Attention-based CNN-BiLSTM algorithm-based vehicle networking intrusion detection method and system

Abstract

The application discloses a kind of CNN-BiLSTM algorithm based on attention Internet of Vehicles intrusion detection method and system, and is suitable for vehicle networking safety detection.The system of the present application includes data acquisition module, data preprocessing module and deep learning detection module.The method of the present application comprises: obtaining the traffic data of in-vehicle network and off-vehicle network respectively;Preprocessing traffic data, converting network data stream in hexadecimal into vectorized digital sequence;Using CNN-BiLSTM model with attention mechanism, training corresponding detection model for in-vehicle network and off-vehicle network respectively, and inputting the vectorized sequence obtained by preprocessing real-time captured network data stream into the corresponding trained detection model for detection.The present application can retain and extract more features of network data stream, accurately represent complex network traffic data, improve the accuracy of intrusion detection, and the detection result is accurate, which is very suitable for current Internet of Vehicles intrusion detection system.

Description

Technical Field

[0001] This invention relates to vehicle networking and intrusion detection systems, belonging to the field of cyberspace security technology, specifically to a vehicle networking intrusion detection method and system based on the attention-based CNN-BiLSTM algorithm. Background Technology

[0002] The development of the Internet of Things (IoT) has spurred numerous revolutionary applications, such as the Internet of Vehicles (IoV). IoV is an integrated, open network system that connects intelligent connected vehicles with other connected vehicle entities, allowing for the exchange and sharing of data and information, which can enhance driving efficiency and safety for users. However, these network connections also introduce risks such as privacy issues and cybersecurity vulnerabilities. Therefore, a security solution is needed to provide security, trust, and privacy for communication entities in IoV, significantly reducing traffic accidents and protecting human life.

[0003] Vehicle-to-everything (V2X) architecture, such as Figure 1 As shown, inside a vehicle, a connected car consists of various elements, such as the in-vehicle infotainment system, on-board diagnostics (OBD) system, central gateway, electronic control unit (ECU), telematics control unit (TCU), and various sensors. Generally, sensors and ECUs communicate using a Controller Area Network (CAN) bus to transmit messages and perform operations. Furthermore, connected cars connect to external networks via vehicle-to-everything (V2X) communication technologies, which can take the form of vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), vehicle-to-pedestrian (V2P), and vehicle-to-network (V2N) technologies. These technologies enable the faster flow of critical traffic data related to traffic, drivers, and vehicles. Intrusion detection systems (IDS) are one of the most important methods for protecting vehicle networks from threats because they can detect both internal and external attacks on the vehicle network with high precision. However, network communication traffic in vehicle networks increases significantly and is vulnerable to different types of network attacks from various attack surfaces, making the security issues of both in-vehicle and external networks a pressing need to be addressed. Therefore, using high-performance intrusion detection methods and systems has become an important means of protecting vehicle networks from malicious interference and ensuring safe driving.

[0004] Intelligentization and networking are the development trends of the Internet of Vehicles (IoV), and the "terminal-management-cloud" ecosystem has become a typical IoV solution. "Terminal" corresponds to the in-vehicle network (IVN), and "management" corresponds to the V2X external network. The first two parts, together with the "cloud" service platform, constitute the three-layer architecture of the IoV.

[0005] The in-vehicle network uses various buses to establish communication between electronic control units and sensors, such as CAN bus, local interconnect network, FlexRay, Ethernet, etc., among which CAN bus is the de facto standard of in-vehicle network, which provides a low-cost, easy-to-install, and low-communication overhead communication protocol. However, the CAN protocol is not secure, mainly because 1) lack of privacy, CAN nodes exchange information in plaintext; 2) lack of identity verification mechanism, sending nodes are not verified; 3) CAN bus uses broadcast communication. In the external network, intelligent connected vehicles in the vehicle network can collect data from other vehicles or road infrastructure using wireless connection technology. Intelligent connected vehicles realize information transmission with the vehicle network cloud service platform through cellular networks such as LTE-V and 5G, for receiving the platform's commands, through dedicated short-range communication (DSRC) to realize information sharing between vehicles, and through Bluetooth, Wi-Fi, cellular, etc. to communicate with users for easy user monitoring and management of the vehicle using corresponding mobile devices.

[0006] However, the increasing connectivity and accessibility of the vehicle network, both internally and externally, increase the network attack surface of modern intelligent connected vehicles, making the vehicle network an easy target for intruders. Currently, the security threats involved in the vehicle network mainly include vehicle internal communication network attacks and various external network attacks of the vehicle network.

[0007] The vehicle network is subject to various attacks that can have a significant impact on the safety and functionality of the vehicle. Here are some major attacks against the vehicle network: denial-of-service attacks (DoS), attackers can send a large amount of invalid data or requests to the vehicle network, causing the vehicle network to be overwhelmed, leading to communication interruption and system instability. This can pose a serious threat to critical vehicle systems such as driver assistance systems (ADAS) and safety systems; spoofing attacks, attackers can pretend to be legitimate vehicle network nodes and send false information to other nodes, leading to misleading and dangerous decisions. For example, attackers can send false GPS data, causing the vehicle to navigate to the wrong location; man-in-the-middle attacks (MITM), MITM attackers can intercept communications in the vehicle network, modify message content, or pretend to be a legitimate node, affecting the integrity and confidentiality of data. This can pose a threat to secure communication and privacy between vehicles; data tampering attacks, attackers can tamper with data packets transmitted in the vehicle network, modify message content or data fields, causing the vehicle to perform incorrect operations. This can pose a dangerous threat to the performance and safety of the vehicle.

[0008] The Internet of Vehicles faces various external network attacks that can threaten the safety and communication availability of vehicles. The most common external network attacks include: denial of service attacks (DoS) and distributed denial of service attacks (DDoS), which threaten the availability of vehicle networks. Attackers overload network resources by sending a large amount of invalid data to vehicle networks, causing vehicles to be unable to process legitimate requests, which can lead to increased communication delays, endangering road safety and traffic efficiency; replay attacks, attackers intercept legitimate messages and resend them to other nodes in the vehicle network, which can cause data forgery, causing vehicles to perform dangerous operations, such as misleading drivers or causing vehicle accidents; spoofing attacks, attackers pretend to be legitimate users or nodes and send false GPS data or other information, which can mislead other vehicles and pose a danger to navigation and traffic decisions; brute force attacks, attackers attempt to guess or crack the password of the vehicle network to gain unauthorized access; phishing attacks, attackers may try to deceive vehicles or drivers by using fake access points or messages to obtain sensitive information such as user credentials, thereby threatening the security of communication; malicious software and fake updates, attackers may send fake software updates containing malicious code, which can cause vehicle systems to be infected or even remotely controlled; man-in-the-middle attacks (MITM), attackers may attempt to intercept communications, modify messages or pretend to be legitimate nodes, thereby compromising the integrity and confidentiality of data.

[0009] The security challenges of the Internet of Vehicles need to be constantly evolved and addressed, and security experts and the industry have been working hard to develop new technologies and standards to ensure that vehicle data is protected from malicious attacks. The development of these technologies is crucial to ensuring the stability of the Internet of Vehicles system and the safety of drivers.

[0010] The prior art provides a deep learning-based intrusion detection system for the Internet of Vehicles, which is a vehicle network intrusion detection using a CAN intrusion dataset. The system first uses a convolutional neural network (CNN) to convert packet samples into images; then, the main layers of the CNN are transferred using the image classification model VGG-16, and only the bottom layer is trained based on the CAN intrusion dataset. In this system, the IDS is deployed after the OBD to detect malicious incoming packets from different sources and distinguish DDoS, fuzzing and benign samples through multi-class classification.

[0011] The current vehicle networking intrusion detection system has the following problems: (1) Low applicability. The current vehicle networking intrusion detection system is either for vehicle network attacks or for external network attacks. However, the attack surface of vehicle networking is expanding, and a single intrusion detection system is not enough to deal with the increasing and changing malicious threats. Therefore, the current vehicle networking intrusion detection system needs to be improved. (2) Low accuracy. With the explosive growth of in-vehicle and off-vehicle traffic of intelligent connected vehicles on the road and the unprecedented increase in the number of V2X communication links, various network attacks are emerging, making it difficult for some traditional methods to extract effective traffic features. And the previous feature extraction methods for various attacks focused on converting network traffic into picture form, ignoring the sequence relationship between each flow, resulting in low detection accuracy. SUMMARY

[0012] In order to overcome the problems of the prior art, the application provides a vehicle networking intrusion detection method and system based on attention CNN-BiLSTM algorithm, which extracts complex nonlinear features and bidirectional long-distance sequence features from vehicle networking traffic data for different types of network attacks in and out of the vehicle, and fuses the features based on the attention mechanism to realize accurate representation of complex data and improve the accuracy of intrusion detection.

[0013] The vehicle networking intrusion detection system based on the attention CNN-BiLSTM algorithm of the application comprises a data acquisition module, a data preprocessing module and a deep learning detection module. The data acquisition module is used to acquire traffic data packets of in-vehicle networks and off-vehicle networks. The data preprocessing module preprocesses the input traffic data to obtain vectorized sequences, which includes removing redundant data, sampling data and converting data format. The data format conversion converts the 16-bit network data stream into a vectorized ordered digital sequence. The deep learning detection module uses a CNN-BiLSTM model with an attention mechanism to establish a detection model, trains the corresponding detection model using traffic data training samples of in-vehicle networks and off-vehicle networks, and uses the trained detection model to detect real-time captured traffic data of in-vehicle networks or off-vehicle networks. The input of the detection model is the vectorized digital sequence of the network data stream, and the output is the judgment of whether the current input is normal data or attack data belonging to a certain intrusion mode.

[0014] The data acquisition module acquires CAN data frames for in-vehicle network traffic data, and each data frame contains CAN ID and data field. For off-vehicle networks, Pcap data packets are captured to obtain traffic data.

[0015] The data preprocessing module converts the data format, that is, regarding two hexadecimal numbers corresponding to each byte of the network data stream as a word, regarding the network data stream as an ordered word sequence, using a tokenizer to count the frequency of each word, performing integer coding on the word, and converting the network data stream represented by the hexadecimal number into an ordered digital sequence, and the number corresponds to the word.

[0016] The deep learning detection module uses a CNN-BiLSTM model with an attention mechanism to establish a detection model; in the detection model, the ordered digital sequence of the network data stream is first input into an embedding layer, each word is embedded and coded, an embedding matrix is obtained for a sequence, and then the sequence is input into k parallel CNN modules for feature extraction, and k is greater than 1; the features extracted by the CNN modules are spliced and input into a BiLSTM model, and the context features of each word are output, then the bidirectional features are spliced, the bidirectional features are mapped through a full connection layer, and a Dropout operation is used to prevent model overfitting; a self-attention module is arranged after the Dropout operation, the self-attention module uses a global attention mechanism to assign a corresponding weight to each word, calculates an attention score, and performs weighted averaging on each word to obtain an output vector, and then the output vector is input into a full connection layer and a softmax activation function to obtain a classification result.

[0017] Correspondingly, the application provides a vehicle networking intrusion detection method based on an attention-based CNN-BiLSTM algorithm, which comprises the following steps:

[0018] Step 1, respectively acquiring the traffic data of the in-vehicle network and the out-vehicle network;

[0019] The CAN bus data of the in-vehicle network is captured, the CAN data frame is acquired, the CAN ID and the data field of each frame of data are acquired, the Pcap data packet of the out-vehicle network is captured, and CAN represents a controller area network bus;

[0020] Step 2, preprocessing the acquired network traffic data to output a vectorized digital sequence;

[0021] The preprocessing includes removing redundant data, sampling the data, and converting the data format; wherein the data format conversion refers to regarding two hexadecimal numbers corresponding to each byte of the network data stream as a word, regarding the network data stream as an ordered word sequence, using a tokenizer to perform integer coding on the word, and converting the network data stream represented by the hexadecimal number into a vectorized ordered digital sequence;

[0022] Step 3, a detection model is established using a CNN-BiLSTM model with an attention mechanism, and the traffic data of the in-vehicle network and the out-of-vehicle network are used to train the corresponding detection model respectively; the traffic data of the in-vehicle network or the out-of-vehicle network is real-time captured through the method of step 1, the captured network data stream is preprocessed through step 2, and the trained detection model is used to detect the real-time captured traffic data of the in-vehicle network or the out-of-vehicle network; CNN represents a convolutional neural network, and BiLSTM represents a bidirectional long short-term memory network;

[0023] The label of the training sample is normal data or a certain intrusion mode of the in-vehicle network or the out-of-vehicle network;

[0024] The real-time captured traffic data is provided with a label indicating whether it belongs to the in-vehicle network or the out-of-vehicle network.

[0025] The advantages and positive effects of the present application are as follows: (1) the vehicle networking intrusion detection system and method of the present application designs a data preprocessing module, which can directly convert the 16-bit byte stream of the original network traffic into a vectorized digital sequence as the input of the deep learning detection model, without the need to convert the network traffic into a picture or manually extract features from the network traffic with expert knowledge. In this way, more features of the network data stream can be retained and extracted, and the sequence relationship of the data stream is not damaged, which is more conducive to subsequent intrusion detection. (2) The deep learning detection module designed by the vehicle networking intrusion detection system and method of the present application is realized by combining a convolutional neural network (CNN) and a bidirectional long short-term memory network (BiLSTM). Based on CNN, the serialized digital vector is processed, and the spatial features of the data are extracted by means of convolution operation, which can realize higher-level and more abstract expression of the data, and multiple CNNs are designed for parallel processing and feature splicing, which realizes better nonlinear feature extraction and better sequence feature representation. Then, BiLSTM is used for bidirectional sequence related information feature extraction, and further feature fusion is performed based on the attention mechanism, which further accurately represents the complex network traffic data and improves the accuracy of intrusion detection. (3) The system and method of the present application are verified by experiments, and it is found that the accuracy of the detection result is relatively high on both the in-vehicle network attack data set and the out-of-vehicle network attack data set, and has good detection effect performance, which is very suitable for the current vehicle networking intrusion detection system. BRIEF DESCRIPTION OF DRAWINGS

[0026] Figure 1 is a schematic diagram of a vehicle networking architecture;

[0027] Figure 2 is an implementation framework diagram of the vehicle networking intrusion detection method of the present application;

[0028] Figure 3 is a CNN model structure diagram used in the embodiment of the present application;

[0029] Figure 4 is a BiLSTM model structure used by an embodiment of the present application;

[0030] Figure 5 is a CNN-BiLSTM model structure with attention mechanism used by an embodiment of the present application;

[0031] Figure 6 is a Car-Hacking Dataset confusion matrix of an embodiment of the present application;

[0032] Figure 7 is a CIC-IoT-2023dataset confusion matrix of an embodiment of the present application. DETAILED DESCRIPTION

[0033] The present application will be further described in detail below with reference to the accompanying drawings and embodiments.

[0034] As shown in Figure 2 the vehicle networking intrusion detection method based on the attention-based CNN-BiLSTM algorithm of the present application, first, the network traffic data of the in-vehicle network and the off-vehicle network of the vehicle networking is obtained through the data acquisition module, on the one hand, label annotation is performed to obtain labeled vehicle networking training data and send it into the training stage, and the other part of the data without label is sent into the detection stage as test data; the data obtained from different data sources needs to be preprocessed by the data preprocessing module before being further analyzed, some obvious useless and redundant information is removed, and then the data is format-converted so that these data can be processed and analyzed by the deep learning module; in the training stage, the training data after data preprocessing is taken as input and sent into the CNN-BiLSTM deep learning model with attention mechanism for training to obtain the prediction result, which is compared with the real label to calculate the loss and feedback the parameters of the model, and then the next round of training is performed until the training converges. The trained model parameters are sent into the model framework in the detection stage, the test data is also preprocessed and entered into the model for classification to obtain the predicted label result, and finally various evaluation indexes are calculated to judge the effect of the intrusion detection system. At present, the rapid decline in the cost of computing devices allows most intelligent networked vehicles to be equipped with sufficient computing resources and storage resources to allow the deployment of firmware and software, such as IDS. Therefore, the IDS can be deployed on the CAN bus in the vehicle network or on the central gateway to detect network attacks in and out of the vehicle. The way of preprocessing the network traffic data obtained from different data sources by the method of the present application and the CNN-BiLSTM deep learning model with attention mechanism will be described in detail below.

[0035] The vehicle networking intrusion detection system method based on the attention-based CNN-BiLSTM deep learning algorithm of the application comprises three parts: a data acquisition module, a data preprocessing module and a deep learning detection module. The data acquisition module is used to acquire CAN data frames of the in-vehicle network and Pcap data packets of the out-of-vehicle network. The data preprocessing module pre-processes the network traffic data in the acquired CAN data frames and Pcap data packets, and the preprocessing includes removing redundant data, sampling, data format conversion and the like, and outputs the network data stream in a vectorized sequence manner. The deep learning detection module detects the input vectorized sequence network data and outputs the corresponding detection result, thereby determining whether the input network traffic data belongs to normal data or attack data of a certain intrusion mode.

[0036] (1) The data acquisition module is used to acquire the traffic data packets of the in-vehicle network and the out-of-vehicle network.

[0037] The in-vehicle network uses a bus topology network structure, and the most commonly used protocol for communication between ECUs is CAN, which is a message-based broadcast protocol, and nodes send data frames called messages between them. Since the standard definition of the CAN protocol does not provide identity verification information and message encryption function, it is easy to be attacked, so the in-vehicle network data is selected for the application. Specifically, the CAN data frame includes 7 fields: frame start field SoF, arbitration field CAN ID, control field, data field, CRC (Cyclic Redundancy Check Code) field for error checking, ACK field for confirming message reception and frame end field EoF. CAN ID and data field are two fields often used by attackers to inject messages, wherein CAN ID can be used to specify the priority of the data frame, that is, the smaller the CAN ID, the higher the priority, thereby solving the conflict caused when multiple nodes send data frames at the same time, and the data field is the most important and vulnerable field, with a length usually between 0 and 8 bytes, containing transmission data that determines the action of the node. Therefore, the data acquisition module collects CAN data frames of the in-vehicle network, and a data frame contains CAN ID and data field.

[0038] The out-of-vehicle network uses V2X technology to realize communication between vehicles, pedestrians, infrastructure and network, so the out-of-vehicle network is easy to be attacked by general network threats to the Internet of Things, and each vehicle or device is a potential attack intrusion point. Therefore, the data acquisition module collects network traffic data packets of the out-of-vehicle network and captures Pcap data packets. Pcap is the abbreviation of PacketCapture, which is a file format for packet capture.

[0039] (2) The data preprocessing module pre-processes the traffic data and outputs a vectorized sequence.

[0040] The CAN data frame for the in-vehicle network and the Pcap data packet for the out-of-vehicle network obtained by the data acquisition module are in the form of hexadecimal data streams, and are respectively preprocessed, cleaning useless and redundant data, sampling large-scale data, and converting data formats. Each CAN data frame or Pcap data packet contains a number of bytes, and each byte is represented by two hexadecimal digits, such as 00011000 represented as 18. If each byte corresponds to two hexadecimal digits, it will correspond to 16*16=256 word candidates. The data format conversion of the application is that the hexadecimal byte data stream in the CAN data frame and the Pcap data packet is regarded as an ordered word sequence, and then the Tokenizer method in natural language processing is used to count the frequency of each word, and each word is converted into a positive integer according to the frequency of the word from high to low. The word sequence is converted into a digital sequence, so that a hexadecimal data stream is finally converted into a vectorized ordered digital sequence, and each number corresponds to a word.

[0041] (3) The deep learning detection module detects the network data represented by the input vectorized digital sequence.

[0042] The deep learning method is based on data representation learning, which is more suitable for complex and variable network attack data than traditional machine learning algorithms. The deep learning detection module of the application combines convolutional neural network CNN and bidirectional long short memory network BiLSTM, which realizes nonlinear feature extraction of complex network information and bidirectional sequence related information feature extraction respectively, and uses attention mechanism based feature fusion. Next, the structure and principle of CNN and BiLSTM are described in detail.

[0043] (1) CNN model. CNN can process data in parallel, realize representation learning, and can be well applied to intrusion detection problems. Generally, CNN is composed of convolutional layer, pooling layer and fully connected layer, etc. Basic components, its structure is as shown in Figure 3 The figure is a 1D convolution layer (Conv 1D), a maximum pooling layer (MaxPool) and a full connection layer (Flatten), wherein the convolution layer is the core component, which automatically extracts feature patterns from image data using multiple convolution kernels, and generates a feature map through convolution calculation, and its operation formula is:

[0044]

[0045] Wherein, h i represents the feature map of the i-th layer of CNN, represents the convolution operation, w i and b iare the weight and bias of the i-th layer, respectively. f(·) represents the activation function, and ReLU function is used as the activation function here, and x is the data input to the ReLU function.

[0046] ReLU(x) = max(0, x)

[0047] The pooling layer uses a subsampling operation to reduce the dimension of the feature map according to the local correlation, reduce the influence of redundant features on the model, and shorten the processing time as much as possible in the case where the information is no longer key. Its calculation formula is:

[0048] h i = pooling(h i-1 )

[0049] The function of the fully connected layer is to integrate the features extracted from the convolutional layer and the pooling layer. In the actual use of CNN, the convolutional layer and the pooling layer and their corresponding number are selected according to the needs.

[0050] (2) BiLSTM model. Long short-term memory LSTM is used to process sequence data in natural language processing, such as time series, text sequences, and speech sequences. Because of the gating mechanism, LSTM can solve the problems of gradient disappearance and gradient explosion in the training process, so LSTM is more suitable for capturing long-term dependencies than RNN. The core components of LSTM include the forget gate, the input gate, and the output gate. Specifically, the LSTM unit state contains a cell state C t and a hidden state h t , which uses three gates to control the update and output of the unit state. Its calculation steps are as follows:

[0051] Forget gate: used to determine which parts of the cell state need to be continued to retain, the output is a value between 0 and 1, the closer to 1 the information is, the more it should be retained. The specific calculation formula of the output f t of the forget gate is as follows:

[0052] f t = σ(W f ·[h t-1 , x t ]+b f )

[0053] Where W f and b f are the weight and bias of the forget gate, respectively, σ is the sigmoid function, h t-1 is the hidden state at the previous time t-1, and x t is the input at the current time t.

[0054] Input gate: used to determine how much information of the current time input is saved to the cell state, first the output i of the input gate t The following formula is calculated:

[0055] i t = σ(W i · [h t-1 , x t ]+b i )

[0056] Where W i and b i are the weights and biases of the input gate respectively.

[0057] The output i t is a value between 0 and 1, the closer to 1, the more important the information. Secondly, the new cell state s

[0058]

[0059] Where W C and b C are the weights and biases of the update cell state network respectively.

[0060] Finally, the cell state C t-1 of the previous time and f t are multiplied point by point, and the obtained is multiplied point by point with i t , and the two are added to update the cell state to obtain C t :

[0061]

[0062] Output gate: used to control how much information of the obtained cell state is used as the value of the next hidden state, the specific output o of the output gate t and the hidden state h t of the current time t are calculated as follows:

[0063] o t = σ(W o · [h t-1 , x t ]+b o )

[0064] h t = o t · tanh(C t )

[0065] Where W o and b orespectively, are weights and bias of the output gate network. The bidirectional LSTM can obtain long-term context information by performing processing in a forward and backward manner, and a model structure thereof is shown in Figure 4

[0066] (3) CNN-BiLSTM network model with attention mechanism. As shown in Figure 5 The CNN-BiLSTM model with attention mechanism used in the present application is composed of the above-mentioned CNN model, BiLSTM model and attention unit.

[0067] Different deep learning models are trained for the detection of in-vehicle network data traffic and out-of-vehicle network data traffic, and the deep learning models are all implemented by using the CNN-BiLSTM network model with attention mechanism.

[0068] As shown in Figure 5 First, the vectorized numerical sequence of network traffic is sent into the input layer, and the embedding layer encodes the integers in the vectorized sequence to obtain an embedding matrix, which is sent into the three parallel CNN modules for feature extraction. Then, the extracted features are subjected to a splicing operation and then enter the BiLSTM model for bidirectional sequence feature extraction, and the context features of each word are output. Then, the bidirectional features are spliced, and the extracted bidirectional features are sent to the fully connected layer for linear mapping of the feature vectors output by the BiLSTM model. After that, the Dropout operation is used to prevent the model from overfitting. The self-attention module is set after the Dropout operation module, and the attention mechanism uses a global attention unit to assign corresponding weights to the bidirectional features of the words. First, the feature vectors output by the BiLSTM model are received and linearly mapped, and the dot product of the converted input tensor and the query vector Query is obtained through the softmax activation function to obtain the attention score. The attention score is weighted and summed with the input tensor to obtain an output vector. Then, the output vector is subjected to a fully connected layer and a softmax activation function to obtain the final output classification result.

[0069] It should be noted that the present application uses three parallel CNN modules for feature extraction after the embedding layer, but the number of parallel CNN modules is not limited to 3, and generally multiple parallel CNN modules are set, which can be set according to actual needs and computing resources. The network weights and bias in the parallel CNN modules are randomly initialized, and the parameters of each CNN module are different. By setting different CNN modules to extract, more data features can be obtained, and higher-level and more abstract expressions of data can be obtained for subsequent classification.

[0070] ​After training the deep network by using different training data of in-vehicle network and out-of-vehicle network, different detection models are obtained. Through the data acquisition module, the traffic data of the in-vehicle network or the out-of-vehicle network is captured in real time, the real-time captured network data stream is preprocessed through the data preprocessing module, the acquired vectorized digital sequence is detected by using the trained detection model, and the classification result is output, so as to judge whether there is an attack data of a certain intrusion mode.

[0071] In the training of the detection model, different training data sets of the in-vehicle network and the out-of-vehicle network are acquired, and the labels of the training samples are normal data or a certain intrusion mode corresponding to the in-vehicle network or the out-of-vehicle network. The labels of the in-vehicle network or the out-of-vehicle network are set for the captured network data traffic, so as to facilitate subsequent input of the corresponding detection model.

[0072] In the training of the detection model, the cross-entropy loss function is used, and the detection accuracy of the detection model is calculated until the trained detection model is obtained.

[0073] The data set "Car-Hacking Dataset" of the vehicle network attack and the data set "CIC-IoT-2023 dataset" of the out-of-vehicle network attack are used to verify the effect of the vehicle networking intrusion detection method based on the attention mechanism CNN-BiLSTM algorithm of the present application. The data set uses information is shown in Table 1 and Table 2. Based on the Tensorflow framework, the model is trained and tested, the Adam optimizer is used to optimize the model, and the evaluation indexes include the confusion matrix, accuracy (Accuracy), precision (Precision), recall (Recall) and F1 score are used to measure the performance of the algorithm.

[0074] Table 1 Car-Hacking Dataset data usage information

[0075] Attack Type Normal Information Quantity Injected Information Quantity DoS Attack 3078250 587521 Fuzzy Attack 3347013 491847 Spoofing Attack (gear) 3845890 597252 Spoofing Attack (RPM) 3966805 654897

[0076] Table 2 CIC-IoT-2023 dataset data usage information

[0077] Attack Type Data Flow Quantity Benign 73283 BruteForce 13314 DDoS 62539 DoS 83001 Mirai 11963 Spoofing 18126 Recon 13711 Web 59821

[0078] The confusion matrix, also known as the error matrix, is used to judge the advantages and disadvantages of the classifier by respectively counting the number of observation values of the misclassified classes and the correctly classified classes of the classification model. The confusion matrix results of the four types of attack types in the in-vehicle network attack data set obtained in the experiment are as follows Figure 6As shown, it can be seen that the model is very good for detecting four types of attacks, and all classifications are correct, that is, the accuracy reaches 100%, except in the Fuzzy Attack type. In the Fuzzy Attack, only one normal sample is misreported as an attack.

[0079] The confusion matrix results obtained in the off-network attack data set are shown in Figure 7 As shown, the performance of the eight types is shown in Table 2, and most of the test samples are classified correctly, and the accuracy of the model is 97.99%. Except for the Spoofing and Recon attack categories, the precision, recall and F1 score of the remaining types all reached more than 92.52%. The best detection effect was achieved for the DDoS attack, with a precision of 99.98%, a recall of 99.86% and an F1 score of 99.92%. For the Spoofing type, the precision performance was good at 96.65%, but the recall performance was poor at 87.08%. Similar situations also occurred in the Recon type.

[0080] As shown in Table 3, the performance of the method of the application on the CIC-IoT-2023dataset data set.

[0081] Table 3 CIC-IoT-2023dataset performance

[0082]

[0083] The above results show that the vehicle networking intrusion detection method based on the CNN-BiLSTM algorithm based on the attention mechanism proposed by the application can show good performance for different types of attacks on the vehicle network and off-network data sets.

[0084] In addition to the technical features described in the specification, they are known to those skilled in the art. The application omits the description of known components and known technologies to avoid redundancy and unnecessary limitation of the application. The embodiments described in the above examples also do not represent all embodiments consistent with the present application. Various modifications or variations made by those skilled in the art without creative labor on the basis of the technical solutions of the application are still within the protection scope of the application.

Claims

1. An attention-based CNN-BiLSTM algorithm-based Internet of Vehicles intrusion detection system, characterized in that, The system comprises a data acquisition module, a data preprocessing module and a deep learning detection module. The data acquisition module is used to acquire the traffic data of the in-vehicle network and the out-vehicle network. The data preprocessing module respectively pre-processes the input traffic data to obtain a vectorized sequence, and the preprocessing includes data format conversion, which converts the network data stream in hexadecimal into an ordered digital sequence. The deep learning detection module uses a CNN-BiLSTM model with an attention mechanism to establish a detection model, and uses the traffic data of the in-vehicle network and the out-vehicle network to train the corresponding detection model. In the detection model established by the deep learning detection module, first, the ordered numerical sequence of the network data stream is input into the embedding layer, each word is embedded and encoded, an embedding matrix is obtained for a sequence, and then the embedding matrix is sent into k parallel CNN modules for feature extraction, where k is greater than 1; then the features extracted by the CNN modules are spliced and input into a BiLSTM model, and the context features of each word extracted are output; then the bidirectional features are spliced, and the bidirectional features are mapped through a full connection layer and then subjected to a Dropout operation to prevent model overfitting; a self-attention module is arranged after the Dropout operation, the self-attention module uses a global attention mechanism to assign a corresponding weight to each word, calculates an attention score, and obtains an output vector by weighted averaging of the attention score and each word; and then the output vector is subjected to a full connection layer and an activation function to obtain a classification result. In the detection model established by the deep learning detection module, first, the ordered numerical sequence of the network data stream is input into the embedding layer, each word is embedded and encoded, an embedding matrix is obtained for a sequence, and then the embedding matrix is sent into k parallel CNN modules for feature extraction, where k is greater than 1; then the features extracted by the CNN modules are spliced and input into a BiLSTM model, and the context features of each word extracted are output; then the bidirectional features are spliced, and the bidirectional features are mapped through a full connection layer and then subjected to a Dropout operation to prevent model overfitting; a self-attention module is arranged after the Dropout operation, the self-attention module uses a global attention mechanism to assign a corresponding weight to each word, calculates an attention score, and obtains an output vector by weighted averaging of the attention score and each word; and then the output vector is subjected to a full connection layer and an activation function to obtain a classification result.

2. The system of claim 1, wherein, The data acquisition module real-time captures the traffic data of the in-vehicle network or the out-vehicle network, and the data preprocessing module pre-processes the real-time captured network data stream. The data preprocessing module further includes removing redundant data and data sampling. The steps include:

3. The system of claim 1, wherein, Step 1: respectively acquire the traffic data of the in-vehicle network and the out-vehicle network; 4. An attention-based CNN-BiLSTM algorithm-based Internet of Vehicles intrusion detection method, characterized in that, Step 2: pre-process the acquired network traffic data to output a vectorized ordered digital sequence; The preprocessing includes removing redundant data, data sampling and data format conversion. The data format conversion refers to regarding the two-bit hexadecimal number corresponding to each byte in the network data stream as a word, and the network data stream is an ordered word sequence. The data preprocessing module further includes removing redundant data and data sampling. The steps include: Step 1: respectively acquire the traffic data of the in-vehicle network and the out-vehicle network; Step 2: pre-process the acquired network traffic data to output a vectorized ordered digital sequence; The preprocessing includes removing redundant data, data sampling and data format conversion. The data format conversion refers to regarding the two-bit hexadecimal number corresponding to each byte in the network data stream as a word, and the network data stream is an ordered word sequence. Step 3, a detection model is established using a CNN-BiLSTM model with an attention mechanism, and the corresponding detection model is trained using the traffic data training samples of the in-vehicle network and the out-of-vehicle network respectively; the traffic data of the in-vehicle network or the out-of-vehicle network is real-time captured through the method of step 1, the captured network data stream is preprocessed through step 2, and the trained detection model is used to detect the real-time captured traffic data of the in-vehicle network or the out-of-vehicle network; CNN represents a convolutional neural network, and BiLSTM represents a bidirectional long short-term memory network; The label of the training sample is normal data or a certain intrusion mode corresponding to the in-vehicle network or the out-of-vehicle network; The real-time captured traffic data is provided with a label indicating whether it belongs to the in-vehicle network or the out-of-vehicle network; The step 3 establishes the detection model, first, the ordered digital sequence of the network data stream is input into the embedding layer, each word is embedded and encoded, an embedding matrix is obtained for a sequence, then the embedding matrix is sent into k parallel CNN modules for feature extraction, k is greater than 1; then the features extracted by the CNN modules are spliced and input into a BiLSTM model, the context features of each word are output, then the bidirectional features are spliced, the bidirectional features are mapped through a full connection layer, and a Dropout operation is used to prevent model overfitting; a self-attention module is arranged after the Dropout operation, the self-attention module uses a global attention mechanism to assign a corresponding weight to each word, calculates an attention score, and obtains an output vector by weighted average of the attention score and each word, and then a full connection layer and an activation function are used to obtain a classification result.

Images