Lightweight vehicle network intrusion detection system and method based on shallow CNN and GRU

Abstract

The present invention belongs to the technical field of vehicle networking and communication security, and relates to a lightweight vehicle-mounted network intrusion detection system and method based on shallow CNN and GRU. The detection system is obtained by training a ConvGRU lightweight model, and the ConvGRU lightweight model comprises a shallow CNN model, a GRU model, and a fusion module; the shallow CNN model comprises a first point-by-point convolution layer, a first DW convolution layer, a second point-by-point convolution layer, a second DW convolution layer, a third point-by-point convolution layer, a third DW convolution layer, a convolution layer, an average pooling layer, and a first fully connected layer which are arranged in sequence; the GRU model comprises a data conversion module, a GRU module, and a second fully connected layer; the shallow CNN model extracts spatial features, and the GRU model extracts temporal features, and the two are fused to improve generalization ability, and while having excellent accuracy, it also brings convenience, so that it has lower model complexity, computing resources, and latency.

Description

Technical Field

[0001] The present invention belongs to the field of vehicle networking and communication security technology, and specifically, relates to a lightweight vehicle network intrusion detection system and method based on shallow CNN and GRU (named as ConvGRU lightweight model). Background Art

[0002] With the rapid development of intelligent transportation and Internet of Vehicles technologies, as well as the continuous integration of new network technologies and automotive technologies, today's vehicle intranet, as a key component of the intelligent transportation system, is responsible for the information interaction between the vehicle and the outside world, the vehicle and the driver, and the passengers. In the vehicle intranet, the controller area network (CAN) is an important underlying control network for the vehicle. However, due to its message broadcast-based characteristics, the CAN protocol lacks authentication of sender and receiver node information, and there is no message encryption mechanism, making it easy for attackers to invade and disrupt CAN communications. In addition, the increased interconnectivity of vehicle networks and the emerging cellular connections between connected vehicles and external networks make these vehicles vulnerable to various traditional network attacks, providing more opportunities for external attackers, thereby increasing the risk of being attacked.

[0003] Li Yang et al. proposed a typical Internet of Vehicles intrusion detection model based on deep convolutional neural network (DCNN) (L. Yang and A. Shami, "A Transfer Learning and Optimized CNN Based Intrusion Detection System for Internet of Vehicles," ICC 2022 - IEEE International Conference on Communications, Seoul, Korea, Republic of, 2022, pp. 2774-2779.). The VGG16, VGG19, Xception, and Inception used in the article all stacked several layers of neural networks. Although the model was optimized and improved using transfer learning, ensemble learning, and hyperparameter optimization techniques, the accuracy of the model was improved. However, the model is highly complex and the model parameters occupy a large amount of memory, which cannot work well on resource-constrained vehicle ECUs.

[0004] MDHossain et al. proposed an in-vehicle CAN bus communication intrusion detection system based on recurrent neural network LSTM (MDHossain, H. Inoue, H. Ochiai, D. Fall and Y. Kadobayashi, "LSTM-Based Intrusion Detection System for In-Vehicle Can Bus Communications," in IEEE Access, vol. 8, pp. 185489-185502, 2020.). The proposed LSTM-based IDS can effectively detect CAN bus network attacks, and through hyperparameter adjustment, it can solve the long-term dependency problem when processing sequence data, achieving a higher detection accuracy, but it may result in lower computational efficiency. In addition, Tariq et al. proposed an intrusion detection method based on convolutional LSTM (ConvLSTM) and transfer learning (S. Tariq, S. Lee, and SS Woo, "CANTransfer: transfer learning based intrusion detection on a controllerarea network using convolutional LSTM network," in Proceedings of the 35thAnnual ACM Symposium on Applied Computing (SAC 20). Brno, Czech Republic: ACM, Mar. 2020, pp. 1048–1055.). Similarly, this model also brings extremely high accuracy, but like the previously mentioned ones, it uses linear superposition of neural network layers to build the model, which has the characteristics of large model scale, consumes a lot of computing resources, and may cause large delays in detection. Summary of the invention

[0005] In view of the fact that the existing vehicle network intrusion detection models are complex, inconvenient and have high latency, the present invention provides a lightweight vehicle network intrusion detection system based on shallow CNN and GRU. The system combines shallow CNN and GRU to form a brand-new framework. The ConvGRU lightweight model combining shallow CNN and GRU can effectively detect network attacks in the vehicle and external network. The shallow CNN extracts spatial features and the GRU extracts temporal features. The two are integrated to improve the generalization ability. While having excellent accuracy, it also brings convenience, so that it has lower model complexity, computing resources and latency.

[0006] To achieve the above object, the present invention adopts the following technical solution:

[0007] A lightweight vehicle network intrusion detection system based on shallow CNN and GRU, wherein the detection system is obtained by training a ConvGRU lightweight model, wherein the ConvGRU lightweight model includes a shallow CNN model, a GRU model, and a fusion module;

[0008] The shallow CNN model includes a first point-by-point convolution layer, a first DW convolution layer, a second point-by-point convolution layer, a second DW convolution layer, a third point-by-point convolution layer, a third DW convolution layer, a convolution layer, an average pooling layer, and a first fully connected layer, which are arranged in sequence;

[0009] The first point-by-point convolution layer, the second point-by-point convolution layer, and the third point-by-point convolution layer all use 1*1 point-by-point convolution with a step size of 1. The first point-by-point convolution layer uses batch normalization and ReLU activation function after the convolution operation, and the second and third point-by-point convolution layers perform batch normalization after the convolution operation.

[0010] The convolution kernel size of the first DW convolution layer, the second DW convolution layer, and the third DW convolution layer are all 3*3, the step size is 2, the groups parameter is set to the number of input channels, and batch normalization and ReLU activation function are used after the convolution operation;

[0011] The convolution kernel size of the convolution layer is 3*3, the step size is 1, the groups parameter is set to 1, batch normalization is used after convolution, and the output channel number is 2*2 features with 64 channels, and then the average pooling layer, the first fully connected layer and finally flattened output are obtained to obtain the result logit value x about the spatial feature;

[0012] The GRU model includes a data conversion module, a GRU module, and a second fully connected layer; wherein the data conversion module is used to convert the feature map x from its original shape into a tensor to match the input requirements of the GRU module, and the tensor converted by the data conversion module is input into the GRU module;

[0013] The number of stacked GRU layers num_layers in the GRU module is set to 2, the feature dimension hidden_size of the hidden state of each time step of the GRU is set to 32, and the Dropout rate is set to 0.5;

[0014] The second fully connected layer is used to flatten the multidimensional tensor obtained by the GRU module, decode the hidden state of the last time step, and obtain the result logit value y about the time characteristic;

[0015] The fusion module is used to perform weighted average calculation on the output x of the first fully connected layer and the output y of the second fully connected layer, and finally obtain the output result z.

[0016] As a preferred embodiment of the present invention, when the fusion module fuses the output x of the first fully connected layer and the output y of the second fully connected layer, the weights of both are 0.5, and the fused feature z=0.5x+0.5y.

[0017] As a preferred embodiment of the present invention, the specific steps for training the ConvGRU lightweight model are:

[0018] Step 1. Obtain a public dataset, clean the data, preprocess the data, normalize it, and convert it into labeled color images;

[0019] Step 2. Pass the data processed in step 1 into the built ConvGRU lightweight model, train the ConvGRU lightweight model, and find the hyperparameters and weights suitable for the ConvGRU lightweight model.

[0020] As a further preference of the present invention, the specific steps of step 1 are as follows:

[0021] Step 1.1. Obtain the public Car-Hacking dataset;

[0022] Step 1.2. Clean the raw data, including extracting specific columns of the data and adding field names, filling missing values ​​of the data, converting the hexadecimal data into decimal, and setting labels;

[0023] Step 1.3. Randomly extract part of the data from each type of traffic data;

[0024] Step 1.4. Normalize the data and then scale it to [0,255];

[0025] Step 1.5. After data normalization, the data is classified and converted into color image form.

[0026] As the preferred embodiment of the present invention, the specific steps of step 2 are:

[0027] Step 2.1. Divide the data set obtained in step 1 into training set, validation set, and test set in a ratio of 7:2:1;

[0028] Step 2.2. Before the model starts training, the color image dataset obtained in step 1 is normalized and standardized;

[0029] Step 2.3. Put the obtained data into the built ConvGRU lightweight model, and use a validation data set to determine the optimal hyperparameters of the model. The training optimizer is the Adam optimizer, and the loss function is the sparse classification cross entropy loss function. According to the changes in the loss value and the exact value during the cross-validation process, the training rounds are set to 15, the learning rate is set to 0.0001, and the batch size is 32;

[0030] Step 2.4. After obtaining the hyperparameters of the model, use 5-fold cross-validation to verify the optimality of the hyperparameters. By continuously optimizing and evaluating the performance of the model, determine the optimal weights, and then save the optimal weights to the specified path.

[0031] As a preferred embodiment of the present invention, the specific steps of step 1.2 are as follows: for abnormal data volume, specific columns 1, 3, 4, 5, 6, 7, 8, 9, 10, 11 in the original data are read as data features, and field names 'CAN_ID', 'Data[0]', 'Data[1]', 'Data[2]', 'Data[3]', 'Data[4]', 'Data[5]', 'Data[6]', 'Data[7]', 'Label' are added to the corresponding columns to indicate the meaning of each column; for normal data flow, specific columns 2, 4, 5, 6, 7, 8, 9, 10, 11 in the original data are read as data features, and field names 'CAN_ID', 'Data[0]', 'Data[1]', 'Data[2]', 'Data[3]', 'Data[4]', 'Label' are added to the corresponding columns to indicate the meaning of each column. 'Data[5]', 'Data[6]', 'Data[7]', and add a column named Label at the end of the data frame and set all its values ​​to 'R'; then fill in the default values ​​of missing values; use '0000' and '00' for the CAN_ID and Data columns, and 'R' for the Label column, and then replace all entries with the value 'R' in the Data column with '00', then convert the hexadecimal strings in all columns to decimal integers, and finally distinguish the normal data stream from the remaining four abnormal data streams and set the corresponding labels; among them, the four abnormal data streams are DoS, Fuzzy, RAM-Spoofing, and Gear-Spoofing.

[0032] As a preferred embodiment of the present invention, when normalizing the data in step 1.4, quantile normalization is used.

[0033] As a preferred embodiment of the present invention, the normalization and standardization processing formula in step 2.2 is as follows:

[0034] The normalization formula is:

[0035] ;

[0036] in, normalized_pixel is the normalized pixel value, pixel is the original image pixel value, and 255 is the maximum pixel value;

[0037] The formula for normalizing the normalized data is:

[0038] ;

[0039] in, standardized_pixel Refers to the pixel value of the image after normalization. normalized_ pixel is the normalized pixel value, mean is the mean of the data, std is the standard deviation of the data, and both mean and std are [0.5, 0.5, 0.5].

[0040] The present invention also provides a lightweight vehicle network intrusion detection method based on shallow CNN and GRU, the method comprising the following steps:

[0041] Step 1. Receive CAN traffic data in real time;

[0042] Step 2. Preprocess the CAN traffic data, normalize it and convert it into a color image;

[0043] Step 3. Input the converted color image into a lightweight vehicle network intrusion detection system based on shallow CNN and GRU;

[0044] Step 4. The lightweight vehicle network intrusion detection system based on shallow CNN and GRU identifies and classifies the CAN traffic data received in real time and outputs the classification results;

[0045] Step 5. Based on the classification results, determine the intrusion detection results.

[0046] Advantages and beneficial effects of the present invention:

[0047] (1) The present invention designs a lightweight vehicle network intrusion detection system based on shallow CNN and GRU. The system has excellent ability to detect abnormal traffic and can distinguish various attack categories. It has high accuracy and low resource consumption (CPU occupancy rate is 10.71%, memory usage is only 0.75MB), as well as efficient processing capability and fast response speed (the model throughput rate reaches 15775.60 samples / second, and the average batch processing time is 2.1 milliseconds). It effectively solves the technical problem that the existing intrusion detection model is complex and inconvenient and cannot be directly deployed in the resource-constrained vehicle network environment.

[0048] (2) The present invention uses a small number of layers of deep separable convolution technology to extract the spatial features of network malicious traffic, uses GRU to extract the temporal features of network malicious traffic, and then fuses the spatial features with the temporal features. This method not only reduces the computational cost and improves the model efficiency, but also significantly enhances the model's ability to identify complex network malicious traffic, providing a more accurate and efficient technical means for network security protection.

[0049] (3) After the entire model is built, in order to improve the adaptability and flexibility of the model, the present invention uses hyperparameter optimization and 5-fold cross validation for the ConvGRU lightweight model. When setting the hyperparameters, the learning rate is 0.0001, the batch size is 32, the training rounds are 15, the loss function is the sparse classification cross entropy loss function, and the optimizer is the Adam optimizer. Through hyperparameter optimization, the model can be adjusted for specific Internet of Vehicles environments and intrusion detection tasks to improve its adaptability and flexibility. After obtaining the hyperparameters, 5-fold cross validation is used. The 5-fold cross validation further ensures the generalization ability of the model. By training and validating on different data subsets, the optimal weights are determined, so that the model can better adapt to new or unseen data and has stronger robustness and reliability in actual deployment.

[0050] (4) The present invention achieves the lightweight requirement by improving data processing and model structure. In the data processing stage, the original data is cleaned to facilitate numerical calculation and analysis. Before converting the data into a color image, the data is normalized using the quantile normalization method to reduce the impact of extreme values ​​on data distribution and ensure that the data is more uniform and stable in the standardized feature space, thereby improving the model training efficiency while ensuring accuracy.

[0051] (5) When the present invention inputs the images of the training set into the already built ConvGRU lightweight model, it is necessary to first normalize the original image to a pixel value in the range of [0, 1], and then standardize and convert it to a pixel value in the range of [-1, 1], so as to unify the pixel values ​​of different images into a standard range, making the model training more stable.

[0052] (6) When training the model of the present invention, the number of stacked GRU layers num_layers is set to 2, the feature dimension hidden_size of the hidden state of each time step of GRU is set to 32, and the Dropout rate is set to 0.5 to randomly discard neurons during the training process in order to reduce overfitting and improve the generalization ability of the model.

[0053] (7) The present invention conducts a comprehensive evaluation on the performance of the ConvGRU lightweight model (including indicators such as accuracy, recall rate, and F1 score). The results show that the model has a good performance of 100% in terms of accuracy, precision, recall rate, and F1 score. It has a good performance in vehicle intrusion detection and can accurately identify malicious traffic in the Internet of Vehicles to ensure the safety of vehicle driving. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] By referring to the following description in conjunction with the accompanying drawings, and with a more comprehensive understanding of the present invention, other objects and results of the present invention will become more clear and easy to understand. In the accompanying drawings:

[0055] Figure 1 It is a schematic diagram of the overall architecture of the ConvGRU lightweight model of the present invention;

[0056] Figure 2 It is a flow chart of the present invention for training the ConvGRU lightweight model;

[0057] Figure 3 is the confusion matrix of predicted labels and true labels. DETAILED DESCRIPTION

[0058] In order to enable those skilled in the art to better understand the technical solution and advantages of the present invention, the present application is described in detail below in conjunction with the accompanying drawings, but it is not intended to limit the protection scope of the present invention.

[0059] like Figure 1 As shown, this embodiment provides a lightweight vehicle network intrusion detection system based on shallow CNN and GRU, and the detection system is obtained by training a ConvGRU lightweight model, and the ConvGRU lightweight model includes a shallow CNN model (Shallow CNN module), a GRU model (GRU module), and a fusion module (Fusion);

[0060] The shallow CNN model includes the first point-by-point convolution layer (1*1 ConV), the first DW convolution layer (3*3 DW), the second point-by-point convolution layer (1*1 ConV), the second DW convolution layer (3*3 DW), the third point-by-point convolution layer (1*1ConV), the third DW convolution layer (3*3 DW), the convolution layer (3*3 ConV), the average pooling layer, and the first fully connected layer.

[0061] The first point-by-point convolution layer, the second point-by-point convolution layer, and the third point-by-point convolution layer all use 1*1 point-by-point convolution with a step size of 1. The first point-by-point convolution layer uses batch normalization (BN) and ReLU activation function after the convolution operation, and the second and third point-by-point convolution layers only perform batch normalization (BN) after the convolution operation.

[0062] The convolution kernel size of the first DW convolution layer, the second DW convolution layer, and the third DW convolution layer are all 3*3, with a step size of 2. Batch Normalization (BN) and ReLU activation function are used after the convolution operation;

[0063] In this embodiment, BN stabilizes the training process, accelerates the convergence speed, and reduces the dependence on initialization by normalizing the data of each batch; in addition, it also has a regularization effect and reduces overfitting; the ReLU activation function is simple and efficient to calculate, which can alleviate the gradient vanishing problem, and at the same time generate sparse activation, improve the calculation efficiency and the nonlinear representation ability of the model. The combination of the two improves the model performance and finally obtains the 2*2 multi-channel feature;

[0064] The convolution kernel size of the convolution layer is 3*3, the step size is 1, and batch normalization (BN) is used after the convolution operation to output 2*2 features with 64 channels. Then, the average pooling layer and the first fully connected layer are used to flatten and output the resulting logit value x of the spatial feature.

[0065] The GRU model includes a data conversion module (Reshape into tensor), a GRU module, a second fully connected layer (Fully

[0066] connected); wherein the data conversion module is used to convert the feature map x from its original shape into a (batch_size, sequence_length, input_size) tensor to match the input requirements of the GRU module, so that the GRU module can correctly process and learn sequence data; the tensor converted by the data conversion module is input into the GRU module;

[0067] The number of stacked GRU layers num_layers in the GRU module is set to 2, the feature dimension hidden_size of the hidden state of each time step of the GRU is set to 32, and the Dropout rate is set to 0.5 to randomly drop neurons during training in order to reduce overfitting and improve the generalization ability of the model;

[0068] The second fully connected layer is used to flatten the multidimensional tensor obtained by the GRU module, decode the hidden state of the last time step, and obtain the result logit value y about the time characteristic;

[0069] The fusion module is used to perform weighted average calculation on the output x of the first fully connected layer and the output y of the second fully connected layer (where both weights are 0.5), and finally obtain the output result z, z=0.5x+0.5y.

[0070] In this embodiment, the steps of data processing by the shallow CNN model are as follows:

[0071] (1) The processed image data is input into the built ConvGRU lightweight model. In the shallow CNN model, the feature map is first subjected to a 1*1 point-by-point convolution with a step size of 1 to adjust the number of channels and maintain the integrity of the spatial dimension; then it is subjected to batch normalization BN:

[0072] ;

[0073] in, x is the input data, is the mean of the input data, is the variance of the input data, is a very small positive number, the value range includes but is not limited to 1e-5 (i.e. 0.00001) or smaller values, such as 1e-6, 1e-7, etc., to prevent the divisor from being zero. and are learnable parameters.

[0074] In this embodiment, the input data is normalized to have a mean of 0 and a variance of 1, and then the learnable parameters and Perform linear transformation;

[0075] After batch normalization, the ReLU activation function is introduced to improve gradient flow, alleviate the gradient vanishing problem, maintain the training stability of the network, and reduce the amount of computation and memory requirements.

[0076] (2) The dimension-enhanced data obtained by 1*1 point-by-point convolution with a step size of 1, batch normalization, and ReLU activation function is passed to the first DW convolution layer for convolution operation. The convolution operation of the first DW convolution layer is a DW convolution with a convolution kernel size of 3*3. In order to perform deep convolution, the groups parameter needs to be set to be equal to the number of input channels, so that the convolution operation is performed independently only in each input channel, and then after BN and ReLU operations, the feature map is finally used as the input for the next step;

[0077] (3) The feature map obtained in step (2) is subjected to a 1*1 point-by-point convolution with a step size of 1, and then to the second DW convolution layer for convolution after batch normalization (BN). The convolution operation of the second DW convolution layer is a DW convolution with a convolution kernel size of 3*3. Similarly, in order to perform deep convolution, the groups parameter needs to be set to be equal to the number of input channels, so that the convolution operation is performed independently only in each input channel. After BN and ReLU operations, the feature map is finally used as the input for the next step;

[0078] (4) The feature map obtained in step (3) is subjected to a 1*1 point-by-point convolution with a step size of 1, and then to the third DW convolution layer after batch normalization (BN) for convolution operation. The convolution operation of the third DW convolution layer is a DW convolution with a convolution kernel size of 3*3. Similarly, in order to perform deep convolution, the groups parameter needs to be set to be equal to the number of input channels, so that the convolution operation is performed independently only in each input channel. After BN and ReLU operations, the feature map is finally used as the input for the next step;

[0079] In this embodiment, repeating the above steps (3) and (4) can gradually extract and enhance features while controlling the computational complexity;

[0080] (5) The corresponding output of step (4) is subjected to a traditional convolution operation with a stride of 1 and a convolution kernel size of 3*3 (set groups=1), followed by a BN operation. The 2*2*64 feature map is then average pooled to reduce the dimension to 1*1*64, and finally the output result logit value x is flattened through the first fully connected layer.

[0081] In this embodiment, the GRU module mainly controls the flow of information through the update gate and the reset gate. The update gate determines the degree to which the previous hidden state is retained in the current hidden state, while the reset gate determines the degree to which the previous hidden state is forgotten when generating a candidate hidden state. Through these gating mechanisms, the GRU can effectively capture and process long-term dependencies in sequence data.

[0082]

[0083] The above formula represents the formula related to the candidate hidden state; is the hyperbolic tangent activation function, which compresses the result of the linear combination to [-1,1]. is the weight matrix, is the bias term, the candidate hidden state The current input and the hidden state of the previous time step after the reset gate is regulated Joint decision.

[0084]

[0085] The above formula represents the formula related to the hidden state; the hidden state is the hidden state of the previous time step and the candidate hidden state at the current time step The update gate is obtained by weighted summation. Determines the weight of the two, update gate The closer it is to 1, the current hidden state The more candidate hidden states are retained The closer the update gate is to 0, the current hidden state The more hidden states of the previous time step are retained Information. Hide status is the final state of the current time step, which combines the hidden state of the previous time step and the candidate hidden state of the current time step. The regulation determines the retention and updating of information.

[0086]

[0087] The above formula represents the formula related to the update gate; Represents the Sigmoid activation function, which compresses the result of the linear combination to the range [0,1]. is the weight matrix, is the bias term. Update gate The closer the value is to 1, the more information is transferred from the previous state. . Update Gate The closer the value is to 0, the more information is obtained from the input of the current time step. Introduced in.

[0088] The update gate of GRU determines how much of the hidden state of the current time step comes from the hidden state of the previous time step and how much comes from the candidate hidden state of the current time step. Its role is similar to the selective memory and forgetting mechanism, which determines the degree of information retention and the introduction of new information.

[0089]

[0090] In the above formula, reset gate Controls the influence of the previous time step hidden state on the current candidate hidden state. The candidate hidden state is the potential new state at the current time step, which combines the current input and the hidden state of the previous time step after the reset gate , represents the Sigmoid activation function, represents the weight matrix, Represents the bias term, the reset gate in GRU The closer the value of is to 0, the hidden state of the previous time step is The smaller the impact on the current candidate hidden state, The closer the value of is to 1, the greater the influence of the hidden state in the previous time step on the current candidate hidden state.

[0091] In the present invention, the GRU module is an existing module, and the key of this application lies in the setting of its parameters, so this application will not introduce the framework structure of the module in detail.

[0092] like Figure 2 As shown, in this embodiment, the specific steps for training the above-mentioned ConvGRU lightweight model are as follows:

[0093] Step 1. Obtain a public dataset, clean the data, preprocess the data, normalize it, and convert it into labeled color images;

[0094] Step 1.1. Obtain the public Car-Hacking dataset, which is generated by transmitting CAN packets to the CAN bus of a real vehicle, including CAN packets collected from the OBD-II port;

[0095] Step 1.2. Clean the raw data, including extracting specific columns of the data and adding field names, filling missing values ​​of the data, converting the hexadecimal data into decimal, and setting labels;

[0096] Specifically, for abnormal data volume, specific columns 1, 3, 4, 5, 6, 7, 8, 9, 10, 11 in the original data are read as data features, and the corresponding columns are added with field names 'CAN_ID', 'Data[0]', 'Data[1]', 'Data[2]', 'Data[3]', 'Data[4]', 'Data[5]', 'Data[6]', 'Data[7]', 'Label' to indicate the meaning of each column; for normal data flow, specific columns 2, 4, 5,6, 7, 8, 9, 10, 11 in the original data are read as data features, and the corresponding columns are added with field names 'CAN_ID', 'Data[0]', 'Data[1]', 'Data[2]', 'Data[3]', 'Data[4]', 'Data[5]', 'Data[6]', 'Data[7]', and add a column named Label at the end of the data frame and set all its values ​​to 'R'; then fill in the default values ​​of missing values; use '0000' and '00' for the CAN_ID and Data columns, and 'R' for the Label column, and then replace all entries with the value 'R' in the Data column with '00' to ensure the uniformity and consistency of the data. Next, convert the hexadecimal strings in all columns to decimal integers for numerical calculation and analysis; finally, distinguish the normal data stream from the remaining four abnormal data streams and set the corresponding labels; among them, the four abnormal data are service denial attack (DoS), fuzzy attack (Fuzzy), random access memory spoofing attack (RAM-Spoofing), gear spoofing attack (Gear-Spoofing);

[0097] Step 1.3. Randomly extract part of the data from each type of traffic data;

[0098] Specifically, the data cleaned in step 1.2 has distinguished normal data from the remaining four abnormal data flows. Due to the large amount of data, 5% of the data in each type of traffic is randomly extracted and the extracted data is saved for subsequent use.

[0099] Step 1.4. Data preprocessing: normalize the data and then scale it to [0,255].

[0100] Since the pixel value range of the image is [0,255], the data needs to be normalized before converting it into a color image. The present invention uses quantile normalization, which converts the feature distribution into a normal distribution and recalculates all feature values ​​according to the normal distribution so that most variable values ​​are close to the median. This method is very effective in dealing with outliers because it can reduce the impact of extreme values ​​on data distribution, ensure that the data is more uniform and stable in the standardized feature space, and then scale it to [0,255] after normalization;

[0101] The main calculation steps of quantile normalization are as follows:

[0102] Step 1.4.1. Calculate the position of the data points: ,in It is a data point In the feature column Position ranking in

[0103] Step 1.4.2. Calculate quantiles: , quantile Represents data points In the feature column The relative position in , where m is the total number of samples in the feature column;

[0104] Step 1.4.3. Map quantiles to normal distribution: , the quantile Convert to the corresponding value in the standard normal distribution ,in represents the inverse of the standard normal distribution;

[0105] Step 1.4.4. Scale the result to [0,255]: ; For data points Normalized and scaled values;

[0106] Step 1.5. After data normalization, classify the data and convert it into color image form;

[0107] For the vehicle CAN information, since it contains 9 important features (CAN ID and DATA[0]-DATA[7]), the 9 features of 27 consecutive samples (a total of 27*9=243 feature values) can be converted into an image with a shape of 9*9*3. In this way, each converted image is a square color image with three channels of red, green, and blue, and the obtained normal data images and abnormal data images (a total of five categories are normal data, DoS, Fuzzy, RAM-Spoofing, Gear-Spoofing) are saved in the corresponding files.

[0108] Step 2. Pass the data obtained after processing in step 1 into the built ConvGRU lightweight model, train the ConvGRU lightweight model, and find the hyperparameters and weights suitable for the ConvGRU lightweight model;

[0109] Step 2.1. Divide the data set obtained in step 1 into training set, validation set, and test set in a ratio of 7:2:1;

[0110] Step 2.2. Before the model starts training, the color image dataset obtained in step 1 is normalized and standardized;

[0111] Normalization: Since the original pixel range is [0,255], the normalization formula is:

[0112]

[0113] in, normalized_pixel It is the normalized pixel value, pixel is the original image pixel value, and 255 is the maximum pixel value.

[0114] Then, normalize the normalized data:

[0115]

[0116] in, standardized_pixel Refers to the pixel value of the image after normalization. normalized_ pixel is the normalized pixel value, mean is the mean of the data, and std is the standard deviation of the data.

[0117] In the present invention, mean and std are both [0.5, 0.5, 0.5], that is, for each channel (R, G, B), 0.5 is subtracted from the pixel value and then divided by 0.5, and the pixel value in the range of [0, 1] is converted to the pixel value in the range of [-1, 1]. This helps to unify the pixel values ​​of different images into a standard range and make the model training more stable.

[0118] Step 2.3. Put the obtained data into the built ConvGRU lightweight model, and use a validation data set to determine the best hyperparameters of the model. According to the changes in the loss value and the precision value during the cross-validation process, the epoch is set to 15 to avoid overfitting. The training hyperparameters are set as follows:

[0119] Table 1 Hyperparameter settings

[0120] Hyperparameters for training Numeric Learning Rate 0.0001 Loss Function Sparse Categorical Cross Entropy Optimizer Adam Optimizer Batch size 32 Training round (epoch) 15

[0121] As shown in the above table, the settings of hyperparameters in the model training process are shown; among them, the loss function of the present invention adopts the sparse classification cross entropy loss function:

[0122]

[0123] Where N is the total number of samples, is the true category of the model for the i-th sample The prediction probability of , which saves memory and computing resources and improves classification efficiency by avoiding one-hot encoding.

[0124] Step 2.4. After obtaining the hyperparameters of the model, use 5-fold cross-validation to randomly divide the data set into 5 folds of equal size. Each fold is used as an independent data subset. The accuracy and loss value of the model in each validation are recorded, and the average performance index of all 5 validations is calculated to obtain a comprehensive evaluation result of the model and verify the optimality of the hyperparameters.

[0125] During the model training process, the present invention continuously optimizes and evaluates the performance of the model to determine the optimal weights, and then saves these weights to a specified path for subsequent use.

[0126] In this embodiment, the trained ConvGRU lightweight model is predicted and evaluated, and the evaluation indicators are set as accuracy, precision, recall rate, and F1-score, respectively. The calculation formula is as follows:

[0127] ;

[0128] ;

[0129] ;

[0130] ;

[0131] Among them, TP represents the number of positive samples (normal data) correctly predicted by the model, TN represents the number of negative samples (abnormal data) correctly predicted by the model, FP represents the number of negative samples incorrectly predicted as positive samples by the model, and FN represents the number of positive samples incorrectly predicted as negative samples by the model.

[0132] The present invention also tests the accuracy, precision, recall rate, and F1 score of P-LeNet (a public model of Deep transfer learningbased intrusion detection system for electric vehicular networks), KNN (nearest neighbor algorithm), SVM (support vector machine), DCNN (deep convolutional neural network), and CANet (a public model of An unsupervised intrusion detection system for high dimensional CAN bus data) on the Car-hacking dataset. The results are shown in the table below.

[0133] Table 2 Experimental results of each model on Car-hacking

[0134] Model Accuracy Recall Accuracy F1 score ConvGRU(Ours) 1.0000 1.0000 1.0000 1.0000 P-LeNet 0.9810 0.9804 0.9814 0.9783 KNN 0.9741 0.9673 0.9632 0.9344 SVM 0.9650 0.9580 0.9570 0.9337 DCNN 0.9993 0.9984 0.9984 0.9991 CANet 0.9875 0.9875 0.9909 0.9889

[0135] Results: The ConvGRU lightweight model of the present invention has an accuracy, precision, recall rate, and F1-score of 1, and the model performs well. The accuracy is 0.0190, 0.0259, 0.0350, 0.0007, and 0.0125 higher than P-LeNet, KNN, SVM, DCNN, and CANet, respectively. The F1 score is 0.0217, 0.0656, 0.0663, 0.0009, and 0.0111 higher than P-LeNet, KNN, SVM, DCNN, and CANet, respectively. Figure 3 The obtained confusion matrix further proves that the ConvGRU lightweight model of the present invention has an excellent ability to distinguish various attack categories.

[0136] In addition, the present invention also evaluates the CPU occupancy, number of parameters, parameter memory, throughput and average processing time of the ConvGRU lightweight model, and the results are shown in the following table:

[0137] Table 3 ConvGRU lightweight model performance evaluation results

[0138] CPU usage (percentage) Number of parameters Memory size occupied (MB) Throughput (samples / s) Average processing time (ms) 10.71% 147434 0.75 15775.60 2.1

[0139] It can be seen from Table 3 that the ConvGRU lightweight model of the present invention shows excellent performance indicators during the evaluation process: the CPU occupancy rate is 10.71%, and the memory usage is only 0.75MB, showing low resource consumption; the throughput of the model reaches 15775.60 samples / second, and the average batch processing time is 2.1 milliseconds, reflecting efficient processing capabilities and fast response speed.

[0140] Example 2

[0141] This embodiment provides a lightweight vehicle network intrusion detection method based on shallow CNN and GRU, and the method includes the following steps:

[0142] Step 1. Receive CAN traffic data in real time;

[0143] Step 2. Preprocess the CAN traffic data, normalize it and convert it into a color image;

[0144] Step 3. Input the converted color image into the ConvGRU lightweight model (lightweight vehicle network intrusion detection system based on shallow CNN and GRU) trained in Example 1;

[0145] Step 4. The trained ConvGRU lightweight model (a lightweight vehicle network intrusion detection system based on shallow CNN and GRU) identifies and classifies the CAN traffic data received in real time and outputs the classification results;

[0146] Step 5. Based on the classification results, determine the intrusion detection results.

[0147] The present invention also provides an electronic device, comprising: one or more processors and a memory; wherein the memory is used to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the lightweight vehicle network intrusion detection method based on shallow CNN and GRU described in Example 2.

[0148] The present invention also provides a computer-readable medium having a computer program stored thereon, and when the computer program is executed by a processor, the lightweight vehicle network intrusion detection method based on shallow CNN and GRU described in Example 2 is implemented.

[0149] Those skilled in the art will appreciate that all or part of the functions of the various methods / modules in the above embodiments may be implemented by hardware or by computer programs. When all or part of the functions in the above embodiments are implemented by computer programs, the program may be stored in a computer-readable storage medium, which may include: a read-only memory, a random access memory, a disk, an optical disk, a hard disk, etc. The program is executed by a computer to implement the above functions. For example, the program is stored in the memory of the device, and when the program in the memory is executed by the processor, all or part of the above functions can be implemented.

[0150] In addition, when all or part of the functions in the above-mentioned embodiments are implemented by means of a computer program, the program can also be stored in a storage medium such as a server, another computer, a disk, an optical disk, a flash drive or a mobile hard disk, and saved to the memory of a local device by downloading or copying, or the system of the local device is updated. When the program in the memory is executed by the processor, all or part of the functions in the above-mentioned embodiments can be implemented.

[0151] The above specific examples are used to illustrate the present invention, which is only used to help understand the present invention and is not intended to limit the present invention. For those skilled in the art of the present invention, according to the idea of ​​the present invention, some simple deductions, deformations or substitutions can be made. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A lightweight vehicle network intrusion detection system based on shallow CNN and GRU, It is characterized in that The detection system is obtained by training a ConvGRU lightweight model, wherein the ConvGRU lightweight model includes a shallow CNN model, a GRU model, and a fusion module; The shallow CNN model includes a first point-by-point convolution layer, a first DW convolution layer, a second point-by-point convolution layer, a second DW convolution layer, a third point-by-point convolution layer, a third DW convolution layer, a convolution layer, an average pooling layer, and a first fully connected layer, which are arranged in sequence; The first point-by-point convolution layer, the second point-by-point convolution layer, and the third point-by-point convolution layer all use 1*1 point-by-point convolution with a step size of 1. The first point-by-point convolution layer uses batch normalization and ReLU activation function after the convolution operation, and the second and third point-by-point convolution layers perform batch normalization after the convolution operation. The convolution kernel size of the first DW convolution layer, the second DW convolution layer, and the third DW convolution layer are all 3*3, the step size is 2, the groups parameter is set to the number of input channels, and batch normalization and ReLU activation function are used after the convolution operation; The convolution kernel size of the convolution layer is 3*3, the step size is 1, the groups parameter is set to 1, batch normalization is used after convolution, and the output channel number is 2*2 features with 64 channels, and then the average pooling layer, the first fully connected layer and finally flattened output are obtained to obtain the result logit value x about the spatial feature; The GRU model includes a data conversion module, a GRU module, and a second fully connected layer; wherein the data conversion module is used to convert the feature map x from its original shape into a tensor to match the input requirements of the GRU module, and the tensor converted by the data conversion module is input into the GRU module; The number of stacked GRU layers num_layers in the GRU module is set to 2, the feature dimension hidden_size of the hidden state of each time step of the GRU is set to 32, and the Dropout rate is set to 0.5; The second fully connected layer is used to flatten the multidimensional tensor obtained by the GRU module, decode the hidden state of the last time step, and obtain the result logit value y about the time characteristic; The fusion module is used to perform weighted average calculation on the output x of the first fully connected layer and the output y of the second fully connected layer, and finally obtain the output result z.

2. According to claim 1, a lightweight vehicle network intrusion detection system based on shallow CNN and GRU, It is characterized in that When the fusion module fuses the output x of the first fully connected layer and the output y of the second fully connected layer, the weights of both are 0.5, and the fused feature z=0.5x+0.5y.

3. According to claim 2, a lightweight vehicle network intrusion detection system based on shallow CNN and GRU, It is characterized in that The specific steps for training the ConvGRU lightweight model are: Step 1. Obtain a public dataset, clean the data, preprocess the data, normalize it, and convert it into labeled color images; Step 2. Pass the data processed in step 1 into the built ConvGRU lightweight model, train the ConvGRU lightweight model, and find the hyperparameters and weights suitable for the ConvGRU lightweight model.

4. According to claim 3, a lightweight vehicle network intrusion detection system based on shallow CNN and GRU, It is characterized in that The specific steps of step 1 are as follows: Step 1.

1. Obtain the public Car-Hacking dataset; Step 1.

2. Clean the raw data, including extracting specific columns of the data and adding field names, filling missing values ​​of the data, converting the hexadecimal data into decimal, and setting labels; Step 1.

3. Randomly extract part of the data from each type of traffic data; Step 1.

4. Normalize the data and then scale it to [0,255]; Step 1.

5. After data normalization, the data is classified and converted into color image form.

5. According to claim 3, a lightweight vehicle network intrusion detection system based on shallow CNN and GRU, It is characterized in that The specific steps of step 2 are: Step 2.

1. Divide the data set obtained in step 1 into training set, validation set, and test set in a ratio of 7:2:1; Step 2.

2. Before the model starts training, the color image dataset obtained in step 1 is normalized and standardized; Step 2.

3. Put the obtained data into the built ConvGRU lightweight model, and use a validation data set to determine the optimal hyperparameters of the model. The training optimizer is the Adam optimizer, and the loss function is the sparse classification cross entropy loss function. According to the changes in the loss value and the exact value during the cross-validation process, the training rounds are set to 15, the learning rate is set to 0.0001, and the batch size is 32; Step 2.

4. After obtaining the hyperparameters of the model, use 5-fold cross-validation to verify the optimality of the hyperparameters. By continuously optimizing and evaluating the performance of the model, determine the optimal weights, and then save the optimal weights to the specified path.

6. A lightweight vehicle network intrusion detection system based on shallow CNN and GRU according to claim 4, It is characterized in that The specific steps of step 1.2 are as follows: for abnormal data volume, read specific columns 1, 3, 4, 5,6, 7, 8, 9, 10, 11 in the original data as data features, and add field names 'CAN_ID', 'Data[0]', 'Data[1]', 'Data[2]', 'Data[3]', 'Data[4]', 'Data[5]', 'Data[6]', 'Data[7]', 'Label' to the corresponding columns to indicate the meaning of each column; for normal data flow, read specific columns 2, 4, 5, 6, 7, 8, 9, 10, 11 in the original data as data features, and add field names 'CAN_ID', 'Data[0]', 'Data[1]', 'Data[2]', 'Data[3]', 'Data[4]', 'Data[5]', 'Data[6]', 'Data[7]', 'Label' to the corresponding columns. 'Data[6]', 'Data[7]', and add a column named Label at the end of the data frame and set all its values ​​to 'R'; then fill in the default values ​​of missing values; use '0000' and '00' for the CAN_ID and Data columns, and 'R' for the Label column, and then replace all entries with the value 'R' in the Data column with '00', then convert the hexadecimal strings in all columns to decimal integers, and finally distinguish the normal data stream from the remaining four abnormal data streams and set the corresponding labels; among them, the four abnormal data streams are DoS, Fuzzy, RAM-Spoofing, and Gear-Spoofing.

7. According to claim 4, a lightweight vehicle network intrusion detection system based on shallow CNN and GRU, It is characterized in that When normalizing the data in step 1.4, quantile normalization is used.

8. According to claim 5, a lightweight vehicle network intrusion detection system based on shallow CNN and GRU, It is characterized in that Step 2.2 The normalization and standardization processing formula is as follows: The normalization formula is: ; in, normalized_pixel is the normalized pixel value, pixel is the original image pixel value, and 255 is the maximum pixel value; The formula for normalizing the normalized data is: ; in, standardized_pixel Refers to the pixel value of the image after normalization. normalized_ pixel is the normalized pixel value, mean is the mean of the data, std is the standard deviation of the data, and both mean and std are [0.5, 0.5, 0.5].

9. A lightweight vehicle network intrusion detection method based on shallow CNN and GRU, It is characterized in that The method comprises the following steps: Step 1. Receive CAN traffic data in real time; Step 2. Preprocess the CAN traffic data, normalize it and convert it into a color image; Step 3. Input the converted color image into the lightweight vehicle network intrusion detection system based on shallow CNN and GRU according to any one of claims 1 to 8; Step 4. The lightweight vehicle network intrusion detection system based on shallow CNN and GRU identifies and classifies the CAN traffic data received in real time and outputs the classification results; Step 5. Based on the classification results, determine the intrusion detection results.

Images