulative clock skew. Payload information entropy feature Hamming distance feature of same ID message payload Continuous ID Euclidean distance feature Specifically as follows: wherein, and represent the length of Data and ID field in the current data frame respectively, and represent the number of 0 and 1 of the data frame payload respectively, and represent the element of Data and ID field of the th data frame at the th bit respectively; S3, record the time stamp of each message ID in the same feature space of step S2, and calculate the average period of each message ID, when the super period clock offset difference value of two message IDs is less than the set threshold , determine that the two message IDs are messages sent by the same function module, realize the matching of message ID and function module, classify and label the features extracted in step S2 according to the matching relationship; S4, constructing an intrusion detection model based on an XGBoost method, and training the intrusion detection model based on the labeled features obtained in step S3, specifically as follows: S401, performing feature extraction on source data, inputting the extracted features into a machine learning model, and enabling the intrusion detection model to learn from changes in data features instead of meanings and distributions of data; S402, matching message IDs and functional modules to form a relationship mapping table, and labeling the extracted features according to the mapping table of the functional modules, that is, the extracted feature labels of ID messages belonging to the same functional module are the same; S403, establishing a weak classifier each time an iteration is performed, the weak classifier performs prediction according to different feature subsets, learns a new function to fit the difference between the previous prediction and the true result, and the final result is the sum of the prediction results of the established weak classifiers, thereby completing the training of the intrusion detection model; S5, based on the intrusion detection model obtained in step S4, performing intrusion detection, when detecting attack data, comparing the clock offset of the current message with the clock offset of the known ID, when the two difference values are less than a set threshold , determining that the current message and the compared ID belong to one function module, and obtaining the invaded module by using the relationship between the ID and the function module.

2. The method of claim 1, wherein, In step S403, the objective function for training the intrusion detection model As follows: in, The leaf node of the weak classifier To obtain leaf nodes from input features a subset of For the loss function with respect to The first-order partial derivative, The loss function between the actual value and the predicted value. For the true values ​​of the dataset, For the first The predicted value of the wheel, To control the fraction of leaf nodes, This is a penalty factor used to control the complexity of weak classifiers.

3. The method of claim 2, wherein, The feature sampling rate of the weak classifier is 0.8, the maximum height of the weak classifier is set to 3, the learning rate is 0.1, and the loss function is softmax.

4. The method for intrusion detection based on multi-dimensional features according to claim 2, wherein, The XGBoost method builds a new weak classifier at each iteration, the prediction value of which is That is, the results are as follows: 。 5. The method for intrusion detection based on multi-dimensional features according to claim 1, wherein, In step S5, when an intrusion is detected, the current message clock offset is compared with clock offsets of other message IDs to trace the source of the intrusion.

6. A multi-dimensional feature based intrusion detection system characterized in that, The method comprises the following steps: A collection module collects data frames of a CAN bus on an unmanned device; An abstracting module extracts data streams and time dimension features from the data frames obtained by the collection module, and abstracts source data with different meanings into the same feature space, wherein the time dimension features include message cycle features, clock offset features, and cumulative clock offset features; The data stream dimension features include payload information entropy features, Hamming distance features of payloads of same ID messages, and Euclidean distance features of ID domains of consecutive messages; Message cycle feature Clock offset feature Cumulative clock offset feature As follows: wherein, and is an index of the current message, refers to the position in the messages where the cumulative clock skew is calculated. Payload information entropy feature Hamming distance feature of same ID message payload Continuous ID Euclidean distance feature As follows: wherein, and represent the length of the Data and ID fields in the current data frame, respectively, and represent the number of 0s and Is in the data frame payload, respectively, and represent the Data and ID field of the thdata frame, respectively, at the thbit element. The tag module records the time stamp of each message ID in the same feature space of the abstract module, and calculates the average period of each message ID, and when the clock offset difference value of the super period of two message IDs is less than the set threshold value, it is determined that the two message IDs are messages sent by the same function module, the matching of the message ID and the function module is realized, and the features extracted by the abstract module are classified and tagged according to the matching relationship ​ A training module constructs an intrusion detection model based on an XGBoost method, and trains the intrusion detection model based on labeled features obtained by the labeling module, specifically as follows: S401, performing feature extraction on source data, inputting the extracted features into a machine learning model, and enabling the intrusion detection model to learn from changes in data features instead of meanings and distributions of data; S402, matching message IDs and functional modules to form a relationship mapping table, and labeling the extracted features according to the mapping table of the functional modules, that is, the extracted feature labels of ID messages belonging to the same functional module are the same; S403, establishing a weak classifier each time an iteration is performed, the weak classifier performs prediction according to different feature subsets, learns a new function to fit the difference between the previous prediction and the true result, and the final result is the sum of the prediction results of the weak classifiers, thereby completing the training of the intrusion detection model. The detection module performs intrusion detection based on the intrusion detection model obtained by the training module, and when attack data is detected, compares the clock offset of the current message with the clock offset of the known ID, and when the two difference values are less than a set threshold , determines that the current message and the compared ID belong to one function module, and obtains the invaded module by using the relationship between the ID and the function module.

Images