A deep learning-based method for detecting abnormalities in vehicle networks of intelligent connected vehicles

Abstract

The present invention provides a method for detecting abnormalities in an on-board network of an intelligent connected vehicle based on deep learning. The method comprises: obtaining a message time series of each ECU in the on-board network within a preset time window before time step t; obtaining a network state time series of the on-board network within a preset time window before time step t; inputting the message time series to an LSTM prediction network to obtain a predicted message of the ECU corresponding to the message time series at time step t; inputting the network state time series to a ConvLSTM prediction network to obtain a predicted network state of the on-board network at time step t; fusing the predicted network state and the predicted messages of all ECUs to obtain a fused network state at time step t; calculating a prediction error based on the fused network state and the actual network state; inputting the prediction error to a Gaussian naive Bayes classifier to obtain an abnormality detection result at step t. The present invention can improve the accuracy of on-board network abnormality detection.

Description

Technical Field

[0001] The present invention relates to the field of vehicle network security technology, and in particular to a method for detecting vehicle network anomalies in an intelligent connected vehicle based on deep learning. Background Art

[0002] The in-vehicle network intrusion detection system (IDS) is a system designed to protect the internal network of the vehicle (such as the controller area network, CAN) from security threats. With the development of automotive technology, especially the rise of autonomous driving and intelligent connected vehicles, the vehicle network is facing various network attacks, such as deception, tampering and denial of service. IDS systems prevent these attacks by monitoring network traffic and analyzing data packets to identify abnormal behavior.

[0003] The in-vehicle network anomaly detection method based on deep learning is an innovative development in this field. Deep learning algorithms are used to learn and identify normal network activity patterns, and detect unusual behaviors that may indicate intrusion attempts. This method is particularly suitable for dealing with highly complex and ever-changing network environments, such as intelligent connected vehicle network systems. These in-vehicle network anomaly detection methods can adapt to new threats because they can continuously update and optimize detection models based on new data, but most network anomaly detection methods have low accuracy.

[0004] For example, the Chinese patent document with publication number CN112787984A in the prior art discloses a method and system for detecting vehicle network anomalies based on correlation analysis. The method first collects communication data during vehicle driving, uses the established prediction model to predict the message value of the corresponding byte sequence, and judges whether the deviation between the predicted message value and the actual message value exceeds the detection threshold. If it exceeds, it is judged that the message is abnormal. Among them, the message data in each correlation group is trained with an LSTM neural network according to the time series, and a prediction model for each correlation group is established. Although this method can detect malicious data injection attacks that do not conform to the normal driving state of the vehicle in real time. However, the patent is based on threshold detection, relying on preset standards to determine when anomalies occur, and cannot accurately identify subtle deviations, which may lead to the neglect of subtle anomalies, and requires manual intervention to adjust the threshold to adapt to the ever-changing network environment and attack mode. In addition, it uses the LTSM neural network to only extract the time-dependent characteristics of the message data time series, ignoring the spatiotemporal dependence characteristics between multiple ECUs (car computers, i.e., computer control modules, electronic control units) in the vehicle network, resulting in the accuracy of its network anomaly detection results still needs to be improved. Summary of the invention

[0005] The present invention aims to at least solve the technical problem that the accuracy of network anomaly detection results of existing vehicle network anomaly detection technologies is insufficient, and provide a method for detecting anomalies in vehicle networks of intelligent connected vehicles based on deep learning.

[0006] In order to achieve the above-mentioned purpose of the present invention, according to the first aspect of the present invention, the present invention provides a method for detecting anomalies in a vehicle network of an intelligent connected vehicle based on deep learning, comprising: obtaining a message time series of each ECU in the vehicle network within a preset time window before time step t; obtaining a network state time series of the vehicle network within a preset time window before time step t, and an actual network state of time step t; t is a positive integer; inputting the message time series to an LSTM prediction network to obtain a predicted message of the ECU corresponding to the message time series at time step t; inputting the network state time series to a ConvLSTM prediction network to obtain a predicted network state of the vehicle network at time step t; fusing the predicted network state and the predicted messages of all ECUs to obtain a fused network state of time step t; calculating a prediction error based on the fused network state and the actual network state; inputting the prediction error to a Gaussian naive Bayes classifier to obtain an anomaly detection result of step t.

[0007] In order to achieve the above-mentioned purpose of the present invention, according to the second aspect of the present invention, the present invention provides an intelligent connected vehicle vehicle network anomaly detection device based on deep learning, which is used to implement an intelligent connected vehicle vehicle network anomaly detection method based on deep learning described in the first aspect of the present invention, including: a data acquisition module, used to obtain the message time series of each ECU in the vehicle network within a preset time window before time step t; also used to obtain the network state time series of the vehicle network within the preset time window before time step t, and the actual network state of time step t; t is a positive integer; an LSTM prediction module, inputting the message time series to the LSTM prediction network to obtain the predicted message of the ECU corresponding to the message time series at time step t; a ConvLSTM prediction module, inputting the network state time series to the ConvLSTM prediction network to obtain the predicted network state of the vehicle network at time step t; a fusion module, fusing the predicted network state and the predicted messages of all ECUs to obtain the fused network state of time step t; a prediction error calculation module, calculating the prediction error based on the fused network state and the actual network state; a classification module, inputting the prediction error to a Gaussian naive Bayes classifier to obtain an anomaly detection result of step t.

[0008] In order to achieve the above-mentioned purpose of the present invention, according to the third aspect of the present invention, the present invention provides an intelligent connected vehicle, which is provided with an on-board network, and the deep learning-based on-board network anomaly detection device for an intelligent connected vehicle as described in the second aspect of the present invention connected to the on-board network.

[0009] In order to achieve the above-mentioned purpose of the present invention, according to the fourth aspect of the present invention, the present invention provides a computer program product, including a computer program / instructions, characterized in that when the computer program / instructions are executed by a processor, the steps of the method described in the first aspect of the present invention are implemented.

[0010] In order to achieve the above-mentioned purpose of the present invention, according to the fifth aspect of the present invention, the present invention provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for detecting anomalies in the in-vehicle network of an intelligent connected vehicle based on deep learning as described in the first aspect of the present invention.

[0011] The present invention integrates an LSTM prediction network and a ConvLSTM prediction network, uses the LSTM prediction network to capture the temporal dependency of a single ECU message time series, and outputs the prediction information of each ECU at a time step t; uses the ConvLSTM prediction network to capture the complex interactions and dependencies between ECUs from the network state time series, so as to obtain the predicted network state of the vehicle network at a time step t; obtains the fused network state by fusing the prediction information and the predicted network state of all ECUs, improves the prediction accuracy of the fused network state, and further improves the accuracy of anomaly detection; calculates the prediction error by fusing the network state and the actual network state, inputs the prediction error into a Gaussian naive Bayes classifier, and obtains the anomaly detection result of the vehicle network at a step t. The present invention improves the detection capability of subtle anomalies by introducing a Gaussian naive Bayes classifier. Compared with the traditional threshold method, this probability-based method can provide more sophisticated classification decisions when processing prediction errors, and automatically adjusts the classification threshold by learning the probability distribution of normal and abnormal behaviors, can adapt to dynamically changing network environments, and also enhances the anomaly classification capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a flowchart of a method for detecting abnormality in an on-board network of an intelligent connected vehicle based on deep learning in a preferred embodiment of the present invention;

[0013] Figure 2 It is a flowchart of a method for detecting abnormality in an on-board network of an intelligent connected vehicle based on deep learning in a preferred embodiment of the present invention;

[0014] Figure 3 This is a schematic diagram of the structure of an LSTM unit in a preferred embodiment of the present invention;

[0015] Figure 41D-ConvLSTM is a schematic diagram of a structure of a preferred embodiment of the present invention;

[0016] Figure 5 It is a schematic structural diagram of an electronic device in a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0017] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

[0018] In the description of the present invention, it is necessary to understand that the terms "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0019] In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installed", "connected" and "connected" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

[0020] The present invention discloses a method for detecting anomalies in the vehicle network of an intelligent connected vehicle based on deep learning, and the execution subject of the method includes but is not limited to at least one of a server, a terminal, etc. In other words, the method for detecting anomalies in the vehicle network of an intelligent connected vehicle based on deep learning can be executed by software or hardware installed on a terminal device or a server device. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. The server can be an independent server, or it can be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms.

[0021] In a preferred implementation manner, the method for detecting abnormality in an intelligent connected vehicle vehicle network based on deep learning provided by the present invention is as follows: Figure 1 and Figure 2 As shown, including:

[0022] Step S1, obtaining the message time sequence of each ECU in the vehicle network within a preset time window before the time step t;

[0023] Get the network status time series of the vehicle network in the preset time window before time step t, and the actual network status at time step t; t is a positive integer.

[0024] In this embodiment, the vehicle network is preferably but not limited to a CAN network. The vehicle network includes multiple ECUs that communicate using the CAN protocol, and each ECU is assigned a CAN ID. The user can set a preset time window according to needs or experience. The time length can be represented by lookback, and the preset time window includes time steps t-1, t-2, ..., t-lookback. The message time sequence of a certain ECU in the preset time window before time step t represents the time sequence composed of the messages of the ECU at each time step in the preset time window. The messages include multiple dimensional features. Specifically, the messages are not limited to the dimensional features including the timestamp, CAN ID, payload data, etc. of the ECU at each time step. Therefore, the message time sequence of a certain ECU in the preset time window before time step t can be expressed as:

[0025] X LSTM =[x t-lookback ,…,x t-2 ,x t-1 ]

[0026] Among them, x t-lookback ,…,x t-2 ,x t-1 They respectively represent the messages of the ECU at time steps t-lookback, ..., t-1, and t-2.

[0027] In this embodiment, the vehicle network has a network state at each time step, and the network state is a two-dimensional data matrix, wherein each row of the two-dimensional data matrix is ​​mapped to an ECU, and all column elements of each row constitute a message of an ECU at the time step, and each column is mapped to the dimensional feature of a message. Therefore, the network state time series of the vehicle network in the preset time window before the time step t can be expressed as:

[0028] X ConvLSTM =[X t-lookback ,…,X t-2 ,X t-1 ]

[0029] Among them, X t-lookback ,…,X t-2 ,Xt-1 They respectively represent the network status of the vehicle network at time steps t-lookback, ..., t-1, and t-2.

[0030] In this embodiment, in order to facilitate the execution of the subsequent step S2 and ensure the consistency and standardization of the data, preferably, before executing step S2, in step S1, it also includes preprocessing the acquired message time series, network status time series, and characteristic data in the actual network status of time step t. The preprocessing includes a normalization processing step and a data length control step. Preferably, the minimum-maximum normalization method is used in the normalization processing step to normalize the characteristic data to between 0 and 1. The data length control step is the data length control in the message (such as CAN). For key fields such as eight-byte payload data, frames with a data code length (Data Length Code, DLC) less than 8 are filled with 0 to make their length 8 bytes. Step S2, input the message time series into the LSTM prediction network to obtain the predicted message of the ECU corresponding to the message time series at time step t;

[0031] Input the network status time series into the ConvLSTM prediction network to obtain the predicted network status of the vehicle network at time step t.

[0032] Step S3, fusing the predicted network state and the predicted messages of all ECUs to obtain the fused network state of time step t.

[0033] Step S4, calculating the prediction error based on the fused network state and the actual network state.

[0034] Preferably, the Huber loss function is used to calculate the prediction error:

[0035]

[0036] Among them, X t represents the actual network state at time step t, represents the fusion network state at time step t, and δ represents the preset threshold of the control smoothing range.

[0037] In this embodiment, the LSTM prediction network and the ConvLSTM prediction network are trained in advance using normal vehicle network data, so that the LSTM prediction network and the ConvLSTM prediction network can well learn the deep-level features of the normal vehicle network data, and the output prediction information and predicted network state are close to the normal vehicle network data. The prediction error indicates the degree of match between the fused network state obtained based on the prediction network and the actual network state at the current time step t. Since the LSTM prediction network and the ConvLSTM prediction network are trained based on normal vehicle network data, the prediction error is often close to zero for messages that are not modified at time step t, that is, when it is normal, and for manipulated messages, that is, when the attack is abnormal, the prediction error is often relatively high.

[0038] Step S5, input the prediction error to the Gaussian Naive Bayes classifier to obtain the anomaly detection result with a step length of t.

[0039] In this embodiment, preferably, the abnormal detection result includes multiple prediction categories and confidence probabilities corresponding to each prediction category, and the multiple prediction categories include normal and one or more attack categories. The attack categories preferably include, but are not limited to, denial of service attacks, fuzzy attacks, gear deception, and speed deception.

[0040] In this embodiment, the present invention further uses Gaussian Naive Bayes (GNB) classifier to distinguish normal and abnormal messages, taking the prediction error as the feature. The GNB classifier assumes that the feature follows a Gaussian distribution in each category, and calculates the confidence probability of belonging to each category for a given time step, and selects the category with the highest confidence probability as the predicted category. Given the category label y and the prediction deviation vector H: H1, ···, H n n represents the number of features of the prediction deviation vector, H n Representing the prediction bias of the nth feature of the network state, Bayes’ theorem is stated as:

[0041]

[0042] Among them, p(y|H1,···,H n ) is achieved by considering the prediction deviation characteristics of the network state H1,···,H n , as well as p(y) and p(H1,···,H n ) as the prior probability of category y. p(H1,···,H n ) represents the prediction deviation vector H1,···,H n The probability of occurrence, p(y) represents the probability of category y occurring, p(H1,···,H n |y) represents the prediction deviation vector H1,···,H under category y nThe probability of occurrence, assuming that the characteristic conditions are independent, the formula can be simplified to:

[0043]

[0044] p(H1,···,H n ) is constant, so it is omitted in the comparison. After calculating the posterior probabilities of all possible classes based on the prior likelihood derived from the given dataset, the class label assignment formula is:

[0045]

[0046] in, is the prediction bias vector H = [H1, ···, H n ]’s prediction class.

[0047] Gaussian Naive Bayes is an extension of the Naive Bayes classifier, assuming that the real-valued input data features have a Gaussian distribution with different parameters in different categories. Each category y is defined with mean and standard deviation parameters, and μy and σy are used to represent the mean and standard deviation of the feature values ​​in the prediction deviation vector corresponding to category y, respectively. The category conditional prior probability can be calculated as:

[0048]

[0049] The GNB classifier module makes the final decision of predicting the deviation vector at time step t. It calculates the confidence probability of the data belonging to normal or multiple attack classes and selects the class with higher confidence probability as the reported class.

[0050] In this embodiment, by integrating the LSTM prediction network and the ConvLSTM prediction network, the spatiotemporal data patterns in the vehicle network can be effectively captured and analyzed, and abnormal data that deviates from the normal behavior pattern can be accurately identified, thereby significantly improving the detection capabilities of complex network attacks and faults. At the same time, the Gaussian Naive Bayes classifier is used to process the prediction error, making the present invention more accurate in distinguishing normal from abnormal data. This method based on statistical probability is superior to traditional fixed thresholds or rule benchmarks, and can maintain a high detection accuracy in a constantly changing network environment.

[0051] In a preferred embodiment, in order to more effectively capture the time dependency of the message time series of each ECU, the LSTM prediction network includes a sequentially connected LSTM unit layer and a first fully connected layer; the LSTM unit layer includes a plurality of cascaded LSTM units, and the neurons of the first fully connected layer correspond to the features in the message. The number of LSTM units is preferably, but not limited to, 32, and the number of neurons in the first fully connected layer is preferably, but not limited to, 9, and each neuron represents an output prediction information feature. The structure of the LSTM unit is as follows: Figure 3As shown. The activation function in the LSTM unit is tanh to account for the nonlinearity of the temporal and long-term dependencies of CAN messages. In order to avoid overfitting problems, it is necessary to keep the network structure as simple as possible and use an early stopping mechanism during training.

[0052] In this embodiment, if Figure 3 As shown in Figure 1, the LSTM unit mainly consists of a memory unit and a gate structure. The gate structure consists of three gates: a forget gate, an update gate, and an output gate. The role of the memory unit is to store long-term information, so that the network can capture and utilize long-term dependencies in the data, thereby effectively processing and predicting important events in time series data. Assume that i t 、f t , o t , C t and h t They represent the update gate, forget gate, output gate, unit state and hidden state at time step t respectively, W is the weight matrix, is the new candidate value, σ and tanh are activation functions, and b is the offset.

[0053] Memory unit formula:

[0054]

[0055] The forget gate determines what information to keep or discard from the cell state.

[0056] Forget gate formula:

[0057] f t =σ(W f ·[h t-1 ,x t ]+b f )

[0058] The Update gate manages updates to the cell state and controls how much new information is retained.

[0059] Update gate formula:

[0060] i t =σ(W i ·[h t-1 ,x t ]+b i )

[0061]

[0062] The output gate determines what information should be output at a given moment.

[0063] Output gate formula:

[0064] o t =σ(Wo [h t-1 ,x t ]+b o )

[0065] h t =o t *tanh(C t )

[0066] In this embodiment, the prediction results output by the LSTM prediction network include not only the prediction message of the ECU at time step t, but also the batch size (i.e., the amount of data used by the LSTM prediction network in each iteration step). The LSTM prediction network optimizes the analysis of the message time series data of the vehicle network ECU. Since the LSTM network is good at processing long-term dependent information, it can accurately capture and predict the behavior pattern of ECU messages in the vehicle communication network over time.

[0067] In a preferred embodiment, in order to more effectively capture the spatial correlation between ECUs in the vehicle network, the ConvLSTM prediction network includes a first 1D-ConvLSTM layer, a second 1D-ConvLSTM layer, a second fully connected layer, and a third fully connected layer connected in sequence.

[0068] In this embodiment, the network structure of the first 1D-ConvLSTM layer and the second 1D-ConvLSTM layer is as follows: Figure 4 As shown, each 1D-ConvLSTM layer has 8 filters of size 5. These 1D-ConvLSTM layers are responsible for extracting historical correlations between ECUs from the network state time series. Similar to LSTM units, the sequence patterns of 1D-ConvLSTM layers are learned through gated structures, each of which controls how much information to keep and forget. Filters are applied in each gate and input data through it. The learned weights in the filters show the correlation in the data of neighboring ECUs. Then the second and third fully connected layers have 16 and 9 neurons, respectively, where the number of neurons in the third fully connected layer corresponds to the number of features to be predicted.

[0069] The output prediction results of the ConvLSTM prediction network include not only the predicted network status, but also the batch size, time step, and number of ECUs. Therefore, it is necessary to aggregate the time step and number of ECUs in the output prediction results of the ConvLSTM prediction network, and the average aggregation method is used. The ConvLSTM prediction network has unique advantages in processing multi-dimensional spatiotemporal data. It not only captures the temporal correlation, but also extracts spatial features through convolution operations, allowing the model to understand the complex interactions and dependencies between ECUs.

[0070] In a preferred embodiment, in order to efficiently fuse the predicted network state and the predicted messages of all ECUs, so that the finally obtained fused network state can more accurately predict the network state of time step t, in step S3, the predicted network state and the predicted messages of all ECUs are fused, including:

[0071] Step S31, concatenating the prediction messages of all ECUs at time step t to obtain the comprehensive prediction message X LSTM The shape of the comprehensive prediction message is the same as that of the network status, both of which are two-dimensional feature matrices, where each row is mapped to an ECU and each column is mapped to a dimensional feature in the ECU message.

[0072] Step S32, obtaining an attention weight array through an attention mechanism, wherein the attention weight array includes an attention weight a1 for comprehensively predicting the message and an attention weight a2 for predicting the network state.

[0073] Step S33, using the attention weight array to fuse the comprehensive prediction message and the predicted network state X ConvLSTM Get the fused network state at time step t

[0074]

[0075] In this implementation, the prediction results of the two prediction models are combined, which not only enhances the single-dimensional data processing capability, but also realizes cross-dimensional data fusion analysis, which is difficult to achieve in traditional single prediction models. This fusion provides a more comprehensive perspective and deeper insight for detecting anomalies inserted in the network.

[0076] In this embodiment, preferably, obtaining the attention weight array through the attention mechanism in step S32 includes:

[0077] Step S321, merge the comprehensive prediction message and the predicted network status to obtain the merged feature:

[0078] X merged =[X LSTM ;X ConvLSTM ]

[0079] Step S322: Merge feature X merged Input the fourth fully connected layer to obtain the original attention score array, which includes the original attention score of the comprehensive prediction message and the original attention score of the predicted network state. The fourth fully connected layer includes a weight matrix W a and a bias term b a , which is used to extract the key information for calculating attention from the merged features, that is, the original attention score array:

[0080] a0=Wa ·X merged +b a

[0081] Step S323, normalize the original attention score array through the softmax function to obtain the attention weight array a:

[0082] a=softmax(a0)

[0083] a={a1,a2}

[0084] In this embodiment, the LSTM prediction network, the ConvLSTM prediction network, the attention mechanism, and the Gaussian naive Bayes classifier need to be pre-trained. During the training process, the CAN bus public data set and the car hacker data set provided by the Hacker and Countermeasures Research Laboratory (HCRL) are used as training data sets, referred to as HCRL data sets, which are mainly divided into four situations, normal situation, denial of service attack, fuzzy attack and deception attack, among which deception attack is further divided into gear deception and speed deception. These measures may include isolating the affected ECU, notifying the vehicle operator or initiating further security protocols. First, the initial network of the LSTM prediction network, the ConvLSTM prediction network, the attention mechanism, and the Gaussian naive Bayes classifier is constructed, and then the HCRL data set is used to train the initial network of the LSTM prediction network, the ConvLSTM prediction network, the attention mechanism, and the Gaussian naive Bayes classifier, and the Adam optimizer and the Huber loss function are used as the loss function in the training. An early stopping mechanism is set to prevent the model from overfitting.

[0085] The present invention also discloses a deep learning-based intelligent connected vehicle vehicle network anomaly detection device, which is used to implement the deep learning-based intelligent connected vehicle vehicle network anomaly detection method, including:

[0086] The data acquisition module is used to obtain the message time series of each ECU in the vehicle network within the preset time window before the time step t; it is also used to obtain the network state time series of the vehicle network within the preset time window before the time step t, and the actual network state at the time step t; t is a positive integer;

[0087] LSTM prediction module, inputs the message time series into the LSTM prediction network to obtain the prediction message of the ECU corresponding to the message time series at time step t;

[0088] ConvLSTM prediction module, inputs the network status time series to the ConvLSTM prediction network to obtain the predicted network status of the vehicle network at time step t;

[0089] The fusion module fuses the predicted network state and the predicted messages of all ECUs to obtain the fused network state at time step t;

[0090] A prediction error calculation module, which calculates the prediction error based on the fused network state and the actual network state;

[0091] The classification module inputs the prediction error into the Gaussian Naive Bayes classifier to obtain the anomaly detection result with a step length of t.

[0092] In this embodiment, the data acquisition module, LSTM prediction module, ConvLSTM prediction module, fusion module, prediction error calculation module and classification module respectively correspond to steps S1, S2, S3, S4 and S5 of the above-mentioned deep learning-based intelligent connected vehicle on-board network anomaly detection method, and will not be repeated here.

[0093] The present invention also discloses an intelligent network-connected vehicle, which is provided with an on-board network, and the above-mentioned deep learning-based on-board network anomaly detection device for the intelligent network-connected vehicle connected to the on-board network.

[0094] The present invention also discloses a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned deep learning-based intelligent connected vehicle on-board network anomaly detection method provided by the present invention. The computer program product should be understood as a software product that mainly implements its solution through a computer program, such as a program product integrated in the cloud or a software library or a terminal device.

[0095] The present invention also discloses an electronic device. In one embodiment, the electronic device includes at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the deep learning-based intelligent connected vehicle in-vehicle network anomaly detection method provided by the present invention.

[0096] like Figure 5 , which is a schematic diagram of the structure of an electronic device for an intelligent connected vehicle vehicle network anomaly detection method based on deep learning provided by an embodiment of the present invention. The electronic device may include a processor 10, a memory 11, a communication bus 12, and a communication interface 13, and may also include a computer program stored in the memory 11 and executable on the processor 10, such as an intelligent connected vehicle vehicle network anomaly detection method program based on deep learning.

[0097] Among them, the processor 10 can be composed of an integrated circuit in some embodiments, for example, it can be composed of a single packaged integrated circuit, or it can be composed of multiple integrated circuits with the same function or different functions, including one or more central processing units (CPU), microprocessors, digital processing chips, graphics processors and various control chips. The processor 10 is the control core (Control Unit) of the electronic device, which uses various interfaces and lines to connect the various components of the entire electronic device, and executes or executes the program or module stored in the memory 11 (for example, executing the intelligent network-connected vehicle vehicle network anomaly detection method based on deep learning, etc.), and calls the data stored in the memory 11 to execute various functions of the electronic device and process data.

[0098] The memory 11 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a mobile hard disk, a multimedia card, a card-type memory (for example, SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. In some embodiments, the memory 11 may be an internal storage unit of an electronic device, such as a mobile hard disk of the electronic device. In other embodiments, the memory 11 may also be an external storage device of an electronic device, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory 11 may also include both an internal storage unit of the electronic device and an external storage device. The memory 11 can not only be used to store application software and various types of data installed in the electronic device, such as the code of the program of the vehicle-mounted network anomaly detection method of the intelligent networked vehicle based on deep learning, but also can be used to temporarily store data that has been output or is to be output.

[0099] The communication bus 12 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is configured to realize connection and communication between the memory 11 and at least one processor 10, etc.

[0100] The communication interface 13 is used for communication between the above-mentioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a display (Display), an input unit (such as a keyboard (Keyboard)), and optionally, the user interface may also be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface.

[0101] Figure 5 Only an electronic device with components is shown, and those skilled in the art will understand that Figure 5 The structure shown does not constitute a limitation on the electronic device, and may include fewer or more components than shown, or combine certain components, or arrange the components differently. For example, although not shown, the electronic device may also include a power supply (such as a battery) for supplying power to each component. Preferably, the power supply may be logically connected to at least one processor 10 through a power management device, so that functions such as charging management, discharging management, and power consumption management are implemented through the power management device. The power supply may also include any components such as one or more DC or AC power supplies, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, etc. The electronic device may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0102] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited by this structure.

[0103] Furthermore, if the module / unit integrated in the electronic device 1 is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0104] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0105] Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims

1. A method for detecting abnormality in an intelligent connected vehicle vehicle network based on deep learning, characterized in that: include: Get the message time series of each ECU in the vehicle network within the preset time window before time step t; Obtain the network status time series of the vehicle network in the preset time window before time step t, and the actual network status at time step t; t is a positive integer; Input the message time series into the LSTM prediction network to obtain the prediction message of the ECU corresponding to the message time series at time step t; Input the network status time series into the ConvLSTM prediction network to obtain the predicted network status of the vehicle network at time step t; Fusion predicts the network state and the prediction messages of all ECUs to obtain the fused network state at time step t; Calculate prediction error based on fused network state and actual network state; Input the prediction error to the Gaussian Naive Bayes classifier to obtain the anomaly detection result with a step length of t; The ConvLSTM prediction network includes a first 1D-ConvLSTM layer, a second 1D-ConvLSTM layer, a second fully connected layer, and a third fully connected layer connected in sequence; The fusion prediction network status and prediction messages of all ECUs include: The prediction messages of all ECUs of time step t are concatenated to obtain the comprehensive prediction message; Obtaining an attention weight array through an attention mechanism, wherein the attention weight array includes an attention weight for comprehensively predicting a message and an attention weight for predicting a network state; Use the attention weight array to fuse the comprehensive prediction message and the predicted network state to obtain the fused network state of time step t; The step of obtaining the attention weight array through the attention mechanism includes: Merge the comprehensive prediction message and the predicted network state to obtain a merged feature; Input the merged features into the fourth fully connected layer to obtain an original attention score array, wherein the original attention score array includes the original attention score of the comprehensive prediction message and the original attention score of the predicted network state; The original attention score array is normalized by the softmax function to obtain the attention weight array.

2. The method for detecting anomalies in an intelligent connected vehicle vehicle network based on deep learning according to claim 1, characterized in that: The LSTM prediction network includes a sequentially connected LSTM unit layer and a first fully connected layer; The LSTM unit layer includes a plurality of cascaded LSTM units, and the neurons of the first fully connected layer correspond to features in the message.

3. A method for detecting anomalies in an intelligent connected vehicle vehicle network based on deep learning as claimed in claim 1 or 2, characterized in that: The anomaly detection result includes multiple prediction categories and confidence probabilities corresponding to each prediction category, and the multiple prediction categories include normal and one or more attack categories.

4. A deep learning-based intelligent connected vehicle vehicle network anomaly detection device, used to implement a deep learning-based intelligent connected vehicle vehicle network anomaly detection method according to any one of claims 1 to 3, characterized in that: include: A data acquisition module is used to obtain the message time series of each ECU in the vehicle network within a preset time window before the time step t; It is also used to obtain the network status time series of the vehicle network in the preset time window before the time step t, and the actual network status of the time step t; t is a positive integer; LSTM prediction module, inputs the message time series into the LSTM prediction network to obtain the prediction message of the ECU corresponding to the message time series at time step t; ConvLSTM prediction module, inputting the network state time series into the ConvLSTM prediction network to obtain the predicted network state of the vehicle network at time step t; wherein the ConvLSTM prediction network includes a first 1D-ConvLSTM layer, a second 1D-ConvLSTM layer, a second fully connected layer and a third fully connected layer connected in sequence; a fusion module, fusing the predicted network state and the prediction messages of all ECUs to obtain a fused network state at time step t; wherein the fused predicted network state and the prediction messages of all ECUs include: The prediction messages of all ECUs of time step t are concatenated to obtain the comprehensive prediction message; Obtaining an attention weight array through an attention mechanism, wherein the attention weight array includes an attention weight for comprehensively predicting a message and an attention weight for predicting a network state; Use the attention weight array to fuse the comprehensive prediction message and the predicted network state to obtain the fused network state of time step t; The step of obtaining the attention weight array through the attention mechanism includes: Merge the comprehensive prediction message and the predicted network state to obtain a merged feature; Input the merged features into the fourth fully connected layer to obtain an original attention score array, wherein the original attention score array includes the original attention score of the comprehensive prediction message and the original attention score of the predicted network state; Normalize the original attention score array through the softmax function to obtain the attention weight array; A prediction error calculation module, which calculates the prediction error based on the fused network state and the actual network state; The classification module inputs the prediction error into the Gaussian Naive Bayes classifier to obtain the anomaly detection result with a step length of t.

5. An intelligent network-connected vehicle, characterized in that: An on-board network and an anomaly detection device for an on-board network of an intelligent connected vehicle based on deep learning as described in claim 4 are provided, which is connected to the on-board network.

6. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 3 are implemented.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, A memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a method for detecting anomalies in an in-vehicle network of an intelligent connected vehicle based on deep learning as described in any one of claims 1 to 3.

Images