Automobile sensitive message attack detection method and system based on data-model hybrid drive

Abstract

The invention provides an automobile sensitive message attack detection method and system based on data-model hybrid driving, belongs to the field of in-vehicle network security of automobiles, and particularly relates to an intrusion detection technology of sensitive messages. A time sequence control data detection module based on a long short-term memory recurrent neural network, a space state data detection module based on a correlation probability model and a detection module based on automobile model prediction work cooperatively, and an intrusion detection comprehensive judgment module is used for detecting intrusion in two aspects of data and models. And comprehensively judging sensitive message attacks of an automobile sensor channel and an actuator channel. According to the method, sensitive message attack detection is carried out through data-model hybrid driving, the detection precision and the working efficiency for automobile sensitive instruction attacks are improved, and the method is suitable for single-point anomalies caused by instantaneous attacks of automobile sensitive messages and collective anomalies caused by short-time attacks. And the method has a good detection effect even on low-speed injection attacks with hidden changes.

Description

Technical Field

[0001] The present invention relates to the field of in-vehicle network security of an automobile, and in particular to an intrusion detection method and system for automobile sensitive message attacks. Background Art

[0002] Intelligent connected vehicles are complex heterogeneous network information-physical systems, usually including multiple interconnected networks and subsystems, and the internal network of the vehicle is gradually realizing global interconnection. Since the automotive controller area network protocol was not well considered in the design of information security issues, the security challenges faced by vehicle network communications are also increasing. Sensitive messages in the car include sensitive status messages such as speed, acceleration, and position on the sensor side, and sensitive control messages such as acceleration, braking, and steering on the actuator side. Once sensitive messages in the in-vehicle network communication are attacked, the in-vehicle network security is at great risk. Attackers can manipulate the sensitive message sending and receiving of sensor channels and actuator channels by tampering, injection, and discarding, and then control the key functions of the car, causing the car to lose control and be illegally manipulated.

[0003] At present, there are many problems in the security protection methods for sensitive messages in the in-vehicle network. Specifically, the data encryption and decryption methods are limited by the computing power and memory of the embedded electronic control unit on the vehicle, and it is difficult to achieve a balance between security and computing resources. The method of identity authentication at the transceiver end will increase the steps and time consumption of the original communication process, and because the number of electronic control units in the car is too large, it is often difficult to achieve a balance between security and time consumption. In the field of in-vehicle network security, most of the existing intrusion detection technologies mainly use methods based on information theory and statistical analysis, physical characteristics or machine learning to achieve secure communication protection for in-vehicle networks in the form of collection, detection, and supervision. Due to the wide range of detection and most of the technical means are aimed at a single attack method, there are problems such as low recognition rate, high false detection rate, poor real-time performance, and difficulty in identifying slow injection attacks with hidden changes in the detection of sensitive message attacks on automobiles, which cannot well protect the security of in-vehicle networks. Summary of the invention

[0004] In order to solve the problems of low recognition rate, high false detection rate, poor real-time performance and difficulty in identifying slowly injected attacks with hidden changes in existing intrusion detection technologies in the field of in-vehicle network security when identifying sensitive message attacks, the present invention provides a data-model hybrid-driven automobile sensitive message attack detection method and system, which combines data-based detection with detection based on a constructed automobile model to hybrid-drive in-vehicle network sensitive message attack detection, thereby improving the effect of intrusion detection. The present invention can be deployed on a central computing unit and has good practicality.

[0005] The present invention provides a data-model hybrid-driven automobile sensitive message attack detection method and system, which includes an offline construction phase and a real-time detection phase, and is implemented by the following technical solutions:

[0006] In the offline construction phase, the main work is to build long short-term memory recursive neural network models, related probability models, and car models.

[0007] The sensitive control messages of the actuator channel when the car is driving normally are collected to build a data set, and the prediction of the sensitive control messages of the actuator channel is established based on the long short-term memory recurrent neural network model. The long short-term memory recurrent neural network has unique advantages in predicting time series data, and the sensitive control message of the actuator channel is a typical time series data. The use of long short-term memory recurrent neural network can greatly improve the recognition effect of intrusion detection of sensitive control messages of the actuator channel.

[0008] The sensitive state messages of the sensor channels during normal driving of the car are collected to construct a data set, and the correlation relationship between the sensitive state messages of the sensor channels is established according to the correlation probability model. Since the sensors in the car are relatively fixed, and each sensor obtains the same state quantity during the normal driving of the car, the correlation relationship between the same state quantity is stable. Since the amount of data in the sensor channel is large and the amount of calculation using the correlation probability model is small, the sensitive state message detection of the sensor channel based on the correlation relationship can greatly improve the real-time performance of sensitive state message intrusion detection.

[0009] In the process of building the car model, by identifying the actual car parameters, the real-time control model of the car dynamics and the car state prediction model based on the model predictive control method are constructed. The car model well represents the state transition and real-time control process of the car as a physical entity. The real-time control model of the car dynamics can obtain the optimal control quantity, and the car state prediction model can obtain the optimal state prediction quantity. Intrusion detection based on the car model can detect the sensor channel and the actuator channel at the same time, and can avoid the problems of high false detection rate and poor real-time performance caused by pure data drive.

[0010] In the real-time detection stage, the automobile sensitive message detection system based on data-model hybrid drive is deployed on the central computing unit or central gateway, and specifically includes the following parts: data analysis and processing module, timing control data detection module based on long short-term memory recursive neural network, timing state data detection module based on correlation probability model, detection module based on automobile model prediction and intrusion detection comprehensive judgment module.

[0011] The gateway interface of the central computing unit continuously collects and filters the sensitive messages of the automobile from the sensor channel and the actuator channel. The data analysis and processing module pre-parses and processes the collected sensitive messages and inputs them into the three detection modules.

[0012] Furthermore, the timing control data detection module based on the long short-term memory recurrent neural network detects the sensitive messages of the preprocessed actuator channel. According to the difference between the actual sensitive control message and the predicted sensitive control message, the attack on the sensitive message of the actuator channel is judged from the data perspective. If the car is driving normally, the difference between the predicted sensitive message and the real sensitive message should be stable within the error range. If the error value undergoes an instantaneous single-point mutation, there is a high probability that an instantaneous attack on the sensitive message of the car may have occurred; if the error value has a short-term collective anomaly, there is a high probability that a short-term attack on the sensitive message of the car may have occurred; if the error value is out of fluctuation and shows a slow upward trend, there is a high probability that a slow injection attack on the sensitive message of the car may have occurred.

[0013] At the same time, the time series state data detection module based on the correlation probability model detects the sensitive messages of the collected sensor channels. According to the difference between the actual correlation between the sensitive state messages and the stable correlation constructed by the normal sensitive state messages in the offline construction phase, the attack on the sensitive message of the sensor channel can be effectively judged from the data perspective. If the car is driving normally, the statistic representing the correlation between the sensitive messages of the sensor channel state should be less than the control limit. If the sensor channel of the car is attacked by sensitive messages, the injection of external attacks will change the original stable correlation relationship between the sensitive states. Whether it is an instantaneous attack, a short-term attack or a slow injection attack, it will cause the correlation statistic to exceed the control limit.

[0014] At the same time, the detection module based on the vehicle model prediction solves the optimal control quantity according to the vehicle dynamics model in real time rolling optimization, and obtains the optimal predicted state quantity according to the optimal control quantity and the vehicle prediction model. Based on the differences between the optimal control quantity, the optimal state quantity and the real-time control physics and real-time state obtained by analytical processing, the sensitive message attacks of the sensor channel and the actuator channel are judged from the perspective of the model.

[0015] Furthermore, the intrusion detection comprehensive discrimination module uses a combined score method to comprehensively discriminate sensitive message attacks. The long short-term memory recurrent neural network and the real-time control model of vehicle dynamics are used to realize the intrusion detection discrimination of the actuator channel driven by data-model hybrid, and the sensor channel driven by data-model hybrid is realized by using the relevant probability model and the vehicle prediction model. The results of the data-model hybrid drive are integrated to obtain the final sensor channel and actuator channel vehicle sensitive message attack detection results.

[0016] The beneficial effects of the automobile sensitive message attack detection method and system based on data-model hybrid drive provided by the present invention are as follows:

[0017] 1. The present invention provides a method and system for detecting automobile sensitive message attacks based on data-model hybrid drive, which respectively construct a timing control data detection module based on a long short-term memory recursive neural network, a timing state data detection module based on a correlation probability model, and a detection module based on automobile model prediction. The hybrid drive intrusion detection is carried out from the data perspective and the model perspective, avoiding the problems of high false detection rate and poor real-time performance of pure data-driven detection, low detection recognition rate and poor recognition effect of slow injection attacks of pure model-driven detection, and has a good detection effect on different attack modes, and has a good detection effect on single-point anomalies caused by instantaneous attacks, collective anomalies caused by short-term attacks, and even slow injection attacks with hidden changes.

[0018] 2. The present invention provides a method and system for detecting automobile sensitive message attacks based on data-model hybrid drive. Through hybrid driven intrusion detection based on a combined score discrimination method, it can simultaneously detect sensitive messages of sensor channels and actuator channels, save identification computing resources, and identify specific attack channels, thereby improving the intrusion detection effect of sensitive messages in the vehicle network and improving the security of the vehicle network. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art; obviously, the drawings in the following description are merely implementation cases of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work.

[0020] Figure 1 A data-model hybrid-driven automobile sensitive message attack detection method and a schematic diagram of a system offline construction provided in an embodiment of the present invention;

[0021] Figure 2 A schematic diagram of a method and system for real-time detection of sensitive message attacks on automobiles based on data-model hybrid drive provided by an embodiment of the present invention;

[0022] Figure 3 A data-model hybrid-driven automobile sensitive message attack detection method and a schematic diagram of the overall system architecture are provided for an example of the present invention. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and understandable, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0024] like Figure 1 As shown, a method for detecting automobile sensitive message attacks based on data-model hybrid drive and a schematic diagram of the offline construction phase of the system provided by an embodiment of the present invention is shown. In the offline construction phase, the main construction includes: a long short-term memory recursive neural network model, a related probability model, and a vehicle model.

[0025] Specifically, in this embodiment, the data of the vehicle operation is obtained, and a data set is constructed based on the communication message data of the sensor channel and the actuator channel when the vehicle is driving normally. The acquired data set includes but is not limited to the message data of the sensor channels such as the camera, the global positioning system, the inertial navigation system, and includes but is not limited to the message data of the actuator channels such as the steering actuator, the electric drive system, and the braking system. Optionally, the collection method can select a data acquisition system or a central gateway. The collected sensitive messages are parsed and classified, and at the same time, the data format is converted into the format of the input long short-term memory recursive neural network model, the format of the construction of the relevant probability model, and the format that is convenient for parameter identification, so as to obtain training samples and parameter identification samples. The constructed data set is used for model construction and parameter identification in the offline stage, and provides support for the real-time detection stage.

[0026] Specifically, the long short-term memory recursive neural network model constructed offline in this embodiment provides a neural network model for the timing control data detection module based on the long short-term memory recursive neural network in the real-time detection stage, which is used to detect sensitive message attacks on the actuator channel. The long short-term memory recursive neural network can learn and memorize the long-term dependencies between normal sensitive instruction messages, and use these relationships to predict sensitive instruction messages. In this embodiment, acceleration instructions, braking instructions and steering instructions sensitive messages are selected for model training; in an extensible way, sensitive time series messages of other actuator channels can be selected. By inputting sensitive messages of the actuator channel of the car during normal driving as training samples, the network performs forward propagation at each time step to calculate the output of each memory unit; then, the model loss function is calculated to determine whether the model error function meets the requirements; if the model error does not meet the requirements, the error is updated in reverse and the forward calculation of the memory unit is continued; when the model error meets the requirements, the neural network model meets the prediction ability requirements and outputs the long short-term memory recursive neural network model used in the real-time detection stage.

[0027] Specifically, the correlation probability model constructed offline in this embodiment provides a correlation probability model for the time series state data detection module based on the correlation probability model in the real-time detection stage, which is used to detect sensitive message attacks on sensor channels. In this embodiment, three sensitive state messages related to position, speed, and heading are selected to construct a correlation probability model; in an extensible manner, sensitive state sequences of other sensor channels can be expanded and selected. As mentioned above, the data set is obtained through sensors such as cameras, global positioning systems, and inertial navigation systems, and the above sensors can directly or indirectly independently calculate and output three state sensitive data of speed, position, and heading angle. First, the training data and test data are divided according to the time window. Within a working unit, the Pearson correlation coefficient is used to quantify the correlation between each two state data elements, and the calculation formula is:

[0028]

[0029] Where n is the number of work units in the time window, x i ,y i They are the state data of the parameters at a certain moment, are the average values ​​of the state data parameters x and y in the working unit, r xy The value range is -1 to +1.

[0030] In this embodiment, there are three different sensitive state data of the car: speed, position, and heading. By calculating the Pearson correlation coefficient between every two sensor state sensitive data elements, the correlation vector in each working unit is obtained, and then the correlation matrix between the speed, position, and heading obtained by the camera, global positioning system, and inertial navigation system is constructed. Optionally, when the number of selected sensors and sensitive state data increases, the data space will increase greatly. The principal component analysis method can be used to reduce the data dimension, and the eigenvector with the largest contribution is retained for the construction of the relevant probability model. When the sensitive data stream of the sensor channel is not attacked, the correlation between the state data can remain stable or fluctuate only in a small range, and T 2 Statistics are used to measure the change of correlation vector in principal component space. is T with confidence α 2 The statistical control limit is calculated as:

[0031]

[0032] Among them, x is the correlation coefficient vector of the sample, A is the dimension reduction transformation matrix, Λ=diag(λ1,λ2,........λ k ), F k,p-k；αIt obeys the F distribution with the first degree of freedom k and the second degree of freedom pk. In this embodiment, α is 0.1, that is, if the calculation result of the relevant probability model of the state-sensitive message does not exceed the control limit That is, there is a 99% probability that the current correlation state is stable and has not been disturbed by the outside world.

[0033] Specifically, in this embodiment, the car model is constructed offline. According to physical measurement, actual car testing, message data collection, etc., the parameters of the car's power system, steering system, braking system, tires, etc. are identified and estimated to obtain the car's mass, maximum acceleration, maximum speed, maximum yaw angle, center of mass position and other car mathematical model parameters, and then establish a real-time control model of car dynamics and a car state prediction model.

[0034] like Figure 2 As shown, a schematic diagram of the real-time detection phase of a sensitive message attack detection method and system for automobiles based on data-model hybrid drive provided by the present invention. In the real-time detection phase, the sensitive message detection system for automobiles based on data-model hybrid drive is deployed on a central computing unit or a central gateway, and specifically includes the following parts: a data parsing and processing module, a timing control data detection module based on a long short-term memory recursive neural network, a timing state data detection module based on a correlation probability model, a detection module based on automobile model prediction, and an intrusion detection comprehensive discrimination module.

[0035] Specifically, in this embodiment, the data analysis and processing module filters the sensitive messages of the sensor channel and the actuator channel, stores, classifies and analyzes the data, and converts the data into the format input required for the long short-term memory recursive neural network model and the construction of the relevant probability model. Optionally, this embodiment uses FIFO and mailbox mechanisms in the central computing unit to store and manage sensitive messages.

[0036] Further, in this embodiment, the long short-term memory recurrent neural network detection model is obtained in the offline construction stage, based on data-driven detection. The detection model uses the acceleration, braking, and steering command sensitive messages of the previous time window to predict the time series, and obtains the acceleration, braking, and steering sensitive message prediction time series in the next time window. The accuracy of the prediction result is guaranteed by the offline training stage. If the car is driving normally, the sensitive message of the previous time window is input into the long short-term memory recurrent neural network detection model, and the difference between the predicted time series of the sensitive message output in the current time window and the real time series of the sensitive message should be stable within the error range. If the actuator channel of the car is attacked by sensitive messages, the difference between the predicted sequence and the real sequence will not be able to fluctuate stably within the error range. If the error value has an instantaneous single-point anomaly, it is very likely that an instantaneous attack on the car's sensitive message has occurred; if the error value has a short-term collective anomaly, it is very likely that a short-term attack on the car's sensitive message has occurred; if the error value is out of fluctuation and shows a slow rising trend, it is very likely that a slow injection attack on the car's sensitive message has occurred.

[0037] Furthermore, in this embodiment, the correlation probability model is constructed in the offline stage and is based on data-driven detection. The correlation probability model constructed in the offline stage well expresses the correlation relationship between sensors and various state quantities obtained by sensors. In this embodiment, the sensors include: cameras, global positioning systems and inertial navigation systems, and the state quantities include: position, speed and heading angle. In this embodiment, the correlation change between the position state, speed state, and heading angle state sensitive messages of the sensor channel is expressed by T 2 To measure statistics, is T with confidence α 2 If the car is running normally, T, which represents the correlation between the sensitive messages of the sensor channel state, 2 The statistic should be less than the control limit If the sensor channel of the car is attacked by sensitive messages, the injection of external attacks will change the stable correlation between the original sensitive states. Whether it is an instantaneous attack, a short-term attack or a slow injection attack, it will cause the correlation statistic T 2 breakthrough At this time, it is considered that there is a probability of 1-α that a sensor channel sensitive message attack has occurred.

[0038] Further, in the detection module based on the vehicle model prediction in this embodiment, the parameters of the vehicle dynamics real-time control model and the vehicle state prediction model based on the model predictive control are obtained by identifying the parameters in the offline construction stage. The model predictive control method is a classic vehicle control method of trajectory tracking control. Based on the vehicle dynamics real-time control model, a series of optimal control rates are obtained by rolling optimization solution for real-time control. In this embodiment, the vehicle dynamics real-time control model based on the model predictive control obtains the optimal control quantity, and the optimal prediction state is obtained by inputting the optimal control quantity into the vehicle state prediction model. The difference between the optimal control quantity and the real control quantity collected by the actuator channel, and the optimal prediction state and the real state quantity collected by the sensor channel characterizes the model deviation between the mathematical model of the constructed vehicle dynamics model and the vehicle state prediction model and the real vehicle. If the vehicle is driving normally, the sensor channel and the actuator channel are not subject to external disturbances. Since the model deviation is stable, the difference between the real value and the optimal control quantity and the optimal prediction state is also stable. If the sensor channel or the actuator channel of the vehicle is attacked by sensitive messages, the closed-loop vehicle model will no longer be stable due to external disturbances.

[0039] Specifically, the intrusion detection comprehensive discrimination module combines the detection results of the data-driven and model-driven intrusion detection modules, adopts a sub-module combined scoring mechanism, and comprehensively discriminates sensitive message attacks by combining the results of the three modules. The long short-term memory recursive neural network and the real-time control model of vehicle dynamics are used to realize the intrusion detection discrimination of the actuator channel driven by data-model hybrid, and the intrusion detection discrimination of the sensor channel driven by data-model hybrid is realized by using the related probability model and the vehicle prediction model. The results of the data-model hybrid drive are comprehensively combined to obtain the final sensor channel and actuator channel vehicle sensitive message attack detection results. The combination of data-driven and model-driven methods effectively improves the recognition ability of deep hidden attacks on the vehicle internal control system network and reduces the false alarm rate.

[0040] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0041] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data-model hybrid-driven automobile sensitive message attack detection method and system, which can be applied to a central gateway or a central computing unit. It is characterized in that The following steps are involved: In the offline construction phase, a long short-term memory recursive neural network model, a related probability model, and a car model are constructed; In the real-time detection stage, it specifically includes: data analysis and processing module, timing control data detection module based on long short-term memory recursive neural network, timing state data detection module based on correlation probability model, detection module based on automobile model prediction and intrusion detection comprehensive judgment module.

2. According to claim 1, Features: Intrusion detection of a data-model hybrid driven actuator channel is implemented using a long short-term memory recursive neural network and a vehicle dynamics real-time control model; optionally, the methods of data-driven and model-driven intrusion detection are not limited to those shown in the embodiments of the present invention.

3. According to claim 1, Features: The intrusion detection of the sensor channel driven by data-model hybrid is realized by using the relevant probability model and the automobile prediction model; optionally, the method of data-driven and model-driven intrusion detection is not limited to that shown in the embodiment of the present invention.

4. According to claim 1, Features: Sensitive status messages of sensor channels, including but not limited to sensitive status messages such as position, speed, and heading angle output by sensors such as cameras, global positioning systems, and inertial navigation systems.

5. According to claim 1, Features: Sensitive control messages of the actuator channel include, but are not limited to, sensitive control messages such as acceleration, braking, and steering received by actuators such as steering actuators and electric drive systems.

Images