A can bus anomaly detection method and system based on a double attention mechanism

Abstract

The application relates to a CAN bus anomaly detection method and system based on a double attention mechanism, which comprises the following steps: S1, collecting vehicle-mounted data from the OBD interface of a vehicle in real time, wherein the collected vehicle-mounted data covers engine operation parameters, vehicle speed, brake system state and readings of other important sensors; S2, performing inference analysis on the vehicle-mounted data at the vehicle end by using an anomaly detection model, calculating a threshold value through normal operation data to identify potential anomalies or attack modes, generating identification information as soon as an anomaly is detected, directly warning the driver, and encrypting and storing the anomaly data slices. The application relates to the technical field of CAN bus anomaly detection. The application detects anomalies by using the strong correlation of normal data representation under different perspectives and the difference between anomaly data representation, learns the representation of a large amount of normal data, thereby achieving the anomaly detection goal, reducing the dependence on anomaly data, and improving the accuracy of CAN bus anomaly detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of CAN bus anomaly detection, and in particular to a CAN bus anomaly detection method and system based on a double attention mechanism. BACKGROUND

[0002] The automobile CAN bus is a serial communication protocol designed for internal communication of vehicles, which allows multiple microcontrollers and devices on the vehicle to communicate effectively without complex point-to-point wiring connections, thereby significantly reducing the number of wires and complexity. By implementing distributed control and real-time data sharing, it improves system integration and reliability, and becomes an important part of modern automotive electronic architecture. With the CAN bus, various sensors, actuators and control units can work together to more conveniently obtain data from various components of the vehicle for anomaly detection and effective implementation of vehicle safety management.

[0003] The existing fault analysis method based on the CAN bus is mainly post-analysis, and most of them are applied to vehicle maintenance scenarios, lacking real-time anomaly detection and warning, and unable to provide timely assistance to users while driving. In particular, with the gradual popularization of intelligent driving vehicles, the risk of external attacks in the Internet of Vehicles environment has risen sharply, and a practical real-time protection scheme is needed.

[0004] In a real vehicle driving environment, the abnormal data collected by the CAN bus only accounts for a small part of all data. This results in a large amount of normal data constituting the training set, while the abnormal data is extremely scarce. Although there are currently methods of artificially injecting abnormal data sets, such methods have many limitations in real vehicle environments. The artificially injected abnormal data sets are highly regular and difficult to fully simulate abnormal situations in real scenarios. Therefore, in the current research on CAN bus anomaly detection, the acquisition of abnormal data is relatively difficult, which reduces the accuracy of CAN bus anomaly detection. SUMMARY

[0005] In view of the deficiencies in the prior art, the present application aims to provide a CAN bus anomaly detection method and system based on a double attention mechanism to solve the above technical problems.

[0006] The above technical object of the present application is achieved by the following technical solution:

[0007] A CAN bus anomaly detection method based on a double attention mechanism, comprising the following steps:

[0008] S1, collecting vehicle data in real time from the OBD interface of the vehicle, the collected vehicle data covering engine operating parameters, vehicle speed, brake system status and readings of other important sensors;

[0009] S2. On-board data is analyzed and reasoned using an anomaly detection model at the vehicle end. Thresholds are calculated using normally operating data to identify potential anomalies or attack patterns. Once an anomaly is detected, identification information is immediately generated, and the driver is alerted directly. The abnormal data is then sliced ​​and stored in an encrypted manner.

[0010] S3. Optimize the anomaly detection model using vehicle data and upload the optimized anomaly detection model to the cloud server;

[0011] S4. The cloud server receives optimized anomaly detection models from different vehicles and fuses them using federated learning. The fused anomaly detection models are then periodically distributed to the vehicles to complete system updates.

[0012] In a preferred embodiment, the present invention can be further configured as follows: the vehicle-mounted data is analyzed using an anomaly detection model on the vehicle side, which is an unsupervised anomaly detection method based on a dual attention mechanism to analyze the uploaded data, specifically including:

[0013] S21, Patching, and normalized CAN bus normal data;

[0014] S22. Feature modeling is performed through two parallel branches: Patch-piece and In-Patch, with a multi-head attention mechanism introduced in each branch.

[0015] S23. By adding upsampling, the representation outputs of different branches are restored to the same dimension;

[0016] S24. A loss function based on the maximum mean difference is used to measure the similarity between two representations;

[0017] S25. Output the abnormal score and perform anomaly detection.

[0018] In a preferred embodiment, the present invention can be further configured such that the specific method of step S21 is as follows:

[0019] Based on the reason that the CAN bus anomaly detection task sensor data synchronization timing has multiple input features, it is divided into a multivariate time series. The input features between different sensor data first undergo channel-independent patching operations, where each channel is data from a single sensor and each channel shares the same self-attention mechanism. The patching processing result is output for step S22.

[0020] In the CAN bus anomaly detection task, the input multivariate time series is:

[0021] χ∈R T×d

[0022] d represents the number of sensors;

[0023] After extracting single sensor data, i.e. single time series data, through a self-attention mechanism, each channel shares a self-attention network, and the representation result is shown as:

[0024] χ i ′ ∈R N×1 ,i=(1,2,...,d)

[0025] Finally, the features are spliced as the input of step S22.

[0026] In a preferred example, the application can be further configured as: the two parallel branches of step S22 are Patch-piece and In-Patch respectively;

[0027] Patch-piece focuses on the connection between different time segment sensors, a single time segment is a unit, and the internal relationship between time segments is modeled by a multi-head self-attention network;

[0028] The In-Patch branch focuses on the connection between sensors within a time segment, also modeled by a multi-head self-attention network;

[0029] According to the joint representation of the two different branches of Patch-piece and In-Patch, the sensor data in the CAN bus anomaly detection problem is represented from two perspectives to the greatest extent, and the local semantic information of the sensors from different perspectives is maximized by using shared weights.

[0030] In a preferred example, the application can be further configured as: the Patch-piece focuses on the connection between different time segment sensors, defines the size of different patches as P, converts each patch into an embedding vector, and the dimension of the embedding is d model , and a multi-head attention weight is used to calculate the representation of different patches, and the query and key Q, K are initialized as:

[0031] Q Ni ,K Ni =W Qi χ Ni ,W Ki χ Ni

[0032] Wherein, 1≤i≤H, H is the number of heads of the multi-head attention mechanism;

[0033]

[0034] Q Ni ,K NiThe dimensions of the query and the key are represented by a learnable parameter matrix as follows:

[0035]

[0036] The attention weight can be represented as the formula:

[0037]

[0038] Finally, the different patch attention weights are spliced, and the Attn N :

[0039]

[0040] wherein, is a learnable parameter matrix.

[0041] In a preferred example, the In-Patch branch focuses on the relationship between the sensors within the time slice, first, the query and the key Q, K are initialized:

[0042] Q Pi ,K Pi = W Qi χ Pi ,W Ki χ Pi

[0043] wherein the dimensions of the query and the key are:

[0044]

[0045] The dimensions of the learnable parameter matrix are defined as:

[0046]

[0047] The attention weight calculation formula is defined as:

[0048]

[0049] By splicing the weights of different nodes, the Attn P :

[0050]

[0051] The Patch-piece and the In-Patch share the weight, and the shared weight is W Qi ,W Ki .

[0052] In a preferred example, the specific method of the step S23 can be further configured as:

[0053] For Patch-piece, repeat the up-sampling in patch, can get the final Patch-piece representation N;

[0054] For In-Patch, repeat the up-sampling from single sensor data to complete sensor data in patch, finally get In-Patch representation P.

[0055] The application can be further configured in a preferred example that the specific method of the step S24 is:

[0056] For Patch-piece time slice representation N and In-Patch sensor node representation P, the MMD loss function is defined as follows:

[0057] Γ P {P,N;χ}=∑MMD(P,Stopgrad(N))+MMD(Stopgrad(N),P)

[0058] Γ N {P,N;χ}=∑MMD(N,Stopgrad(P))+MMD(Stopgrad(P),N)

[0059] Wherein, MMD is the maximum mean difference function, Stopgrad operation is used to prevent the gradient from propagating backward in a specific position, so as to ensure that part of the parameters remain unchanged, finally, the total loss Γ of the model is defined as follows:

[0060]

[0061] The loss function based on the maximum mean difference measures the similarity of the two representations, which reduces the distance between normal data and increases the distance between normal data and abnormal data.

[0062] A CAN bus anomaly detection system based on a double attention mechanism includes the CAN bus anomaly detection method based on the double attention mechanism, and further includes a vehicle end CAN signal acquisition module, a vehicle data end, a CAN signal processing module, a cloud end module and a cloud end management module.

[0063] The vehicle end CAN signal acquisition module reads data from the OBD interface of the vehicle in real time, and the collected data covers engine operating parameters, vehicle speed, brake system status and readings of other important sensors.

[0064] The vehicle data end collects vehicle data collected by the vehicle end CAN signal acquisition module, and the vehicle data end is connected with the vehicle end CAN signal acquisition module.

[0065] The CAN signal processing module is based on an unsupervised anomaly detection algorithm of a double attention mechanism, analyzes data sent by a vehicle-mounted data terminal, provides real-time protection for users, and can optimize a model using current driving data of the users, and upload the optimized model to a cloud module, the vehicle-mounted data terminal and the cloud module are connected with the CAN signal processing module;

[0066] The cloud module is used for receiving anomaly detection models from different vehicles, fusing the anomaly detection models by using a federated learning method, and regularly issuing the fused anomaly detection model to the vehicle CAN signal processing module to complete system updating;

[0067] The cloud management module records information of anomalies and alarms, and provides an alarm issuing function for managers, and provides data support and an interface for remote management and operation and maintenance.

[0068] In summary, the present application has the following at least one beneficial technical effect:

[0069] 1. The present application proposes a CAN bus anomaly detection method based on a double attention mechanism, which detects anomalies by using the strong correlation of normal data representation and the difference of abnormal data representation under different perspectives, and through the representation learning of a large amount of normal data, the model can effectively distinguish normal and abnormal data, so as to achieve the goal of anomaly detection, reduce the dependence on abnormal data, and improve the accuracy of CAN bus anomaly detection.

[0070] 2. According to the joint representation of Patch-piece and In-Patch two different branches, the sensor data in the CAN bus anomaly detection problem can be represented in two different perspectives to the greatest extent, and the shared weight method can maximize the acquisition of local semantic information of sensors in different perspectives; an up-sampling data processing scheme is introduced, which can balance the CAN bus anomaly detection field dataset, solve the problem of unbalanced dataset, and also expand the feature expression in the data, so that the model can learn the data features more comprehensively.

[0071] 3. The present application uses MMD maximum mean difference as the loss function measurement method of the model, realizes the core idea of the contrast representation algorithm, that is, reduces the distance between normal data, increases the distance between normal data and abnormal data, and improves the contrast effect. BRIEF DESCRIPTION OF DRAWINGS

[0072] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used for the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0073] Figure 1 is a flow chart of a CAN bus anomaly detection method based on a dual attention mechanism of the present application;

[0074] Figure 2 is a flow chart of an unsupervised anomaly detection method of the dual attention mechanism in the present application;

[0075] Figure 3 is a model framework diagram of the unsupervised anomaly detection method of the dual attention mechanism in the present application;

[0076] Figure 4 is a patching operation schematic diagram in the present application;

[0077] Figure 5 is a dual-branch upsampling schematic diagram in the present application;

[0078] Figure 6 is a system diagram of a CAN bus anomaly detection system based on a dual attention mechanism of the present application. DETAILED DESCRIPTION

[0079] The present application will be further described in detail below with reference to the accompanying drawings.

[0080] Example 1:

[0081] With reference to Figures 1 to 5 , the present application discloses a CAN bus anomaly detection method based on a dual attention mechanism, comprising the following steps:

[0082] S1, real-time collection of vehicle data from the OBD interface of the vehicle, the collected vehicle data covering engine operating parameters, vehicle speed, brake system status and readings of other important sensors;

[0083] S2, the vehicle data is analyzed by the anomaly detection model on the vehicle side, the threshold is calculated by the normally operating data to identify potential anomalies or attack patterns, once the anomaly is detected, the identification information is generated immediately, the driver is directly warned, and the abnormal data slice is encrypted and stored;

[0084] S3, the anomaly detection model is optimized using vehicle data, and the optimized anomaly detection model is uploaded to the cloud server;

[0085] S4, the cloud server receives the optimized anomaly detection model from different vehicles, and uses the federated learning method to fuse, and periodically issues the fused anomaly detection model to the vehicle side to complete system update.

[0086] With reference to Figure 2 and Figure 3The vehicle-mounted data is analyzed by an unsupervised anomaly detection method based on a double attention mechanism, specifically including:

[0087] S21, patching and normalizing CAN bus data;

[0088] S22, through two parallel branches of Patch-piece and In-Patch, and introducing a multi-head attention mechanism in each branch for feature modeling;

[0089] S23, the representation outputs of different branches are restored to the same dimension by adding up-sampling;

[0090] S24, a loss function based on maximum mean difference is used to measure the similarity of the two representations;

[0091] S25, outputting an anomaly score and performing anomaly detection.

[0092] Referring to Figure 4 The specific method of step S21 is:

[0093] According to the reason that the CAN bus anomaly detection task has multiple input features under sensor data synchronization timing, the input features between different sensor data are first subjected to channel-independent patching operation, wherein each channel is the data of a single sensor, and each channel shares the same self-attention mechanism. The patching processing result is output for step S22;

[0094] In the CAN bus anomaly detection task, the input multi-element time series is:

[0095] χ∈R T×d

[0096] d is the number of sensors;

[0097] After extracting the single sensor data, i.e., single time series data, through the self-attention mechanism, each channel shares the self-attention network, and the representation result is:

[0098] χ i ′ ∈R N×1 ,i=(1,2,...,d)

[0099] Finally, the features are spliced as the input of step S22.

[0100] The two parallel branches of step S22 are Patch-piece and In-Patch;

[0101] Patch-piece focuses on the connection between different time slices of sensors, and a single time slice is a unit. The intrinsic relationship between time slices is modeled by a multi-head self-attention network.

[0102] In-Patch branch focuses on the connection between sensors within a time slice, and also uses a multi-head self-attention network for modeling.

[0103] According to the joint representation of the two different branches of Patch-piece and In-Patch, the sensor data in the CAN bus anomaly detection problem is represented from two perspectives. The shared weight is used to maximize the acquisition of local semantic information of sensors from different perspectives.

[0104] Meanwhile, the output dimensions of the two branches are different. Considering the subsequent calculation of shared weights and the design to compensate for this vulnerability, the embodiment restores the representation output of different branches to the same dimension by adding upsampling.

[0105] The Patch-piece focuses on the connection between different time slices of sensors. The size of different patches is defined as P. Each patch is converted into an embedding vector, and the dimension of the embedding is d model The multi-head attention weight is used to calculate the representation of different patches. The initialized query and key Q, K are as follows:

[0106] Q Ni ,K Ni =W Qi χ Ni ,W Ki χ Ni

[0107] Wherein, 1≤i≤H, H is the number of heads of the multi-head attention mechanism.

[0108]

[0109] Q Ni ,K Ni represent the dimensions of the query and key. The learnable parameter matrix is represented as follows:

[0110]

[0111] The attention weight can be represented as the formula:

[0112]

[0113] Finally, we splice the different patch attention weights, and the Attn N :

[0114]

[0115] wherein, is a learnable parameter matrix.

[0116] The In-Patch branch focuses on the connection between sensors within a time slice. First, initialize the query and key Q, K:

[0117] Q Pi ,K Pi =W Qi χ Pi ,W Ki χ Pi

[0118] wherein the dimensions of the query and key are:

[0119]

[0120] The dimensions of the learnable parameter matrix are defined as:

[0121]

[0122] The attention weight calculation formula is defined as:

[0123]

[0124] By concatenating the weights of different nodes, the Attn P :

[0125]

[0126] Patch-piece and In-Patch share weights, and the shared weights are W Qi ,W Ki .

[0127] Referring to Figure 5 , the specific method of the step S23 is:

[0128] For Patch-piece, repeat the upsampling within the patch to obtain the final Patch-piece representation N.

[0129] For In-Patch, repeat the upsampling from single sensor data to complete patch sensor data to finally obtain the In-Patch representation P.

[0130] This scheme can balance the CAN bus anomaly detection field dataset and solve the problem of unbalanced dataset. Secondly, it can expand the feature expression in the data, so that the model can learn the data features more comprehensively.

[0131] The comparative representation learning model proposed in this embodiment represents the normal data of the CAN bus from two branches and different perspectives. In order to realize the core concept of the comparative representation algorithm, that is, to reduce the distance between normal data and increase the distance between normal data and abnormal data, we use MMD, the maximum mean difference, as the loss function measurement method of the model.

[0132] We believe that the characteristics of normal sensor data in the process of transmitting data basically meet a fixed threshold, that is, the transmission data basically does not change irregularly, and the change of the data must follow the normal driving state of the vehicle. The mutation of a certain normal sensor data will inevitably lead to the change of other normal sensor data, that is, the data change still has a trace, and the MMD loss function realizes this goal by using the principle of average sample similarity.

[0133] The specific method of the step S24 is:

[0134] For the Patch-piece time slice representation N and the In-Patch sensor node representation P, the MMD loss function is defined as follows:

[0135] Γ P {P,N;χ}=∑MMD(P,Stopgrad(N))+MMD(Stopgrad(N),P)

[0136] Γ N {P,N;χ}=∑MMD(N,Stopgrad(P))+MMD(Stopgrad(P),N)

[0137] Where MMD is the maximum mean difference function, and Stopgrad is an operation used to prevent the gradient from propagating backward at a specific location to ensure that some parameters remain unchanged. Finally, the total loss Γ of the model is defined as follows:

[0138]

[0139] The loss function based on the maximum mean difference reduces the distance between normal data and increases the distance between normal data and abnormal data.

[0140] The embodiment proposes a CAN bus anomaly detection method based on a double attention mechanism. The method detects anomalies by using the strong correlation of normal data representation under different perspectives and the difference between abnormal data representation. By learning the representation of a large amount of normal data, the model can effectively distinguish between normal and abnormal data, thereby achieving the goal of anomaly detection, reducing the dependence on abnormal data, and improving the accuracy of CAN bus anomaly detection.

[0141] Embodiment 2:

[0142] Referring to Figure 6 A CAN bus anomaly detection system based on a dual attention mechanism, comprising the CAN bus anomaly detection method based on a dual attention mechanism described in embodiment 1, further comprising a vehicle-end CAN signal acquisition module, a vehicle-mounted data terminal, a CAN signal processing module, a cloud module, and a cloud management module;

[0143] The vehicle-end CAN signal acquisition module reads data from the OBD interface of the vehicle in real time, and the collected data covers engine operating parameters, vehicle speed, brake system status, and readings of other important sensors;

[0144] The vehicle-mounted data terminal collects vehicle data collected by the vehicle-end CAN signal acquisition module, and the vehicle-mounted data terminal is connected to the vehicle-end CAN signal acquisition module;

[0145] The CAN signal processing module is based on an unsupervised anomaly detection algorithm based on a dual attention mechanism, analyzes the data sent by the vehicle-mounted data terminal, provides real-time protection for users, and optimizes the model using the current driving data of the user, uploads the optimized model to the cloud module, and the vehicle-mounted data terminal and the cloud module are connected to the CAN signal processing module;

[0146] The cloud module is used to receive anomaly detection models from different vehicles, and uses a federated learning method to fuse them, and periodically issues the fused anomaly detection model to the vehicle-end CAN signal processing module to complete system updates;

[0147] The cloud management module records information about anomalies and alarms, and provides an alarm issuing function for management personnel, and provides data support and interfaces for remote management and operation and maintenance.

[0148] The implementation principle of the above embodiment is:

[0149] S1, real-time collection of vehicle-mounted data from the OBD interface of the vehicle, and the collected vehicle-mounted data covers engine operating parameters, vehicle speed, brake system status, and readings of other important sensors;

[0150] S2, the vehicle-mounted data is analyzed by the anomaly detection model at the vehicle end, the threshold value is calculated through the normally operating data to identify potential anomalies or attack patterns, once an anomaly is detected, identification information is generated immediately, the driver is directly alarmed, and the anomaly data slice is encrypted and stored;

[0151] S3, optimizing the anomaly detection model using vehicle data, and uploading the optimized anomaly detection model to the cloud server;

[0152] S4, the cloud server receives the optimized anomaly detection model from different vehicles, and fuses the anomaly detection model by using a federated learning method, and periodically issues the fused anomaly detection model to the vehicle end to complete system updating.

[0153] The embodiments of the present embodiment are the preferred embodiments of the present application, but do not limit the protection scope of the present application, so that: any equivalent changes made according to the structure, shape, principle of the present application should be covered within the protection scope of the present application.

Claims

1. A CAN bus anomaly detection method based on a dual attention mechanism, characterized in that: The method comprises the following steps: S1, collecting vehicle data from the OBD interface of the vehicle in real time, the collected vehicle data covering engine operating parameters, vehicle speed, brake system status and readings of other important sensors; S2, using an anomaly detection model on the vehicle side to analyze the vehicle data, calculating a threshold value based on normally operating data to identify potential anomalies or attack patterns, generating identification information as soon as an anomaly is detected, directly warning the driver, and encrypting and storing the abnormal data slices; The vehicle data is analyzed by an unsupervised anomaly detection method based on a double attention mechanism, specifically including: S21, Patching and normalizing CAN bus data; S22, passing through two parallel branches of Patch-piece and In-Patch, and introducing a multi-head attention mechanism in each branch for feature modeling; S23, restoring the representation outputs of different branches to the same dimension by adding up-sampling; S24, measuring the similarity of the two representations based on a maximum mean difference loss function; S25, outputting an anomaly score and performing anomaly detection; S3, optimizing the anomaly detection model using vehicle data, and uploading the optimized anomaly detection model to the cloud server; S4, the cloud server receives the optimized anomaly detection model from different vehicles, and uses a federated learning method to fuse the anomaly detection model, and periodically distributes the fused anomaly detection model to the vehicle side to complete system updates; The two parallel branches of step S22 are Patch-piece and In-Patch; Patch-piece focuses on the relationship between sensors in different time slices, with a single time slice as a unit, and the internal relationship between time slices is modeled by a multi-head self-attention network; The In-Patch branch focuses on the relationship between sensors within a time slice, also using a multi-head self-attention network for modeling; According to the joint representation of Patch-piece and In-Patch, the sensor data in the CAN bus anomaly detection problem is represented from two perspectives to the greatest extent, and the local semantic information of the sensors in different perspectives is maximized by using shared weights; The specific method of step S23 is: For Patch-piece, repeat upsampling within patch to get final Patch-piece representation ; For In-Patch, up-sampling is repeated from single sensor data to complete patch- in-sensor data, finally obtaining In-Patch representation .

2. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 1, characterized in that: The specific method of step S21 is: According to the reason that the sensor data in the CAN bus anomaly detection task has multiple input features under synchronous timing, it is divided into a multivariate time series, and the input features between different sensor data are first subjected to channel-independent Patching operation, where each channel is the data of a single sensor, and each channel shares the same self-attention mechanism. The Patching processing result is output for step S22; In the CAN bus anomaly detection task, the input multivariate time series is: ； d is the number of sensors; After extracting the single sensor data, i.e., the single time series data, through the self-attention mechanism, each channel shares the self-attention network, and the representation result is: ； Finally, the features are spliced as the input of step S22.

3. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 1, characterized in that: The Patch-piece focuses on the connection between different time segments of sensors, defines the size of different patches as P, converts each segment into an embedding vector, and the dimension of the embedding is The representation of different segments is calculated using multi-head attention weight, and the query and key Q, K are initialized: ； wherein, , is the number of heads of the multi-head attention mechanism; ； denotes the dimensions of the query and key, whose learnable parameter matrices are denoted as follows: ； The attention weight can be represented as a formula: ； Finally, we concatenate the different shard attention weights, i.e. : ； wherein, is a matrix of learnable parameters.

4. The CAN bus anomaly detection method based on a dual attention mechanism according to claim 3, characterized in that: The In-Patch branch focuses on the connections between sensors within a time slice, first, initializing queries and keys : ； Wherein, the dimensions of the query and the key are: ； The dimension of the learnable parameter matrix is defined as: ； The formula for calculating the attention weight is defined as: ； By splicing the weights of different nodes, we can get : ； The patch-piece shares weights with the in-patch, and the shared weights are , is a learnable parameter matrix.

5. A CAN bus anomaly detection system based on a dual attention mechanism, used to implement the CAN bus anomaly detection method based on a dual attention mechanism in any one of claims 1-4, characterized in that: It includes a vehicle end CAN signal acquisition module, a vehicle data end, a CAN signal processing module, a cloud end module and a cloud end management module. The vehicle end CAN signal acquisition module reads data from the OBD interface of the vehicle in real time, and the collected data covers engine operating parameters, vehicle speed, brake system status and readings of other important sensors. The vehicle data end collects vehicle data collected by the vehicle end CAN signal acquisition module, and the vehicle data end is connected with the vehicle end CAN signal acquisition module. The CAN signal processing module analyzes the data sent by the vehicle data end based on the unsupervised anomaly detection algorithm of the double attention mechanism, provides real-time protection for users, and optimizes the model using the current driving data of the user, uploads the optimized model to the cloud end module, and the vehicle data end and the cloud end module are connected with the CAN signal processing module. The cloud end module is used to receive anomaly detection models from different vehicles, and fuse them using a federated learning method, and periodically distribute the fused anomaly detection model to the vehicle end CAN signal processing module to complete system updating. The cloud end management module records the information of the anomaly and the alarm, and provides the alarm distribution function for the management personnel, and provides data support and interface for remote management and operation and maintenance.

Images