Vehicle CAN bus anomaly detection method and medium based on timing and semantic features

Abstract

The present invention discloses a method and medium for detecting abnormalities of a vehicle-mounted CAN bus based on timing and semantic features. The method trains a prediction model through normal vehicle-mounted CAN bus message data, and compares and analyzes actual messages with a prediction message library, thereby realizing the detection of abnormal messages of the vehicle-mounted CAN bus. As a serial data communication protocol, the communication interface of the CAN bus integrates the physical layer and data link layer functions of the CAN protocol, and can complete the framing processing of communication data. The present invention starts with collecting vehicle-mounted CAN bus message data frame information, and establishes a deep learning model for data frame timestamps, IDs, and data domain information to realize message abnormality detection based on message timing features and semantic analysis. The present invention combines and encodes ID and data domain bytes according to position information, and uses ID information as the starting point for predicting message data domain bytes, thereby realizing speed optimization of the data domain prediction model.

Description

Technical Field

[0001] The present invention relates to the technical field of automobile network security, and in particular to a vehicle-mounted CAN bus anomaly detection method and a storage medium based on timing and semantic features. Background Art

[0002] In recent years, vehicle-mounted communication technology has developed rapidly, and the information exchange between vehicles and the outside world has become more frequent, but the security risks it brings are also increasing. As an important vehicle-mounted network in modern cars, the CAN bus may be attacked by hackers in various ways, resulting in safety accidents such as vehicle loss of control or functional failure. Therefore, attack behavior analysis technology for vehicle-mounted networks is crucial in the study of automotive intrusion detection.

[0003] At present, CAN bus security research is mainly divided into two directions: one is from the perspective of protocol security, by identifying and authenticating the sender of the message to detect whether it is abnormal, but currently various protocols have not formed a consensus and specification, and the recognition effect is poor; the second is to detect CAN bus message anomalies from the perspective of traffic analysis and data packet structure, without modifying the communication protocol and physical hardware. CAN bus message anomaly detection has good detection effect and practicality, but the current detection method has poor detection performance for unknown attacks or detects limited attack types. This invention proposes a vehicle-mounted CAN bus abnormal behavior detection method based on timing and semantic features. Summary of the invention

[0004] The present invention proposes a method, device and storage medium for detecting anomalies of a vehicle-mounted CAN bus based on timing and semantic features, which can at least solve one of the technical problems in the background technology.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] A vehicle CAN bus abnormality detection method based on timing and semantic features, a vehicle CAN bus abnormal behavior detection method based on timing and semantic features is implemented by the following steps:

[0007] Step 1: In order to build a reliable and accurate vehicle CAN message language prediction model and ensure the accurate identification of abnormal behavior of the vehicle network by the automobile intrusion detection system, the present invention first pre-processes the CAN bus message data collected by various models under normal operating conditions in urban roads, highways and other environments. By collecting the vehicle bus message, the message timestamp, ID, data field and other information are obtained, and the real vehicle data frame ID is respectively encoded according to the timestamp embedded timing information, and the ID of each message of the real vehicle data frame is combined with the data field as the first bit to be encoded, and the relative position information of each byte inside the message is embedded.

[0008] Step 2: The message ID embedded with timing information is trained through the Transformer model to obtain a model for predicting the next message based on the timing relationship. At the same time, the data domain information of the embedded message ID and the relative position of each internal byte is trained through the Transformer model to obtain a semantic prediction model based on the data domain of each message. By comparing the two prediction models at the same time, anomaly detection of on-board CAN messages is achieved.

[0009] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0010] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0011] It can be seen from the above technical scheme that the present invention is a context-based vehicle network anomaly detection method based on the Transformer model. The method trains the prediction model through the normal vehicle-mounted CAN bus message data, and compares and analyzes the actual message with the prediction message library, thereby realizing the detection of abnormal messages of the vehicle-mounted CAN bus. As a serial data communication protocol, the communication interface of the CAN bus integrates the physical layer and data link layer functions of the CAN protocol, which can complete the framing processing of the communication data. The present invention starts with collecting the vehicle-mounted CAN bus message data frame information, and establishes a deep learning model for the data frame timestamp, ID, and data domain information to realize message anomaly detection based on message timing characteristics and semantic analysis.

[0012] Specifically, the beneficial effects of the present invention are:

[0013] (1) The present invention is an anomaly detection method based on bus message ID timing and message semantics. Compared with the method of realizing intrusion detection based only on the context association of message ID timing based on the Transformer model, the present invention not only optimizes the speed by training the optimal prediction sample size, but also solves the problem that the above method has poor detection effect on difficult-to-detect attacks such as replacement attacks by combining the semantic feature detection of the data domain itself. In addition, it also solves the defect that the Transformer model cannot detect replay attacks based on the single reliance on message semantic features.

[0014] (2) The present invention is a method for detecting abnormal behavior of a vehicle-mounted CAN bus based on bus message ID timing and message semantics. The prediction samples are updated in real time according to the message ID generated by the actual vehicle operation, and the optimal prediction sample size is used to achieve rapid detection. The prediction model is iteratively uploaded to the cloud periodically through the phased collection of actual vehicle data, and the false alarm rate of detection is continuously reduced through OTA remote upgrades.

[0015] (3) The present invention is an anomaly detection method based on bus message ID timing and message semantics. By combining and encoding the ID and data domain bytes according to position information, the ID information is used as the starting point for predicting the message data domain bytes, thereby achieving speed optimization of the data domain prediction model. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of the message anomaly detection process of the present invention;

[0017] Figure 2 This is a schematic diagram of message data preprocessing of the present invention;

[0018] Figure 3 This is a general schematic diagram of the Transformer network structure of the present invention;

[0019] Figure 4 This is a schematic diagram of the core components of the Transformer network structure of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

[0021] like Figure 1 As shown, the vehicle-mounted CAN bus anomaly detection method based on timing and semantic features described in this embodiment includes the following steps:

[0022] Step 1: In order to build a reliable and accurate vehicle CAN message language prediction model and ensure the accurate identification of abnormal behavior of the vehicle network by the automobile intrusion detection system, the present invention first pre-processes the CAN bus message data collected by various models under normal operating conditions in urban roads, highways and other environments. By collecting the vehicle bus message, the message timestamp, ID, data field and other information are obtained, and the real vehicle data frame ID is respectively encoded according to the timestamp embedded timing information, and the ID of each message of the real vehicle data frame is combined with the data field as the first bit to be encoded, and the relative position information of each byte inside the message is embedded.

[0023] Step 2: The message ID embedded with timing information is trained through the Transformer model to obtain a model for predicting the next message based on the timing relationship. At the same time, the data domain information of the embedded message ID and the relative position of each internal byte is trained through the Transformer model to obtain a semantic prediction model based on the data domain of each message. By comparing the two prediction models at the same time, anomaly detection of on-board CAN messages is achieved.

[0024] The following is a detailed description with reference to the accompanying drawings:

[0025] like Figure 1 The flowchart of the message anomaly detection method of the present invention is shown. In step 1, the ID domain and the data domain are processed and embedded with information respectively, and in step 2, the input matrix of the corresponding model is formed, and the prediction matrix library is obtained through model training, and anomaly detection is realized by comparing the matrix library.

[0026] like Figure 2 The figure shows the schematic diagram of message data preprocessing in step 1. On the one hand, each CAN bus message has good timing due to the existence of timestamp, so the message ID, data field and other fields are collected at the same time. The data field retains the 8-byte format and the data is converted to decimal for matrix calculation. Secondly, the ID of each message is embedded in the semantic first digit code as the vector X 1， The 8 bytes in the data domain are encoded by the embedding semantic position to obtain 8 vectors X 2-9 , as 9 row vectors to obtain the matrix X of the input Transformer model. On the other hand, the r messages before the current message are encoded based on the time series features, and the ID is embedded in the time series information according to the timestamp to obtain r row vectors, forming the matrix Y input to the Transformer model.

[0027] like Figure 3 The figure shows the overall structure of the Transformer model in step 2. The model consists of multiple layers of encoders and decoders. The input matrix is ​​linearly superimposed on multiple layers of encoders and finally input into the decoder. The output of the previous layer of decoder is input into the next layer of decoder, and the prediction matrix is ​​finally output.

[0028] like Figure 4 The following is a schematic diagram of the core components of the Transformer model structure in step 2. The input matrices X and Y are passed through N encoders to obtain the information encoding matrix C. X , C Y。During this period, in each encoder, the matrix passes through a multi-head attention module Muti-HeadAttention, which is composed of multiple self-attention modules. The matrix passes through each self-attention module and is respectively combined with the weight matrix W Q , W K , W V Multiply them to get three vectors Q, K, and V, where the weight matrix is ​​obtained through training and then scaled by the dot product attention function Obtain a similarity evaluation of the input, where d k is the number of columns of the Q, K matrices, i.e., the vector dimension; the calculation results of multiple self-attention modules are concatenated and linearly transformed to obtain a multi-head attention module. The multi-head attention module also includes an Add&Norm layer. Add represents residual connection, which is used to prevent network degradation, and Norm represents Layer Normalization, which is used to normalize the activation values ​​of each layer. Each row element of the input matrix will pass through N encoders in turn to obtain a new row and form the encoding matrix C X , C Y .

[0029] Coding matrix C X , C Y The input is sent to the Decoder and then to the multi-head attention module. The output of the previous layer of the Decoder in this layer (the initial Decoder input start signal is sufficient) is input to the masked multi-head attention module. The Mask matrix formed by masking part of the input matrix is ​​input to the multi-head attention module and the Add&Norm layer. Each masked output is output through the Linear layer to obtain the corresponding prediction vector Z. Xi , Z Yi , and finally the prediction matrix is ​​obtained through the Softmax layer.

[0030] The processing method of the ID field is similar to that of the data field. The difference is that the ID field is based on the time series characteristics and connects multiple messages to achieve prediction. Figure 1 As shown in the figure, when the number of messages r used for prediction is too large, it will lead to excessive computation and slow system response. Let the next message be the Nth message, and this message is named the current prediction message. If the prediction is based on the N-1 messages before this message, the prediction range can be narrowed as much as possible, but there is still the problem of excessive computation. Therefore, the r messages before the current prediction message are used as prediction samples, and the r value with the smallest computation is trained according to the algorithm to achieve computational optimization of the prediction layer.

[0031] On the other hand, the present invention further discloses a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the above method.

[0032] On the other hand, the present invention further discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the above method.

[0033] In another embodiment provided in the present application, a computer program product comprising instructions is also provided, which, when executed on a computer, enables the computer to execute any of the vehicle-mounted CAN bus anomaly detection methods based on timing and semantic features in the above-mentioned embodiments.

[0034] It is understandable that the system provided by the embodiment of the present invention corresponds to the method provided by the embodiment of the present invention, and the explanation, examples and beneficial effects of the relevant contents can refer to the corresponding parts in the above method.

[0035] An embodiment of the present application also provides an electronic device, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus.

[0036] Memory, used to store computer programs;

[0037] The processor is used to implement the above-mentioned vehicle-mounted CAN bus anomaly detection method based on timing and semantic features when executing the program stored in the memory.

[0038] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc.

[0039] The communication interface is used for communication between the above electronic device and other devices.

[0040] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0041] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, and discrete hardware components.

[0042] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive Solid State Disk (SSD)), etc.

[0043] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0044] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0045] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A vehicle CAN bus anomaly detection method based on timing and semantic features, characterized in that: The following steps are included: Step 1: First, pre-process the CAN bus message data collected from various vehicle models under normal operating conditions in urban roads and highways; By collecting the vehicle bus message to obtain the message timestamp, ID, and data domain information, the real vehicle data frame ID is respectively encoded according to the timestamp embedded in the timing information, the ID of each message of the real vehicle data frame is combined with the data domain as the first bit and encoded, and the relative position information of each byte in the message is embedded; Step 2: The message ID embedded with timing information is trained through the Transformer model to obtain a model for predicting the next message based on the timing relationship. At the same time, the data domain information of the embedded message ID and the relative position of each internal byte is trained through the Transformer model to obtain a semantic prediction model based on the data domain of each message. By comparing the two prediction models at the same time, anomaly detection of vehicle-mounted CAN messages is achieved; Data preprocessing in step 1 includes: First, the ID and data fields of the message are collected at the same time. The data field is kept in 8-byte format, and the data is converted to decimal for matrix calculation. Secondly, the ID of each message is embedded in the semantic first bit code as vector X 1， The 8 bytes in the data domain are encoded by the embedding semantic position to obtain 8 vectors X 2-9 , as 9 row vectors to get the matrix X of the input Transformer model; On the other hand, the r messages before the current message are encoded based on the time series features, and the ID is embedded in the time series information according to the timestamp to obtain r row vectors, forming a matrix Y to input into the Transformer model; Step 2 specifically includes: Input matrices X and Y pass through N encoders to obtain information encoding matrix C X , C Y During this period, in each encoder, the matrix passes through a multi-head attention module Muti-Head Attention and an Add & Norm layer; each row element of the input matrix will pass through N encoders in turn to obtain a new row vector and form the encoding matrix C X , C Y ; Coding matrix C X , C Y Input to the Decoder, input to the multi-head attention module, and the Mask matrix is ​​formed by masking part of the input matrix. Each masked output is output through the Linear layer to generate the corresponding prediction vector Z Xi , Z Yi , and finally the prediction matrix is ​​obtained through the Softmax layer to realize the prediction function.

2. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the method according to claim 1.

Images