CAN message anomaly detection method and device and vehicle
By obtaining the message set and its load rate on the CAN bus, and correcting the information entropy to detect abnormal messages, the problem of low efficiency and inaccurate detection of CAN bus message loss in the existing technology is solved, and efficient and accurate abnormality detection is achieved. .
Patent Information
- Application Number
- CN202411476382.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-22
- Publication Date
- 2025-01-21
- Estimated Expiration
- 2044-10-22
AI Technical Summary
In the prior art, the detection efficiency of CAN bus packet loss is low and inaccurate, especially when the CAN bus is disturbed, it is easy to cause misjudgment.
By obtaining the current collection of packets to be tested and the CAN bus load rate of the corresponding time period, the correction parameters of each type of message are determined based on the load rate, the information entropy of the correction packet collection, and the information entropy is not in the preset range Internal confirmation of abnormal messages in the packet collection.
The efficient and accurate detection of the case of the CAN packet is abnormal, avoiding the inaccurate detection of the overall interference of the CAN bus, and improving the accuracy and efficiency of the detection.
Smart Images

Figure CN119341945A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of CAN bus communication technology, and in particular to a CAN message anomaly detection method, device and vehicle. Background Art
[0002] The Controller Area Network (CAN) bus is the most widely used bus in automobiles and is the underlying communication network of automobiles. Different controllers of a vehicle can communicate with each other through the CAN bus.
[0003] In actual applications, when controllers communicate with each other, they communicate by sending messages to the CAN bus. However, in the process of the controller sending messages through the CAN bus, there may be cases where the messages are lost.
[0004] At present, the detection of message loss is generally achieved by detecting whether some important message IDs of the controller have timed out. The above method not only has low detection efficiency, but also causes message timeout when the CAN bus is disturbed. Detection according to the above method will detect message loss, so the above detection method is also inaccurate. Summary of the invention
[0005] The present application provides a CAN message anomaly detection method, device and vehicle to solve the technical problem that the detection of message loss in the prior art is not only low in detection efficiency but also inaccurate in detection efficiency.
[0006] In a first aspect, the present application provides a CAN message anomaly detection method, the method comprising:
[0007] Acquire a message set to be detected and a load rate of a controller area network (CAN) bus in a time period corresponding to the message set, wherein the message set includes messages of multiple types;
[0008] When the load rate is within a first preset range, determining a correction parameter for each type of message based on the load rate, the correction parameter being used to correct the information entropy of the message set;
[0009] Determining the information entropy of the message set based on the correction parameter of each type of message;
[0010] When the information entropy is not within the second preset range, it is determined that an abnormal message exists in the message set.
[0011] As a possible implementation manner, determining the correction parameter of each type of message based on the load rate includes:
[0012] Determining a signal-to-noise ratio factor of the CAN bus, and determining a priority difference factor between the priority of each type of message and the priority of a preset message;
[0013] For each type of message, a correction parameter of the type of message is determined according to the signal-to-noise ratio factor, the load rate, and a priority difference factor corresponding to the type of message.
[0014] As a possible implementation manner, determining the priority difference factor between the priority of each type of message and the priority of the preset message includes:
[0015] For each type of message, convert the bit value of the message identifier corresponding to the type of message from the bit value to a first value of a first preset base;
[0016] Subtract the second value of the first preset base of the message identifier corresponding to the preset message from the first value to obtain a first base target value;
[0017] Converting the first base target value into a second base target value in a second preset base, wherein the first preset base and the second preset base are different bases;
[0018] Divide the binary target value by a preset value and round down to obtain the priority difference of the class of messages;
[0019] A priority difference factor is determined according to the priority difference.
[0020] As a possible implementation manner, for each type of message, determining the correction parameter of the type of message according to the signal-to-noise ratio factor, the load rate, and the priority difference factor corresponding to the type of message includes:
[0021] Determining a minimum value within the first preset range;
[0022] For each type of message, add the load rate and the priority difference factor corresponding to the type of message to obtain a first correction value;
[0023] Determine a ratio of the first correction value to the minimum value to obtain a second correction value;
[0024] The signal-to-noise ratio factor is multiplied by the second correction value to obtain a correction parameter for the type of message.
[0025] As a possible implementation manner, determining the signal-to-noise ratio factor of the CAN bus includes:
[0026] Obtaining a signal-to-noise ratio of the CAN bus;
[0027] When the signal-to-noise ratio is within a third preset range, determining a maximum value within the third preset range;
[0028] Subtract the signal-to-noise ratio from the maximum value to obtain a first reference value;
[0029] Dividing the first reference value by a first preset value to obtain a second reference value;
[0030] The second reference value is added to a second preset value to obtain the signal-to-noise ratio factor.
[0031] As a possible implementation manner, determining the information entropy of the message set based on the correction parameter of each type of message includes:
[0032] Determine the probability value of each type of message generated in the message set;
[0033] The probability value of each type of message and the correction parameter of each type of message are calculated according to a preset formula to obtain the information entropy of the message set; wherein the preset formula is as follows:
[0034]
[0035] Wherein, H(S) is the information entropy, n is the number of types of messages in the message set, and K i is the correction parameter corresponding to the i-th type of message, the P i is the probability value of the i-th type of message.
[0036] As a possible implementation manner, after determining that an abnormal message exists in the message set, the method further includes:
[0037] Dividing the message set into two sub-message sets;
[0038] Determine the relative entropy between each of the sub-message sets and a preset message set, where the preset message set is a message set without any abnormal messages;
[0039] Based on the relative entropy corresponding to each of the sub-message sets, abnormal messages in the message set are determined.
[0040] As a possible implementation manner, determining the abnormal message in the message set based on the relative entropy corresponding to each of the sub-message sets includes:
[0041] Determining whether the relative entropy corresponding to each of the sub-message sets is within the second preset range;
[0042] For the sub-message set whose relative entropy is not within the second preset range, continue to split the sub-message set into two new sub-message sets, and determine a new relative entropy between each new sub-message set and the preset message set;
[0043] For the new sub-message set whose new relative entropy is not within the second preset range, if the new sub-message set cannot be split, determining the messages included in the new sub-message set as abnormal messages;
[0044] For the new sub-message set whose new relative entropy is not within the second preset range, if the new sub-message set can be further split, the new sub-message set is used as a sub-message set to execute the step of continuing to split the sub-message set into two new sub-message sets, and determining the new relative entropy of each new sub-message set with the preset message set, until the abnormal message is determined.
[0045] In a second aspect, the present application provides a CAN message anomaly detection device, the device comprising:
[0046] An acquisition module, used to acquire a message set to be detected and a load rate of a controller area network (CAN) bus in a time period corresponding to the message set, wherein the message set includes messages of multiple types;
[0047] A first determination module, configured to determine, when the load rate is within a first preset range, a correction parameter for each type of message based on the load rate, wherein the correction parameter is used to correct the information entropy of the message set;
[0048] A second determination module, configured to determine the information entropy of the message set based on the correction parameter of each type of message;
[0049] The third determination module is used to determine whether there is an abnormal message in the message set when the information entropy is not within a second preset range.
[0050] In a third aspect, the present application provides a vehicle, comprising: a processor and a memory, wherein the processor is used to execute a CAN message anomaly detection program stored in the memory to implement the CAN message anomaly detection method described in any one of the first aspects.
[0051] In a fourth aspect, the present application provides a storage medium storing one or more programs, and the one or more programs can be executed by one or more processors to implement the CAN message anomaly detection method described in any one of the first aspects.
[0052] The technical solution provided by the embodiment of the present application is to obtain the current message set to be detected, and the load rate of the CAN bus in the time period corresponding to the above message set, the above message set includes multiple types of messages, and when the above load rate is within the first preset range, the correction parameters of each type of message are determined based on the above load rate, and the above correction parameters are used to correct the information entropy of the above message set, and the information entropy of the above message set is determined based on the correction parameters of each type of message, and when the above information entropy is not within the second preset range, it is determined that there are abnormal messages in the above message set. This technical solution determines whether there are abnormal messages in the message set in a timely manner by determining whether the information entropy in the received message set is within the preset range. Further, the information entropy can express the certainty of the entire system, and the correction parameters of each message are determined according to the load rate of the CAN bus, and the information entropy of the message set determined based on the correction parameters is more accurate, thereby avoiding the inaccurate detection of abnormal messages caused by the overall interference of the CAN bus, and realizing efficient and accurate detection of whether there are abnormalities in the CAN messages. BRIEF DESCRIPTION OF THE DRAWINGS
[0053] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art texts are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0055] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.
[0056] Figure 1 A flowchart of an embodiment of a CAN message anomaly detection method provided in an embodiment of the present application;
[0057] Figure 2 A flowchart of another CAN message anomaly detection method provided in an embodiment of the present application;
[0058] Figure 3 A flowchart of another CAN message anomaly detection method provided in an embodiment of the present application;
[0059] Figure 4A block diagram of an embodiment of a CAN message anomaly detection device provided in an embodiment of the present application;
[0060] Figure 5 A schematic diagram of the structure of a vehicle provided in an embodiment of the present application. DETAILED DESCRIPTION
[0061] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described in conjunction with the drawings in the embodiments of the present application. Obviously, the embodiments described in the text are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.
[0062] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.
[0063] In order to solve the technical problem that the detection of message loss in the prior art is generally achieved by detecting whether the message ID has timed out, the above method not only has low detection efficiency, but also causes message timeout when the CAN bus is disturbed, and the detection according to the above method will detect message loss, so the above detection method is also inaccurate, the present application provides a CAN message anomaly detection method, device and vehicle, which can timely determine whether there are abnormal messages in the message set by determining whether the information entropy in the received message set is within a preset range. Furthermore, the information entropy can express the certainty of the entire system, and the correction parameters of each message are determined according to the load rate of the CAN bus, and the information entropy of the message set determined based on the correction parameters is more accurate, thereby avoiding the problem of inaccurate abnormal message detection caused by the overall interference of the CAN bus, and achieving efficient and accurate detection of whether there are abnormalities in the CAN messages.
[0064] The CAN message anomaly detection method provided by the present application is further explained below with reference to specific embodiments in conjunction with the accompanying drawings. The embodiments do not constitute a limitation on the embodiments of the present invention.
[0065] See also Figure 1 , is a flow chart of an embodiment of a CAN message anomaly detection method provided in an embodiment of the present application. Figure 1 As shown, the process may include the following steps:
[0066] Step 101: Obtain a message set to be detected and a load rate of the CAN bus in a time period corresponding to the message set, wherein the message set includes messages of multiple types.
[0067] The above-mentioned message set refers to a set of messages received by the CAN bus in the vehicle that are to be detected for abnormality.
[0068] Among them, different domain controllers of the vehicle communicate with each other through the CAN bus, and the CAN bus can correspond to a communication system for receiving and sending CAN messages from different domain controllers. Furthermore, after receiving the CAN message sent by the domain controller, the communication system can detect the CAN message periodically or in real time to determine whether there is an abnormal message. The abnormal message here can be a lost message, and the above-mentioned message set is a set of messages to be detected whether there is an abnormality.
[0069] Furthermore, the above-mentioned message set may include multiple types of messages, and the types of messages can be distinguished by message identifiers. The above-mentioned message identifiers may be message IDs (Identity Document) or other identifiers used to distinguish message types. The embodiments of the present application do not impose any restrictions on this.
[0070] Furthermore, the vehicle CAN bus generally includes periodic messages and event-triggered messages. The CAN message anomaly detection method provided in the present application can detect periodic messages.
[0071] The above load rate refers to the load pressure of the CAN bus in the time period corresponding to the above message set.
[0072] In one embodiment, the execution subject of the embodiment of the present application can obtain the detection window to be detected, and determine the current message set to be detected based on the above detection window. The above detection window can be a pre-set window for performing CAN message anomaly detection, which can be represented by the number of messages or by a time period.
[0073] As an optional implementation method, when the above-mentioned detection window is expressed by the number of messages, it means that whenever the CAN bus receives the number of messages corresponding to the detection window, the CAN message anomaly detection starts. Therefore, according to the above-mentioned detection window, the most recently received CAN messages corresponding to the number of the detection window can be obtained to obtain the current message set to be detected.
[0074] As another optional implementation method, when the above-mentioned detection window is represented by a time period, it means that every time a preset time period is reached, the CAN messages received within the preset time period are detected. Therefore, when the current distance from the last CAN message abnormality detection reaches the time period corresponding to the above-mentioned detection window, the CAN messages received in the time period corresponding to the detection window are obtained to obtain the current message set to be detected.
[0075] Based on this, after determining the above message set, the time period corresponding to the above message set can be determined, and the load rate of the CAN bus in the time period can be determined.
[0076] As an exemplary implementation, when determining the load rate of the CAN bus in the above time period, the actual time of each bit value transmission of the CAN bus in the above time period can be obtained, and then the actual time of each bit value transmission is calculated using the following formula (1), and the load rate of the CAN bus in the above time period can be obtained:
[0077] Load rate = actual time of each bit transmission / 1s*100% Formula (1)
[0078] Step 102: When the load rate is within a first preset range, a correction parameter for each type of message is determined based on the load rate, where the correction parameter is used to correct the information entropy of the message set.
[0079] Step 103: Based on the correction parameters of each type of message, determine the information entropy of the message set.
[0080] The following is a unified description of step 102 and step 103:
[0081] The above-mentioned first preset range is a predetermined load rate range in which correction parameters need to be determined, that is, when the load rate of the CAN bus is within the first preset range, the correction parameters of each type of message can be determined based on the above-mentioned load rate; when the load rate of the CAN bus is not within the above-mentioned first preset range, the correction parameters of each type of message may not be determined. When determining the information entropy of the message set below, it can be directly determined according to the existing method, and there is no need to calibrate the correction parameters. The specific determination method can be described below and will not be described in detail here.
[0082] For example, the first preset range mentioned above can be [40%, 70%), wherein, when the load rate is greater than or equal to 40% (and less than 70%), the correction parameters of each type of message can be determined, and when the load rate is less than 40%, all message IDs can be sent according to the design state, and the information entropy is not affected by the CAN bus and message priority, etc.; when the load rate is greater than 70%, if there is a message abnormality, the information entropy determined according to the existing method can also be accurately detected and no correction is required.
[0083] The above correction parameters are used to correct the information entropy of the message set.
[0084] Among them, since the CAN protocol is a non-destructive arbitration for sending messages, that is, the smaller the message ID, the higher the sending priority. Especially when the bus is disturbed, the sending of messages with higher priority is basically unaffected, but the sending of messages with lower priority will change greatly, which will cause a large error in the calculated information entropy, exceeding the preset threshold, causing a misjudgment of communication loss. Therefore, in the embodiment of the present application, a correction parameter can be determined according to the load rate of the CAN bus to reduce the error in determining the information entropy of the message set.
[0085] In one embodiment, after determining the load rate of the CAN bus, the executing entity of the embodiment of the present application can determine whether the above load rate is within the above first preset range, and when the above load rate is within the above first preset range, determine the correction parameters of each type of message based on the above load rate.
[0086] As for how to determine the correction parameters for each type of message based on the load rate, it can be seen below. Figure 2 The process shown is explained and will not be described in detail here.
[0087] Afterwards, the information entropy of the message set may be determined based on the correction parameters of each type of message.
[0088] As an optional implementation, when the load rate is within the first preset range, when determining the information entropy of the message set based on the correction parameters of each type of message, the probability value of each type of message in the message set may be determined first.
[0089] As an exemplary implementation, when determining the probability value of each type of message in the message set, the sending period corresponding to each type of message and the detection window corresponding to the message set can be obtained. The above-mentioned sending period refers to the period of regular message sending. As can be seen from the description in step 101, this application is aimed at periodic messages received on the vehicle CAN bus.
[0090] Afterwards, the sending period and detection window corresponding to each type of message can be calculated according to the preset formula shown in the following formula (II) to obtain the probability value of each type of message being generated:
[0091]
[0092] Among them, the above P i is the probability value of the i-th type of message, the above C is the above detection window, and the above T i is the sending period corresponding to the i-th type of message, and the above n is the number of types of messages in the above message set.
[0093] At this point, the probability value of each message in the message set being generated can be obtained.
[0094] Based on the above-determined probability values of each type of message and the correction parameters of each type of message, the execution subject of the embodiment of the present application may calculate the probability values of each type of message and the correction parameters of each type of message according to the preset formula shown in the following formula (III) to obtain the information entropy of the message set:
[0095]
[0096] Among them, the above H(S) is the above information entropy, the above n is the number of types of messages in the above message set, and the above K i is the correction parameter corresponding to the i-th type of message, the above P i is the probability value of the i-th type of message.
[0097] In addition, when the load rate is not within the first preset range, when determining the information entropy of the message set, correction may no longer be performed using the correction parameter of each type of message. Therefore, the information entropy of the message set may be determined using the preset formula shown in the following formula (IV):
[0098]
[0099] Wherein, the above H(S) is the above information entropy, the above n is the number of types of messages in the above message set, and the above P i It is understandable that the probability value generated by each type of message is consistent with the determination method of formula (II) above, which will not be repeated here.
[0100] Step 104: When the information entropy is not within the second preset range, determine that an abnormal message exists in the message set.
[0101] The second preset range refers to the range to which the message set belongs when there is no abnormality in the messages received by the CAN bus (for example, there is no lost message).
[0102] In actual applications, when there is no abnormality in the message set received by the CAN bus, the information entropy of the message set is within a preset range, that is, the second preset range mentioned above.
[0103] In the embodiment of the present application, after determining the information entropy of the above-mentioned message set, it can be determined whether the above-mentioned information entropy is within the above-mentioned second preset range.
[0104] Optionally, when it is determined that the information entropy is within the second preset range, it can be determined that no abnormal message exists in the message set at this time.
[0105] On the contrary, when it is determined that the information entropy is not within the second preset range, it can be determined that an abnormal message exists in the message set at this time.
[0106] In addition, when it is determined that there are abnormal messages in the message set, the execution subject of the embodiment of the present application can determine the abnormal messages in the message set according to the relative entropy of the message set. As for how to determine the abnormal messages from the message set, it can be described below. Figure 3 The process shown is explained and will not be described in detail here.
[0107] The technical solution provided by the embodiment of the present application is to obtain the current message set to be detected, and the load rate of the CAN bus in the time period corresponding to the above message set, the above message set includes multiple types of messages, and when the above load rate is within the first preset range, the correction parameters of each type of message are determined based on the above load rate, and the above correction parameters are used to correct the information entropy of the above message set, and the information entropy of the above message set is determined based on the correction parameters of each type of message, and when the above information entropy is not within the second preset range, it is determined that there are abnormal messages in the above message set. This technical solution determines whether there are abnormal messages in the message set in a timely manner by determining whether the information entropy in the received message set is within the preset range. Further, the information entropy can express the certainty of the entire system, and the correction parameters of each message are determined according to the load rate of the CAN bus, and the information entropy of the message set determined based on the correction parameters is more accurate, thereby avoiding the inaccurate detection of abnormal messages caused by the overall interference of the CAN bus, and realizing efficient and accurate detection of whether there are abnormalities in the CAN messages.
[0108] See also Figure 2 , which is a flow chart of an embodiment of another CAN message anomaly detection method provided in an embodiment of the present application. Figure 2 The process shown in Figure 1 Based on the process shown in FIG. 1 , it describes how to determine the correction parameters of each type of message based on the load rate. Figure 2 As shown, the process may include the following steps:
[0109] Step 201: Determine the signal-to-noise ratio factor of the CAN bus.
[0110] The above-mentioned signal-to-noise ratio factor refers to the correction factor of the signal-to-noise ratio of the CAN bus to the information entropy in the message set.
[0111] In practical applications, when the signal quality of the CAN bus is poor, it may affect the accuracy of message anomaly detection. Therefore, in an embodiment of the present application, the influence of the CAN signal quality on message anomaly detection can be reduced by the signal-to-noise ratio factor.
[0112] In the embodiment of the present application, since the above-mentioned signal-to-noise ratio factor is to reduce the influence of the signal quality of the CAN bus on the message abnormality detection, and the signal quality of the CAN bus can be represented by the signal-to-noise ratio of the CAN bus, the execution subject of the embodiment of the present application can first obtain the signal-to-noise ratio of the CAN bus when determining the signal-to-noise ratio factor of the CAN bus.
[0113] Afterwards, it may be determined whether the signal-to-noise ratio is within a preset range (hereinafter referred to as a third preset range for ease of distinction).
[0114] Optionally, if the signal-to-noise ratio is within the third preset range, it means that the signal quality of the CAN bus at this time has an impact on the abnormal detection of the message. Therefore, the maximum value within the third preset range can be determined, and the signal-to-noise ratio can be subtracted from the maximum value to obtain a first reference value. After that, the first reference value can be divided by the first preset value to obtain a second reference value, and the second reference value can be added to the second preset value to obtain the signal-to-noise ratio factor. Among them, the first preset value can be a signal-to-noise ratio that characterizes a good current signal, such as 100; the second preset value can be a preset value, such as 1.
[0115] As an exemplary implementation, the above signal-to-noise ratio can be calculated by the preset formula shown in the following formula (V) to obtain the signal-to-noise ratio factor of the CAN bus:
[0116]
[0117] Among them, the above S is the above signal-to-noise ratio factor, the above B is the maximum value within the third preset range, and the above SNR is the above signal-to-noise ratio.
[0118] Furthermore, the third preset range may be within the range of [20, 40] dB, or other ranges, which are not limited in the present embodiment. When the signal-to-noise ratio is greater than 40 dB, the signal quality of the CAN bus is excellent, and there is no need to consider the effect of the interference on the detection accuracy. When the signal-to-noise ratio is less than 20 dB, no correction is required, and the message abnormality can be accurately detected according to the original formula (Formula (IV) above).
[0119] On the contrary, if the signal-to-noise ratio is not within the third preset range, it means that the signal quality of the CAN bus has no effect on the abnormal detection of the message. Therefore, the signal-to-noise ratio factor can be set to a preset value, which can indicate that the signal-to-noise ratio factor does not exist, such as 0.
[0120] Step 202: Determine the priority difference factor between the priority of each type of message and the priority of the preset message.
[0121] The above priority refers to the priority of message sending. The larger the priority, the higher the priority is.
[0122] Correspondingly, the above-mentioned priority difference factor is a factor corresponding to the priority difference between two messages, which can be used to correct the influence of message priority on message anomaly detection.
[0123] The above-mentioned preset message refers to a message that is preset as a standard, which may be a message with the smallest message ID, that is, a message with the highest priority.
[0124] In an embodiment of the present application, each type of message may correspond to a priority, and the different priorities of different types of messages will have a certain impact on message anomaly detection. Therefore, the executing entity of the embodiment of the present application may determine a priority difference factor corresponding to each type of message, thereby reducing the impact of the priority of this type of message on message anomaly detection.
[0125] As an optional implementation method, the execution subject of the embodiment of the present application may first determine a preset message as a standard, and then determine the priority difference between each type of message and the preset message. Further, different priority differences may correspond to a priority factor, so after determining the priority difference of each type of message, the priority factor corresponding to each type of message may be determined.
[0126] Specifically, for each type of message, the bit value of the message identifier corresponding to that type of message can be converted into a first value of a first preset base, wherein the above bit value can be the bit value of the message identifier itself, such as an 11-bit bit value, and the above first preset base can be hexadecimal.
[0127] Afterwards, the second value of the first preset base of the message identifier corresponding to the preset message may be subtracted from the first value to obtain a first base target value.
[0128] Afterwards, the first base target value may be converted into a binary base target value in a second preset base (eg, decimal), wherein the first preset base and the second preset base are different bases.
[0129] After that, the binary target value may be divided by a preset value and rounded down to obtain the priority difference of the message of this type. The preset value may be 128.
[0130] For example, assuming that CANID is an 11-bit BIT ID, it can be converted into hexadecimal to get 0x XXX. Then, subtract the minimum message ID from the message ID (0x XXX) to get a hexadecimal number, convert it to a decimal number, and then divide it by 128. The divisor obtained by rounding down is the priority difference.
[0131] Finally, the priority difference factor can be determined based on the above priority difference.
[0132] As an exemplary implementation, the execution subject of the embodiment of the present application may pre-store the correspondence between the priority difference and the priority difference factor. Based on this, the execution subject of the embodiment of the present application may determine the priority difference factor corresponding to the priority difference according to the above correspondence. Among them, the correspondence between the above priority difference and the priority difference factor may be shown in the following Table 1:
[0133] Table 1
[0134] Level difference <![CDATA[Q i (Priority Difference Factor)]]> 0 5% 1 10% 2 15% 3 20%
[0135] Step 203: For each type of message, a correction parameter of the message is determined according to the signal-to-noise ratio factor, the load rate, and the priority difference factor corresponding to the message of the type.
[0136] In one embodiment, after obtaining the signal-to-noise ratio factor and load rate of the CAN bus, as well as the priority difference factor of each type of message, the correction parameters of each type of message can be determined according to the above signal-to-noise ratio factor, load rate, and the priority difference factor corresponding to the type of message.
[0137] As an optional implementation, a minimum value within the first preset range may be determined, and for each type of message, the load rate may be added to the priority difference factor corresponding to the message of the type to obtain a first correction value. Then, a ratio of the first correction value to the minimum value may be determined to obtain a second correction value. Finally, the signal-to-noise ratio factor may be multiplied by the second correction value to obtain a correction parameter corresponding to the message of the type.
[0138] As an exemplary implementation, the above-mentioned signal-to-noise ratio factor, load rate, and priority difference factor corresponding to this type of message may be calculated according to the preset formula shown in the following formula (VI) to obtain the correction parameter of this type of message:
[0139]
[0140] Among them, the above K i is the correction parameter corresponding to the i-th type of message, the above S is the above signal-to-noise ratio factor, the above L is the above load rate, and the above Q i is the priority difference factor corresponding to the i-th type of message, and the above A is the minimum value within the above first preset range.
[0141] The technical solution provided in the embodiment of the present application determines the signal-to-noise ratio factor of the CAN bus, determines the priority difference factor between the priority of each type of message and the priority of the preset message, and for each type of message, determines the correction parameter of the type of message according to the above signal-to-noise ratio factor, the above load rate, and the priority difference factor corresponding to the type of message. This technical solution determines the correction factor of each type of message by comprehensively considering the signal-to-noise ratio factor and load rate of the CAN bus, as well as the priority difference factor of each type of message, and can eliminate the influence of factors such as the signal-to-noise ratio, load rate, and priority of each type of message of the CAN bus on the message anomaly detection process, thereby improving the accuracy of message anomaly detection.
[0142] See also Figure 3 , which is a flow chart of an embodiment of another CAN message anomaly detection method provided in an embodiment of the present application. Figure 3 The process shown in Figure 1 Based on the process shown in FIG. 1 , the specific method of determining abnormal messages in a message set is described. Figure 3 As shown, the process may include the following steps:
[0143] Step 301: Obtain a message set to be detected and a load rate of the CAN bus in a time period corresponding to the message set, wherein the message set includes messages of multiple types.
[0144] Step 302: When the load rate is within a first preset range, a correction parameter for each type of message is determined based on the load rate, where the correction parameter is used to correct the information entropy of the message set.
[0145] Step 303: Determine the information entropy of the message set based on the correction parameters of each type of message.
[0146] Step 304: When the information entropy is not within the second preset range, determine that an abnormal message exists in the message set.
[0147] For a detailed description of steps 301 to 304 , please refer to the description of steps 101 to 104 , which will not be repeated here.
[0148] Step 305: Divide the above message set into two sub-message sets.
[0149] Step 306: Determine the relative entropy between each of the above sub-message sets and a preset message set, where the preset message set is a message set without any abnormal messages.
[0150] Step 307: Determine abnormal messages in the message set based on the relative entropy corresponding to each of the above sub-message sets.
[0151] The following is a unified description of steps 305 to 307:
[0152] In the embodiment of the present application, when it is determined that there are abnormal messages in the message set, the binary method and the relative entropy of the message set can be used to determine the abnormal messages in the message set.
[0153] As an optional implementation method, the above message set may be first divided into two sub-message sets.
[0154] As an exemplary implementation, the message types in the above message set may be evenly divided into two sub-message sets.
[0155] As another exemplary implementation, the above message set may be randomly divided into two sub-message sets.
[0156] Afterwards, the relative entropy between each sub-message set and a preset message set may be determined. The preset message set is a message set without abnormal messages, which may be a message set that has been determined to have no abnormal messages within a historical time period.
[0157] As an optional implementation, the sending probability of each sub-message set relative to the message set can be determined respectively, and the sending probability of the preset message set relative to the above message set can be determined, and then the relative entropy of each sub-message set and the preset message set can be determined by the following formula (VII) and the following formula (VIII) respectively:
[0158]
[0159] Among them, the above D(P S1 ||P S ) is the relative entropy of the first sub-message set and the preset message set, the above P S1 is the sending probability of the first sub-message set relative to the message set, the above P S is the sending probability of the above preset message set relative to the message set.
[0160]
[0161] Among them, the above D(P S2 ||P S ) is the relative entropy of the second sub-message set and the preset message set, and the above P S2 is the sending probability of the second sub-message set relative to the message set, the above P S is the sending probability of the above preset message set relative to the message set.
[0162] As an exemplary real-time method, for each sub-message set, the probability values of all types of messages included in the sub-message set may be added to obtain a first probability value. Then, the probability values of all types of messages included in the message set may be added to obtain a second probability value. Finally, the first probability value may be divided by the second probability value to obtain the sending probability of the sub-message set relative to the message set.
[0163] Finally, based on the relative entropy corresponding to each sub-message set, the abnormal messages in the message set can be determined.
[0164] As an optional implementation, when determining abnormal messages in a message set based on the relative entropy corresponding to each sub-message set, it can be determined whether the relative entropy corresponding to each sub-message set is within the above-mentioned second preset range.
[0165] Optionally, if the relative entropy corresponding to the sub-message set is within the second preset range, it means that there is no abnormal message in the sub-message set.
[0166] Optionally, if the relative entropy corresponding to the sub-message set is not within the second preset range, it indicates that there are abnormal messages in the sub-message set.
[0167] Furthermore, for a sub-message set whose relative entropy is not within the second preset range, the executing entity of the embodiment of the present application may continue to split the sub-message set into two new sub-message sets, and again determine the relative entropy of each new sub-message set with the preset message set (hereinafter referred to as the new relative entropy for ease of distinction).
[0168] Afterwards, it may be determined again whether the new relative entropy is within the second preset range.
[0169] Optionally, if the new relative entropy is within the second preset range, it means that there are no abnormal messages in the new sub-message set, so the new sub-message set may no longer be split.
[0170] On the contrary, if the new relative entropy is not within the second preset range, it means that there are abnormal messages in the new sub-message set, so the new sub-message set can be split again.
[0171] Furthermore, for the new sub-message set whose new relative entropy is not within the second preset range, the executing entity of the embodiment of the present application can determine whether the new sub-message set can be split again, that is, whether the new sub-message set includes two or more types of messages.
[0172] Optionally, if the new sub-message set cannot be split, the messages included in the new sub-message set are determined to be abnormal messages, that is, the lost messages are the messages in the new sub-message set.
[0173] On the contrary, if the new sub-message set can be further split, the new sub-message set can be used as a new sub-message set to execute the step of continuing to split the sub-message set into two new sub-message sets until an abnormal message is determined.
[0174] In addition, in an embodiment of the present application, the message set can be split into more than two sub-message sets, and the relative entropy of each sub-message set and the preset message set can be determined, so as to continue to determine the abnormal messages according to the binary search method. The embodiment of the present application does not limit the number of sub-message sets into which the message set is split.
[0175] The technical solution provided by the embodiment of the present application is to obtain the current message set to be detected and the load rate of the CAN bus in the time period corresponding to the above message set, the above message set includes multiple types of messages, and when the above load rate is within the first preset range, the correction parameter of each type of message is determined based on the above load rate, and the above correction parameter is used to correct the information entropy of the message set, and the information entropy of the above message set is determined based on the correction parameter of each type of message, and when the above information entropy is not within the second preset range, it is determined that there are abnormal messages in the message set, and the above message set is divided into two sub-message sets, and the relative entropy of each of the above sub-message sets and the preset message set is determined, and the above preset message set is a message set without abnormal messages, and the abnormal messages in the message set are determined based on the relative entropy corresponding to each of the above sub-message sets. This technical solution, by determining that there are abnormal messages in the message set according to the information entropy of the message set, further locating the abnormal messages in the message set according to the relative entropy of the message set, realizes efficient and accurate determination of whether there are abnormal messages in the message set, and quickly and accurately determines the abnormal messages in the message set.
[0176] See also Figure 4 , is a block diagram of an embodiment of a CAN message anomaly detection device provided in an embodiment of the present application. Figure 4 As shown, the device may include:
[0177] An acquisition module 41 is used to acquire a message set to be detected and a load rate of a controller area network CAN bus in a time period corresponding to the message set, wherein the message set includes messages of multiple types;
[0178] A first determination module 42, configured to determine, when the load rate is within a first preset range, a correction parameter for each type of message based on the load rate, the correction parameter being used to correct the information entropy of the message set;
[0179] A second determination module 43, configured to determine the information entropy of the message set based on the correction parameter of each type of message;
[0180] The third determining module 44 is configured to determine that an abnormal message exists in the message set when the information entropy is not within a second preset range.
[0181] like Figure 5 As shown, it is a schematic diagram of the structure of a vehicle provided in an embodiment of the present application, including a processor 51, a communication interface 52, a memory 53 and a communication bus 54, wherein the processor 51, the communication interface 52, and the memory 53 communicate with each other through the communication bus 54.
[0182] A memory 53, for storing computer programs;
[0183] In one embodiment of the present application, the processor 51 is used to execute the program stored in the memory 53 to implement the CAN message anomaly detection method provided by any of the above method embodiments, including:
[0184] Acquire a message set to be detected and a load rate of a controller area network (CAN) bus in a time period corresponding to the message set, wherein the message set includes messages of multiple types;
[0185] When the load rate is within a first preset range, determining a correction parameter for each type of message based on the load rate, the correction parameter being used to correct the information entropy of the message set;
[0186] Determining the information entropy of the message set based on the correction parameter of each type of message;
[0187] When the information entropy is not within the second preset range, it is determined that an abnormal message exists in the message set.
[0188] An embodiment of the present application further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the CAN message anomaly detection method provided in any of the aforementioned method embodiments are implemented.
[0189] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, i.e., they may be located in one place, or may be distributed over multiple grid units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.
[0190] Through the text of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a general hardware platform, and of course, by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a grid device, etc.) to execute the methods described in each embodiment or some parts of the embodiment.
[0191] It should be understood that the terms used in the text are only for the purpose of the specific example implementation of the text, and are not intended to be limited. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used in the text can also be represented to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of the stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or their combinations. The method steps, processes, and operations of the text in the text are not interpreted as necessarily requiring them to be performed in the specific order of the text or description, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps can be used.
[0192] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A CAN message anomaly detection method, characterized in that: The method comprises: Acquire a message set to be detected and a load rate of a controller area network (CAN) bus in a time period corresponding to the message set, wherein the message set includes messages of multiple types; When the load rate is within a first preset range, determining a correction parameter for each type of message based on the load rate, the correction parameter being used to correct the information entropy of the message set; Determining the information entropy of the message set based on the correction parameter of each type of message; When the information entropy is not within the second preset range, it is determined that an abnormal message exists in the message set.
2. The method according to claim 1, characterized in that The determining of the correction parameter of each type of message based on the load rate includes: Determining a signal-to-noise ratio factor of the CAN bus, and determining a priority difference factor between the priority of each type of message and the priority of a preset message; For each type of message, a correction parameter of the type of message is determined according to the signal-to-noise ratio factor, the load rate, and a priority difference factor corresponding to the type of message.
3. The method according to claim 2, characterized in that The priority difference factor between the priority of each type of message and the priority of the preset message includes: For each type of message, convert the bit value of the message identifier corresponding to the type of message from the bit value to a first value of a first preset base; Subtract the second value of the first preset base of the message identifier corresponding to the preset message from the first value to obtain a first base target value; Converting the first base target value into a second base target value in a second preset base, wherein the first preset base and the second preset base are different bases; Divide the binary target value by a preset value and round down to obtain the priority difference of the class of messages; A priority difference factor is determined according to the priority difference.
4. The method according to claim 2, characterized in that: The step of determining, for each type of message, a correction parameter of the type of message according to the signal-to-noise ratio factor, the load rate, and a priority difference factor corresponding to the type of message, includes: Determining a minimum value within the first preset range; For each type of message, add the load rate and the priority difference factor corresponding to the type of message to obtain a first correction value; Determine a ratio of the first correction value to the minimum value to obtain a second correction value; The signal-to-noise ratio factor is multiplied by the second correction value to obtain a correction parameter for the type of message.
5. The method according to claim 2, characterized in that: The determining of the signal-to-noise ratio factor of the CAN bus comprises: Obtaining a signal-to-noise ratio of the CAN bus; When the signal-to-noise ratio is within a third preset range, determining a maximum value within the third preset range; Subtract the signal-to-noise ratio from the maximum value to obtain a first reference value; Dividing the first reference value by a first preset value to obtain a second reference value; The second reference value is added to a second preset value to obtain the signal-to-noise ratio factor.
6. The method according to claim 1, characterized in that The determining the information entropy of the message set based on the correction parameter of each type of message includes: Determine the probability value of each type of message generated in the message set; The probability value of each type of message and the correction parameter of each type of message are calculated according to a preset formula to obtain the information entropy of the message set; wherein the preset formula is as follows: Wherein, H(S) is the information entropy, n is the number of types of messages in the message set, and K i is the correction parameter corresponding to the i-th type of message, the P i is the probability value of the i-th type of message.
7. The method according to claim 1, characterized in that After determining that an abnormal message exists in the message set, the method further includes: Dividing the message set into two sub-message sets; Determine the relative entropy between each of the sub-message sets and a preset message set, where the preset message set is a message set without any abnormal messages; Based on the relative entropy corresponding to each of the sub-message sets, abnormal messages in the message set are determined.
8. The method according to claim 7, characterized in that The determining, based on the relative entropy corresponding to each of the sub-message sets, an abnormal message in the message set includes: Determining whether the relative entropy corresponding to each of the sub-message sets is within the second preset range; For the sub-message set whose relative entropy is not within the second preset range, continue to split the sub-message set into two new sub-message sets, and determine a new relative entropy between each new sub-message set and the preset message set; For the new sub-message set whose new relative entropy is not within the second preset range, if the new sub-message set cannot be split, determining the messages included in the new sub-message set as abnormal messages; For the new sub-message set whose new relative entropy is not within the second preset range, if the new sub-message set can be further split, the new sub-message set is used as a sub-message set to execute the step of continuing to split the sub-message set into two new sub-message sets, and determining the new relative entropy of each new sub-message set with the preset message set, until the abnormal message is determined.
9. A CAN message anomaly detection device, characterized in that: The device comprises: An acquisition module, used to acquire a message set to be detected and a load rate of a controller area network (CAN) bus in a time period corresponding to the message set, wherein the message set includes messages of multiple types; A first determination module, configured to determine, when the load rate is within a first preset range, a correction parameter for each type of message based on the load rate, wherein the correction parameter is used to correct the information entropy of the message set; A second determination module, configured to determine the information entropy of the message set based on the correction parameter of each type of message; The third determination module is used to determine whether there is an abnormal message in the message set when the information entropy is not within a second preset range.
10. A vehicle, characterized in that: include: A processor and a memory, wherein the processor is used to execute a CAN message anomaly detection program stored in the memory to implement the CAN message anomaly detection method according to any one of claims 1 to 8.
Citation Information
Patent Citations
In-vehicle network intrusion detection method based on state awareness
CN116318955A
Vehicle charging interface attack detection method and device, equipment and storage medium
CN118802351A
Vehicle fuel monitoring system and methods
US20230044784A1
Cited By
CAN message anomaly detection method and device and vehicle
CN119484347A
Method, device and vehicle for detecting CAN message anomaly
CN119484347B