Vehicle network intrusion detection method and system based on improved PCA and PSO

Abstract

The present invention relates to the field of data processing technology, and in particular to a vehicle network intrusion detection method based on improved PCA and PSO, comprising the following steps: S10, collecting vehicle network data in the vehicle network communication process, and preprocessing the vehicle network data to obtain preprocessed vehicle network data; S20, using the Gaussian random increment improved principal component analysis algorithm to perform data dimension reduction processing on the preprocessed vehicle network data to obtain the reduced-dimension vehicle network data; S30, using the reduced-dimension vehicle network data as input, using the WELM model to perform intrusion detection, and outputting the vehicle network intrusion detection result; the WELM model is optimized based on the inertia weighted particle swarm algorithm. By performing intrusion detection through the method of the present invention, the detection efficiency and accuracy can be improved, the detection time can be reduced, and the timeliness can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a vehicle network intrusion detection method and system based on improved PCA and PSO. Background Art

[0002] The Internet of Vehicles uses vehicles on the road as information sensing objects and uses the new generation of information and communication technology to achieve network connection between vehicles and X (vehicles, people, roads, and service platforms). The Internet of Vehicles can provide protection for the distance between vehicles, reduce the probability of vehicle collision accidents, help car owners navigate in real time, and improve the efficiency of traffic operation through communication with other vehicles and network systems.

[0003] The Internet of Vehicles terminal is the basis for ensuring the smooth operation of the Internet of Vehicles, and is also vulnerable to attacks. Therefore, it is necessary to detect whether the Internet of Vehicles terminal has been invaded in real time. For example, the Chinese invention with application number 202310489303.3 discloses a "Internet of Vehicles intrusion detection method based on parallel analysis of spatiotemporal features". This method can effectively improve the intrusion detection performance, but the technology may also face the challenge of real-time requirements, because the training and reasoning of deep learning models take a long time and have high demand for computing resources. Summary of the invention

[0004] The purpose of the present invention is to provide a vehicle network intrusion detection method and system based on improved PCA and PSO, which can improve the efficiency of intrusion detection and thus have strong real-time performance.

[0005] In order to achieve the above object, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides a vehicle network intrusion detection method based on improved PCA and PSO, comprising the following steps:

[0007] S10, collecting vehicle network data during the vehicle networking communication process, and preprocessing the vehicle network data to obtain preprocessed vehicle network data;

[0008] S20, performing data dimensionality reduction processing on the preprocessed vehicle network data using a principal component analysis algorithm improved by Gaussian random increment to obtain vehicle network data after dimensionality reduction;

[0009] S30, using the vehicle network data after dimension reduction as input, using the WELM model to perform intrusion detection, and outputting the vehicle network intrusion detection result; the WELM model is optimized based on the inertia weighted particle swarm algorithm.

[0010] In the optimized solution, S20 includes the following steps:

[0011] S201, generating a Gaussian random matrix composed of random variables obeying Gaussian distribution, and multiplying the preprocessed vehicle network data with the Gaussian random matrix to obtain a new matrix;

[0012] S202, processing the new matrix in batches, subtracting the mean of each feature from each batch of data, and then calculating the covariance matrix of each batch of data;

[0013] S203, performing eigenvalue decomposition on each covariance matrix to obtain eigenvalues ​​and eigenvectors, wherein the eigenvectors represent principal components, combining the eigenvectors of each batch of data with the eigenvectors of the previous batch of data, updating the principal components, and calculating the cumulative contribution rate;

[0014] S204, selecting the number of principal components to be retained by cumulative contribution rate, and using the selected principal components to construct a projection matrix, projecting the preprocessed data onto the projection matrix, and the obtained matrix is ​​the vehicle network data after dimensionality reduction.

[0015] In the optimized scheme, the optimization process of the WELM model described in S30 includes the following steps:

[0016] S301, determining the search space range of the weight and bias of the WELM model, and initializing the inertia weight particle swarm optimization algorithm by randomly generating particles;

[0017] S302, randomly initializing weights connected to input features and bias items according to the features and label information of the vehicle network data, and starting iterative optimization;

[0018] S303, during the iteration process, the output weight matrix and negative precision are evaluated, the individual optimal fitness and the global optimal fitness of all particles in DPSO are evaluated, and the individual extreme value and the global extreme value are determined, and the individual extreme value is compared with the global extreme value, and the individual with smaller negative precision is selected;

[0019] S304, updating the position, velocity and inertia weight of particles in the inertia weight particle swarm optimization algorithm after each iteration;

[0020] S305, determine whether the number of iterations reaches the set maximum number of iterations. If not, return to step S303. If yes, the iteration ends and the optimized parameters (optimal weights and biases) are provided to WELM to obtain the optimized WELM model.

[0021] In a second aspect, the present invention provides a vehicle network intrusion detection system based on improved PCA and PSO, comprising:

[0022] A data acquisition module is used to collect vehicle network data during the vehicle networking communication process and pre-process the vehicle network data to obtain pre-processed vehicle network data;

[0023] The data dimension reduction module is used to perform data dimension reduction processing on the preprocessed vehicle network data using the principal component analysis algorithm improved by Gaussian random increment to obtain the vehicle network data after dimension reduction;

[0024] The intrusion detection module is used to take the vehicle network data after dimension reduction as input, use the WELM model to perform intrusion detection, and output the vehicle network intrusion detection result; the WELM model is optimized based on the inertia weighted particle swarm algorithm.

[0025] In a third aspect, the present invention provides a computer program product, comprising computer-readable instructions, characterized in that the computer-readable instructions, when executed by a processor, implement the steps of the vehicle network intrusion detection method based on improved PCA and PSO of the present invention.

[0026] In a fourth aspect, the present invention provides a computer-readable storage medium comprising computer-readable instructions, characterized in that when the computer-readable instructions are executed by a processor, the steps of the vehicle network intrusion detection method based on improved PCA and PSO of the present invention are implemented.

[0027] In a fifth aspect, the present invention provides an electronic device, comprising: a memory storing program instructions; a processor connected to the memory, executing the program instructions in the memory, and implementing the steps of the vehicle network intrusion detection method based on improved PCA and PSO of the present invention.

[0028] Compared with the prior art, the present invention has the following technical advantages:

[0029] (1) The vehicle network data is processed by using the Gaussian random incremental principal component analysis algorithm (improved PCA). The high-dimensional data is projected into a low-dimensional space to reduce data redundancy, thereby saving storage space and reducing the amount of calculation, and speeding up the calculation.

[0030] (2) By using the inertia weighted particle swarm algorithm (DPSO) to optimize the parameters of the weighted extreme learning machine (WELM), the detection efficiency of intrusion detection can be improved, including indicators such as accuracy, precision, recall, false alarm rate, F1-score and detection time.

[0031] For other advantages of the present invention, please refer to the relevant description in the embodiment section. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 The flowchart of the vehicle network intrusion detection method based on improved PCA and PSO provided in an embodiment of the present invention.

[0034] Figure 2 for Figure 1 Flowchart of the processing of S10.

[0035] Figure 3 for Figure 1 Flowchart of the processing of S20.

[0036] Figure 4 for Figure 1 Flowchart of the processing of S30.

[0037] Figure 5 The block diagram is a composition block diagram of the vehicle network intrusion detection system based on improved PCA and PSO provided in an embodiment of the present invention.

[0038] Figure 6 It is a block diagram of the composition of the electronic device provided in the embodiment. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0040] See also Figure 1 , this embodiment provides a vehicle network intrusion detection method based on improved PCA and PSO, including the following steps:

[0041] S10, collecting vehicle network data during the vehicle network communication process, and preprocessing the vehicle network data to obtain preprocessed vehicle network data.

[0042] The preprocessing includes missing value filling, data digitization and data standardization.

[0043] S20, using a Gaussian random increment principal component analysis algorithm (improved PCA) to perform data dimension reduction on the preprocessed vehicle network data to obtain vehicle network data after dimension reduction.

[0044] S30, taking the vehicle network data after dimension reduction as input, using the trained WELM model to perform intrusion detection, and outputting the vehicle network intrusion detection results.

[0045] In this embodiment, please refer to Figure 2 , the above step S10 specifically includes the following steps:

[0046] S101, collect several vehicle network data sequences in the vehicle network communication process, each vehicle network data sequence contains n consecutive vehicle network data, and each vehicle network data contains m data features. The vehicle network data is constructed into a matrix, which can be called the vehicle network data matrix A, as shown in the following formula:

[0047]

[0048] Where n is the number of vehicle network data, m is the number of features in the vehicle network data, and both n and m are positive integers. nm is the value in the vehicle network data.

[0049] The WELM model needs to be trained in advance using a training set, and the samples in the training set also need to be processed using steps S10-S20. For the training set, in this step, when collecting vehicle network data sequences, it is necessary to collect vehicle network data sequences in normal operation and when intrusion occurs at the same time. In addition, for the samples in the training set, the vehicle network data needs to be labeled with class labels. If the vehicle network is in normal operation during collection, the class label is set to 0. If the vehicle network is intruded during collection, the class label is set to 1.

[0050] S102: For missing values ​​in the matrix, fill them with the average value of all feature data that are not missing in the vehicle network data.

[0051] For example, 21 a 23 … a 2m In the above example, we assume that a 22 If the data at a position is lost, the data at that position is replaced by a 21 a 23 … a 2m The average value of these m-1 data values ​​is used for filling.

[0052] S103, for the character features in the matrix, label encoding is used to convert the character features into digital features to achieve data numerical processing.

[0053] S104, the vehicle network data after the data digitization processing is standardized. Standardization is to adjust the data distribution to a standard normal distribution with a mean of 0 and a standard deviation of 1. The calculation formula is as follows:

[0054]

[0055]

[0056]

[0057] Among them, a ij represents the i-th value in the j-th column feature in the vehicle network data matrix, is the mean of the j-th column feature in the vehicle network data matrix, σ j is the standard deviation of the j-th column feature in the vehicle network data matrix, is the vehicle network data matrix a ij The normalized value.

[0058] The vehicle network data obtained after standardization (i.e., preprocessing) can be performed as follows:

[0059]

[0060] Among them, y nm is the standardized value in the vehicle network data matrix, and Y is the preprocessed vehicle network data matrix.

[0061] Data standardization can ensure the consistency and comparability of data and reduce the impact of size changes between features on intrusion detection. Standardization eliminates the size differences between data from different sources and types, which can enable the WELM model to better learn features, achieve accurate detection, improve algorithm performance, and be able to respond to potential security threats more effectively.

[0062] In this embodiment, please refer to Figure 3 The above step S20 specifically includes the following steps:

[0063] S201, using the random number generation function provided in Python, generates a Gaussian random matrix composed of random variables that obey the Gaussian distribution, and multiplies the preprocessed vehicle network data with the Gaussian random matrix to obtain a new matrix.

[0064] The preprocessed vehicle network data is projected into a low-dimensional subspace using a Gaussian random matrix. This random projection technology retains the main structure and characteristics of the data, which can improve the accuracy and efficiency of intrusion detection and reduce detection time.

[0065] S202, the new matrix is ​​processed in batches, the mean of each feature is subtracted from each batch of data, and then the covariance matrix of each batch of data is calculated. The covariance matrix provides the degree of correlation between various features in the data. The calculation formula is as follows:

[0066]

[0067] Among them, L i is the matrix of the i-th batch, YesL i The transpose of C i represents the covariance matrix.

[0068] When processing in batches, the choice of batch size is usually adjusted according to the available memory and computing resources. In this step, the data of each batch can be fit into the memory by batch processing to ensure that it will not crash due to insufficient memory when processing large data.

[0069] S203, perform eigenvalue decomposition on each covariance matrix to obtain eigenvalues ​​and eigenvectors, which represent principal components. The eigenvectors of each batch of data are combined with the eigenvectors of the previous batch of data, and the principal components are updated by weighted averaging the new eigenvectors with the old eigenvectors.

[0070] Eigenvalue decomposition can identify the main direction in the data, and the eigenvalue of each eigenvector represents the variance in that direction. The eigenvectors obtained through eigenvalue decomposition can help better understand the structure of the data and reduce information redundancy.

[0071] After processing all the data, calculate the variance contribution of each principal component. The variance contribution is the ratio of each eigenvalue divided by the total variance. The cumulative contribution is the sum of the variance contributions of the first p principal components. The calculation formula is as follows:

[0072]

[0073] Among them, k is the number of all eigenvalues, p is the number of selected principal components, and λ i is the i-th eigenvalue, φ p is the cumulative contribution rate.

[0074] S204, selecting the number of principal components to be retained by cumulative contribution rate, and using the selected principal components to construct a projection matrix, projecting the preprocessed data onto the projection matrix, and the obtained matrix is ​​the vehicle network data after dimensionality reduction.

[0075] Typically, the top p principal components with a cumulative contribution rate of 95% are selected to retain. Such a selection criterion can balance data retention and dimensionality reduction.

[0076] In this embodiment, please refer to Figure 4 The training (optimization) process of the WELM model described in step S30 above includes the following steps:

[0077] S301, according to the characteristics of the vehicle network data, determine the search space range of the weight and bias of the WELM model, and initialize the DPSO (inertia weighted particle swarm optimization) algorithm by randomly generating particles.

[0078] Heuristic methods are often used to determine the range of the search space for weights and biases. For example, the range of weights is set according to the standard deviation of the feature, the range of biases is set according to the range of feature values, and upper and lower bounds are established for each weight and bias to prevent the search space from becoming too broad or too restricted.

[0079] Each particle represents a combination of the weights and biases of the WELM model. The positions of these particles correspond to the values ​​of the weights and biases. The velocity of the particle represents the direction and distance that the particle moves in the search space. Use the initialized learning factor to adjust the speed and direction of the particle's movement in the search space. Initialize the particle velocity so that the particle velocity remains within the specified range to prevent the particle from moving too fast in the search space.

[0080] S302, according to the characteristics and label information of the vehicle network data, select a suitable activation function for each neuron, randomly initialize the weights connected to the input features and the bias term, and start the iterative optimization process.

[0081] S303, using negative precision as the fitness function, evaluating the output weight matrix and negative precision during the iteration process, evaluating the individual optimal fitness of all particles in DPSO and the global optimal fitness, and determining the individual extreme value and the global extreme value, comparing the individual extreme value with the global extreme value, and selecting the individual with smaller negative precision.

[0082] The calculation formula for evaluating the output weight matrix and negative precision is as follows:

[0083] Hβ=Y;

[0084]

[0085]

[0086]

[0087] The structure of the WELM model consists of an input layer, a hidden layer, and an output layer. The input layer is the vehicle network data after dimensionality reduction. Each feature corresponds to an input node. The hidden layer contains several hidden nodes. The number of nodes in the output layer is equal to the number of categories. Among them, H is the output matrix of the hidden layer, H = h(x), β is the connection weight between the hidden layer and the output layer, Count(t i ) is the vehicle network data sample with category t iThe number of categories is abnormal and normal. I is the unit matrix, N is the number of vehicle network data samples, L is the number of hidden layer nodes, is the weight matrix. f(x) is the output function of the WELM model.

[0088]

[0089]

[0090] in, is the current position p of the i-th particle (or particle i) i The corresponding accuracy, also called the individual's current fitness, is the individual optimal position p of the i-th particle ib The corresponding accuracy is also called the optimal fitness of the individual. It refers to the accuracy of the global optimal position of particle i, also known as the global optimal fitness, p i refers to the current position of particle i, p ib is the individual optimal position of particle i, p g is the global optimal position of particle i.

[0091] The current fitness of the individual The optimal fitness of an individual Compare and take the individual's best position as the individual extreme value; take the individual's current fitness The best fitness with global Compare and take the best position of the individual as the global extreme value; compare the individual extreme value with the global extreme value and select the individual with smaller negative precision.

[0092] The accuracy is calculated from the results after each iteration using the formula:

[0093]

[0094] Among them, A represents accuracy, TP represents the number of samples correctly classified as abnormal (true positive), TN represents the number of samples correctly classified as normal (true negative), FP represents the number of samples misclassified as abnormal (false positive), and FN represents the number of samples misclassified as normal (false negative). The DPSO optimization algorithm is a minimization problem, so negative accuracy is used as the fitness function, so that the optimization goal is to maximize the accuracy value.

[0095] Negative precision as a fitness function pays more attention to the prediction effect of the model on minority categories, which can better reflect its performance on unbalanced data in the Internet of Vehicles, and can make the optimization process pay more attention to the recognition and detection capabilities of abnormal samples, thereby improving its performance in anomaly detection.

[0096] S304, updating the position, velocity and inertia weight of the particles in the DPSO after each iteration.

[0097] In this step, the inertia weight is introduced. The inertia weight will gradually decrease with the increase of the number of iterations to balance the proportion of global search and local search, thereby improving the convergence speed and search ability of the algorithm. The calculation formula is as follows:

[0098]

[0099]

[0100]

[0101] Among them, t is the current iteration number, and x represents the position of the particle, for example represents the position of the i-th particle in the t-th iteration, c1 and c2 are the learning factors of the particle, representing the local learning factor and the global learning factor of the particle respectively, w is the inertia weight, r1 and r2 are random numbers between [0,1], and v represents the velocity of the particle, for example represents the velocity of the i-th particle in the t-th iteration. max Indicates the maximum value of the inertia weight, w min Indicates the minimum value of the inertia weight, which is set by the user to determine the boundary, t max Indicates the maximum number of iterations.

[0102] The inertia weight changes dynamically, so it can also be called dynamic inertia weight. In this step, updating the inertia weight by the above formula can improve the detection efficiency, reduce the detection time, and then improve the timeliness of vehicle network intrusion detection.

[0103] S305, determine whether the number of iterations reaches the set maximum number of iterations. If not, return to step S303. If yes, the iteration ends and the optimized parameters (optimal weights and biases) are provided to WELM to obtain the optimized WELM model.

[0104] The optimized WELM model is used to detect and classify the vehicle network data after dimension reduction to obtain the vehicle network intrusion detection results.

[0105] See also Figure 5 Based on the same inventive concept, this embodiment also provides a vehicle network intrusion detection system based on improved PCA and PSO, including:

[0106] A data acquisition module is used to collect vehicle network data during the vehicle networking communication process and pre-process the vehicle network data to obtain pre-processed vehicle network data;

[0107] The data dimension reduction module is used to perform data dimension reduction processing on the preprocessed vehicle network data using the principal component analysis algorithm improved by Gaussian random increment to obtain the vehicle network data after dimension reduction;

[0108] The intrusion detection module is used to take the vehicle network data after dimension reduction as input, use the WELM model to perform intrusion detection, and output the vehicle network intrusion detection result; the WELM model is optimized based on the inertia weighted particle swarm algorithm.

[0109] For more specific processing of each module, please refer to the relevant description of the aforementioned method, which will not be repeated here.

[0110] like Figure 6 As shown, this embodiment also provides an electronic device, which may include a processor 41 and a memory 42, wherein the memory 42 is coupled to the processor 41. It is worth noting that this figure is exemplary, and other types of structures may be used to supplement or replace this structure to achieve data extraction, report generation, communication or other functions.

[0111] like Figure 6 As shown, the electronic device may further include: an input unit 43, a display unit 44 and a power supply 45. It is worth noting that the electronic device does not necessarily have to include Figure 6 All components shown in the figure. In addition, electronic devices may also include Figure 6 For components not shown, reference may be made to the prior art.

[0112] The processor 41 is sometimes also called a controller or an operation control, and may include a microprocessor or other processor devices and / or logic devices. The processor 41 receives inputs and controls the operations of various components of the electronic device.

[0113] The memory 42 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices, and may store information such as configuration information of the processor 41 and instructions executed by the processor 41. The processor 41 may execute the program stored in the memory 42 to implement information storage or processing. In one embodiment, the memory 42 also includes a buffer memory, i.e., a buffer, to store intermediate information.

[0114] The input unit 43 is used, for example, to input MRI images to the processor 41. The display unit 44 is used to display various results during the processing, and the display unit may be, for example, an LCD display, but the present invention is not limited thereto. The power supply 45 is used to provide power to the electronic device.

[0115] An embodiment of the present invention further provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed in an electronic device, the program product enables the electronic device to execute the operation steps included in the method of the present invention.

[0116] An embodiment of the present invention further provides a storage medium storing computer-readable instructions, wherein the computer-readable instructions enable an electronic device to execute the operation steps included in the method of the present invention.

[0117] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0118] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0119] Those of ordinary skill in the art will appreciate that the modules of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the constituent modules and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0120] In the several embodiments provided in this application, it should be understood that the disclosed system can be implemented in other ways. For example, the system embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0121] The above-described embodiments are only specific implementations of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications, replacements and improvements within the technical scope disclosed by the present invention, and these modifications, replacements and improvements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A vehicle network intrusion detection method based on improved PCA and PSO, characterized in that: The following steps are involved: S10, collecting vehicle network data during the vehicle networking communication process, and preprocessing the vehicle network data to obtain preprocessed vehicle network data; S20, performing data dimensionality reduction processing on the preprocessed vehicle network data using a principal component analysis algorithm improved by Gaussian random increment to obtain vehicle network data after dimensionality reduction; S20 includes the following steps: S201, generating a Gaussian random matrix composed of random variables obeying Gaussian distribution, and multiplying the preprocessed vehicle network data with the Gaussian random matrix to obtain a new matrix; S202, processing the new matrix in batches, subtracting the mean of each feature from each batch of data, and then calculating the covariance matrix of each batch of data; S203, performing eigenvalue decomposition on each covariance matrix to obtain eigenvalues ​​and eigenvectors, wherein the eigenvectors represent principal components, combining the eigenvectors of each batch of data with the eigenvectors of the previous batch of data, updating the principal components, and calculating the cumulative contribution rate; S204, selecting the number of principal components to be retained by cumulative contribution rate, and using the selected principal components to construct a projection matrix, projecting the preprocessed data onto the projection matrix, and the obtained matrix is ​​the vehicle network data after dimensionality reduction; S30, using the vehicle network data after dimension reduction as input, performing intrusion detection using the WELM model, and outputting the vehicle network intrusion detection result; the WELM model is optimized based on the inertia weighted particle swarm algorithm; the optimization process of the WELM model described in S30 includes the following steps: S301, determining the search space range of the weight and bias of the WELM model, and initializing the inertia weight particle swarm optimization algorithm by randomly generating particles; S302, randomly initializing weights connected to input features and bias items according to the features and label information of the vehicle network data, and starting iterative optimization; S303, during the iteration process, the output weight matrix and negative precision are evaluated, the individual optimal fitness and the global optimal fitness of all particles in DPSO are evaluated, and the individual extreme value and the global extreme value are determined, and the individual extreme value is compared with the global extreme value, and the individual with smaller negative precision is selected; S304, updating the position, velocity and inertia weight of the particles in the inertia weight particle swarm optimization algorithm after each iteration; the calculation formulas of the position, velocity and inertia weight of the particles are respectively: Among them, t is the current iteration number, x represents the position of the particle, represents the position of the i-th particle in the t-th iteration, c1 and c2 are the learning factors of the particle, which represent the local learning factor and global learning factor of the particle respectively, w is the inertia weight, r1 and r2 are random numbers between [0,1], and v represents the velocity of the particle. represents the velocity of the i-th particle in the t-th iteration; w max Indicates the maximum value of the inertia weight, w min Indicates the minimum value of inertia weight, t max Indicates the maximum number of iterations; S305, determine whether the number of iterations reaches the set maximum number of iterations. If not, return to step S303. If yes, the iteration ends and the optimized parameters (optimal weights and biases) are provided to WELM to obtain the optimized WELM model.

2. The vehicle network intrusion detection method based on improved PCA and PSO according to claim 1 is characterized in that: The preprocessing includes missing value filling, data digitization and data standardization.

3. The vehicle network intrusion detection method based on improved PCA and PSO according to claim 2 is characterized in that: In the process of filling missing values, the number of vehicle network data is taken as the number of rows, and the number of features contained in each vehicle network data is taken as the number of columns. The vehicle network data is first converted into a matrix, and then the value of the missing position is filled with the average value of all the feature data that are not missing in the vehicle network data.

4. The vehicle network intrusion detection method based on improved PCA and PSO according to claim 3 is characterized in that: In the data digitization process, label encoding is used to convert character features in the matrix into digital features.

5. A vehicle network intrusion detection system based on improved PCA and PSO, characterized in that: include: A data acquisition module is used to collect vehicle network data during the vehicle networking communication process and pre-process the vehicle network data to obtain pre-processed vehicle network data; The data dimension reduction module is used to perform data dimension reduction processing on the preprocessed vehicle network data using the principal component analysis algorithm improved by Gaussian random increment to obtain the vehicle network data after dimension reduction; The dimensionality reduction process includes the following steps: S201, generating a Gaussian random matrix composed of random variables obeying Gaussian distribution, and multiplying the preprocessed vehicle network data with the Gaussian random matrix to obtain a new matrix; S202, processing the new matrix in batches, subtracting the mean of each feature from each batch of data, and then calculating the covariance matrix of each batch of data; S203, performing eigenvalue decomposition on each covariance matrix to obtain eigenvalues ​​and eigenvectors, wherein the eigenvectors represent principal components, combining the eigenvectors of each batch of data with the eigenvectors of the previous batch of data, updating the principal components, and calculating the cumulative contribution rate; S204, selecting the number of principal components to be retained by cumulative contribution rate, and using the selected principal components to construct a projection matrix, projecting the preprocessed data onto the projection matrix, and the obtained matrix is ​​the vehicle network data after dimensionality reduction; The intrusion detection module is used to take the vehicle network data after dimension reduction as input, perform intrusion detection using the WELM model, and output the vehicle network intrusion detection result; the WELM model is optimized based on the inertia weighted particle swarm algorithm, and the optimization process includes the following steps: S301, determining the search space range of the weight and bias of the WELM model, and initializing the inertia weight particle swarm optimization algorithm by randomly generating particles; S302, randomly initializing weights connected to input features and bias items according to the features and label information of the vehicle network data, and starting iterative optimization; S303, during the iteration process, the output weight matrix and negative precision are evaluated, the individual optimal fitness and the global optimal fitness of all particles in DPSO are evaluated, and the individual extreme value and the global extreme value are determined, and the individual extreme value is compared with the global extreme value, and the individual with smaller negative precision is selected; S304, updating the position, velocity and inertia weight of the particles in the inertia weight particle swarm optimization algorithm after each iteration; the calculation formulas of the position, velocity and inertia weight of the particles are respectively: Among them, t is the current iteration number, x represents the position of the particle, represents the position of the i-th particle in the t-th iteration, c1 and c2 are the learning factors of the particle, which represent the local learning factor and global learning factor of the particle respectively, w is the inertia weight, r1 and r2 are random numbers between [0,1], and v represents the velocity of the particle. represents the velocity of the i-th particle in the t-th iteration; w max Indicates the maximum value of the inertia weight, w min Indicates the minimum value of inertia weight, t max Indicates the maximum number of iterations; S305, determine whether the number of iterations reaches the set maximum number of iterations. If not, return to step S303. If yes, the iteration ends and the optimized parameters (optimal weights and biases) are provided to WELM to obtain the optimized WELM model.

6. A computer program product comprising computer readable instructions, characterized in that: When the computer-readable instructions are executed by the processor, the steps of the vehicle network intrusion detection method based on improved PCA and PSO as described in any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium comprising computer-readable instructions, characterized in that: When the computer-readable instructions are executed by the processor, the steps of the vehicle network intrusion detection method based on improved PCA and PSO as described in any one of claims 1 to 4 are implemented.

Images