CAN bus flow intrusion detection method based on deep embedded clustering

Abstract

The invention discloses a CAN (Controller Area Network) bus traffic intrusion detection method based on deep embedded clustering, which comprises the following steps of: preprocessing periodically sampled CAN bus data to obtain preprocessed data meeting a basic data format requirement of machine learning, and then, on one hand, carrying out data dimension compression on the preprocessed data by adopting an auto-encoder, and on the other hand, carrying out data dimension compression on the preprocessed data; on the other hand, a membership degree matrix used for representing the membership degree of each piece of data in the preprocessed data and a centroid matrix of a clustering center are constructed based on the number of the pieces of data of the preprocessed data, the membership degree matrix and the centroid matrix are initialized, and then the self-encoder, the membership degree matrix and the centroid matrix are trained; in the training process, an entropy-based embedded fuzzy clustering target function is constructed to serve as a target loss function to constrain the distance from a membership matrix to a centroid matrix and an auto-encoder, a final membership matrix is obtained, and whether intrusion occurs or not is judged; the method has the advantages of high stability and reliability.

Description

Technical Field

[0001] The present invention relates to a CAN bus traffic intrusion detection method, and in particular to a CAN bus traffic intrusion detection method based on deep embedded clustering. Background Art

[0002] At present, the global digital economy is in a stage of rapid development. The continuous integration and penetration of new-generation information and communication technologies into various industries has promoted the rapid growth of emerging industries such as the Internet of Things (IoT), the Internet of Vehicles (IoV), and the Industrial Internet of Things (IIoT). The development of these emerging industries has played a strong role in promoting the digitalization, networking, and intelligentization of traditional industries such as automobiles and transportation. At the same time, with the rise of artificial intelligence technologies such as machine learning and neural networks, it has not only enriched and expanded the development prospects of automobile intelligence and networking, but also provided solid support for the high-quality development of the Internet of Vehicles security industry.

[0003] At present, an average smart connected car has dozens of electronic control units (ECUs), and advanced smart connected cars can even have hundreds of ECUs. Each ECU in a smart connected car controls its corresponding components.

[0004] The network structure of intelligent connected vehicles mainly includes three parts: vehicle network, vehicle self-organizing short-distance communication network and mobile long-distance communication network. Among them, the vehicle network is used to realize the data transmission between the various electronic control units (Electronic Controller Unit, ECU) in the intelligent connected vehicle. The CAN bus is widely used in vehicle networks and is an important underlying control network for intelligent connected vehicles. It is responsible for the data interaction between the electronic control units in the vehicle network and realizes the transmission of the status information and control information of the intelligent connected vehicle. It has a very high reliability and can provide reliable communication quality in complex and harsh working environments. The CAN bus data frame consists of seven fields that support data transmission, namely the start of frame (SOF), arbitration field (CAN ID), control field (DLC), payload (DATA), cyclic redundancy code (CRC), acknowledgement (ACK) and end of frame (EOF).

[0005] The early vehicle network implemented using the CAN bus had a simple structure and did not require data interaction with external networks. It was a relatively closed network with no information security issues. Therefore, the CAN bus was not designed with any information security protection mechanism in mind. Nowadays, the vehicle network has added many interfaces for data interaction with the outside world, making it easy for the vehicle network to become a target of hacker attacks, seriously affecting driving safety.

[0006] Unlike traditional computer network security, the design of information security enhancement for vehicle networks is constrained by cost, network bandwidth, computing resources, and compatibility. The deployment of information security mechanisms in vehicle networks needs to consider the limitations of message real-time and schedulability. In response to the multi-faceted vulnerabilities and potential network threats faced by vehicle networks, people have made great efforts to strengthen their security protection system. Some studies have attempted to enhance the security of the CAN bus protocol by introducing digital signatures based on pairwise symmetric keys. However, digital signatures introduce considerable communication overhead, which is a critical issue considering that the bandwidth of the CAN bus is limited to 500kbps. In addition, in addition to the communication overhead, it is also a considerable challenge to implement these changes in all devices of existing intelligent connected vehicles. Therefore, it is necessary to recognize that in the field of operational and financial constraints, detection methods become a more practical and feasible way to enhance the security of vehicle networks.

[0007] In the existing vehicle network environment, relevant scholars have conducted in-depth research in the field of anomaly detection of known feature attacks, and most of the proposed methods are based on supervised learning models. However, vehicle network attacks are constantly evolving, and it is difficult to effectively exhaust all vehicle network attack behaviors. At the same time, the attack behaviors are diverse and their characteristics are becoming more and more difficult to capture. In the face of endless zero-day attacks, it is not enough to rely solely on labeled data. This idea limits the learning ability of supervised learning models. In order to meet this challenge, people have proposed a CAN bus traffic intrusion detection method based on an unsupervised model. The CAN bus traffic intrusion detection method based on an unsupervised model is to map the CAN bus data frame from high dimension to low dimension through a feature extraction module to obtain low-dimensional features, and cluster the low-dimensional features through a clustering module to obtain a classification result of whether it is abnormal, and judge whether there is an intrusion based on the classification result. However, the existing CAN bus traffic intrusion detection method based on an unsupervised model is limited by the separation training method constrained by traditional thinking, resulting in unstable detection effect; in addition, the learning direction of low-dimensional features is unconstrained, which will also lead to unstable and unreliable detection results. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a CAN bus traffic intrusion detection method based on deep embedded clustering with high stability and reliability.

[0009] The technical solution adopted by the present invention to solve the above technical problems is: a CAN bus traffic intrusion detection method based on deep embedded clustering, by periodically sampling the CAN bus data and preprocessing the periodically sampled CAN bus data to obtain preprocessed data that meets the basic data format requirements of machine learning, so that the autoencoder can learn, and then on the one hand, the autoencoder is used to compress the data dimension of the preprocessed data to obtain low-dimensional feature data, and on the other hand, based on the number of data items in the preprocessed data, a membership matrix for representing the membership of each data item in the preprocessed data and a centroid matrix of the cluster center are respectively constructed, and the membership matrix and the centroid matrix are initialized to obtain The initial value of the membership of each data in the preprocessed data and the initial value of the centroid matrix; then the autoencoder, membership matrix and centroid matrix are trained. During the training process, an entropy-based embedded fuzzy clustering objective function is constructed as the target loss function to constrain the distance from the membership matrix to the centroid matrix and the autoencoder. After training, the final membership matrix is ​​obtained. The data corresponding to the membership value less than 0.5 in the final membership matrix is ​​judged as normal CAN bus data, and the data corresponding to the membership value greater than or equal to 0.5 is judged as abnormal CAN bus data. If there is abnormal CAN bus data in the preprocessed data, it is judged that an intrusion has occurred, otherwise, no intrusion has occurred.

[0010] The specific process of preprocessing the periodically sampled CAN bus data to obtain preprocessed data that meets the basic data format requirements of machine learning is as follows:

[0011] Step 1, record the number of messages included in the CAN bus data sampled in each period as M, where M is an integer greater than or equal to 100, and select the timestamp, CAN ID, data length code DLC and 8-byte data field DATA[0]-DATA[7] in each message;

[0012] Step 2: Update the M messages respectively to obtain M intermediate messages, which are as follows:

[0013] S2.1. Calculate the absolute value of the difference between the timestamp of each message and the previous message, and the absolute value of the difference between the timestamp of the next message, and use the average of the two absolute values ​​to update the timestamp of the message. If the message is the first message sampled in the current sampling period, the timestamp value of the previous message is equal to the timestamp of the message. If the message is the last message sampled in the current sampling period, the timestamp value of the next message is equal to the timestamp of the message.

[0014] S2.2. Divide the 8-byte data field DATA[0]-DATA[7] of each message into 8 blocks. If the 8-byte data field DATA[0]-DATA[7] is less than 8 bytes, divide it into 8 blocks after filling with leading 0. Each block contains two hexadecimal values. Convert the two hexadecimal values ​​of each block into decimal values. At this time, each message is updated. Each updated message is an intermediate message. The timestamp, CAN ID, data length code DLC and 8 blocks of each intermediate message are the features of the intermediate message, that is, each intermediate message has 11 features.

[0015] Step 3: The construction process of preprocessing data is as follows:

[0016] S3.1. From the M intermediate messages, starting from the one with the latest timestamp, construct a message flow of length N for every N intermediate messages until the result is A message stream of length N, where N is 10 or 100. is the rounding down symbol; according to the construction order, the i-th message flow is recorded as In each message flow, each feature of each intermediate message is a feature of the message flow. The number of features of each message flow is recorded as n, n = 11*N. Formula (1) is used to convert Stream(M i ) is expressed as:

[0017] Stream(M i )=M i (t1), M i (t2), M i (t3), …, M i (t n ) (1)

[0018] In formula (1), M i (t a ), is the i-th message stream Stream(M i )’s ath feature, a=1,2,…,n;

[0019] S3.2, calculate the i-th message stream Stream (M i ) is the average value μ of n features n and standard deviation σ n :

[0020]

[0021] S3.3, using formula (4) to obtain the i-th message stream Stream (M i) of the preprocessed data stream Z i :

[0022]

[0023] S3.4, the preprocessed data stream Z1 of the first message stream Stream (M1) to the Kth message stream Stream (M K ) of the preprocessed data stream Z K Construct preprocessed data that meets the basic data format requirements of machine learning,

[0024] The autoencoder, membership matrix and centroid matrix are trained. During the training process, the distance from the membership matrix to the centroid matrix and the autoencoder are constrained by constructing an entropy-based embedded fuzzy clustering objective function as a loss function. After training, the specific process of obtaining the final membership matrix is ​​as follows:

[0025] S3.1 sends the preprocessed data stream Z1 of the first message stream Stream(M1) to the Kth message stream Stream(M K ) of the preprocessed data stream Z K The input autoencoder is constrained and back-propagated using the target loss function of entropy-based embedded fuzzy clustering to update the weight and bias parameters of the autoencoder. After the update is completed, the final membership matrix is ​​obtained, where the target loss function is shown in formula (5):

[0026]

[0027] Where Θ = {W, b, U, C}, W represents the weight of the autoencoder, b represents the bias of the autoencoder, U represents the membership matrix, and C represents the centroid matrix. Expressed as the target loss function The minimum value on Θ, It is represented by the square norm of the distance between two vectors, log is the logarithmic symbol, X i Yes Z i The latent representation of is extracted from the latent space of the autoencoder and is the reconstructed representation of the output, C j represents the centroid of the centroid matrix, c is the number of centroids, generally 2, u ij Represents the element in the i-th row and j-th column of U. The first item represents the reconstruction error (RE), the second term represents the loss of fuzzy clustering, the third term represents the entropy regularization term; the coefficients λ1, λ2, and λ3 are used to weigh the loss terms in the target loss function, where λ1 = [1, 10, 100, 1000, 10000, 100000], λ2 = [0.1, 1, 10, 100], and λ3 = [0.1, 0.01, 0.001, 0.0001]; f(u ij )Use ij Calculated using the softmax function.

[0028] Compared with the prior art, the advantage of the present invention is that by periodically sampling the CAN bus data and preprocessing the periodically sampled CAN bus data, preprocessed data that meets the basic data format requirements of machine learning is obtained so that the autoencoder can learn, and then on the one hand, the autoencoder is used to compress the data dimension of the preprocessed data to obtain low-dimensional feature data, and on the other hand, based on the number of data items in the preprocessed data, a membership matrix for representing the membership of each data item in the preprocessed data and a centroid matrix of the clustering center are respectively constructed, and the membership matrix and the centroid matrix are initialized to obtain the initial value of the membership of each data item in the preprocessed data and the initial value of the centroid matrix; then the autoencoder, the membership matrix and the centroid matrix are trained, and during the training process, an embedded fuzzy clustering objective function based on entropy is constructed to perform The loss function is used to constrain the distance from the membership matrix to the centroid matrix and the autoencoder. After training, the final membership matrix is ​​obtained. The data corresponding to the membership values ​​less than 0.5 in the final membership matrix are judged as normal CAN bus data, and the data corresponding to the membership values ​​greater than or equal to 0.5 are judged as abnormal CAN bus data. If abnormal CAN bus data exists in the preprocessed data, it is judged that an intrusion has occurred, otherwise, no intrusion has occurred. Therefore, the present invention combines the autoencoder with deep clustering, and constructs an entropy-based embedded fuzzy clustering objective function as a target loss function during the training process to constrain the distance from the membership matrix to the centroid matrix and the autoencoder, so as to ensure that the final membership matrix obtained has a high accuracy, and then determines whether an intrusion has occurred based on the final membership matrix, with high stability and reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is a flow chart of the CAN bus traffic intrusion detection method based on deep embedded clustering of the present invention. DETAILED DESCRIPTION

[0030] The present invention is further described in detail below with reference to the accompanying drawings.

[0031] Embodiment 1: Figure 1As shown in the figure, a CAN bus traffic intrusion detection method based on deep embedded clustering is provided. The CAN bus data is periodically sampled and preprocessed to obtain preprocessed data that meets the basic data format requirements of machine learning so that the autoencoder can learn. Then, on the one hand, the autoencoder is used to compress the data dimension of the preprocessed data to obtain low-dimensional feature data. On the other hand, based on the number of data items in the preprocessed data, a membership matrix for representing the membership degree of each data item in the preprocessed data and a centroid matrix of the clustering center are respectively constructed. The membership matrix and the centroid matrix are initialized to obtain each data item in the preprocessed data. The initial value of the membership degree and the initial value of the centroid matrix are obtained; then the autoencoder, membership matrix and centroid matrix are trained. During the training process, an entropy-based embedded fuzzy clustering objective function is constructed as the target loss function to constrain the distance from the membership matrix to the centroid matrix and the autoencoder. After training, the final membership matrix is ​​obtained. The data corresponding to the membership values ​​less than 0.5 in the final membership matrix are judged as normal CAN bus data, and the data corresponding to the membership values ​​greater than or equal to 0.5 are judged as abnormal CAN bus data. If there is abnormal CAN bus data in the preprocessed data, it is judged that an intrusion has occurred, otherwise, no intrusion has occurred.

[0032] In this embodiment, the autoencoder and deep clustering are combined, and an entropy-based embedded fuzzy clustering objective function is constructed during the training process as the target loss function to constrain the distance from the membership matrix to the centroid matrix and the autoencoder, thereby ensuring that the final membership matrix has high accuracy. The intrusion is then determined based on the final membership matrix, with high stability and reliability.

[0033] Embodiment 2: This embodiment is basically the same as Embodiment 1, except that: in this embodiment, the specific process of preprocessing the periodically sampled CAN bus data to obtain preprocessed data that meets the basic data format requirements of machine learning is as follows:

[0034] Step 1, record the number of messages included in the CAN bus data sampled in each period as M, where M is an integer greater than or equal to 100, and select the timestamp, CAN ID, data length code DLC and 8-byte data field DATA[0]-DATA[7] in each message;

[0035] Step 2: Update the M messages respectively to obtain M intermediate messages, which are as follows:

[0036] S2.1. Calculate the absolute value of the difference between the timestamp of each message and the previous message, and the absolute value of the difference between the timestamp of the next message, and use the average of the two absolute values ​​to update the timestamp of the message. If the message is the first message sampled in the current sampling period, the timestamp value of the previous message is equal to the timestamp of the message. If the message is the last message sampled in the current sampling period, the timestamp value of the next message is equal to the timestamp of the message.

[0037] S2.2. Divide the 8-byte data field DATA[0]-DATA[7] of each message into 8 blocks. If the 8-byte data field DATA[0]-DATA[7] is less than 8 bytes, divide it into 8 blocks after filling with leading 0. Each block contains two hexadecimal values. Convert the two hexadecimal values ​​of each block into decimal values. At this time, each message is updated. Each updated message is an intermediate message. The timestamp, CAN ID, data length code DLC and 8 blocks of each intermediate message are the features of the intermediate message, that is, each intermediate message has 11 features.

[0038] Step 3: The construction process of preprocessing data is as follows:

[0039] S3.1. From the M intermediate messages, starting from the one with the latest timestamp, construct a message flow of length N for every N intermediate messages until the result is A message stream of length N, where N is 10 or 100. is the rounding down symbol; according to the construction order, the i-th message flow is recorded as In each message flow, each feature of each intermediate message is a feature of the message flow. The number of features of each message flow is recorded as n, n = 11*N, * is the multiplication operator, and formula (1) is used to convert Stream(M i ) is expressed as:

[0040] Stream(M i )=M i (t1), M i (t2), M i (t3), …, M i (t n ) (1)

[0041] In formula (1), M i (t a ), is the i-th message stream Stream(M i )’s ath feature, a=1,2,…,n;

[0042] S3.2, calculate the i-th message stream Stream (M i ) is the average value μ of n features n and standard deviation σ n :

[0043]

[0044] S3.3, using formula (4) to obtain the i-th message stream Stream (M i ) of the preprocessed data stream Z i :

[0045]

[0046] S3.4, the preprocessed data stream Z1 of the first message stream Stream (M1) to the Kth message stream Stream (M K ) of the preprocessed data stream Z K Construct preprocessed data that meets the basic data format requirements of machine learning,

[0047] In this embodiment, by updating the message to obtain the intermediate message, and then constructing the message stream based on the intermediate message, we can accurately analyze and process the data, so as to better capture the spatiotemporal pattern or abnormal behavior in the intermediate message. This method is particularly suitable for high-frequency data streams on the CAN bus, where thousands of messages may be generated per second. Through the above processing method, the detection requirements of such a large amount of data can be more effectively met, and the real-time and accuracy of the results can be guaranteed.

[0048] Embodiment 3: This embodiment is basically the same as Embodiment 1, except that: in this embodiment, the autoencoder, the membership matrix and the centroid matrix are trained. During the training process, the distance from the membership matrix to the centroid matrix and the autoencoder are constrained by constructing an entropy-based embedded fuzzy clustering objective function as a loss function. After the training, the specific process of obtaining the final membership matrix is ​​as follows:

[0049] S3.1 sends the preprocessed data stream Z1 of the first message stream Stream(M1) to the Kth message stream Stream(M K ) of the preprocessed data stream Z K The input autoencoder is constrained and back-propagated using the target loss function of entropy-based embedded fuzzy clustering to update the weight and bias parameters of the autoencoder. After the update is completed, the final membership matrix is ​​obtained, where the target loss function is shown in formula (5):

[0050]

[0051] Where Θ = {W, b, U, C}, W represents the weight of the autoencoder, b represents the bias of the autoencoder, U represents the membership matrix, and C represents the centroid matrix. Expressed as the target loss function The minimum value on Θ, It is represented by the square norm of the distance between two vectors, log is the logarithmic symbol, X i Yes Z i The latent representation of is extracted from the latent space of the autoencoder and is the reconstructed representation of the output, C j represents the centroid of the centroid matrix, c is the number of centroids, generally 2, u ij Represents the element in the i-th row and j-th column of U. The first item represents the reconstruction error (RE), the second term represents the loss of fuzzy clustering, the third term represents the entropy regularization term; the coefficients λ1, λ2, and λ3 are used to weigh the loss terms in the target loss function, where λ1 = [1, 10, 100, 1000, 10000, 100000], λ2 = [0.1, 1, 10, 100], and λ3 = [0.1, 0.01, 0.001, 0.0001]; f(u ij )Use ij Calculated using the softmax function.

[0052] In this embodiment, the complexity of the traditional optimization reasoning method and the non-convergence problem that requires convergence proof are easily encountered. We convert the traditional entropy-based deep embedded fuzzy clustering module into a pure deep training mode. This method constrains the low-dimensional features of the CAN bus from multiple angles during the autoencoder learning process. By jointly training the membership matrix, the centroid matrix and the autoencoder module, valuable information can be better learned from the CAN message. It constrains the learning direction of low-dimensional features from multiple angles, thereby effectively classifying abnormal attack data.

[0053] To verify the performance of the CAN bus traffic intrusion detection method based on deep embedded clustering of the present invention, we use accuracy, precision, recall, F1, false positive rate and false negative rate as performance indicators for evaluation. In order to evaluate the intrusion detection performance of the CAN bus traffic intrusion detection method based on deep embedded clustering of the present invention, we compared it with five baseline methods: deep embedded self-clustering (DESC), LSTM autoencoder (LSTM-ae-ids), deep clustering (SOMK-C), autoencoder (DAE) and one-class support vector machine (OC-SVM), where the comparison data of accuracy, precision, recall and F1 score are shown in Table 1.

[0054] Table 1 Performance comparison of the present invention and other baseline methods

[0055]

[0056]

[0057] From the analysis of the data in Table 1, it can be seen that the accuracy of the CAN bus traffic intrusion detection method based on deep embedded clustering of the present invention reaches 99.98%, 99.99%, 99.91% and 99.98% respectively. It can be said that this accuracy is a detection performance that is difficult to achieve by traditional unsupervised methods, which is mainly attributed to the effective extraction of spatiotemporal features by the autoencoder and the further constraint of low-dimensional features by embedded clustering.

[0058] The LSTM-ae-ids also performs well only in DoS attacks, which shows that the method of extracting low-dimensional features from the collected message frequencies based solely on the LSTM-ae-ids and then identifying anomalies based on reconstruction errors is only feasible when the attack has a huge impact on the original message traffic, and cannot accurately adapt to all attacks on the CAN bus.

[0059] DESC and DAE, as traditional unsupervised clustering methods, extract low-dimensional features based on deep autoencoders and combine them with density-based clustering to achieve intrusion detection solutions. However, due to data and model limitations, it is impossible to obtain a very stable and efficient detection performance. Traditional methods lack a specific convergence direction in the learning process of data dimensionality reduction, which leads to the fact that the design of loss functions can only focus on aspects such as data reconstruction and distribution. This limitation makes it easy for traditional methods to ignore the tendency of low-dimensional feature learning and can only explore clustering modules for roughly similar low-dimensional data. However, when facing different types of attacks, the stability and efficiency of the clustering module are particularly critical. Therefore, traditional methods cannot meet the needs of flexible adjustment in different attack scenarios, and thus cannot achieve stable and efficient detection performance.

[0060] The CAN bus traffic intrusion detection method based on deep embedded clustering of the present invention can consider clustering features while better learning low-dimensional features to optimize the learning direction of the autoencoder, so that the low-dimensional spatiotemporal features used are fully highlighted and utilized at the clustering level, and finally show a stable f1 score. In the four attacks of flooding attack, fuzzy attack, deceptive device attack, and deceptive gear attack, the F1 scores of the CAN bus traffic intrusion detection method based on deep embedded clustering of the present invention reached 99.12%, 99.61%, 99.50% and 99.17% respectively.

[0061] In summary, the CAN bus traffic intrusion detection method based on deep embedded clustering of the present invention combines the autoencoder and deep clustering, and constructs an entropy-based embedded fuzzy clustering objective function as the target loss function during the training process to constrain the distance from the membership matrix to the centroid matrix and the autoencoder, thereby ensuring that the final membership matrix has high accuracy, and then determines whether there is an intrusion based on the final membership matrix, with high stability and reliability.

Claims

1. A CAN bus traffic intrusion detection method based on deep embedded clustering, Features By periodically sampling the CAN bus data and preprocessing the periodically sampled CAN bus data, preprocessed data that meets the basic data format requirements of machine learning is obtained so that the autoencoder can learn. Then, on the one hand, the autoencoder is used to compress the data dimension of the preprocessed data to obtain low-dimensional feature data. On the other hand, based on the number of data items in the preprocessed data, a membership matrix for representing the membership of each data item in the preprocessed data and a centroid matrix of the clustering center are respectively constructed, and the membership matrix and the centroid matrix are initialized to obtain the initial value of the membership of each data item in the preprocessed data and the centroid matrix. The initial value of the matrix; then the autoencoder, membership matrix and centroid matrix are trained. During the training process, the distance from the membership matrix to the centroid matrix and the autoencoder are constrained by constructing an entropy-based embedded fuzzy clustering objective function as the target loss function. After training, the final membership matrix is ​​obtained. The data corresponding to the membership values ​​less than 0.5 in the final membership matrix are judged as normal CAN bus data, and the data corresponding to the membership values ​​greater than or equal to 0.5 are judged as abnormal CAN bus data. If there is abnormal CAN bus data in the preprocessed data, it is judged that an intrusion has occurred, otherwise, no intrusion has occurred.

2. According to claim 1, a CAN bus traffic intrusion detection method based on deep embedded clustering, Features The specific process of preprocessing the periodically sampled CAN bus data to obtain preprocessed data that meets the basic data format requirements of machine learning is as follows: Step 1, record the number of messages included in the CAN bus data sampled in each period as M, where M is an integer greater than or equal to 100, and select the timestamp, CAN ID, data length code DLC and 8-byte data field DATA[0]-DATA[7] in each message; Step 2: Update the M messages respectively to obtain M intermediate messages, which are as follows: S2.

1. Calculate the absolute value of the difference between the timestamp of each message and the previous message, and the absolute value of the difference between the timestamp of the next message, and use the average of the two absolute values ​​to update the timestamp of the message. If the message is the first message sampled in the current sampling period, the timestamp value of the previous message is equal to the timestamp of the message. If the message is the last message sampled in the current sampling period, the timestamp value of the next message is equal to the timestamp of the message. S2.

2. Divide the 8-byte data field DATA[0]-DATA[7] of each message into 8 blocks. If the 8-byte data field DATA[0]-DATA[7] is less than 8 bytes, divide it into 8 blocks after filling with leading 0. Each block contains two hexadecimal values. Convert the two hexadecimal values ​​of each block into decimal values. At this time, each message is updated. Each updated message is an intermediate message. The timestamp, CAN ID, data length code DLC and 8 blocks of each intermediate message are the features of the intermediate message, that is, each intermediate message has 11 features. Step 3: The construction process of preprocessing data is as follows: S3.

1. From the M intermediate messages, starting from the one with the latest timestamp, construct a message flow of length N for every N intermediate messages until the result is A message stream of length N, where N is 10 or 100. is the rounding down symbol; according to the construction order, the i-th message flow is recorded as In each message flow, each feature of each intermediate message is a feature of the message flow. The number of features of each message flow is recorded as n, n = 11*N. Formula (1) is used to convert Stream(M i ) is expressed as: Stream(M i )=M i (t 1 ),M i (t 2 ),M i (t 3 ), …,M i (t n ) (1) In formula (1), M i (t a ), is the i-th message stream Stream(M i )’s ath feature, a=1,2,…,n; S3.2, calculate the i-th message stream Stream (M i ) is the average value μ of n features n and standard deviation σ n : S3.3, using formula (4) to obtain the i-th message stream Stream (M i ) of the preprocessed data stream Z i : S3.4, Stream 1 (M 1 ) of the preprocessed data stream Z 1 To the Kth message stream Stream(M K ) of the preprocessed data stream Z K Construct preprocessed data that meets the basic data format requirements of machine learning, 3. According to claim 1, a CAN bus traffic intrusion detection method based on deep embedded clustering, Features The autoencoder, membership matrix and centroid matrix are trained. During the training process, the distance from the membership matrix to the centroid matrix and the autoencoder are constrained by constructing an entropy-based embedded fuzzy clustering objective function as a loss function. After training, the specific process of obtaining the final membership matrix is ​​as follows: S3.1 sends the first message stream Stream(M 1 ) of the preprocessed data stream Z 1 To the Kth message stream Stream(M K ) of the preprocessed data stream Z K The input autoencoder is constrained and back-propagated using the target loss function of entropy-based embedded fuzzy clustering to update the weight and bias parameters of the autoencoder. After the update is completed, the final membership matrix is ​​obtained, where the target loss function is shown in formula (5): Where Θ = {W, b, U, c}, W represents the weight of the autoencoder, b represents the bias of the autoencoder, U represents the membership matrix, and C represents the centroid matrix. Expressed as the target loss function The minimum value on Θ, It is represented by the square norm of the distance between two vectors, log is the logarithmic symbol, X i Yes Z i The latent representation of is extracted from the latent space of the autoencoder and is the reconstructed representation of the output, C j represents the centroid of the centroid matrix, c is the number of centroids, generally 2, u ij Represents the element in the i-th row and j-th column of U. The first item represents the reconstruction error (RE), the second term represents the loss of fuzzy clustering, the third term represents the entropy regularization term; the coefficient λ 1 ,λ 2 ,λ 3 Used to weigh the loss term in the objective loss function, where λ1 = [1, 10, 100, 1000, 10000, 100000], λ2 = [0.1, 1, 10, 100], λ3 = [0.1, 0.01, 0.001, 0.0001]; f(u ij )Use ij Calculated using the softmax function.

Images