CAN bus anomaly detection method and device, storage medium and vehicle

Abstract

The invention relates to a CAN bus anomaly detection method and device, a storage medium and a vehicle, and the method comprises the steps: carrying out the principal component analysis of a to-be-detected CAN data set based on a first kernel function and a second kernel function, and obtaining a first kernel matrix and a second kernel matrix; determining a fusion matrix based on the first kernel matrix and the second kernel matrix; performing key feature extraction on the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set; and inputting the key feature set into a target anomaly detection model for anomaly detection to obtain an anomaly detection result. By adopting the technical scheme, the key features in the CAN data set can be effectively extracted, the accuracy of anomaly detection is improved, and the data dimension is reduced by extracting the key features from the CAN data set, so that the operation pressure of anomaly detection is reduced, and the calculation cost is saved.

Description

Technical Field

[0001] The present disclosure relates to the technical field of abnormality detection, and in particular to a CAN bus abnormality detection method, device, storage medium and vehicle. Background Art

[0002] Controller Area Network (CAN) bus intrusion refers to an unauthorized third party attempting to illegally access or interfere with the CAN bus. The intruder may try to tamper with the data on the CAN bus, causing errors or incorrect operations in the vehicle system, thus affecting the normal driving and safety of the vehicle. Therefore, it is very necessary to perform CAN bus anomaly detection.

[0003] At present, most of the related technologies are based on the pre-training of detection models based on the data features of the CAN bus, and use the detection models to automatically detect intrusion behaviors in the CAN bus and issue alarms. However, due to the high-dimensional characteristics of the CAN bus message data and the complex features contained, it is difficult to filter out the optimal feature set from the message data, resulting in poor detection results of the final trained detection model and low accuracy of CAN bus anomaly detection. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, at least one embodiment of the present disclosure provides a CAN bus abnormality detection method, device, storage medium and vehicle.

[0005] In a first aspect, the present disclosure provides a CAN bus abnormality detection method, comprising:

[0006] Based on the first kernel function and the second kernel function, principal component analysis is performed on the CAN data set to be detected, and a first kernel matrix and a second kernel matrix are obtained;

[0007] Determine a fusion matrix based on the first kernel matrix and the second kernel matrix;

[0008] Extract key features of the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set;

[0009] The key feature set is input into a target anomaly detection model to perform anomaly detection and obtain an anomaly detection result.

[0010] In a second aspect, the present disclosure provides a CAN bus abnormality detection device, comprising:

[0011] An analysis module is used to perform principal component analysis on the CAN data set to be detected based on the first kernel function and the second kernel function to obtain a first kernel matrix and a second kernel matrix;

[0012] A fusion module, configured to determine a fusion matrix based on the first kernel matrix and the second kernel matrix;

[0013] A feature extraction module, used for extracting key features of the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set;

[0014] The detection module is used to input the key feature set into the target anomaly detection model to perform anomaly detection and obtain anomaly detection results.

[0015] In a third aspect, the present disclosure provides an electronic device, including: a processor and a memory;

[0016] The processor is used to execute any CAN bus anomaly detection method provided by the embodiments of the present disclosure by calling the program or instruction stored in the memory.

[0017] In a fourth aspect, the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores a program or instruction, wherein the program or instruction enables a computer to execute any of the CAN bus anomaly detection methods provided in the embodiments of the present disclosure.

[0018] In a fifth aspect, the present disclosure provides a vehicle, comprising the CAN bus abnormality detection device as described in the second aspect or the electronic device as described in the third aspect or the computer-readable storage medium as described in the fourth aspect.

[0019] In a sixth aspect, the present disclosure provides a computer program product, which is used to execute any of the CAN bus anomaly detection methods provided by the embodiments of the present disclosure.

[0020] Compared with the prior art, the technical solution provided by the embodiments of the present disclosure has at least the following advantages:

[0021] In the disclosed embodiment, principal component analysis is performed on the CAN data set to be detected based on the first kernel function and the second kernel function respectively to obtain the first kernel matrix and the second kernel matrix, and a fusion matrix is ​​determined based on the first kernel matrix and the second kernel matrix; key features are extracted from the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set; and the key feature set is then input into the target anomaly detection model to perform anomaly detection to obtain anomaly detection results. By adopting the above technical scheme, by adopting two different kernel functions to perform principal component analysis on the CAN data set to be detected respectively to obtain the corresponding kernel matrix, and then extracting key features from the CAN data set after matrix fusion, the key features in the CAN data set can be effectively extracted, and the accuracy of anomaly detection can be improved. In addition, by extracting key features from the CAN data set, the data dimension is reduced, thereby reducing the computational pressure of anomaly detection and saving computing costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0024] Figure 1 A flowchart of a CAN bus abnormality detection method provided by an exemplary embodiment of the present disclosure;

[0025] Figure 2 A flowchart of a CAN bus abnormality detection method provided by another exemplary embodiment of the present disclosure;

[0026] Figure 3 A schematic diagram showing a fusion matrix obtained by fusing kernel matrices of multiple kernel functions according to an exemplary embodiment of the present disclosure is shown;

[0027] Figure 4 A flowchart of a method for obtaining multiple anomaly detection models provided in one embodiment of the present disclosure;

[0028] Figure 5 The overall architecture diagram of the CAN bus anomaly detection solution disclosed in the present invention is shown;

[0029] Figure 6 A schematic diagram of the structure of a CAN bus anomaly detection device provided in one embodiment of the present disclosure. DETAILED DESCRIPTION

[0030] In order to more clearly understand the above-mentioned purposes, features and advantages of the present disclosure, the present disclosure is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understandable that the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments, and the specific embodiments described herein are only used to explain the present disclosure, rather than to limit the present disclosure. In the absence of conflict, the embodiments of the present disclosure and the features in the embodiments can be combined with each other. Based on the described embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in the field belong to the scope of protection of the present disclosure.

[0031] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0032] CAN bus is a serial communication protocol widely used in automotive electronic systems to transmit data between various electronic control units in a car. Due to the importance and wide application of CAN bus in automobiles, it also faces security threats, one of which is the abnormal bus status caused by CAN bus intrusion. CAN bus intrusion refers to an unauthorized third party attempting to illegally access or interfere with the CAN bus. Intruders may try to tamper with the data on the CAN bus, causing errors or incorrect operations in the automotive system, thereby affecting the normal driving and safety of the vehicle.

[0033] The CAN bus detection system can monitor the data flow on the CAN bus and identify any abnormal behavior or intrusion attempts, so as to take timely measures to prevent intrusion and protect the safety and privacy of the car. Most of the existing CAN bus detection systems are based on pre-trained detection models. The detection model is obtained by obtaining the data features of the CAN bus and then the CAN data to be detected can be input into the detection model to automatically detect the intrusion behavior in the CAN bus and issue a warning in real time. However, due to the complexity of the CAN bus feature set, it is difficult to determine the optimal feature set, and the message data in the CAN bus is time-series. The existing method of directly using CAN data for anomaly detection has the problem of low detection accuracy.

[0034] In response to the above problems, the present invention provides a CAN bus anomaly detection solution, which uses two different kernel functions to perform principal component analysis on the CAN data set to be detected to obtain the corresponding kernel matrix, and then fuses the two kernel matrices to obtain a fusion matrix, and then determines the key feature set in the CAN data set based on the fusion matrix, and performs anomaly detection based on the key feature set. As a result, the feature dimension of the CAN data is reduced, thereby reducing the computational pressure, and by extracting the key features in the CAN data for anomaly detection, the accuracy of the detection results can be improved.

[0035] The specific implementation methods of the CAN bus anomaly detection method, device, storage medium and vehicle disclosed in the present invention are explained in detail below with reference to the accompanying drawings.

[0036] Figure 1 A flow chart of a CAN bus anomaly detection method provided for an exemplary embodiment of the present disclosure is provided. The method can be executed by a CAN bus anomaly detection device provided for an exemplary embodiment of the present disclosure. The CAN bus anomaly detection device can be implemented by software and / or hardware and can be integrated in a vehicle.

[0037] like Figure 1 As shown, the CAN bus abnormality detection method may include the following steps:

[0038] Step 101 , performing principal component analysis on the CAN data set to be detected based on the first kernel function and the second kernel function respectively, to obtain a first kernel matrix and a second kernel matrix.

[0039] Among them, the first kernel function and the second kernel function are two different kernel functions.

[0040] In CAN bus data, the kernelized PCA (KPCA) algorithm can be used to reduce high-dimensional data to low dimensions, thereby performing feature extraction. However, when the KPCA algorithm is applied to CAN bus data, there is a problem that the effect of the single kernel function of KPCA is limited. Therefore, the traditional KPCA algorithm cannot be well applied to the industrial environment of the CAN bus. In view of the characteristics of the high dimension of CAN bus data features and mixed linear and nonlinear features, in the disclosed embodiment, the traditional kernel principal component analysis algorithm is improved. On the basis of the traditional kernel principal component analysis algorithm, a traffic feature extraction method suitable for the CAN bus is proposed. This method uses two different kernel functions to perform principal component analysis on the CAN data set to generate a kernel matrix, and then fuses the kernel matrix to extract the principal components to obtain important features in the CAN data. This overcomes the limitations of a single kernel function, is more suitable for data features in the CAN bus environment, and effectively extracts key feature sets.

[0041] The input of the first kernel function and the second kernel function is an input data matrix of a preset size (n*d), n represents the number of CAN data contained in the CAN data set, d represents the number of all features that the CAN data may contain, and the feature refers to the temperature, speed, control command and other features in the CAN data. The number of features contained in a CAN data is not greater than d, and the number of all features contained in a CAN data set is not greater than d. When the number of features contained in a CAN data set is less than d, the number of matrix columns can be filled by filling 0 to obtain an n*d matrix. For example, assuming that the CAN data set contains 10 linear data and 3 nonlinear data, and all features that the CAN data may contain include temperature, pressure, speed, position and 5 different control commands, then the value of n is 13, and the value of d is 9, and a 13*9 input data matrix is ​​generated based on the CAN data set. In this embodiment, when performing principal component analysis, the CAN data set to be detected can be read, and the obtained n CAN data can be written in the form of an n*d-dimensional data matrix. Then, the first kernel function is used to calculate the kernel matrix of the n*d-dimensional data matrix (called the first kernel matrix), and the second kernel function is used to calculate the kernel matrix of the n*d-dimensional data matrix (called the second kernel matrix).

[0042] In addition, the original message data of the CAN bus has the characteristics of high dimensionality, and due to the complexity of the system environment, it usually mixes linear data and nonlinear data, as well as noise. In an optional implementation, when generating a data matrix of a preset size, the acquired real vehicle or simulated CAN bus data can be cleaned first to remove message impurities not included in DBC (abbreviation of DataBaseCAN, representing the database file of CAN, in which the relevant information of CAN communication, such as message name, message ID, signal name, signal layout, etc., is defined in detail) and error frames when the vehicle is just started, and then the cleaned CAN data is pre-processed by data balancing, standardization, normalization and other pre-processing operations to ensure the validity and rationality of the data.

[0043] Step 102: determining a fusion matrix based on the first kernel matrix and the second kernel matrix.

[0044] In the embodiment of the present disclosure, after the first kernel matrix and the second kernel matrix are determined, a fusion matrix may be determined based on the two kernel matrices.

[0045] Exemplarily, the Hadamard product of the first kernel matrix and the second kernel matrix may be calculated to obtain a fusion matrix.

[0046] Exemplarily, the sum of the first kernel matrix and the second kernel matrix may be calculated to obtain a fusion matrix.

[0047] Step 103: extract key features of the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set.

[0048] In the disclosed embodiment, after the fusion matrix is ​​determined, key features of the CAN data set can be extracted based on the fusion matrix to obtain a key feature set corresponding to the CAN data set.

[0049] As an optional implementation, the fusion matrix can be summed or averaged by column, and a preset number of columns with the largest results are selected as key feature vectors. The CAN data set is then projected onto the key feature vector to obtain the corresponding key feature set. The key feature set reflects the traffic features in the CAN data set that are most relevant to the CAN bus anomaly, which helps to accurately detect whether there is abnormal data in the CAN bus.

[0050] As an optional implementation, the fusion matrix can be subjected to eigenvalue decomposition to obtain multiple eigenvalues ​​and eigenvectors corresponding to each eigenvalue, wherein the eigenvector represents the corresponding principal component, and the eigenvalue represents the importance of the corresponding principal component. The larger the eigenvalue, the higher the importance of the corresponding principal component. Then, the eigenvectors are sorted in descending order of the eigenvalues, and a preset number of target eigenvectors in the front order are obtained. The target eigenvector is the most important eigenvector. The CAN data set is then projected onto the target eigenvector to obtain a key feature set. For example, the input data matrix corresponding to the CAN data set can be multiplied by the obtained target eigenvector, and the CAN data set can be projected onto the target eigenvector to obtain a key feature set, thereby extracting the traffic features in the CAN data set that are most relevant to the CAN bus anomaly, and providing data support for accurate anomaly detection. In addition, optionally, after obtaining the fusion matrix, the fusion matrix can be first centralized to obtain a centralized matrix, and then the centralized matrix can be subjected to eigenvalue decomposition. In which, assuming that the fusion matrix is ​​denoted as K, the centralized matrix K centered =K-mean(K,axis=0)-mean(K,axis=1)+mean(K), where axis=0 represents rows and axis=1 represents columns.

[0051] Commonly used data feature extraction methods mainly include Fourier transform method, machine learning method, deep learning method and principal component analysis method. Due to the limited computing power of vehicle processors, the computing power requirements of the above methods cannot be fully met. In addition, there are a large number of linear data and nonlinear data complexes in the CAN bus. In order to better process the nonlinear data in the CAN bus data, the present invention uses two different kernel functions to calculate the kernel matrix and perform matrix fusion to extract the most important effective features in the CAN data, which can better adapt to the application scenarios of CAN bus data.

[0052] Step 104: input the key feature set into a target anomaly detection model to perform anomaly detection and obtain anomaly detection results.

[0053] Among them, the target anomaly detection model is obtained by pre-training, and the initial model can be trained to obtain the anomaly detection model. During training, the training sample set obtained is a key feature sample set obtained by performing principal component analysis on the CAN training data set. The method of obtaining each key feature sample in the key feature sample set is the same as the method of obtaining the key feature set in this embodiment, which will not be repeated here. The initial model is iteratively trained and parameter optimized using the training sample set, and finally an efficient and accurate anomaly detection model is obtained for CAN bus anomaly detection.

[0054] In the embodiment of the present disclosure, after obtaining the key feature set, the key feature set can be input into a pre-trained target anomaly detection model, and the target anomaly detection model performs anomaly detection based on the key feature set and outputs anomaly detection results. For example, the anomaly detection result may include two classifications: normal and abnormal. If the anomaly detection result indicates that an abnormality exists, an abnormality warning is issued.

[0055] The CAN bus anomaly detection method of the disclosed embodiment performs principal component analysis on the CAN data set to be detected based on the first kernel function and the second kernel function respectively to obtain the first kernel matrix and the second kernel matrix, and determines the fusion matrix based on the first kernel matrix and the second kernel matrix; extracts key features of the CAN data set based on the fusion matrix to obtain the key feature set corresponding to the CAN data set; and then inputs the key feature set into the target anomaly detection model to perform anomaly detection to obtain anomaly detection results. The above technical solution is adopted, by using two different kernel functions to perform principal component analysis on the CAN data set to be detected respectively to obtain the corresponding kernel matrix, and then extracting key features from the CAN data set after matrix fusion, which can effectively extract the key features in the CAN data set and improve the accuracy of anomaly detection. In addition, by extracting key features from the CAN data set, the data dimension is reduced, thereby reducing the computational pressure of anomaly detection and saving computing costs.

[0056] In the scheme disclosed in the present invention, two different kernel functions are used to perform principal component analysis on the CAN data set, and the choice of kernel function also affects the extraction effect of the principal component. Commonly used kernel functions include: linear kernel function (LinearKernel), polynomial kernel function (Polynomial Kernel), radial basis kernel function (Radial Basis Function, RBF) and Sigmoid kernel function. Considering that there are a large number of linear data and nonlinear data composites in the CAN bus, in order to better process the linear data and nonlinear data in the CAN bus data, in the embodiment disclosed in the present invention, the first kernel function is a linear kernel function, and the second kernel function is a nonlinear kernel function (for example, any one of the polynomial kernel function, radial basis kernel function, and Sigmoid kernel function). The principal component is determined by the linear kernel function and the nonlinear kernel function, which can ensure the accuracy of the extracted key feature set.

[0057] Further, in an optional implementation of the present disclosure, on the basis that the first kernel function is a linear kernel function and the second kernel function is a nonlinear kernel function, as follows Figure 2 As shown, in Figure 1 Based on the illustrated embodiment, step 102 may include the following sub-steps:

[0058] Step 201: Obtain a first weight corresponding to the linear kernel function and a second weight corresponding to the nonlinear kernel function.

[0059] As an example, the first weight and the second weight may be pre-set weight values, for example, the first weight and the second weight are both set to 0.5.

[0060] As another example, the first weight and the second weight can be determined according to the current data environment. Specifically, the CAN data set can be classified according to the preset linear data and nonlinear data classification rules to obtain the linear data set and the nonlinear data set; then, the first number of linear data contained in the linear data set, the second number of nonlinear data contained in the nonlinear data set, and the total amount of data contained in the CAN data set are counted; then, the ratio of the first number to the total amount of data is calculated to obtain the first weight, and the ratio of the second number to the total amount of data is calculated to obtain the second weight.

[0061] Among them, linear data refers to data arranged in a continuous order, which can be directly extracted and analyzed; non-linear data refers to a certain relationship between data, which requires certain calculations to obtain meaningful results. Specifically, the linear data in the CAN bus message includes:

[0062] (1) Sensor data: such as continuously changing physical quantities such as temperature, pressure, and speed;

[0063] (2) Location data: For example, the location information of a car can be expressed by numerical values ​​such as longitude and latitude;

[0064] (3) Speed ​​data: For example, vehicle speed information, which can be expressed as a numerical value or frequency.

[0065] The nonlinear data in the CAN bus message includes:

[0066] (1) Status data: such as switch status, light status, etc., which need to be parsed according to specific coding rules;

[0067] (2) Fault code data: such as the fault code information of the car;

[0068] (3) Control commands: such as engine start, brake control, etc.

[0069] Therefore, in the embodiment of the present disclosure, the CAN data set can be classified into a linear data set and a nonlinear data set according to the classification rules of the linear data and the nonlinear data in the above-mentioned CAN message, and the number of data contained in each data set can be counted. In addition, when classifying according to linear data and nonlinear data, it is also possible to analyze and classify in combination with the DBC of a specific vehicle model, and then perform quantitative statistics to ensure the accuracy of the classification result. Assuming that the first number of linear data contained in the linear data set is Count(Linerdata), the second number of nonlinear data contained in the nonlinear data set is Count(noneLinerdata), and the total amount of data is N (N=Count(Linerdata)+Count(noneLinerdata)), then the first weight (denoted as Ld) and the second weight (denoted as nLd) can be calculated by the following formula (1):

[0070]

[0071] In this embodiment, the first weight corresponding to the linear kernel function and the second weight corresponding to the nonlinear kernel function are determined according to the amount of linear data and nonlinear data contained in the CAN data set, so that the determined weights match the current data environment, have strong flexibility, and help to ensure the accuracy of key feature extraction.

[0072] Step 202: multiply the first kernel matrix by the first weight to obtain a first weighted kernel matrix, and multiply the second kernel matrix by the second weight to obtain a second weighted kernel matrix.

[0073] In the embodiment of the present disclosure, after the first weight and the second weight are obtained, the first kernel matrix can be multiplied by the first weight to obtain a first weighted kernel matrix, and the second kernel matrix can be multiplied by the second weight to obtain a second weighted kernel matrix.

[0074] Step 203: Fusing the first weighted kernel matrix and the second weighted kernel matrix to obtain the fused matrix.

[0075] As an example, the first weighted kernel matrix and the second weighted kernel matrix may be summed or averaged to obtain a fusion matrix.

[0076] As another example, the first weighted kernel matrix and the second weighted kernel matrix may be fused by using a Hadamard product to generate a fused matrix.

[0077] In the solution disclosed in the present invention, kernel matrices generated by multiple kernel functions are fused by assigning different weight factors to form a new fused matrix.

[0078] Figure 3FIG. 4 is a schematic diagram showing a fusion matrix obtained by fusing kernel matrices of multiple kernel functions according to an exemplary embodiment of the present disclosure. Figure 3 As shown in the figure, assuming that the first kernel function is a linear kernel function and the second kernel function is a radial basis kernel function, after reading the data, the obtained n CAN data are written into an n-dimensional matrix, and then the linear kernel function and the radial basis kernel function are selected respectively, and the kernel matrix is ​​calculated at the same time, and the kernel matrix obtained by each is multiplied with the corresponding weight to obtain the kernel matrix K1 and the kernel matrix K2, and finally the kernel matrix K1 and the kernel matrix K2 are multiplied element by element to obtain the main kernel matrix K (i.e., the fusion matrix), and finally the principal component is selected based on the main kernel matrix K to extract the traffic features most relevant to the system.

[0079] The CAN bus anomaly detection method of the disclosed embodiment obtains a first weight corresponding to a linear kernel function and a second weight corresponding to a nonlinear kernel function, multiplies the first kernel matrix by the first weight to obtain a first weighted kernel matrix, and multiplies the second kernel matrix by the second weight to obtain a second weighted kernel matrix, and fuses the first weighted kernel matrix and the second weighted kernel matrix to obtain a fused matrix. Thus, by using the kernel function fusion method and assigning different weight factors to the generated kernel matrix to generate a fused matrix, effective features in the CAN bus are extracted based on the fused matrix, thereby overcoming the limitations of a single kernel function, thereby better adapting to the application scenarios of CAN bus data.

[0080] In order to match different data environments and further improve the accuracy of CAN bus anomaly detection, in an optional embodiment of the present disclosure, multiple anomaly detection models can be pre-trained, each of which corresponds to a different combination of linear weight factors and nonlinear weight factors. Multiple anomaly detection models can be trained by Figure 4 The flowchart shown in the training is:

[0081] Step 301 : obtaining a plurality of training sample sets, wherein the amount of linear sample data and the amount of nonlinear sample data in the plurality of training sample sets have different proportions in the training sample sets.

[0082] Exemplarily, the original message data of the CAN bus can be obtained. Considering that the original message data has the characteristics of high dimensionality, and because of the complexity of the vehicle-side system environment, it usually mixes linear data and nonlinear data, as well as noise, the original message data can be preprocessed. The preprocessing method includes data balancing, standardization and normalization. Multiple training sample sets are generated based on the preprocessed data. For example, the preprocessed data can be randomly divided into multiple groups to obtain multiple training sample sets. In other words, each training sample set is a CAN data set, and the training sample set contains sample data after preprocessing the CAN data, including linear sample data and nonlinear sample data.

[0083] Among them, the number of sample data contained in different training sample sets may be the same or different, but for different training sample sets, the proportion of the data amount of linear sample data and the data amount of nonlinear sample data in the training sample sets is different. That is to say, the proportion of the data amount of linear sample data and the data amount of nonlinear sample data in the training sample sets to which they belong is different between multiple training sample sets. For example, for training sample set A and training sample set B, the proportion of linear sample data in training sample set A is different from the proportion of linear sample data in training sample set B. Correspondingly, the proportion of nonlinear data is also different. For example, the proportion of linear sample data in training sample set A (i.e., the ratio of the data amount of linear sample data in training sample set A to the total number of sample data in training sample set A) is 50%, and the proportion of nonlinear sample data (i.e., the ratio of the data amount of nonlinear sample data in training sample set A to the total number of sample data in training sample set A) is 50%, while the proportion of linear sample data in training sample set B is 60%, and the proportion of nonlinear sample data is 40%.

[0084] Step 302: Perform principal component analysis on the plurality of training sample sets based on the first kernel function and the second kernel function to obtain a key feature sample set corresponding to each training sample set.

[0085] Feature extraction is to extract the most important effective features of the message in the CAN bus, and use the extracted feature attributes to reconstruct the traffic data set for model training and testing. In this embodiment, after obtaining multiple training sample sets, each training sample set is written in the form of a multidimensional data matrix, and for each training sample set, the corresponding multidimensional data matrix uses the first kernel function and the second kernel function to generate a kernel matrix, and at the same time, the kernel matrices generated by each are fused to generate a fusion matrix, and finally the principal component is obtained according to the fusion matrix, so that the traffic features related to the CAN bus anomaly can be extracted, and the key feature sample set corresponding to each training sample set is obtained, and the key feature sample set is used for model training and testing. Among them, the amount of data contained in a training sample set is much larger than the dimension of the multidimensional data matrix, so that a training sample set can be written into multiple multidimensional data matrices to obtain multiple key feature sample sets, so that each training sample set can generate enough key feature sample sets for model training to ensure the model training effect.

[0086] It should be noted that the implementation method of determining the key feature set described in the above embodiment is also applicable to determining the key feature sample set corresponding to each training sample set in this step. The implementation principle is similar and will not be repeated here.

[0087] The data set has many original features, but the more features there are, the more accurate the training results will be. Too many features will lead to a decrease in performance due to excessive calculations. For the original data, by extracting features from the data set in this step, the number of feature attributes can be reduced without losing important information, thereby simplifying the data processing and modeling process. Use the extracted important features that are highly related to the abnormal state of the CAN bus to form a new training set and test set, and then input the initial network model for learning, training and prediction, which improves the accuracy of abnormal traffic detection while reducing computing pressure and saving computing costs.

[0088] Step 303: Train the initial network model based on each of the key feature sample sets to obtain multiple trained anomaly detection models.

[0089] In order to solve the problem that the existing detection model ignores the timing problem of CAN data and causes a low abnormality detection rate, in the embodiments of the present disclosure, the initial network model can adopt a recurrent neural network such as a long short-term memory network (Long Short-Term Memory, LATM) and a GRU network.

[0090] In the disclosed embodiment, for each key feature sample set corresponding to a training sample set, the initial network model can be trained based on each key feature sample set to obtain a trained anomaly detection model, wherein one key feature sample set corresponding to one training sample set is trained to obtain one anomaly detection model.

[0091] Taking the initial network model as LSTM as an example, for a key feature sample set corresponding to a training sample set, each key feature sample set is input into the LSTM network in turn for learning, trained using the Back Propagation (BP) algorithm, and optimized using the Adaptive Moment Estimation (Adam) optimization algorithm for gradient descent. Finally, the effect of the model is tested on the test set data until the detection accuracy of the model reaches the expected level, and a trained anomaly detection model is obtained.

[0092] Since the traditional anomaly detection model is too large, resulting in huge demand for performance and thus low usability, in the embodiment of the present disclosure, the number of layers of the LSTM model is also optimized. In order to obtain higher performance, a 1-layer LSTM network model is used, that is, in addition to the input layer and the output layer, only one intermediate layer is included. The number of neurons in each layer is determined according to the BP algorithm, and the model evaluation index is F 1 -score.

[0093] When training the improved LSTM model, first randomly initialize the weight parameters and bias parameters of the model. According to the current model parameters, pass the input sample data (i.e., a key feature sample set of the current training sample set) to the neural network, calculate the output of each neuron layer by layer, calculate the value of the loss function based on the output of the model and the true label, and calculate the gradient of each neuron to the loss function through the chain rule based on the value of the loss function. Then, propagate these gradients back layer by layer, update the weight parameters and bias parameters of each neuron, and use the Adam optimization algorithm to update the weight parameters and bias parameters of the model according to the gradient of the neuron. After that, input the next key feature sample set of the current training sample set, repeat the above process until the model effect passes the test, the training is completed, and the anomaly detection model corresponding to the current training sample set is obtained.

[0094] The Adam optimization algorithm is a commonly used optimization algorithm. The Adam optimization algorithm is an adaptive learning rate optimization algorithm based on the gradient descent algorithm, which can automatically adjust the learning rate. In the disclosed embodiment, the advantage of selecting the Adam optimization algorithm for model optimization lies in its adaptive learning rate mechanism, which can adaptively adjust the learning rate according to the change of the gradient, thereby converging to the local optimal solution more efficiently. In addition, the Adam optimization algorithm performs well when processing sparse gradients, has a certain robustness, and is insensitive to the choice of hyperparameters. The Adam optimization algorithm uses the first-order moment estimate and the second-order moment estimate of the gradient to calculate the adaptive learning rate. Specifically, the Adam optimization algorithm maintains the momentum and second-order moment estimates of each parameter, and uses these estimates to update the parameters. The update rules of the Adam optimization algorithm are as follows:

[0095] (1) Calculate the first-order moment estimate of the gradient:

[0096] m t =β 1 m t-1 +(1-β 1 ) t ;

[0097] (2) Calculate the second-order moment estimate of the gradient:

[0098]

[0099] (3) Calculate the bias-corrected estimates of the first-order and second-order moments:

[0100]

[0101] (4) Update parameters:

[0102]

[0103] Among them, gt represents the gradient at time step t, θ t represents the parameters at time step t, η represents the learning rate, β 1 , β 2 is a constant, β 1 represents the exponential decay rate of the first-order moment estimate, β 2 represents the exponential decay rate of the second-order moment estimate, ε is a very small number, usually set to 10 -8 , which is used to ensure that the denominator is not zero.

[0104] Step 304: Establish and store a mapping relationship between a combination of linear weights and nonlinear weights and a corresponding anomaly detection model according to the proportion of the amount of linear sample data and the amount of nonlinear sample data contained in each training sample set.

[0105] In the disclosed embodiment, each training sample set is trained to obtain a corresponding anomaly detection model. For each training sample set, the number of linear data and the number of nonlinear data contained in the training sample set can be counted, and the proportion of linear data in the training sample set can be calculated according to the number of linear data to obtain linear weights, and the proportion of nonlinear data in the training sample set can be calculated according to the number of nonlinear data to obtain nonlinear weights, and then a mapping relationship between a combination of linear weights and nonlinear weights and the corresponding anomaly detection model is established, and the mapping relationship between each linear weight, a combination of nonlinear weights and the anomaly detection model is stored, so as to select a suitable anomaly detection model according to the data proportion during anomaly detection.

[0106] It can be understood that since the sum of linear weights and nonlinear weights in a training sample set is 1, when establishing the mapping relationship between weights and anomaly detection models, it is also possible to only establish and store the mapping relationship between linear weights and anomaly detection models (or establish the mapping relationship between nonlinear weights and anomaly detection models). When selecting a matching anomaly detection model, it is only necessary to calculate the proportion of linear data (or nonlinear data) in the CAN data set.

[0107] In addition, in an optional embodiment of the present disclosure, in order to improve the scope of application of the anomaly detection model, when establishing a mapping relationship between weights and anomaly detection models, a linear weight range can be determined based on the linear weights (or nonlinear weights) in the training sample set and a preset error value, and a mapping relationship between the linear weight range and the anomaly detection model is established. When selecting a matching anomaly detection model, as long as the proportion of linear data (or nonlinear data) in the CAN data set is within the linear weight range, the corresponding anomaly detection model is selected for anomaly detection.

[0108] The CAN bus anomaly detection method of the disclosed embodiment obtains multiple anomaly detection models through training, establishes and stores mapping relationships between different weights and corresponding anomaly detection models, and can select a suitable anomaly detection model for anomaly detection according to the current data environment during actual anomaly detection, which helps to improve the accuracy of anomaly detection results.

[0109] Further, in an optional embodiment of the present disclosure, before the key feature set is input into the target anomaly detection model for anomaly detection, a suitable anomaly detection model can be selected as the target anomaly detection model according to the CAN data set to be detected, and whether there is an anomaly in the CAN data set is detected based on the target anomaly detection model. Specifically, the data in the CAN data set can be classified according to the preset linear data and nonlinear data classification rules to count the data volume of the linear data and the data volume of the nonlinear data contained in the CAN data set; then, according to the data volume of the linear data and the data volume of the nonlinear data contained in the CAN data set, the target linear weight and the target nonlinear weight corresponding to the CAN data set are determined; and then, the mapping relationship between the weight established above and the anomaly detection model is queried to determine the target anomaly detection model that matches the combination of the target linear weight and the target nonlinear weight. It can be understood that the implementation method of classifying CAN data in this embodiment can refer to the description of the relevant content in the aforementioned embodiment, and the implementation method of determining the target linear weight and the target nonlinear weight can refer to the description of the relevant content of determining the first weight and the second weight in the aforementioned embodiment, and the implementation principle is similar, which will not be repeated here.

[0110] As an example, assuming that the mapping relationship binds the relationship between the combination of linear weights and nonlinear weights and the anomaly detection model, after determining the target linear weights and the target nonlinear weights, the anomaly detection model corresponding to the combination of linear weights and nonlinear weights that are closest to the target linear weights and the target nonlinear weights in the mapping relationship can be queried as the target anomaly detection model.

[0111] As another example, assuming that the mapping relationship is bound to the relationship between the linear weight range and the anomaly detection model, after determining the target linear weight and the target nonlinear weight, the linear weight range to which the target linear weight belongs in the mapping relationship can be queried, and the anomaly detection model corresponding to the linear weight range to which the target linear weight belongs is used as the target anomaly detection model. If the target linear weight does not fall within any linear weight range, the target linear weight is compared with the upper and lower limits of each linear weight range, and the anomaly detection model corresponding to the linear weight range where the upper or lower limit closest to the target linear weight is located is used as the target anomaly detection model.

[0112] In this embodiment, after the target anomaly detection model is determined, the determined key feature set can be input into the target anomaly detection model for anomaly detection. Thus, by determining a suitable anomaly detection model for anomaly detection according to the proportion of linear data and nonlinear data in the CAN data set to be detected, the accuracy of CAN bus anomaly detection can be further improved.

[0113] Figure 5 The overall architecture diagram of the CAN bus abnormality detection solution disclosed in the present invention is shown in FIG. Figure 5 As shown, the acquired CAN message is used as the original flow, and the original features contained in the original flow are written into a data matrix of preset dimensions. The data matrix is ​​input into different kernel functions to generate a kernel matrix and matrix fusion is performed to obtain a fusion matrix. Then, the principal component is extracted from the fusion matrix to obtain the target feature vector, and then the data matrix corresponding to the original process is mapped to the extracted target feature vector to obtain the key feature set in the original flow, and then the key feature set is input into the pre-trained target anomaly detection model for flow prediction (i.e., anomaly detection), and the target anomaly detection model outputs the detection result. If anomalies are found, an early warning prompt is given to relevant personnel. The disclosed scheme can automatically extract effective features from high-dimensional and complex CAN bus data, and reconstruct the streamlined flow data training set and test set based on the extracted important feature attributes, and then the streamlined data set is input into the initial network model for learning and training to obtain a trained anomaly detection model, and then the trained anomaly detection model can be used to predict abnormal flow, thereby realizing the detection of abnormal messages of the CAN bus, while improving the accuracy of abnormal flow detection, reducing the computing pressure and saving computing costs.

[0114] In order to implement the above embodiments, the present disclosure also provides a CAN bus abnormality detection device, which can be implemented by software and / or hardware and can be integrated in a vehicle.

[0115] Figure 6 A schematic diagram of the structure of a CAN bus abnormality detection device provided by an embodiment of the present disclosure is shown in FIG. Figure 6 As shown, the CAN bus abnormality detection device 40 may include: an analysis module 410 , a fusion module 420 , a feature extraction module 430 and a detection module 440 .

[0116] The analysis module 410 is used to perform principal component analysis on the CAN data set to be detected based on the first kernel function and the second kernel function respectively to obtain a first kernel matrix and a second kernel matrix;

[0117] A fusion module 420, configured to determine a fusion matrix based on the first kernel matrix and the second kernel matrix;

[0118] A feature extraction module 430 is used to extract key features of the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set;

[0119] The detection module 440 is used to input the key feature set into the target anomaly detection model to perform anomaly detection and obtain anomaly detection results.

[0120] Optionally, the first kernel function is a linear kernel function, and the second kernel function is a nonlinear kernel function.

[0121] Further optionally, the fusion module 420 includes:

[0122] A weight acquisition unit, used to acquire a first weight corresponding to the linear kernel function and a second weight corresponding to the nonlinear kernel function;

[0123] a weighting unit, configured to multiply the first kernel matrix by the first weight to obtain a first weighted kernel matrix, and to multiply the second kernel matrix by the second weight to obtain a second weighted kernel matrix;

[0124] A fusion unit is configured to fuse the first weighted kernel matrix and the second weighted kernel matrix to obtain the fused matrix.

[0125] Further optionally, the weight acquisition unit is further used for:

[0126] According to preset linear data and nonlinear data classification rules, the CAN data set is classified to obtain a linear data set and a nonlinear data set;

[0127] Counting a first quantity of linear data included in the linear data set, a second quantity of nonlinear data included in the nonlinear data set, and a total amount of data included in the CAN data set;

[0128] The first weight is obtained by calculating the ratio of the first quantity to the total amount of data, and the second weight is obtained by calculating the ratio of the second quantity to the total amount of data.

[0129] Optionally, the feature extraction module 430 is further used to:

[0130] Performing eigenvalue decomposition on the fusion matrix to obtain multiple eigenvalues ​​and an eigenvector corresponding to each eigenvalue;

[0131] Sorting the feature vectors in descending order of feature values, and obtaining a preset number of target feature vectors that are ranked first;

[0132] The CAN data set is projected onto the target feature vector to obtain the key feature set.

[0133] Optionally, the CAN bus anomaly detection device 40 further includes: a training module for pre-training a plurality of anomaly detection models, wherein the training module is specifically used for:

[0134] Acquire multiple training sample sets, wherein the amounts of linear sample data and the amounts of nonlinear sample data in the multiple training sample sets have different proportions in the training sample sets;

[0135] Based on the first kernel function and the second kernel function, principal component analysis is performed on the multiple training sample sets respectively to obtain a key feature sample set corresponding to each training sample set;

[0136] Based on each of the key feature sample sets, the initial network model is trained to obtain multiple trained anomaly detection models;

[0137] According to the proportion of the amount of linear sample data and the amount of nonlinear sample data contained in each training sample set, a mapping relationship between a combination of linear weights and nonlinear weights and a corresponding anomaly detection model is established and stored.

[0138] Further optionally, the CAN bus abnormality detection device 40 further includes: a target model determination module;

[0139] The target model determination module is used to:

[0140] Classifying the data in the CAN data set according to preset linear data and nonlinear data classification rules to count the amount of linear data and the amount of nonlinear data contained in the CAN data set;

[0141] Determining a target linear weight and a target nonlinear weight corresponding to the CAN data set according to the amount of linear data and the amount of nonlinear data contained in the CAN data set;

[0142] The mapping relationship is queried to determine a target anomaly detection model that matches the combination of the target linear weight and the target non-linear weight.

[0143] The CAN bus anomaly detection device applicable to a vehicle provided in the embodiment of the present disclosure can execute the CAN bus anomaly detection method provided in the embodiment of the present disclosure, and has the corresponding functional modules and beneficial effects of the execution method. The contents not fully described in the embodiment of the device of the present disclosure can refer to the description in any method embodiment of the present disclosure.

[0144] The embodiment of the present disclosure also provides an electronic device, including a processor and a memory; the processor calls the program or instructions stored in the memory to execute the steps of each embodiment of the CAN bus abnormality detection method as described in any of the above embodiments. To avoid repeated description, they will not be repeated here.

[0145] The embodiments of the present disclosure also provide a computer-readable storage medium, which is non-transitory and stores programs or instructions. The programs or instructions enable a computer to execute the steps of each embodiment of the CAN bus abnormality detection method as described in any of the aforementioned embodiments. To avoid repeated description, they will not be repeated here.

[0146] An embodiment of the present disclosure also provides a vehicle, comprising a CAN bus abnormality detection device as described in any of the foregoing embodiments of the present disclosure, or an electronic device as described in any of the foregoing embodiments of the present disclosure, or a computer-readable storage medium as described in any of the foregoing embodiments of the present disclosure.

[0147] The embodiments of the present disclosure also provide a computer program product, which is used to execute the steps of each embodiment of the CAN bus abnormality detection method as described in any of the aforementioned embodiments.

[0148] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0149] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A CAN bus abnormality detection method, characterized in that: The method comprises: Based on the first kernel function and the second kernel function, principal component analysis is performed on the CAN data set to be detected, and a first kernel matrix and a second kernel matrix are obtained; Determining a fusion matrix based on the first kernel matrix and the second kernel matrix; Extract key features of the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set; The key feature set is input into a target anomaly detection model to perform anomaly detection and obtain an anomaly detection result.

2. The method according to claim 1, characterized in that: The first kernel function is a linear kernel function, and the second kernel function is a nonlinear kernel function.

3. The method according to claim 2, characterized in that The determining of a fusion matrix based on the first kernel matrix and the second kernel matrix includes: Obtaining a first weight corresponding to the linear kernel function and a second weight corresponding to the nonlinear kernel function; Multiplying the first kernel matrix by the first weight to obtain a first weighted kernel matrix, and multiplying the second kernel matrix by the second weight to obtain a second weighted kernel matrix; The first weighted kernel matrix and the second weighted kernel matrix are fused to obtain the fused matrix.

4. The method according to claim 3, characterized in that: The obtaining of the first weight corresponding to the linear kernel function and the second weight corresponding to the nonlinear kernel function includes: According to preset linear data and nonlinear data classification rules, the CAN data set is classified to obtain a linear data set and a nonlinear data set; Counting a first quantity of linear data included in the linear data set, a second quantity of nonlinear data included in the nonlinear data set, and a total amount of data included in the CAN data set; The first weight is obtained by calculating the ratio of the first quantity to the total amount of data, and the second weight is obtained by calculating the ratio of the second quantity to the total amount of data.

5. The method according to any one of claims 1 to 4, characterized in that: The extracting key features of the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set includes: Performing eigenvalue decomposition on the fusion matrix to obtain multiple eigenvalues ​​and an eigenvector corresponding to each eigenvalue; Sorting the feature vectors in descending order of feature values, and obtaining a preset number of target feature vectors that are ranked first; The CAN data set is projected onto the target feature vector to obtain the key feature set.

6. The method according to any one of claims 1 to 4, characterized in that: Pre-train multiple anomaly detection models, wherein the multiple anomaly detection models are trained in the following manner: Acquire multiple training sample sets, wherein the amounts of linear sample data and the amounts of nonlinear sample data in the multiple training sample sets have different proportions in the training sample sets; Based on the first kernel function and the second kernel function, principal component analysis is performed on the multiple training sample sets respectively to obtain a key feature sample set corresponding to each training sample set; Based on each of the key feature sample sets, the initial network model is trained to obtain multiple trained anomaly detection models; According to the proportion of the amount of linear sample data and the amount of nonlinear sample data contained in each training sample set, a mapping relationship between a combination of linear weights and nonlinear weights and a corresponding anomaly detection model is established and stored.

7. The method according to claim 6, characterized in that Before inputting the key feature set into the target anomaly detection model for anomaly detection, the method further includes: Classifying the data in the CAN data set according to preset linear data and nonlinear data classification rules to count the amount of linear data and the amount of nonlinear data contained in the CAN data set; Determining a target linear weight and a target nonlinear weight corresponding to the CAN data set according to the amount of linear data and the amount of nonlinear data contained in the CAN data set; The mapping relationship is queried to determine a target anomaly detection model that matches the combination of the target linear weight and the target non-linear weight.

8. A CAN bus abnormality detection device, characterized in that: include: An analysis module is used to perform principal component analysis on the CAN data set to be detected based on the first kernel function and the second kernel function to obtain a first kernel matrix and a second kernel matrix; A fusion module, configured to determine a fusion matrix based on the first kernel matrix and the second kernel matrix; A feature extraction module, used for extracting key features of the CAN data set based on the fusion matrix to obtain a key feature set corresponding to the CAN data set; The detection module is used to input the key feature set into the target anomaly detection model to perform anomaly detection and obtain anomaly detection results.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a program or instruction, and the program or instruction enables a computer to execute the CAN bus abnormality detection method according to any one of claims 1 to 7.

10. A vehicle, characterized in that: It includes the CAN bus abnormality detection device as claimed in claim 8 or the computer-readable storage medium as claimed in claim 9.

Images