Intrusion detection method, device, vehicle and storage medium for vehicle-mounted CAN network

Abstract

The present invention relates to the technical field of vehicle networking, and discloses an intrusion detection method, device, vehicle and storage medium for a vehicle-mounted CAN network. The method comprises: obtaining a data frame of a vehicle-mounted CAN bus, extracting a timestamp feature, a CAN ID feature and a data field feature of each data frame, and stitching all features of a plurality of consecutive data frames into a data image; extracting multiple types of feature images of different scales from the data image through a sliding window, each type of feature image comprising one or more of a timestamp feature, a CAN ID feature and a data field feature; inputting the feature image into a trained intrusion detection model, and outputting the intrusion situation of the vehicle-mounted CAN bus; the intrusion detection model comprises multiple groups of temporal convolutional network layers, and each group of temporal convolutional network layers is respectively used to extract the temporal features of data in the feature image of the corresponding category. The present invention can make predictions and decisions more accurately, and ensure the effect of vehicle-mounted intrusion detection.

Description

Technical Field

[0001] The present invention relates to the technical field of vehicle networking, and in particular to an intrusion detection method, device, vehicle and storage medium for a vehicle-mounted CAN network. Background Art

[0002] With the continuous development of Internet of Vehicles technology, the vulnerability of vehicle-mounted CAN networks has become an increasingly severe challenge. Its inherent weaknesses and security flaws, such as easy physical access, lack of encryption and authentication mechanisms, and trust in all messages, provide opportunities for potential attackers. In the context of the increasing popularity of Internet of Vehicles, protecting the security of vehicle-mounted CAN networks has become a vital task. Effective security measures and technologies need to be taken to ensure the safety and privacy of vehicles and their passengers. Vehicle-mounted intrusion detection systems can monitor, identify and respond to potential security threats in real time, thereby preventing malicious attacks from causing harm to vehicles and their passengers in a timely manner. By introducing intrusion detection technology, the security of vehicle systems can be effectively improved and the safety and privacy of passengers can be guaranteed.

[0003] Current vehicle-mounted intrusion detection systems usually adopt a single feature or all features together processing method. This method may make it impossible to fully explore the features of different data types, resulting in insufficient accuracy and comprehensiveness in the data understanding and decision-making process, making it difficult to comprehensively and accurately detect attacks on the vehicle-mounted CAN network. Summary of the invention

[0004] The problem solved by the present invention is how to improve the performance and accuracy of vehicle-mounted intrusion detection.

[0005] To solve the above problems, the present invention provides an intrusion detection method for a vehicle-mounted CAN network, comprising:

[0006] Obtain the data frame of the vehicle CAN bus, extract the timestamp feature, CAN ID feature and data field feature of each data frame, and combine all the features of multiple consecutive data frames into a data image;

[0007] Extracting multiple types of feature images of different scales from the data image through a sliding window, each type of feature image comprising one or more of a timestamp feature, a CAN ID feature, and a data field feature;

[0008] The feature image is input into the trained intrusion detection model to output the intrusion situation of the vehicle CAN bus; the intrusion detection model includes a temporal convolutional network layer, a feature fusion layer and an identification layer; the number of temporal convolutional network layers corresponds to the number of categories of the feature image, and each group of temporal convolutional network layers is used to extract the temporal features of the data in the feature image of the corresponding category and input them into the feature fusion layer; the feature fusion layer is used to fuse the temporal features of different scales, and the fused features are input into the identification layer, and the identification layer is used to output the probability distribution of the vehicle CAN bus being subjected to different intrusion categories.

[0009] Optionally, the timestamp difference between each data frame and the adjacent data frame is encoded, and the digital feature formed is the timestamp feature; the CAN ID at the end of each data frame m 1 hexadecimal number is the unique identification mark of the corresponding electronic controller, forming m 1 CAN ID feature; the data field of each data frame is m Two 2-digit hexadecimal numbers represent the data content of the data frame, forming m 2×2 data field features; wherein, m 1 and m 2 are all integers greater than 1.

[0010] Optionally, three types of feature images of different scales are extracted from the data image through a sliding window; wherein the first type of feature images includes timestamp features and CAN ID features; the second type of feature images includes CAN ID features and data field features; and the third type of feature images includes data field features.

[0011] Optionally, each group of temporal convolutional network layers includes a convolutional neural network and three improved residual blocks; wherein the convolution kernel size of the convolutional neural network is (3, Wi), wherein 3 represents the number of rows of the convolution kernel, Wi represents the width of each scale input data, i.e., each type of feature image, and the number of channels is (1, 64), and then a Dropout layer is deployed for regularization operation; each residual block is composed of an expanded causal convolution layer and a residual connection, and the residual block is simplified by replacing the ReLU activation function, weight normalization and Dropout layer in the traditional residual block with the SeLU activation function; the expression of the SeLU activation function is:

[0012] ;

[0013] In the formula, x It is the input of SeLU activation function; α and λ is a predefined scaling parameter to ensure the self-normalization property; e is a natural constant.

[0014] Optionally, the feature fusion layer adopts a feature fusion strategy of attention weights to sum time series features of different scales according to weights to achieve dynamic importance allocation of input features, thereby obtaining the fused features; wherein the expression of the feature fusion strategy is:

[0015] ;

[0016] In the formula, , N is the number of temporal convolutional network layers, i.e. the number of feature image categories; x i Indicates i The temporal features extracted by the temporal convolutional network layer; is the feature fusion function.

[0017] Optionally, the identification layer consists of a fully connected layer and a softmax layer; the fully connected layer is used to linearly combine and transform the fused features and map the features to an intermediate representation space; the softmax layer is used to convert the output of the fully connected layer into a probability distribution to achieve decision-making for multi-category classification tasks.

[0018] Optionally, according to the data transmission direction, the dilation factors of the three residual blocks in each group of the temporal convolutional network layer are set to 1, 2, and 4 respectively, and the dilated causal convolutional layer in each residual block is used to extract global features between long-distance time steps.

[0019] The present invention also provides an intrusion detection device for a vehicle-mounted CAN network, comprising: a splicing module, an extraction module and an identification module.

[0020] The splicing module is used to obtain the data frames of the vehicle CAN bus, extract the timestamp features, CANID features and data field features of each data frame, and splice all the features of multiple consecutive data frames into a data image.

[0021] The extraction module is used to extract multiple types of feature images of different scales from the data image through a sliding window, and each type of feature image includes one or more of a timestamp feature, a CAN ID feature, and a data field feature.

[0022] The recognition module is used to input the feature image into the trained intrusion detection model and output the intrusion situation of the vehicle CAN bus; wherein, the intrusion detection model includes a temporal convolutional network layer, a feature fusion layer and an identification layer; the number of temporal convolutional network layers corresponds to the number of categories of the feature image, and each group of temporal convolutional network layers is used to extract the temporal features of the data in the feature image of the corresponding category and input them into the feature fusion layer; the feature fusion layer is used to fuse the temporal features of different scales, and input the fused features into the identification layer, and the identification layer is used to output the probability distribution of the vehicle CAN bus being subjected to different intrusion categories.

[0023] The present invention also provides a vehicle, comprising a memory and a processor, wherein the processor is used to store a computer program, and the processor is used to implement the intrusion detection method for the vehicle-mounted CAN network as described above when executing the computer program.

[0024] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the intrusion detection method for the vehicle-mounted CAN network as described above is implemented.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. The present invention extracts the timestamp features, CAN ID features and data field features of each data frame, and assembles all the features of multiple consecutive data frames into a data image. It uses a sliding window to extract multiple types of data content in the entire data image, and inputs them into different temporal convolutional network layers of the intrusion detection model respectively. It can better mine the features of each data type, build models in a targeted manner, and comprehensively utilize multiple information, thereby improving the accuracy and performance of the model, enabling it to understand the data more comprehensively and accurately, make predictions and decisions more accurately, and ensure the effectiveness of vehicle-mounted intrusion detection.

[0027] 2. The present invention adopts SeLU activation function to replace ReLU, weight normalization and Dropout layer in the temporal convolutional network layer, which can better deal with the gradient vanishing and explosion problems in deep networks, which is conducive to enhancing the nonlinear modeling ability of the model and better learning complex time series features; at the same time, three layers of improved residual blocks are used to extract time series features, which can better learn and capture the complex time series features in the data, improve the model's ability to represent time series data, and further improve the model performance and accuracy.

[0028] 3. The present invention also uses the attention mechanism, and the model can dynamically learn the importance weights of different features in the data, thereby achieving fine selection and weighting of features, so that the model can pay more attention to important features, reduce the interference of irrelevant information on the model, and improve the model's representation and generalization capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 The present invention is a flowchart of an intrusion detection method for a vehicle-mounted CAN network according to an embodiment of the present invention.

[0030] Figure 2 It is a schematic diagram of the structure of the intrusion detection model of an embodiment of the present invention.

[0031] Figure 3 4 is a network structure diagram of a residual block according to an embodiment of the present invention.

[0032] Figure 4 The figure is a schematic diagram of the structure of an intrusion detection device for a vehicle-mounted CAN network according to an embodiment of the present invention.

[0033] Figure 5 Schematic diagram of the structure of a vehicle according to an embodiment of the present invention. DETAILED DESCRIPTION

[0034] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0035] See also Figure 1 , this embodiment provides an intrusion detection method for a vehicle-mounted CAN network, including steps S1 to S3.

[0036] S1. Obtain the data frame of the vehicle CAN bus, extract the timestamp feature, CAN ID feature and data field feature of each data frame, and piece together all the features of multiple consecutive data frames into a data image.

[0037] In this embodiment, the timestamp difference between each data frame and the adjacent data frame is encoded to form a digital feature, namely the timestamp feature; the three hexadecimal numbers at the end of the CAN ID of each data frame are the unique identity of the corresponding electronic controller (ECU), forming three CAN ID features respectively; the data field of each data frame is 8 2-bit hexadecimal numbers, representing the data content of the data frame, forming 8×2=16 data field features respectively. Therefore, there are 20 features in total.

[0038] Of course, in other embodiments, the number of hexadecimal digits at the end of the CAN ID used to represent the unique identity of the electronic controller and the total number of data fields may also be other sizes, which are not limited here.

[0039] In this embodiment, 128 data frames are sequentially assembled into a data image of 128×20 size as a detection object for vehicle-mounted intrusion detection.

[0040] S2. extracting multiple types of feature images of different scales from the data image through a sliding window, each type of feature image comprising one or more of a timestamp feature, a CAN ID feature, and a data field feature.

[0041] In this embodiment, three types of feature images of different scales are extracted from the data image through a sliding window; wherein the first type of feature image includes timestamp features and CAN ID features; the second type of feature image includes CAN ID features and data field features; and the third type of feature image includes data field features. Of course, in other embodiments, each feature image may also contain other single or multiple features in combination, which is not limited here.

[0042] S3. Input the feature image into the trained intrusion detection model and output the intrusion situation of the vehicle CAN bus; wherein, the intrusion detection model includes a temporal convolutional network layer, a feature fusion layer and an identification layer; the number of temporal convolutional network layers corresponds to the number of categories of the feature image, and each group of temporal convolutional network layers is used to extract the temporal features of the data in the feature image of the corresponding category and input them into the feature fusion layer; the feature fusion layer is used to fuse the temporal features of different scales, and input the fused features into the identification layer, and the identification layer is used to output the probability distribution of the vehicle CAN bus being subjected to different intrusion categories.

[0043] Among them, the Temporal Convolutional Network (TCN) is a deep learning model specially designed for processing time series data. It is characterized by being able to effectively capture long-range dependencies and having the advantages of translation invariance and parameter sharing. TCN uses a series of convolutional layers and residual connections to build a deep network structure, enabling the model to efficiently learn complex patterns and features in time series data while reducing the problem of gradient vanishing. In time series detection tasks, TCN can effectively handle the correlation between different time steps and achieve accurate modeling and prediction of time series data.

[0044] Each group of temporal convolutional network layers includes a convolutional neural network and three improved residual blocks. The convolutional neural network has a convolution kernel size of (3, Wi), where 3 represents the number of rows of the convolution kernel, Wi represents the width of each scale input data, i.e., each type of feature image, and the number of channels is (1, 64). A Dropout layer is then deployed for regularization.

[0045] Each residual block consists of a dilated causal convolution layer and a residual connection. The ReLU activation function, weight normalization, and Dropout layer in the traditional residual block are replaced with the SeLU activation function to simplify the residual block and take advantage of the SeLU activation function to extract more robust features. The expression of the SeLU activation function is:

[0046] ;

[0047] In the formula, x It is the input of SeLU activation function; α and λ is a predefined scaling parameter to ensure the self-normalization property; e is a natural constant.

[0048] The feature fusion layer adopts the feature fusion strategy of attention weights. By using the calculated attention weights, the time series features of different scales are weighted and summed according to the weights to achieve dynamic importance allocation of input features, so as to obtain more effective representation and decision-making, thereby obtaining the fused features; wherein, the expression of the feature fusion strategy is:

[0049] ;

[0050] In the formula, , N is the number of temporal convolutional network layers, i.e. the number of feature image categories; x i Indicates i The temporal features extracted by the temporal convolutional network layer; is the feature fusion function.

[0051] The identification layer is composed of a fully connected layer and a softmax layer; the fully connected layer is used to linearly combine and transform the fused features and map the features to an intermediate representation space; the softmax layer is used to convert the output of the fully connected layer into a probability distribution to achieve decision-making for multi-category classification tasks.

[0052] When training an intrusion detection model, the present invention comprises the following steps: (1) extracting data from a data set; (2) preprocessing data; (3) generating three types of input data using a sliding window; and (4) training the intrusion detection model.

[0053] (1) Data extraction of data sets:

[0054] A public data set is used for training, which includes five types of attacks on the CAN bus. The timestamp, CAN ID and data field in the CAN data frame are extracted as intrusion detection objects, where the timestamp is in the form of a time interval as a feature; the last three hexadecimal numbers in the CANID are the unique identity of each ECU, which are three features; the data field is 8 2-digit hexadecimal numbers, representing the data content of the data frame, which are sixteen features, totaling 20 features.

[0055] (2) Data preprocessing:

[0056] First, not all data fields of CAN data frames are composed of 8 2-bit hexadecimal data. For the vacant data fields, "00" is filled, and the data is converted from hexadecimal to decimal. The time stamp is in the form of a time interval, and then the character label is encoded into a digital feature using a label encoder. Since the data features of CAN messages usually have large differences, the extracted data is normalized. This embodiment uses the normal Min-Max method for data normalization, that is:

[0057] ;

[0058] In the formula, x ' represents normalized data; x Represents the original data; x max Indicates the maximum value in the original data; x min Indicates the minimum value in the original data.

[0059] (3) The sliding window generates three types of input data:

[0060] In the network structure diagram, the first part of the data image represents the timestamp, the middle part is the CAN ID, and the last part is the data field. The sliding window extracts the three types of data content, namely, timestamp and CAN ID, CAN ID and data field, and data field, from the entire data graph and inputs them into different temporal convolutional network layers of the model, so as to better utilize the characteristics of each data type and improve the accuracy and performance of the model.

[0061] (4) Intrusion detection model training:

[0062] Convolutional neural network (CNN) convolution part: first, through the convolution kernel of size (3, Wi) (3 represents the number of rows of the convolution kernel, Wi represents the width of the input data at each scale), the data is converted into sequence data of (Hi, 1, 64), that is, 64 channels and column data of length Hi. Then, the data is regularized through the Dropout layer to reduce the overfitting phenomenon of the neural network. In this way, the local features of the input data are extracted and filtered with a smaller amount of calculation, which reduces the complexity of the network.

[0063] Reshape part: The 64-channel column data generated in the convolution layer are concatenated into a two-dimensional image in sequence through the Reshape function, and then passed to the subsequent improved residual block (MTCN).

[0064] Three residual blocks: In this stage, the two-dimensional image is input into three MTCN layers, where the dilation factors of the three residual blocks are set to 1, 2, and 4 respectively, and the dilated causal convolutional layers are used to extract global features between distant time steps. These layers help the model learn the most informative features in the time series input.

[0065] Feature fusion layer: Since the importance of the three types of inputs of different scales is different, the attention fusion strategy is adopted in the feature fusion layer. By learning the attention weights, different inputs or features can be weighted and combined according to the importance of different parts or features of the input data to improve the model's attention to key information. The fusion expression has been introduced in the previous article and will not be repeated here.

[0066] Identification layer: The fused features are input into the identification layer. After linear combination and transformation in the fully connected layer, the model is judged by the softmax function and the category probability of the sample is output to realize the detection of intrusion type.

[0067] In this embodiment, the cross entropy function is used as the loss function of the model to train the model, and its expression is:

[0068] ;

[0069] In the formula, L Represents the value of the loss function; n is the total number of samples, j ∈[1, n ]; y j and y j 'Respectively represent the j The actual probability distribution and predicted probability distribution of samples.

[0070] Later in the training process, the parameters are updated through the Adam optimization algorithm, with the goal of making the value of this loss function as small as possible.

[0071] After the training is completed, it is only necessary to receive the CAN messages inside the vehicle through the CAN bus receiver, perform the above-mentioned extraction and preprocessing operations on the data, and then input the preprocessed data into the trained intrusion detection model to obtain the intrusion category and probability distribution.

[0072] Compared with the prior art, the advantages of the present invention are:

[0073] Timestamp, CAN ID and data fields represent different levels of information, and processing them separately can better mine the information contained in each data type. This helps improve the system's ability to understand and analyze data, thereby improving the accuracy and robustness of detection, enabling it to perform intrusion detection more comprehensively and accurately.

[0074] The traditional TCN model eliminates the problems of gradient vanishing and gradient exploding by integrating ReLU activation function, weight normalization and Dropout layer. The present invention replaces these layers with SeLU and uses its advantages to simplify the residual block. SeLU is a self-normalizing neural network. It converges to zero mean and unit variance when propagating through multiple layers during network training, making it immune to the problems of gradient vanishing and exploding. In addition, SeLU also solves the "dying ReLU" problem, that is, for any input, the ReLU function always outputs the same value of 0, so gradient descent cannot change the learnable parameters. At the same time, SeLU also reduces training time and learns more robust features.

[0075] Different data features are extracted through three parallel temporal convolutional network layers, and they are fused and judged through the attention weight mechanism. Different temporal convolutional network layers extract different types of features. By using them in parallel, the model can learn richer and more diverse data representations and improve the model's representation ability. By fusing the features extracted by different temporal convolutional network layers through the attention weight mechanism, the information of each module can be effectively integrated, and the feature information extracted by the three temporal convolutional network layers can be comprehensively utilized to further improve the model performance.

[0076] like Figure 4 As shown, another embodiment of the present invention further provides an intrusion detection device for a vehicle-mounted CAN network, comprising: a splicing module, an extraction module and an identification module.

[0077] The splicing module is used to obtain the data frames of the vehicle CAN bus, extract the timestamp features, CANID features and data field features of each data frame, and splice all the features of multiple consecutive data frames into a data image.

[0078] The extraction module is used to extract multiple types of feature images of different scales from the data image through a sliding window, and each type of feature image includes one or more of a timestamp feature, a CAN ID feature, and a data field feature.

[0079] The recognition module is used to input the feature image into the trained intrusion detection model and output the intrusion situation of the vehicle CAN bus; wherein, the intrusion detection model includes a temporal convolutional network layer, a feature fusion layer and an identification layer; the number of temporal convolutional network layers corresponds to the number of categories of the feature image, and each group of temporal convolutional network layers is used to extract the temporal features of the data in the feature image of the corresponding category and input them into the feature fusion layer; the feature fusion layer is used to fuse the temporal features of different scales, and input the fused features into the identification layer, and the identification layer is used to output the probability distribution of the vehicle CAN bus being subjected to different intrusion categories.

[0080] The intrusion detection device provided in this embodiment can produce substantially the same technical effects as the above-mentioned intrusion detection method, and will not be described in detail here.

[0081] Yet another embodiment of the present invention provides a vehicle, comprising a memory and a processor, wherein the processor is used to store a computer program, and the processor is used to implement the intrusion detection method as described above when executing the computer program.

[0082] like Figure 5 As shown, the vehicle provided in this embodiment includes: at least one processor 101, and a memory 102 connected to the at least one processor 101. In this embodiment, the specific connection medium between the processor 101 and the memory 102 is not limited. Figure 5 In the example, the processor 101 and the memory 102 are connected via the bus 100. The bus 100 is connected to the memory 102 via the bus 100. Figure 5 The connections between other components are shown by thick lines, which are only schematic and not limiting. The bus 100 can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, Figure 5 In the figure, only one thick line is used, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 101 can also be called a controller, and there is no limitation on the name.

[0083] In this embodiment, the memory 102 stores instructions that can be executed by at least one processor 101. The at least one processor 101 can execute the vehicle-mounted intrusion detection method discussed above by executing the instructions stored in the memory 102. The processor 101 can implement Figure 4 The functions of each module in the device shown.

[0084] Among them, the processor 101 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 102 and calling data stored in the memory 102, the various functions of the device and process data, the device can be monitored as a whole.

[0085] In one possible design, the processor 101 may include one or more processing units, and the processor 101 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 101. In some embodiments, the processor 101 and the memory 102 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0086] The processor 101 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in this embodiment. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the intrusion detection method disclosed in this embodiment may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor 101.

[0087] The memory 102 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 102 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 102 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 102 in this embodiment can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0088] By programming the processor 101, the code corresponding to the vehicle control method described in the above embodiment can be fixed into the chip, so that the chip can execute the control method when running. Figure 1 The steps of the intrusion detection method of the embodiment shown are as follows: How to design and program the processor 101 is a technique known to those skilled in the art and will not be described in detail here.

[0089] Yet another embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the vehicle control method as described above is implemented.

[0090] In some possible implementations, various aspects of the intrusion detection method provided by the present invention may also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the intrusion detection method according to various exemplary embodiments of the present invention described above in this specification.

[0091] Those skilled in the art will appreciate that the present embodiment may be provided as a method, system, or computer program product. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0092] The computer-readable storage medium and the intrusion detection method provided in this embodiment can produce substantially the same technical effects, which will not be described in detail herein.

[0093] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for detecting intrusion in a vehicle CAN network, characterized in that: include: The data frames of the vehicle CAN bus are obtained, and the timestamp features, CAN ID features and data field features of each data frame are extracted, and all the features of multiple consecutive data frames are assembled into a data image; wherein the timestamp difference between each data frame and the adjacent data frame is encoded, and the digital feature formed is the timestamp feature; the CAN ID at the end of each data frame m 1 hexadecimal number is the unique identification mark of the corresponding electronic controller, forming m 1 CAN ID feature; the data field of each data frame is m Two 2-digit hexadecimal numbers represent the data content of the data frame, forming m 2×2 of the data field features; m 1 and m 2 are all integers greater than 1; Performing data preprocessing on the data image, including: filling in vacant data fields, converting hexadecimal data into decimal data, encoding character labels into digital features using a label encoder, and then normalizing the data; Extracting multiple types of feature images of different scales from the data image through a sliding window, each type of feature image comprising one or more of a timestamp feature, a CAN ID feature, and a data field feature; The feature image is input into the trained intrusion detection model to output the intrusion situation of the vehicle CAN bus; the intrusion detection model includes a temporal convolutional network layer, a feature fusion layer and an identification layer; the number of temporal convolutional network layers corresponds to the number of categories of the feature image, and each group of temporal convolutional network layers is used to extract the temporal features of the data in the feature image of the corresponding category and input them into the feature fusion layer; the feature fusion layer is used to fuse the temporal features of different scales, and the fused features are input into the identification layer, and the identification layer is used to output the probability distribution of the vehicle CAN bus being subjected to different intrusion categories.

2. The intrusion detection method of the vehicle-mounted CAN network according to claim 1 is characterized in that: Three types of feature images of different scales are extracted from the data image through a sliding window; wherein the first type of feature image includes timestamp features and CAN ID features; the second type of feature image includes CAN ID features and data field features; and the third type of feature image includes data field features.

3. The intrusion detection method of the vehicle-mounted CAN network according to claim 1 is characterized in that: Each group of temporal convolutional network layers includes a convolutional neural network and three improved residual blocks; wherein the convolution kernel size of the convolutional neural network is (3, Wi), where 3 represents the number of rows of the convolution kernel, Wi represents the width of each scale input data, i.e., each type of feature image, and the number of channels is (1, 64), after which a Dropout layer is deployed for regularization operation; each residual block consists of an expanded causal convolution layer and a residual connection, and the residual block is simplified by replacing the ReLU activation function, weight normalization, and Dropout layer in the traditional residual block with the SeLU activation function; the expression of the SeLU activation function is: ； In the formula, x It is the input of SeLU activation function; α and λ is a predefined scaling parameter to ensure the self-normalization property; e is a natural constant.

4. The intrusion detection method of the vehicle-mounted CAN network according to claim 3 is characterized in that: The feature fusion layer adopts the feature fusion strategy of attention weights, and sums the time series features of different scales according to the weights to achieve dynamic importance allocation of input features, thereby obtaining the fused features; wherein, the expression of the feature fusion strategy is: ； In the formula, , N is the number of temporal convolutional network layers, i.e. the number of feature image categories; x i Indicates i The temporal features extracted by the temporal convolutional network layer; f (·) is the feature fusion function; The identification layer consists of a fully connected layer and a softmax layer; the fully connected layer is used to linearly combine and transform the fused features and map the features to an intermediate representation space; the softmax layer is used to convert the output of the fully connected layer into a probability distribution to achieve decision-making for multi-category classification tasks.

5. The intrusion detection method of the vehicle-mounted CAN network according to claim 3 is characterized in that: According to the data transmission direction, the dilation factors of the three residual blocks in each group of the temporal convolutional network layer are set to 1, 2, and 4 respectively, and the dilated causal convolutional layer in each residual block is used to extract global features between long-distance time steps.

6. An intrusion detection device for a vehicle-mounted CAN network, characterized in that: include: The splicing module is used to obtain the data frame of the vehicle CAN bus, extract the timestamp feature, CANID feature and data field feature of each data frame, and splice all the features of multiple consecutive data frames into a data image; wherein the timestamp difference between each data frame and the adjacent data frame is encoded, and the digital feature formed is the timestamp feature; the CAN ID at the end of each data frame m 1 hexadecimal number is the unique identification mark of the corresponding electronic controller, forming m 1 CAN ID feature; the data field of each data frame is m Two 2-digit hexadecimal numbers represent the data content of the data frame, forming m 2×2 of the data field features; m 1 and m 2 are all integers greater than 1; An extraction module is used to extract multiple types of feature images of different scales from the data image through a sliding window, each type of feature image includes one or more of a timestamp feature, a CAN ID feature, and a data field feature; in extracting multiple types of feature images of different scales from the data image through the sliding window, the data image is also preprocessed, including: filling in vacant data fields, converting hexadecimal data into decimal data, using a label encoder to encode character labels into digital features, and then performing data normalization; The recognition module is used to input the feature image into the trained intrusion detection model and output the intrusion situation of the vehicle-mounted CAN bus; wherein the intrusion detection model includes a temporal convolutional network layer, a feature fusion layer and an identification layer; the number of temporal convolutional network layers corresponds to the number of categories of the feature image, and each group of temporal convolutional network layers is used to extract the temporal features of the data in the feature image of the corresponding category and input them into the feature fusion layer; the feature fusion layer is used to fuse the temporal features of different scales, and input the fused features into the identification layer, and the identification layer is used to output the probability distribution of the vehicle-mounted CAN bus being subjected to different intrusion categories.

7. A vehicle, characterized in that: The invention comprises a memory and a processor, wherein the processor is used to store a computer program, and the processor is used to implement the intrusion detection method for the vehicle-mounted CAN network as claimed in any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the intrusion detection method for the vehicle-mounted CAN network as described in any one of claims 1 to 5 is implemented.

Images