CAN message anomaly detection methods, devices and vehicles
By acquiring load rate and signal-to-noise ratio factors on the CAN bus, combining them with priority difference correction parameters, and utilizing the information entropy calculation method, the problems of low efficiency and insufficient accuracy in CAN message loss detection are solved, achieving efficient and accurate abnormal message detection.
Patent Information
- Application Number
- CN202411476382.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-22
- Publication Date
- 2025-11-14
- Estimated Expiration
- 2044-10-22
AI Technical Summary
Existing technologies for detecting lost CAN messages are inefficient and inaccurate, especially when the CAN bus is interfered with, they are prone to misjudgment.
By obtaining the load rate of the message set, the correction parameters for each type of message are determined. Abnormal messages are detected using the information entropy calculation method, including comprehensive correction of signal-to-noise ratio factors, priority difference factors, and load rate. The message set is then decomposed to identify abnormal messages.
It enables efficient and accurate detection of CAN message anomalies under CAN bus interference, reducing false positives and improving detection efficiency and accuracy.
Smart Images

Figure CN119341945B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of CAN bus communication technology, and in particular to a method, device and vehicle for detecting abnormal CAN messages. Background Technology
[0002] The Controller Area Network (CAN) bus is the most widely used bus in automobiles and serves as the vehicle's underlying communication network. Different controllers within the vehicle can communicate with each other via the CAN bus.
[0003] In practical applications, controllers communicate by sending messages to the CAN bus. However, there is a possibility of message loss during the process of the controller sending messages through the CAN bus.
[0004] Currently, message loss detection is generally achieved by checking whether certain important message IDs of the controller have timed out. This method is not only inefficient, but also prone to message timeouts when the CAN bus is interfered with, thus failing to detect message loss. Therefore, the above detection method is also inaccurate. Summary of the Invention
[0005] This application provides a CAN message anomaly detection method, device, and vehicle to solve the technical problems of low detection efficiency and inaccurate detection efficiency in the prior art for message loss detection.
[0006] Firstly, this application provides a method for detecting CAN message anomalies, the method comprising:
[0007] Obtain the current set of messages to be detected, and the load rate of the CAN bus of the controller area network for the corresponding time period of the message set. The message set includes multiple types of messages.
[0008] When the load rate is within a first preset range, a correction parameter for each type of message is determined based on the load rate. The correction parameter is used to correct the information entropy of the message set.
[0009] Based on the correction parameters for each type of message, the information entropy of the message set is determined;
[0010] If the information entropy is not within the second preset range, it is determined that there are abnormal messages in the message set.
[0011] As one possible implementation, determining the correction parameters for each type of message based on the load rate includes:
[0012] Determine the signal-to-noise ratio factor of the CAN bus, and determine the priority difference factor between the priority of each type of message and the priority of a preset message;
[0013] For each type of message, the correction parameters for that type of message are determined based on the signal-to-noise ratio factor, the load rate, and the priority difference factor corresponding to that type of message.
[0014] As one possible implementation, the step of determining the priority difference factor between the priority of each type of message and the priority of a preset message includes:
[0015] For each type of message, the bit value of the message identifier corresponding to that type of message is converted from a bit value to a first value in a first preset base;
[0016] Subtract the second value of the first preset base corresponding to the message identifier of the preset message from the first value to obtain the first base target value;
[0017] Convert the first base target value into the second preset base binary target value, wherein the first preset base and the second preset base are different bases;
[0018] Divide the binary target value by a preset value and round down to obtain the priority difference of the message class;
[0019] Based on the aforementioned priority difference, determine the priority difference factor.
[0020] As one possible implementation, determining the correction parameters for each type of message based on the signal-to-noise ratio factor, the load rate, and the priority difference factor corresponding to the message type includes:
[0021] Determine the minimum value within the first preset range;
[0022] For each type of message, the load rate is added to the priority difference factor corresponding to that type of message to obtain a first correction value;
[0023] The ratio of the first correction value to the minimum value is determined to obtain the second correction value;
[0024] Multiply the signal-to-noise ratio factor by the second correction value to obtain the correction parameters for the message type.
[0025] As one possible implementation, determining the signal-to-noise ratio factor of the CAN bus includes:
[0026] Obtain the signal-to-noise ratio of the CAN bus;
[0027] When the signal-to-noise ratio is within a third preset range, determine the maximum value within the third preset range;
[0028] Subtracting the signal-to-noise ratio from the maximum value yields the first reference value;
[0029] Divide the first reference value by the first preset value to obtain the second reference value;
[0030] The signal-to-noise ratio factor is obtained by adding the second reference value to the second preset value.
[0031] As one possible implementation, determining the information entropy of the message set based on the correction parameters for each type of message includes:
[0032] Determine the probability value of each type of message generated in the message set;
[0033] The probability value of each type of message and the correction parameter of each type of message are calculated according to a preset formula to obtain the information entropy of the message set; wherein the preset formula is as follows:
[0034]
[0035] Wherein, H(S) is the information entropy, n is the number of message types in the message set, and K... i For the correction parameters corresponding to the i-th type of message, the P i This represents the probability value for the generation of the i-th type of message.
[0036] As one possible implementation, after determining that there are abnormal packets in the packet set, the method further includes:
[0037] The message set is divided into two sub-message sets;
[0038] Determine the relative entropy between each of the sub-message sets and a preset message set, wherein the preset message set is a message set in which no abnormal messages exist;
[0039] Based on the relative entropy corresponding to each of the sub-message sets, the abnormal messages in the message set are determined.
[0040] As one possible implementation, determining the abnormal packets in the packet set based on the relative entropy corresponding to each of the sub-packet sets includes:
[0041] Determine whether the relative entropy corresponding to each of the sub-message sets is within the second preset range;
[0042] For the sub-packet set whose relative entropy is not within the second preset range, the sub-packet set is further split into two new sub-packet sets, and the new relative entropy of each new sub-packet set with respect to the preset packet set is determined.
[0043] For the new sub-message set whose new relative entropy is not within the second preset range, if the new sub-message set cannot be split, the messages contained in the new sub-message set are determined to be abnormal messages;
[0044] For a new sub-packet set whose new relative entropy is not within the second preset range, if the new sub-packet set can be further split, the new sub-packet set is used as a sub-packet set to perform the step of further splitting the sub-packet set into two new sub-packet sets and determining the new relative entropy of each new sub-packet set with respect to the preset packet set, until the abnormal packet is identified.
[0045] Secondly, this application provides a CAN message anomaly detection device, the device comprising:
[0046] The acquisition module is used to acquire the current set of messages to be detected, and the load rate of the CAN bus of the controller local area network for the corresponding time period of the message set. The message set includes multiple types of messages.
[0047] The first determining module is used to determine the correction parameters for each type of message based on the load rate when the load rate is within a first preset range. The correction parameters are used to correct the information entropy of the message set.
[0048] The second determining module is used to determine the information entropy of the message set based on the correction parameters for each type of message;
[0049] The third determining module is used to determine that there are abnormal messages in the message set when the information entropy is not within the second preset range.
[0050] Thirdly, this application provides a vehicle, including a processor and a memory, wherein the processor is configured to execute a CAN message anomaly detection program stored in the memory to implement the CAN message anomaly detection method described in any one of the first aspects.
[0051] Fourthly, this application provides a storage medium storing one or more programs that can be executed by one or more processors to implement the CAN message anomaly detection method described in any one aspect.
[0052] The technical solution provided in this application obtains the current set of messages to be detected and the load rate of the CAN bus during the corresponding time period. The message set includes multiple types of messages. When the load rate is within a first preset range, a correction parameter is determined for each type of message based on the load rate. This correction parameter is used to correct the information entropy of the message set. Based on the correction parameter for each type of message, the information entropy of the message set is determined. If the information entropy is not within a second preset range, it is determined that there are abnormal messages in the message set. This technical solution determines whether there are abnormal messages in the message set in a timely manner by determining whether the information entropy in the received message set is within a preset range. Furthermore, information entropy can express the determinism of the entire system. Determining the correction parameter for each type of message based on the CAN bus load rate and the information entropy of the message set determined based on the correction parameter is more accurate. This avoids the inaccurate detection of abnormal messages caused by overall CAN bus interference, achieving efficient and accurate detection of whether there are abnormal CAN messages. Attached Figure Description
[0053] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0054] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments or the prior art will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.
[0055] One or more embodiments are illustrated by way of example with reference numerals in the accompanying drawings. These illustrations do not constitute a limitation on the embodiments. Elements with the same reference numerals in the drawings are denoted as similar elements. Unless otherwise stated, the figures in the drawings are not to be limited by scale.
[0056] Figure 1 A flowchart illustrating an embodiment of a CAN message anomaly detection method provided in this application;
[0057] Figure 2 A flowchart illustrating an embodiment of another CAN message anomaly detection method provided in this application;
[0058] Figure 3 A flowchart illustrating an embodiment of another CAN message anomaly detection method provided in this application;
[0059] Figure 4A block diagram illustrating an embodiment of a CAN message anomaly detection device provided in this application.
[0060] Figure 5 This is a structural schematic diagram of a vehicle provided in an embodiment of this application. Detailed Implementation
[0061] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some, not all, of the embodiments of this application. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0062] The following disclosure provides numerous different embodiments or examples for implementing various structures of the invention. To simplify the disclosure, specific examples of components and arrangements are described below. These are merely examples and are not intended to limit the scope of the invention. Furthermore, reference numerals and / or letters may be repeated in different examples. Such repetition is for simplification and clarity and does not in itself indicate a relationship between the various embodiments and / or arrangements discussed.
[0063] To address the shortcomings of existing technologies that detect message loss by checking message IDs for timeouts, this application provides a CAN message anomaly detection method, apparatus, and vehicle. This method determines the presence of abnormal messages by checking if the information entropy of the received message set is within a preset range. Furthermore, information entropy represents the determinism of the entire system. Determining the correction parameters for each message based on the CAN bus load rate and using the resulting information entropy of the message set is more accurate. This avoids the inaccurate detection of abnormal messages caused by overall CAN bus interference, achieving efficient and accurate detection of CAN message anomalies.
[0064] The CAN message anomaly detection method provided in this application will be further explained and described below with reference to the accompanying drawings and specific embodiments. The embodiments do not constitute a limitation on the embodiments of the present invention.
[0065] See Figure 1 This is a flowchart illustrating an embodiment of a CAN message anomaly detection method provided in this application. Figure 1 As shown, the process may include the following steps:
[0066] Step 101: Obtain the current set of messages to be detected, and the load rate of the CAN bus for the corresponding time period of the above message set. The above message set includes multiple types of messages.
[0067] The aforementioned message set refers to the set of messages received by the vehicle's CAN bus that are to be checked for abnormalities.
[0068] In this system, different domain controllers of the vehicle communicate with each other via a CAN bus. The CAN bus can correspond to a communication system for receiving and sending CAN messages from different domain controllers. Furthermore, after receiving CAN messages sent by the domain controllers, the communication system can periodically or in real time detect the CAN messages to determine whether there are any abnormal messages. Here, abnormal messages can be lost messages, and the aforementioned message set is the set of messages to be detected for abnormality.
[0069] Furthermore, the aforementioned message set may include multiple types of messages. Here, the message type can be distinguished by a message identifier. The message identifier may be a message ID (Identity Document) or other identifiers used to distinguish message types. This application embodiment does not limit this.
[0070] Furthermore, the vehicle CAN bus generally includes periodic messages and event-triggered messages, and the CAN message anomaly detection method provided in this application can detect periodic messages.
[0071] The aforementioned load rate refers to the load pressure on the CAN bus within the corresponding time period of the aforementioned message set.
[0072] In one embodiment, the executing entity of this application embodiment can obtain a detection window to be detected, and determine the current set of messages to be detected based on the detection window. The detection window can be a pre-set window for performing CAN message anomaly detection, and can be represented by the number of messages or by a time period.
[0073] As an optional implementation, when the detection window is represented by the number of messages, it means that whenever the CAN bus receives the number of messages corresponding to the detection window, CAN message anomaly detection begins. Therefore, the set of messages to be detected can be obtained by obtaining the number of CAN messages recently received that corresponds to the number of the detection window.
[0074] As another optional implementation, when the above detection window is represented by a time period, it means that every time a preset time period is reached, the CAN messages received within that preset time period are detected. Therefore, when the time since the last CAN message anomaly detection reaches the time period corresponding to the above detection window, the CAN messages received within the time period corresponding to that detection window are obtained, and the current set of messages to be detected is obtained.
[0075] Based on this, after determining the above message set, the time period corresponding to the above message set can be determined, and the load rate of the CAN bus during that time period can be determined.
[0076] As an exemplary implementation, when determining the load rate of the CAN bus during the aforementioned time period, the actual transmission time of each bit value of the CAN bus during the aforementioned time period can be obtained. Then, the actual transmission time of each bit value can be calculated using the following formula (a) to obtain the load rate of the CAN bus during the aforementioned time period:
[0077] Load factor = (Actual time transmitted per bit / 1s) * 100% (Equation 1)
[0078] Step 102: When the load rate is within the first preset range, determine the correction parameters for each type of message based on the load rate. The correction parameters are used to correct the information entropy of the message set.
[0079] Step 103: Determine the information entropy of the above message set based on the correction parameters for each type of message.
[0080] The following provides a unified explanation of steps 102 and 103:
[0081] The aforementioned first preset range is a pre-determined load rate range for which correction parameters need to be determined. That is, when the load rate of the CAN bus is within the first preset range, the correction parameters for each type of message can be determined based on the aforementioned load rate. When the load rate of the CAN bus is not within the aforementioned first preset range, the correction parameters for each type of message can be determined. When determining the information entropy of the message set below, it can be determined directly according to the existing method without the need for correction parameters. The specific determination method will be explained below and will not be detailed here.
[0082] For example, the first preset range mentioned above can be [40%, 70%). When the load rate is greater than or equal to 40% (and less than 70%), the correction parameters for each type of message can be determined. When the load rate is less than 40%, all message IDs can be sent according to the design state. At this time, the information entropy is not affected by the CAN bus and message priority. When the load rate is greater than 70%, if there is a message abnormality, the information entropy determined according to the existing method can also be accurately detected without correction.
[0083] The above correction parameters are used to correct the information entropy of the message set.
[0084] In this application, the CAN protocol uses non-destructive arbitration to send messages, meaning that messages with smaller message IDs have higher transmission priority. Especially when the bus is interfered with, higher-priority messages are largely unaffected, but lower-priority messages experience significant fluctuations. This can lead to large errors in the calculated information entropy, exceeding a preset threshold and causing misjudgments of communication loss. Therefore, in this embodiment, a correction parameter can be determined based on the CAN bus load rate to reduce the error in determining the information entropy of the message set.
[0085] In one embodiment, after determining the load rate of the CAN bus, the executing entity of this application embodiment can determine whether the load rate is within the first preset range, and if the load rate is within the first preset range, determine the correction parameters for each type of message based on the load rate.
[0086] As for how the correction parameters for each type of message are determined based on the load rate, this will be explained below. Figure 2 The process shown will be explained in detail here.
[0087] Then, the information entropy of the message set can be determined based on the correction parameters of each type of message.
[0088] As an optional implementation, when the load rate is within the first preset range, when determining the information entropy of the message set based on the correction parameters of each type of message, the probability value of each type of message generated in the message set can be determined first.
[0089] As an exemplary implementation, when determining the probability value of each type of message generated in the message set, the transmission period corresponding to each type of message and the detection window corresponding to the message set can be obtained. The aforementioned transmission period refers to the period during which messages are transmitted at regular intervals. As can be seen from the description in step 101, this application targets periodic messages received on the vehicle CAN bus.
[0090] Then, the transmission period and detection window corresponding to each type of message can be calculated according to the preset formula shown in formula (II) to obtain the probability value of each type of message:
[0091]
[0092] Among them, the above P i Let C be the probability value for the generation of the i-th type of message, and T be the detection window. i Let n be the sending period corresponding to the i-th type of message, and n is the number of message types in the above message set.
[0093] At this point, the probability value of each message generated in the message set can be obtained.
[0094] Based on the probability value and correction parameter of each type of message determined above, the execution entity of this application embodiment can calculate the probability value and correction parameter of each type of message according to the preset formula shown in formula (iii) below to obtain the information entropy of the message set:
[0095]
[0096] Wherein, H(S) is the information entropy, n is the number of message types in the message set, and K... i For the correction parameters corresponding to the i-th type of message, the above P i This represents the probability value for the generation of the i-th type of message.
[0097] Furthermore, when the aforementioned load rate is not within the aforementioned first preset range, when determining the information entropy of the message set, it is no longer necessary to correct it using the correction parameters for each type of message. Therefore, the information entropy of the message set can be determined using the preset formula shown in Equation (IV):
[0098]
[0099] Wherein, H(S) is the information entropy, n is the number of message types in the message set, and P... i Let be the probability value of the i-th type of message. It is understood that the probability value of each type of message is determined in the same way as in Equation (II) above, and will not be repeated here.
[0100] Step 104: If the above information entropy is not within the second preset range, determine that there are abnormal messages in the above message set.
[0101] The aforementioned second preset range refers to the range to which the above-mentioned message set belongs when there are no abnormalities in the messages received by the CAN bus (e.g., no lost messages).
[0102] In practical applications, when there are no abnormalities in the CAN bus received message set, the information entropy of the message set is within a preset range, namely the second preset range mentioned above.
[0103] In this embodiment of the application, after determining the information entropy of the above-mentioned message set, it can be determined whether the above-mentioned information entropy is within the above-mentioned second preset range.
[0104] Optionally, if the information entropy is determined to be within the second preset range, it can be determined that there are no abnormal messages in the message set at this time.
[0105] Conversely, if it is determined that the above information entropy is not within the second preset range, it can be determined that there are abnormal messages in the message set at this time.
[0106] Furthermore, when it is determined that there are abnormal messages in the message set, the execution entity of this application embodiment can determine the abnormal messages in the message set based on the relative entropy of the message set. As to how the abnormal messages are determined from the message set, this will be explained below. Figure 3 The process shown will be explained in detail here.
[0107] The technical solution provided in this application obtains the current set of messages to be detected and the load rate of the CAN bus during the corresponding time period. The message set includes multiple types of messages. When the load rate is within a first preset range, a correction parameter is determined for each type of message based on the load rate. This correction parameter is used to correct the information entropy of the message set. Based on the correction parameter for each type of message, the information entropy of the message set is determined. If the information entropy is not within a second preset range, it is determined that there are abnormal messages in the message set. This technical solution determines whether there are abnormal messages in the message set in a timely manner by determining whether the information entropy in the received message set is within a preset range. Furthermore, information entropy can express the determinism of the entire system. Determining the correction parameter for each type of message based on the CAN bus load rate and the information entropy of the message set determined based on the correction parameter is more accurate. This avoids the inaccurate detection of abnormal messages caused by overall CAN bus interference, achieving efficient and accurate detection of whether there are abnormal CAN messages.
[0108] See Figure 2 This is a flowchart of an embodiment of another CAN message anomaly detection method provided in this application. Figure 2 The process shown is in Figure 1 Based on the illustrated process, the specific method for determining the correction parameters for each type of message based on the load rate is described. For example... Figure 2 As shown, the process may include the following steps:
[0109] Step 201: Determine the signal-to-noise ratio factor of the CAN bus.
[0110] The aforementioned signal-to-noise ratio factor refers to the correction factor of the CAN bus's signal-to-noise ratio to the information entropy in the message set.
[0111] In practical applications, when the signal quality of the CAN bus is poor, it may affect the accuracy of message anomaly detection. Therefore, in this embodiment, the impact of CAN signal quality on message anomaly detection can be reduced by the signal-to-noise ratio factor.
[0112] In this embodiment of the application, since the above-mentioned signal-to-noise ratio factor is to reduce the impact of the CAN bus signal quality on message anomaly detection, and the CAN bus signal quality can be represented by the CAN bus signal-to-noise ratio, the execution subject of this embodiment of the application can first obtain the CAN bus signal-to-noise ratio when determining the CAN bus signal-to-noise ratio factor.
[0113] Then, it can be determined whether the above signal-to-noise ratio is within the preset range (hereinafter referred to as the third preset range for easy distinction).
[0114] Optionally, if the signal-to-noise ratio (SNR) is within the aforementioned third preset range, it indicates that the signal quality of the CAN bus is affecting the anomaly detection of the message. Therefore, the maximum value within the third preset range can be determined, and the SNR can be subtracted from the maximum value to obtain the first reference value. Then, the first reference value can be divided by the first preset value to obtain the second reference value, and the second reference value can be added to the second preset value to obtain the aforementioned SNR factor. The first preset value can be a SNR that represents a relatively good signal, such as 100; the second preset value can be a pre-set value, such as 1.
[0115] As an exemplary implementation, the signal-to-noise ratio of the CAN bus can be calculated using the preset formula shown in equation (v) below:
[0116]
[0117] Wherein, S is the signal-to-noise ratio factor, B is the maximum value within the third preset range, and SNR is the signal-to-noise ratio.
[0118] Furthermore, the aforementioned third preset range can be within the range of [20, 40] dB, or of course, other ranges. This application embodiment does not limit this. Among them, when the signal-to-noise ratio is greater than 40 dB, the CAN bus signal quality is excellent, and there is no need to consider the impact of this interference on the detection accuracy. When the signal-to-noise ratio is less than 20 dB, no correction is required, and the message anomaly can be accurately detected according to the original formula (Equation (IV) above).
[0119] Conversely, if the signal-to-noise ratio is not within the third preset range mentioned above, it indicates that the signal quality of the CAN bus does not affect the abnormal detection of the message. Therefore, the above signal-to-noise ratio factor can be set to a preset value, which can indicate that the signal-to-noise ratio factor does not exist, for example, 0.
[0120] Step 202: Determine the priority difference factor between the priority of each type of message and the priority of the preset message.
[0121] The aforementioned priority refers to the priority level of message transmission. The higher the priority, the faster the message will be transmitted.
[0122] Accordingly, the priority difference factor mentioned above is the factor corresponding to the priority difference between two messages, which can be used to correct the impact of message priority on message anomaly detection.
[0123] The aforementioned preset message refers to a pre-defined standard message, which can be the message with the smallest message ID, that is, the message with the highest priority.
[0124] In this embodiment of the application, each type of message can correspond to a priority, and the different priorities of different types of messages will have a certain impact on message anomaly detection. Therefore, the execution subject of this embodiment of the application can determine a priority difference factor corresponding to each type of message for each type of message, thereby reducing the impact of the priority of that type of message on message anomaly detection.
[0125] As an optional implementation, the executing entity in this application embodiment can first determine a preset message as a standard, and then determine the priority difference between each type of message and the preset message. Furthermore, different priority differences can correspond to a priority factor; therefore, after determining the priority difference for each type of message, the priority factor corresponding to each type of message can be determined.
[0126] Specifically, for each type of message, the bit value of the message identifier corresponding to that type of message can be converted into a first value in a first preset base. The bit value can be the bit value of the message identifier itself, such as an 11-bit bit value, and the first preset base can be hexadecimal.
[0127] Then, the first value can be subtracted from the second value of the first preset base corresponding to the message identifier of the preset message to obtain the first base target value.
[0128] Then, the first base target value can be converted into the second preset base (e.g., decimal) binary target value, where the first preset base and the second preset base are different bases.
[0129] Next, the aforementioned binary target value can be divided by a preset value and rounded down to obtain the priority difference for this type of message. The preset value can be 128.
[0130] For example, suppose the CANID is an 11-bit ID, which can be converted to hexadecimal to get 0xXXX. Then, subtract the smallest message ID from the message ID (0xXXX) to get a hexadecimal number, convert it to decimal, divide it by 128, and round down the divisor to get the priority difference.
[0131] Finally, priority difference factors can be determined based on the above priority differences.
[0132] As an exemplary implementation, the execution entity of this application embodiment can pre-store the correspondence between priority differences and priority difference factors. Based on this, the execution entity of this application embodiment can determine the priority difference factor corresponding to the priority difference according to the above correspondence. The correspondence between the priority differences and priority difference factors is shown in Table 1 below:
[0133] Table 1
[0134] Grade difference <![CDATA[Q i (Priority difference factors) 0 5% 1 10% 2 15% 3 20%
[0135] Step 203: For each type of message, determine the correction parameters for that type of message based on the above signal-to-noise ratio factor, the above load rate, and the priority difference factor corresponding to that type of message.
[0136] In one embodiment, after obtaining the signal-to-noise ratio factor and load rate of the CAN bus, as well as the priority difference factor of each type of message, the correction parameters of each type of message can be determined based on the aforementioned signal-to-noise ratio factor, load rate, and priority difference factor corresponding to that type of message.
[0137] As an optional implementation, a minimum value within a first preset range can be determined, and for each type of message, the aforementioned load rate can be added to the priority difference factor corresponding to that type of message to obtain a first correction value. Then, the ratio of the first correction value to the aforementioned minimum value can be determined to obtain a second correction value. Finally, the aforementioned signal-to-noise ratio factor can be multiplied by the aforementioned second correction value to obtain the correction parameter corresponding to that type of message.
[0138] As an exemplary implementation, the signal-to-noise ratio factor, load rate, and priority difference factor corresponding to this type of message can be calculated according to the preset formula shown in formula (vi) below to obtain the correction parameters for this type of message:
[0139]
[0140] Among them, the above K i Here are the correction parameters corresponding to the i-th type of message, where S is the signal-to-noise ratio factor, L is the load factor, and Q is... i For the priority difference factor corresponding to the i-th type of message, A is the minimum value within the first preset range.
[0141] The technical solution provided in this application determines the signal-to-noise ratio (SNR) factor of the CAN bus, the priority difference factor between the priority of each type of message and the priority of a preset message, and for each type of message, a correction parameter is determined based on the aforementioned SNR factor, the aforementioned load rate, and the corresponding priority difference factor. This technical solution, by comprehensively considering the SNR factor and load rate of the CAN bus, as well as the priority difference factor of each type of message, to determine the correction factor for each type of message, can eliminate the influence of factors such as the SNR, load rate, and priority of each type of message on the message anomaly detection process, thereby improving the accuracy of message anomaly detection.
[0142] See Figure 3 This is a flowchart of an embodiment of another CAN message anomaly detection method provided in this application. Figure 3 The process shown is in Figure 1 Based on the illustrated process, the specific method for identifying abnormal packets within the packet set is described. For example... Figure 3 As shown, the process may include the following steps:
[0143] Step 301: Obtain the current set of messages to be detected, and the load rate of the CAN bus for the corresponding time period of the above message set. The above message set includes multiple types of messages.
[0144] Step 302: When the load rate is within the first preset range, determine the correction parameters for each type of message based on the load rate. The correction parameters are used to correct the information entropy of the message set.
[0145] Step 303: Determine the information entropy of the above message set based on the correction parameters of each type of message.
[0146] Step 304: If the above information entropy is not within the second preset range, determine that there are abnormal messages in the message set.
[0147] For a detailed description of steps 301 to 304, please refer to the descriptions in steps 101 to 104, which will not be repeated here.
[0148] Step 305: Divide the above message set into two sub-message sets.
[0149] Step 306: Determine the relative entropy between each of the above sub-message sets and the preset message set, where the preset message set is the message set that does not contain any abnormal messages;
[0150] Step 307: Based on the relative entropy corresponding to each of the above sub-message sets, determine the abnormal messages in the message set.
[0151] The following provides a unified explanation of steps 305 to 307:
[0152] In this embodiment of the application, when it is determined that there are abnormal messages in the message set, the binary search method and the relative entropy of the message set can be used to determine the abnormal messages in the message set.
[0153] As an optional implementation, the above message set can be divided into two sub-message sets.
[0154] As an exemplary implementation, the message types in the above message set can be equally divided into two sub-message sets.
[0155] As another exemplary implementation, the above message set can be randomly split into two sub-message sets.
[0156] Then, the relative entropy of each sub-message set and the preset message set can be determined. The preset message set is the message set without abnormal messages, which can be the message set that has been determined to have no abnormal messages within a historical time period.
[0157] As an optional implementation, the transmission probability of each sub-message set relative to the message set and the transmission probability of the preset message set relative to the aforementioned message set can be determined separately. Then, the relative entropy of each sub-message set and the preset message set can be determined using the following equations (vii) and (viii) respectively:
[0158]
[0159] Among them, the above D(P) S1 ||P S ) represents the relative entropy between the first sub-message set and the preset message set, and the above P S1 Let P be the probability of sending the first sub-message set relative to the message set. S The probability of sending the above-mentioned preset message set relative to the message set.
[0160]
[0161] Among them, the above D(P) S2 ||P S ) represents the relative entropy between the second sub-message set and the preset message set, and the above P S2 Let P be the probability of sending the second sub-message set relative to the message set. S The probability of sending the above-mentioned preset message set relative to the message set.
[0162] As an example of a real-time approach, for each sub-message set, the probability values of all types of messages included in that sub-message set can be summed to obtain a first probability value. Then, the probability values of all types of messages included in the message set can be summed to obtain a second probability value. Finally, the first probability value can be divided by the second probability value to obtain the transmission probability of that sub-message set relative to the message set.
[0163] Finally, based on the relative entropy corresponding to each sub-packet set, the abnormal packets in the packet set can be determined.
[0164] As an optional implementation, when determining abnormal packets in a packet set based on the relative entropy corresponding to each sub-packet set, it can be determined whether the relative entropy corresponding to each sub-packet set is within the aforementioned second preset range.
[0165] Optionally, if the relative entropy corresponding to the sub-message set is within the second preset range mentioned above, it indicates that there are no abnormal messages in the sub-message set.
[0166] Optionally, if the relative entropy corresponding to the sub-message set is not within the second preset range mentioned above, it indicates that there are abnormal messages in the sub-message set.
[0167] Furthermore, for a sub-message set whose relative entropy is not within the second preset range, the execution entity of this application embodiment may further split the sub-message set into two new sub-message sets, and determine the relative entropy of each new sub-message set with respect to the preset message set (hereinafter referred to as the new relative entropy for easy distinction).
[0168] Then, it can be determined again whether the new relative entropy is within the second preset range.
[0169] Optionally, if the new relative entropy is within the second preset range mentioned above, it indicates that there are no abnormal messages in the new sub-message set, so the new sub-message set does not need to be split.
[0170] Conversely, if the new relative entropy is not within the second preset range, it indicates that there are abnormal messages in the new sub-message set, so the new sub-message set can be split again.
[0171] Furthermore, for a new sub-message set whose new relative entropy is not within the second preset range, the executing entity of this application embodiment can determine whether the new sub-message set can be split again, that is, whether the new sub-message set includes two or more types of messages.
[0172] Optionally, if the new sub-message set cannot be split, the messages included in the new sub-message set are identified as abnormal messages, that is, the lost messages are the messages in the new sub-message set.
[0173] Conversely, if the new sub-message set can be further split, then the above new sub-message set can be used as a new sub-message set to continue splitting the sub-message set into two new sub-message sets until the abnormal message is identified.
[0174] In addition, in this embodiment of the application, the message set can be split into two or more sub-message sets, and the relative entropy of each sub-message set with the preset message set can be determined, so as to continue to determine the abnormal message according to the binary search method. This embodiment of the application does not limit the number of sub-message sets split into the message set.
[0175] The technical solution provided in this application obtains the current message set to be detected and the CAN bus load rate of the corresponding time period for the message set. The message set includes multiple types of messages. When the load rate is within a first preset range, a correction parameter is determined for each type of message based on the load rate. The correction parameter is used to correct the information entropy of the message set. Based on the correction parameter for each type of message, the information entropy of the message set is determined. When the information entropy is not within a second preset range, it is determined that there are abnormal messages in the message set. The message set is divided into two sub-message sets, and the relative entropy of each sub-message set with respect to a preset message set is determined. The preset message set is a message set without abnormal messages. Based on the relative entropy corresponding to each sub-message set, abnormal messages in the message set are determined. This technical solution, by determining the presence of abnormal messages in the message set based on the information entropy of the message set, and further locating the abnormal messages in the message set based on the relative entropy of the message set, achieves efficient and accurate determination of whether abnormal messages exist in the message set, while also quickly and accurately determining the abnormal messages in the message set.
[0176] See Figure 4 This is a block diagram illustrating an embodiment of a CAN message anomaly detection device provided in this application. Figure 4 As shown, the device may include:
[0177] The acquisition module 41 is used to acquire the current set of messages to be detected, and the load rate of the CAN bus of the controller local area network for the corresponding time period of the message set. The message set includes multiple types of messages.
[0178] The first determining module 42 is used to determine the correction parameters for each type of message based on the load rate when the load rate is within a first preset range. The correction parameters are used to correct the information entropy of the message set.
[0179] The second determining module 43 is used to determine the information entropy of the message set based on the correction parameters for each type of message;
[0180] The third determining module 44 is used to determine that there are abnormal messages in the message set when the information entropy is not within the second preset range.
[0181] like Figure 5 The diagram shown is a structural schematic of a vehicle according to an embodiment of this application, including a processor 51, a communication interface 52, a memory 53, and a communication bus 54. The processor 51, communication interface 52, and memory 53 communicate with each other via the communication bus 54.
[0182] Memory 53 is used to store computer programs;
[0183] In one embodiment of this application, when the processor 51 executes the program stored in the memory 53, it implements the CAN message anomaly detection method provided in any of the foregoing method embodiments, including:
[0184] Obtain the current set of messages to be detected, and the load rate of the CAN bus of the controller area network for the corresponding time period of the message set. The message set includes multiple types of messages.
[0185] When the load rate is within a first preset range, a correction parameter for each type of message is determined based on the load rate. The correction parameter is used to correct the information entropy of the message set.
[0186] Based on the correction parameters for each type of message, the information entropy of the message set is determined;
[0187] If the information entropy is not within the second preset range, it is determined that there are abnormal messages in the message set.
[0188] This application also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the CAN message anomaly detection method provided in any of the foregoing method embodiments.
[0189] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple grid units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.
[0190] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented using software and a general-purpose hardware platform, or of course, using hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or grid device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0191] It should be understood that the terminology used herein is for the purpose of illustrating specific embodiments of the text only and is not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms “a,” “an,” and “described” as used herein may also include the plural forms. The terms “comprising,” “including,” “containing,” and “having” are inclusive and therefore indicate the presence of the stated features, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not construed as requiring them to be performed in the specific order described or illustrated unless the order is explicitly indicated. It should also be understood that additional or alternative steps may be used.
[0192] The above description is merely a specific embodiment of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A method for detecting CAN message anomalies, characterized in that, The method includes: Obtain the current set of messages to be detected, and the load rate of the CAN bus of the controller area network for the corresponding time period of the message set. The message set includes multiple types of messages. When the load rate is within a first preset range, a correction parameter for each type of message is determined based on the load rate. The correction parameter is used to correct the information entropy of the message set. Based on the correction parameters for each type of message, the information entropy of the message set is determined; If the information entropy is not within the second preset range, it is determined that there are abnormal messages in the message set.
2. The method according to claim 1, characterized in that, The determination of correction parameters for each type of message based on the load rate includes: Determine the signal-to-noise ratio factor of the CAN bus, and determine the priority difference factor between the priority of each type of message and the priority of a preset message; For each type of message, the correction parameters for that type of message are determined based on the signal-to-noise ratio factor, the load rate, and the priority difference factor corresponding to that type of message.
3. The method according to claim 2, characterized in that, The factor for determining the priority difference between the priority of each type of message and the priority of a preset message includes: For each type of message, the bit value of the message identifier corresponding to the type of message is converted from a bit value to a first value in a first preset base; Subtracting the second value of the first preset base corresponding to the message identifier of the preset message from the first value yields the first base target value. Convert the first base target value into the second preset base binary target value, wherein the first preset base and the second preset base are different bases; Divide the binary target value by a preset value and round down to obtain the priority difference of the message class; Based on the aforementioned priority difference, determine the priority difference factor.
4. The method according to claim 2, characterized in that, For each type of message, the correction parameters for that type of message are determined based on the signal-to-noise ratio factor, the load rate, and the priority difference factor corresponding to that type of message, including: Determine the minimum value within the first preset range; For each type of message, the load rate is added to the priority difference factor corresponding to that type of message to obtain a first correction value; The ratio of the first correction value to the minimum value is determined to obtain the second correction value; Multiplying the signal-to-noise ratio factor by the second correction value yields the correction parameters for the message type.
5. The method according to claim 2, characterized in that, The determination of the signal-to-noise ratio factor of the CAN bus includes: Obtain the signal-to-noise ratio of the CAN bus; When the signal-to-noise ratio is within a third preset range, determine the maximum value within the third preset range; Subtracting the signal-to-noise ratio from the maximum value yields the first reference value; Divide the first reference value by the first preset value to obtain the second reference value; The signal-to-noise ratio factor is obtained by adding the second reference value to the second preset value.
6. The method according to claim 1, characterized in that, Determining the information entropy of the message set based on the correction parameters for each type of message includes: Determine the probability value of each type of message generated in the message set; The probability value of each type of message and the correction parameter of each type of message are calculated according to a preset formula to obtain the information entropy of the message set; wherein the preset formula is as follows: Wherein, H(S) is the information entropy, n is the number of message types in the message set, and K... i For the correction parameters corresponding to the i-th type of message, the P i This represents the probability value for the generation of the i-th type of message.
7. The method according to claim 1, characterized in that, After determining that there are abnormal messages in the message set, the method further includes: The message set is divided into two sub-message sets; Determine the relative entropy between each of the sub-message sets and a preset message set, wherein the preset message set is a message set in which no abnormal messages exist; Based on the relative entropy corresponding to each of the sub-message sets, the abnormal messages in the message set are determined.
8. The method according to claim 7, characterized in that, The step of determining the abnormal packets in the packet set based on the relative entropy corresponding to each of the sub-packet sets includes: Determine whether the relative entropy corresponding to each of the sub-message sets is within the second preset range; For the sub-packet set whose relative entropy is not within the second preset range, the sub-packet set is further split into two new sub-packet sets, and the new relative entropy of each new sub-packet set with respect to the preset packet set is determined. For the new sub-message set whose new relative entropy is not within the second preset range, if the new sub-message set cannot be split, the messages contained in the new sub-message set are determined to be abnormal messages; For a new sub-packet set whose new relative entropy is not within the second preset range, if the new sub-packet set can be further split, the new sub-packet set is used as a sub-packet set to perform the step of further splitting the sub-packet set into two new sub-packet sets and determining the new relative entropy of each new sub-packet set with respect to the preset packet set, until the abnormal packet is identified.
9. A CAN message anomaly detection device, characterized in that, The device includes: The acquisition module is used to acquire the current set of messages to be detected, and the load rate of the CAN bus of the controller local area network for the corresponding time period of the message set. The message set includes multiple types of messages. The first determining module is used to determine the correction parameters for each type of message based on the load rate when the load rate is within a first preset range. The correction parameters are used to correct the information entropy of the message set. The second determining module is used to determine the information entropy of the message set based on the correction parameters for each type of message; The third determining module is used to determine that there are abnormal messages in the message set when the information entropy is not within the second preset range.
10. A vehicle, characterized in that, include: A processor and a memory, wherein the processor is configured to execute a CAN message anomaly detection program stored in the memory to implement the CAN message anomaly detection method according to any one of claims 1 to 8.
Citation Information
Patent Citations
In-vehicle network intrusion detection method based on state awareness
CN116318955A
Vehicle charging interface attack detection method and device, equipment and storage medium
CN118802351A