Vehicle-mounted CAN bus anomaly detection method and system based on data analysis
By data analysis -based car CAN bus abnormal detection methods, the problem of lack of information security mechanisms in the CAN bus lack information security mechanism was solved, and real -time detection and alarm of potential abnormalities were realized, reducing maintenance costs and improving vehicle information security.
Patent Information
- Application Number
- CN202411575540.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-06
- Publication Date
- 2025-01-24
AI Technical Summary
The CAN bus lacks a basic information security mechanism, which leads to malicious attacks directly penetrate into the on-board CAN bus network through external interfaces, seriously endangering the personal and property safety of the driver and passengers.
Adopt data -based analysis of the vehicle CAN bus abnormal detection method, and to extract CAN bus data from the vehicle IoT database, calculate the lack of value filling, data fusion and concentration trend, and discrete level. Similarity calculation, real -time alarm.
Effective detection and alarm's potential CAN bus is abnormal, reduce maintenance costs, improve vehicle information security, and meet the needs of staff.
Smart Images
Figure CN119363613A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of vehicle networking automobile safety detection technology, and in particular to a vehicle-mounted CAN bus anomaly detection method and system based on data analysis. Background Art
[0002] With the development of automobile intelligence and networking, intelligent connected cars have become the development direction of automobile informatization. In recent years, information security incidents targeting automobiles have occurred frequently, and the information security issues of connected cars have become prominent. It is urgent to study the information security issues of connected cars and vehicle network systems.
[0003] CAN bus is the most widely used vehicle bus network technology. With the emergence of automobile information security issues, malicious attacks directly penetrate into the vehicle CAN bus network through external interfaces, seriously endangering the personal and property safety of drivers and passengers. CAN bus lacks basic information security mechanism. It is of great significance to study the information security issues of vehicle CAN bus network and the abnormal detection technology suitable for CAN bus. Summary of the invention
[0004] In order to solve the above technical problems, a method and system for detecting anomalies of a vehicle-mounted CAN bus based on data analysis are provided. This technical solution solves the problem that the CAN bus lacks a basic information security mechanism proposed in the above background technology.
[0005] In order to achieve the above purpose, the technical solution adopted by the present invention is: A vehicle-mounted CAN bus anomaly detection method based on data analysis, comprising: Extract CAN bus data from the vehicle Internet of Things database, where the types of CAN bus data include data frames, remote frames, error frames, and overload frames; Preprocessing the CAN bus data to obtain complete CAN bus data, wherein the preprocessing is filling missing values of the data; Calculate the central tendency and dispersion of complete data, divide the complete data into several groups, and merge the same complete data; Form a detection data set based on the data after the data frame and the remote frame are fused; Retrieve the CAN bus data of error frames and overload frames, and name the data frames and remote frames before the abnormal state as the alarm data set; Acquire the detection data set in real time, and calculate the similarity between the real-time detection data set and the alarm data set; Abnormal alarms are issued for data frames and remote frames with high similarity.
[0006] Preferably, the preprocessing of the CAN bus data specifically comprises the following steps:
[0007] In the formula, is the filling data; i is the number of filling data; are different types of CAN bus data; n is the number of different types of CAN bus data.
[0008] Preferably, the calculation of the central tendency and dispersion degree of the complete data specifically comprises the following steps: Calculate the average value of the data in the complete running data, and calculate the variance of the data according to the variance formula; Setting the variance as the central tendency of the complete operation data and assigning a trend identification code to the central tendency; Pair each data in the complete running data with the remaining data in the complete data to obtain at least one paired group; Calculate the absolute value of the difference between two data in each paired group of the complete running data, and accumulate the absolute values of the difference between two data in all paired groups to obtain a discrete value; The discrete value is set as the discrete degree of the data, and a discrete identification code is assigned to the discrete degree.
[0009] Preferably, the calculation formula of the variance is as follows:
[0010] Where D is the variance, n is the number of data, is the value of the data, and a is the average value of the data.
[0011] Preferably, the step of dividing the complete data into several groups of categories specifically comprises the following steps: Retrieve data normalization standard 1 from the database, and obtain the range interval of the central tendency ratio and the range interval of the dispersion ratio in the data normalization standard 1; Calculate the ratio of the central tendency of the data to the mean of the central tendency of the sample data; Calculate the ratio of the degree of dispersion of the data to the mean of the degree of dispersion of the sample data; Ratio 1 is compared with the first preset threshold and ratio 2 is compared with the second preset threshold to determine whether the central trend of the data belongs to the range interval of the central tendency ratio and the range interval of the dispersion ratio in normalization standard 1, and based on the judgment result, the complete data is fused.
[0012] Preferably, the step of fusing the complete data based on the judgment result specifically includes the following steps: If the ratio value 1 is greater than or equal to the first preset threshold, it belongs to the range interval of the central tendency ratio in the normalization standard 1; If the ratio value 1 is less than the first preset threshold, it does not belong to the range interval of the central tendency ratio value in the normalization standard 1; Compare the second ratio with the second preset threshold to determine whether the degree of dispersion of the data falls within the range of the dispersion degree ratio in the first normalization standard; If the second ratio is greater than or equal to the second preset threshold, it belongs to the range interval of the discrete degree ratio in the normalization standard one; If the second ratio is less than the second preset threshold, it does not belong to the range interval of the discrete degree ratio in the normalization standard one; The data belonging to the range interval of the central tendency ratio and the range interval of the dispersion ratio in the normalization standard 1 are attributed to the first data; The data that does not belong to the range interval of the central tendency ratio and the range interval of the dispersion ratio in the first normalization standard are classified as the second data; The first data and the second data are fused respectively to obtain first fused data and second fused data.
[0013] Preferably, the formula for calculating the similarity between the real-time detection data set and the alarm data set is:
[0014] In the formula, To detect the similarity of the i-th feature of the data set and the alarm data set in real time, To detect the jth feature index value of the i-th feature of the data set in real time, is the jth feature index value of the i-th feature of the alarm data set, is the total number of characteristic index values of the ith feature.
[0015] Preferably, the abnormal alarm for the data frame and the remote frame with high similarity specifically comprises the following steps: Comparing the calculated similarity value with a third preset threshold; If the similarity value is greater than or equal to a third preset threshold, an abnormal alarm is issued for the data frame and the remote frame; If the similarity value is less than the third preset threshold, no processing is performed.
[0016] A vehicle-mounted CAN bus anomaly detection system based on data analysis, comprising: A CAN bus data extraction module, wherein the CAN bus data extraction module is used to extract CAN bus data from a vehicle Internet of Things database; A data processing module, the data processing module is used to process the CAN bus data, the processing includes data missing value filling and data fusion; A first set acquisition module, the first set acquisition module is used to form a detection data set according to the data after the data frame and the remote frame are fused; A second set acquisition module, the second set acquisition module is used to retrieve the CAN bus data in which error frames and overload frames have appeared, and name the data frames and remote frames before the abnormal state as an alarm data set; A calculation module, the calculation module is used to calculate the similarity between the real-time detection data set and the alarm data set; An abnormality alarm module, the abnormality alarm module is used to issue an abnormality alarm to data frames and remote frames with high similarity; The data processing module includes a data preprocessing unit and a data fusion unit; The data preprocessing unit is used to preprocess the CAN bus data to obtain complete CAN bus data; The data fusion unit is used to calculate the central tendency and the degree of dispersion of the complete data, and to divide the complete data into several groups and types, and to fuse the same type of complete data.
[0017] Compared with the prior art, the present invention provides a vehicle-mounted CAN bus anomaly detection method and system based on data analysis, which has the following beneficial effects: In real life, CAN bus data types include data frames, remote frames, error frames and overload frames. Data frames are the main data type transmitted on the CAN bus and are used for data communication between nodes. Remote frames are sent by nodes to request other nodes to send data. When an error is detected, the node will send an error frame to notify other nodes, and when the node is receiving a data frame or a remote frame, if it cannot be processed in time, it will send an overload frame to request the sending node to suspend sending data. It can be seen that error frames and overload frames are abnormal signals of the CAN bus. The present invention collects various CAN bus data types online, fills missing values in the data, makes the data complete, and has processing value. By classifying and fusing the data, the memory of the same type of data becomes smaller, and the processing speed of the data is improved. The data are formed into a set. Further, the CAN bus data in which error frames and overload frames have appeared are retrieved. This operating data is for the data one hour before the abnormal alarm state, and the time difference cannot be large, otherwise it has no reference value. The real-time detection data set and the alarm data set are similarly calculated to obtain data frames and remote frames that are about to be abnormal, and an alarm is issued to reduce maintenance costs and meet the needs of staff. BRIEF DESCRIPTION OF THE DRAWINGS
[0018] Figure 1 It is a schematic diagram of the vehicle-mounted CAN bus abnormality detection method in the present invention; Figure 2A schematic diagram of a method for calculating the central tendency and dispersion degree of complete data in the present invention; Figure 3 A schematic diagram of a method for dividing complete data into several groups of categories in the present invention; Figure 4 It is a schematic diagram of a method for fusing complete data in the present invention; Figure 5 It is a schematic diagram of a method for performing abnormal alarm on data frames and remote frames with high similarity in the present invention. DETAILED DESCRIPTION
[0019] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.
[0020] Example 1 Please refer to Figure 1-Figure 5 As shown, a vehicle-mounted CAN bus anomaly detection method based on data analysis includes: Extract CAN bus data from the vehicle IoT database, where the types of CAN bus data include data frames, remote frames, error frames, and overload frames; Preprocess the CAN bus data to obtain complete CAN bus data, and the preprocessing is to fill the missing values of the data; Calculate the central tendency and dispersion of complete data, divide the complete data into several groups, and merge the same complete data; Form a detection data set based on the data after the data frame and the remote frame are fused; Retrieve the CAN bus data of error frames and overload frames, and name the data frames and remote frames before the abnormal state as the alarm data set; Acquire the detection data set in real time, and calculate the similarity between the real-time detection data set and the alarm data set; Abnormal alarms are issued for data frames and remote frames with high similarity.
[0021] It can be understood by those skilled in the art that in real life, CAN bus data types include data frames, remote frames, error frames, and overload frames. Data frames are the main data type transmitted on the CAN bus and are used for data communication between nodes. Remote frames are sent by nodes to request other nodes to send data. When an error is detected, the node will send an error frame to notify other nodes. When a node receives a data frame or a remote frame, if it cannot process it in time, it will send an overload frame to request the sending node to suspend sending data. It can be seen that error frames and overload frames are abnormal signals of the CAN bus. The present invention collects various CAN bus data types online. Type, fill in missing values in the data to make the data complete and have processing value. By classifying and fusing the data, the memory of data of the same category becomes smaller, which improves the data processing speed. The data is formed into a set. Further, the CAN bus data of error frames and overload frames are retrieved. This operating data is for the data one hour before the abnormal alarm state. The time difference cannot be large, otherwise it will have no reference value. The real-time detection data set and the alarm data set are calculated for similarity, and the data frames and remote frames that are about to be abnormal can be obtained, and an alarm can be issued to reduce maintenance costs and meet the needs of staff.
[0022] The preprocessing of CAN bus data specifically includes the following steps:
[0023] In the formula, is the filling data; i is the number of filling data; are different types of CAN bus data; n is the number of different types of CAN bus data.
[0024] Calculating the central tendency and dispersion of complete data specifically includes the following steps: Calculate the average value of the data in the complete running data, and calculate the variance of the data according to the variance formula; Set the variance to the central tendency of the complete run data and assign a trend identification code to the central tendency; Pair each data in the complete running data with the remaining data in the complete data to obtain at least one paired group; Calculate the absolute value of the difference between two data in each paired group of the complete running data, and accumulate the absolute values of the difference between two data in all paired groups to obtain a discrete value; Set the discrete value to the discrete degree of the data and assign a discrete identification code to the discrete degree.
[0025] The formula for calculating variance is as follows:
[0026] Where D is the variance, n is the number of data, is the value of the data, and a is the average value of the data.
[0027] The specific steps of dividing the complete data into several groups are as follows: Retrieve data normalization standard 1 from the database, and obtain the range interval of the central tendency ratio and the range interval of the dispersion ratio in the data normalization standard 1; Calculate the ratio of the central tendency of the data to the mean of the central tendency of the sample data; Calculate the ratio of the degree of dispersion of the data to the mean of the degree of dispersion of the sample data; Ratio 1 is compared with the first preset threshold and ratio 2 is compared with the second preset threshold to determine whether the central trend of the data belongs to the range interval of the central tendency ratio and the range interval of the dispersion ratio in normalization standard 1, and based on the judgment result, the complete data is fused.
[0028] Based on the judgment results, the integration of complete data includes the following steps: If the ratio value 1 is greater than or equal to the first preset threshold, it belongs to the range interval of the central tendency ratio in the normalization standard 1; If the ratio value 1 is less than the first preset threshold, it does not belong to the range interval of the central tendency ratio value in the normalization standard 1; Compare the second ratio with the second preset threshold to determine whether the degree of dispersion of the data falls within the range of the dispersion degree ratio in the first normalization standard; If the second ratio is greater than or equal to the second preset threshold, it belongs to the range interval of the discrete degree ratio in the normalization standard one; If the second ratio is less than the second preset threshold, it does not belong to the range interval of the discrete degree ratio in the normalization standard one; The data belonging to the range interval of the central tendency ratio and the range interval of the dispersion ratio in the normalization standard 1 are attributed to the first data; The data that does not belong to the range interval of the central tendency ratio and the range interval of the dispersion ratio in the first normalization standard are classified as the second data; The first data and the second data are fused respectively to obtain first fused data and second fused data.
[0029] The formula for calculating the similarity between the real-time detection data set and the alarm data set is:
[0030] In the formula, To detect the similarity of the i-th feature of the data set and the alarm data set in real time, To detect the jth feature index value of the i-th feature of the data set in real time, is the jth feature index value of the i-th feature of the alarm data set, is the total number of characteristic index values of the ith feature.
[0031] The specific steps of abnormal alarm for data frames and remote frames with high similarity are as follows: Comparing the calculated similarity value with a third preset threshold; If the similarity value is greater than or equal to a third preset threshold, an abnormal alarm is issued for the data frame and the remote frame; If the similarity value is less than the third preset threshold, no processing is performed.
[0032] A vehicle-mounted CAN bus anomaly detection system based on data analysis, comprising: CAN bus data extraction module, the CAN bus data extraction module is used to extract CAN bus data from the vehicle Internet of Things database; Data processing module: The data processing module is used to process the CAN bus data, including data missing value filling and data fusion; A first set acquisition module, the first set acquisition module is used to form a detection data set according to the data after the data frame and the remote frame are fused; The second set acquisition module is used to retrieve the CAN bus data in which error frames and overload frames have appeared, and name the data frames and remote frames before the abnormal state as an alarm data set; A calculation module, the calculation module is used to calculate the similarity between the real-time detection data set and the alarm data set; An abnormal alarm module is used to issue abnormal alarms to data frames and remote frames with high similarity; The data processing module includes a data preprocessing unit and a data fusion unit; The data preprocessing unit is used to preprocess the CAN bus data to obtain complete CAN bus data; The data fusion unit is used to calculate the central tendency and the degree of dispersion of the complete data, and to divide the complete data into several groups and types, and to fuse the same type of complete data.
[0033] In summary, the present invention collects various CAN bus data types online, fills missing values in the data, makes the data complete, and has processing value. By classifying and fusing the data, the memory of data of the same type becomes smaller, and the data processing speed is improved. These data are formed into a set, and further, the CAN bus data of error frames and overload frames are retrieved. This operating data is for the data one hour before the abnormal alarm state, and the time difference cannot be large, otherwise it will have no reference value. The real-time detection data set and the alarm data set are calculated for similarity, and the data frames and remote frames that are about to have abnormalities can be obtained, and an alarm can be issued, thereby reducing maintenance costs and meeting the needs of staff.
[0034] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.
Claims
1. A vehicle-mounted CAN bus anomaly detection method based on data analysis, characterized in that: include: Extract CAN bus data from the vehicle Internet of Things database, where the types of CAN bus data include data frames, remote frames, error frames, and overload frames; Preprocessing the CAN bus data to obtain complete CAN bus data, wherein the preprocessing is filling missing values of the data; Calculate the central tendency and dispersion of complete data, divide the complete data into several groups, and merge the same complete data; Form a detection data set based on the data after the data frame and the remote frame are fused; Retrieve the CAN bus data of error frames and overload frames, and name the data frames and remote frames before the abnormal state as the alarm data set; Acquire the detection data set in real time, and calculate the similarity between the real-time detection data set and the alarm data set; Abnormal alarms are issued for data frames and remote frames with high similarity.
2. The method for detecting abnormality of a vehicle-mounted CAN bus based on data analysis according to claim 1, characterized in that: The preprocessing of CAN bus data specifically comprises the following steps: In the formula, is the filling data; i is the number of filling data; are different types of CAN bus data; n is the number of different types of CAN bus data.
3. A vehicle-mounted CAN bus anomaly detection method based on data analysis according to claim 2, characterized in that: The calculation of the central tendency and dispersion degree of the complete data specifically includes the following steps: Calculate the average value of the data in the complete running data, and calculate the variance of the data according to the variance formula; Setting the variance as the central tendency of the complete operation data and assigning a trend identification code to the central tendency; Pair each data in the complete running data with the remaining data in the complete data to obtain at least one paired group; Calculate the absolute value of the difference between two data in each paired group of the complete running data, and accumulate the absolute values of the difference between two data in all paired groups to obtain a discrete value; The discrete value is set as the discrete degree of the data, and a discrete identification code is assigned to the discrete degree.
4. The method for detecting abnormality of a vehicle-mounted CAN bus based on data analysis according to claim 3 is characterized in that: The calculation formula of the variance is as follows: Where D is the variance, n is the number of data, is the value of the data, and a is the average value of the data.
5. The method for detecting abnormality of a vehicle-mounted CAN bus based on data analysis according to claim 4 is characterized in that: The method of dividing the complete data into several groups of categories specifically includes the following steps: Retrieve data normalization standard 1 from the database, and obtain the range interval of the central tendency ratio and the range interval of the dispersion ratio in the data normalization standard 1; Calculate the ratio of the central tendency of the data to the mean of the central tendency of the sample data; Calculate the ratio of the degree of dispersion of the data to the mean of the degree of dispersion of the sample data; Ratio 1 is compared with the first preset threshold and ratio 2 is compared with the second preset threshold to determine whether the central trend of the data belongs to the range interval of the central tendency ratio and the range interval of the dispersion ratio in normalization standard 1, and based on the judgment result, the complete data is fused.
6. A vehicle-mounted CAN bus anomaly detection method based on data analysis according to claim 5, characterized in that: Based on the judgment result, the integration of complete data specifically includes the following steps: If the ratio value 1 is greater than or equal to the first preset threshold, it belongs to the range interval of the central tendency ratio in the normalization standard 1; If the ratio value 1 is less than the first preset threshold, it does not belong to the range interval of the central tendency ratio value in the normalization standard 1; If the second ratio is greater than or equal to the second preset threshold, it belongs to the range interval of the discrete degree ratio in the normalization standard one; If the second ratio is less than the second preset threshold, it does not belong to the range interval of the discrete degree ratio in the normalization standard one; The data belonging to the range interval of the central tendency ratio and the range interval of the dispersion ratio in the normalization standard 1 are attributed to the first data; The data that does not belong to the range interval of the central tendency ratio and the range interval of the dispersion ratio in the first normalization standard are classified as the second data; The first data and the second data are fused respectively to obtain first fused data and second fused data.
7. The method for detecting abnormality of a vehicle-mounted CAN bus based on data analysis according to claim 6 is characterized in that: The formula for calculating the similarity between the real-time detection data set and the alarm data set is: In the formula, To detect the similarity of the i-th feature of the data set and the alarm data set in real time, To detect the jth feature index value of the i-th feature of the data set in real time, is the jth feature index value of the i-th feature of the alarm data set, is the total number of characteristic index values of the ith feature.
8. The method for detecting vehicle CAN bus anomalies based on data analysis according to claim 7, characterized in that: The abnormal alarm for the data frame and the remote frame with high similarity specifically comprises the following steps: Comparing the calculated similarity value with a third preset threshold; If the similarity value is greater than or equal to a third preset threshold, an abnormal alarm is issued for the data frame and the remote frame; If the similarity value is less than the third preset threshold, no processing is performed.
9. A vehicle-mounted CAN bus anomaly detection system based on data analysis, used to implement a vehicle-mounted CAN bus anomaly detection method based on data analysis as described in any one of claims 1 to 8, characterized in that: include: A CAN bus data extraction module, wherein the CAN bus data extraction module is used to extract CAN bus data from a vehicle Internet of Things database; A data processing module, the data processing module is used to process the CAN bus data, the processing includes data missing value filling and data fusion; A first set acquisition module, the first set acquisition module is used to form a detection data set according to the data after the data frame and the remote frame are fused; A second set acquisition module, the second set acquisition module is used to retrieve the CAN bus data in which error frames and overload frames have appeared, and name the data frames and remote frames before the abnormal state as an alarm data set; A calculation module, the calculation module is used to calculate the similarity between the real-time detection data set and the alarm data set; The abnormal alarm module is used to issue abnormal alarms to data frames and remote frames with high similarity.
10. The vehicle-mounted CAN bus anomaly detection system based on data analysis according to claim 9, characterized in that: include: The data processing module includes a data preprocessing unit and a data fusion unit; The data preprocessing unit is used to preprocess the CAN bus data to obtain complete CAN bus data; The data fusion unit is used to calculate the central tendency and the degree of dispersion of the complete data, and to divide the complete data into several groups and types, and to fuse the same type of complete data.