1553 bus data anomaly detection method

Abstract

The invention provides a 1553 bus data anomaly detection method, which comprises the following steps of: processing periodically acquired to-be-detected data transmitted on a 1553 bus through a fault diagnosis neural network model to obtain a diagnosis result of whether an attack message exists or not; when the diagnosis result is that the attack information exists, the currently detected data is abnormal; when the diagnosis result is that the attack information does not exist, the currently detected data is normal; through the method, the fault diagnosis neural network model can quickly process and judge the input to-be-detected data, the anomaly detection efficiency is improved, the abnormal condition in the 1553 bus system can be found and processed in time, and the safety and reliability of the system are guaranteed; normal and abnormal conditions in the 1553 bus data can be finely distinguished, and the false alarm rate and the missing report rate can be reduced.

Description

Technical Field

[0001] The present application relates to the technical field of bus communication anomaly detection, and in particular to a 1553 bus data anomaly detection method. Background Art

[0002] Anomaly detection, also known as outlier detection or novelty detection, is an important branch of data analysis and machine learning. Its main goal is to identify outliers or abnormal events in the data; these anomalies may be caused by system failures, malicious behavior, intentional fraud, etc.

[0003] The 1553 bus is a data bus standard widely used in the aerospace field. In order to ensure the stability, security and reliability of the 1553 bus system, it is necessary to perform data anomaly detection on the 1553 bus. In the prior art, anomaly detection is usually performed based on a combination of periodic sequences and system behavior rules. However, this lightweight anomaly detection method is prone to false positives and missed positives. Summary of the invention

[0004] The purpose of this application is to provide a 1553 bus data anomaly detection method to address the above problems.

[0005] The present application provides a 1553 bus data anomaly detection method, comprising the following steps: S100: Periodically obtain the data to be detected transmitted on the 1553 bus; S200: Inputting the data to be detected into a fault diagnosis neural network model, wherein: the input of the fault diagnosis neural network model is the data transmitted by the bus, and the output is whether there is an attack message; S300: The fault diagnosis neural network model processes the data to be detected to obtain a diagnosis result.

[0006] According to the technical solution provided by the present application, before step S100, the following steps are also included: S020: Acquire a reorganized data set, wherein the reorganized data set includes a plurality of reorganized data, each of the reorganized data includes at least a forged message; S030: Inputting the reorganized data set into a neural network model for training to obtain an optimized fault diagnosis neural network model.

[0007] According to the technical solution provided in the present application, the reconstructed data also includes control and interaction messages, and the control and interaction messages and forged messages are numerically normalized and dimensionally expanded to obtain the reconstructed data.

[0008] According to the technical solution provided by the present application, the following steps are also included before step S020: S010: Acquire valid test information, and encode it according to the type of the valid test information to obtain the forged information.

[0009] According to the technical solution provided by the present application, the following steps are also included before step S010: S001: Obtain training data set; S002: Remove useless fields in the training data set to obtain valid test information; the valid test information includes: command words, data words and status words; the useless fields include timestamps, message channels and message intervals.

[0010] According to the technical solution provided by this application, step S001 includes the following steps: Constructing an abnormal test data set, wherein the abnormal test data set includes: first type data and second type data; The message sending frequency of the abnormal test data set is controlled by generating a random number, and after running for a first period of time, the training data set is obtained.

[0011] According to the technical solution provided in the present application, the first type of data is real data obtained from the bus message; the second type of data is forged data written in accordance with the bus message format.

[0012] According to the technical solution provided in this application, the fault diagnosis neural network model is an LSTM model.

[0013] Compared with the prior art, the present invention has the following advantages: The present application provides a 1553 bus data anomaly detection method, which processes the periodically acquired data to be detected transmitted on the 1553 bus through a fault diagnosis neural network model to obtain a diagnosis result of whether there is an attack message; when the diagnosis result is that there is attack information, it means that the currently detected data is abnormal; when the diagnosis result is that there is no attack information, it means that the currently detected data is normal; through the above method, the fault diagnosis neural network model can quickly process and judge the input data to be detected, improve the efficiency of anomaly detection, and can timely discover and handle abnormal situations in the 1553 bus system to ensure the safety and reliability of the system; it can make a fine distinction between normal and abnormal situations in the 1553 bus data, and can reduce the false alarm rate and the missed alarm rate.

[0014] It should be understood that the description of technical features, technical solutions, beneficial effects or similar language in this application does not imply that all features and advantages can be realized in any single embodiment. On the contrary, it is understood that the description of features or beneficial effects means that specific technical features, technical solutions or beneficial effects are included in at least one embodiment. Therefore, the description of technical features, technical solutions or beneficial effects in this specification does not necessarily refer to the same embodiment. Furthermore, the technical features, technical solutions and beneficial effects described in the present embodiment can also be combined in any appropriate manner. Those skilled in the art will understand that the embodiment can be realized without one or more specific technical features, technical solutions or beneficial effects of a specific embodiment. In other embodiments, additional technical features and beneficial effects can also be identified in a specific embodiment that does not embody all embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solution in this embodiment, the drawings required for use in the description of the embodiment will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 A flowchart of a 1553 bus data anomaly detection method provided in Example 1 of the present application; Figure 2 A schematic diagram of the expansion of the LSTM model provided in Example 1 of the present application at time t. DETAILED DESCRIPTION

[0017] In order to enable those skilled in the art to better understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings. The description in this section is only exemplary and explanatory and should not have any limiting effect on the protection scope of the present application. Specifically, the described embodiments are only embodiments of a part of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present application.

[0018] It should be noted that similar reference numerals and letters represent similar items in the following figures, so once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0019] Example 1 Please refer to Figure 1 , a flowchart of a 1553 bus data anomaly detection method provided in this embodiment includes the following steps: S100: Periodically obtain the data to be detected transmitted on the 1553 bus; S200: inputting the data to be detected into the fault diagnosis neural network model, wherein: the input of the fault diagnosis neural network model is the data transmitted by the bus, and the output is whether there is an attack message; S300: The fault diagnosis neural network model processes the data to be detected to obtain a diagnosis result.

[0020] Specifically, the 1553 bus is mainly composed of a bus controller (BC), a remote terminal (RT) and a bus monitor (BM); the bus controller is responsible for initiating data transmission, the remote terminal responds to the bus controller's instructions and sends data, and the bus monitor is used to monitor the data flow on the bus; on the 1553 bus, data is transmitted in the form of messages, and each message consists of a command word, a data word and a status word; the command word is sent by the bus controller to indicate the data to be obtained, and the remote terminal returns the data word and the status word after receiving the command word to confirm the reception of the data; at the same time, the 1553 bus supports periodic message transmission, which means that messages can be sent cyclically at predetermined time intervals (frame periods); multiple messages can be sent within a frame period to ensure the acquisition and processing of real-time data; Specifically, the present application processes the periodically acquired data to be detected transmitted on the 1553 bus through a fault diagnosis neural network model to obtain a diagnosis result of whether there is an attack message; when the diagnosis result is that there is attack information, it means that the currently detected data is abnormal; when the diagnosis result is that there is no attack information, it means that the currently detected data is normal; Working principle: The fault diagnosis neural network model can quickly process and judge the input data to be detected, improve the efficiency of anomaly detection, and can timely discover and handle abnormal situations in the 1553 bus system to ensure the safety and reliability of the system; it can make a fine distinction between normal and abnormal situations in the 1553 bus data, and can reduce the false alarm rate and missed alarm rate.

[0021] In some embodiments, before step S100, the method further includes: S020: Acquire a reorganized data set, where the reorganized data set includes a plurality of reorganized data, each reorganized data at least includes a forged message; S030: Input the reorganized data set into the neural network model for training to obtain an optimized fault diagnosis neural network model.

[0022] Specifically, due to the correlation between bus messages, a single message cannot be simply used as an independent input; the reorganized data also includes control and interaction messages, and the control and interaction messages and forged messages are numerically normalized and dimensionally expanded to obtain the reorganized data; the control and interaction information includes: scheduling information, response information and handshake information in the 1553 bus communication extreme value; Numerical normalization is to scale the data according to a certain ratio so that it falls within a specific interval (such as [0,1]); numerical normalization of reorganized data can eliminate the differences between different types of data due to factors such as dimensions, making the data comparable in subsequent processing; Dimensional expansion processing usually refers to increasing the dimension of data in some way. For example, this application combines the forged information with several previous control and interaction information into a new unit to increase the data dimension; Specifically, for a piece of forged information recorded , and compare it with the previous Combines control and interaction information into a new Reorganize the data, set the reorganized data to , where: m is a hyperparameter, which indicates the number of messages traversed forward when expanding the data dimension; when training the neural network model, a fixed number of reorganized data are combined into a reorganized data set to be trained as the input of the fault diagnosis neural network model, and the optimized fault diagnosis neural network model is obtained; For one Reorganized data , the forged information is , given the output variable , where n represents a forged message The number of features in, m represents the number of messages; for each forged message , there is a label ; ; Use pre-processed fake information As input, each element All represent a characteristic field of the bus message, where , ; In 1553 bus communication, considering that a message has at most 2 command words, 2 status words and 32 data words, n=36 is taken; this means that each message is represented as having 36 feature quantities; Specifically, for the training model, the training set is divided into multiple subsets of equal length. If the subset cannot be divided evenly, the length of the last subset does not need to be filled up; the CrossEntropyLoss loss function is used to calculate the error, which is usually used for classification problems and can measure the difference between the predicted value and the true label; the Adam optimizer is used to optimize the error numerical calculation to obtain the gradient optimization model parameters; the Adam optimizer is a commonly used gradient-based optimization algorithm that combines the advantages of the momentum method and RMSProp, can adaptively adjust the learning rate, and effectively update the model parameters during the training process.

[0023] In some embodiments, the following steps are also included before step S020: S010: Acquire valid test information, encode it according to the type of the valid test information, and obtain forged information.

[0024] Specifically, in 1553 bus data processing, a message may contain different types of data, such as command words, status words, and data words; encoding these data can represent them in a standard form to facilitate subsequent data processing and analysis.

[0025] In some embodiments, the following steps are also included before step S010: S001: Obtain training data set; S002: Remove useless fields in the training data set to obtain valid test information; the valid test information includes: command words, data words and status words; the useless fields include timestamps, message channels and message intervals.

[0026] Wherein, step S001 includes the following steps: Construct an abnormal test data set, which includes: first type data and second type data; the first type data is real data obtained from bus messages, which conforms to industry standards and communication protocols and has high reliability and executability; the second type data is forged data written in the bus message format, which may be executed or directly discarded as meaningless messages; The message sending frequency of the abnormal test data set is controlled by generating random numbers, and after running for a first period of time, a training data set is obtained to ensure the randomness and validity of the abnormal test data set; in this embodiment, the first period of time is 12 hours; Specifically, the present application can effectively train and test the model through the self-constructed abnormal test data set, improve the model's ability to identify abnormal data and processing efficiency, and ensure the normal operation of the bus system in a complex environment; Specifically, when obtaining a bus message, corresponding descriptive data will be generated at the same time, including timestamp, message channel, message interval, etc.; these descriptive information is not helpful for model training, so these useless fields are removed during data processing, and valid test information such as command words, data words, and status words are retained for encoding to obtain forged information.

[0027] In some embodiments, the fault diagnosis neural network model is an LSTM model.

[0028] Specifically, this application selects to optimize the LSTM model to detect anomalies in bus data. The model structure is as follows: Figure 2 As shown in Figure 2, the core of the LSTM model's ability to handle long-term dependency problems is that it introduces , through the entire training process Maintenance and update to choose to remember or forget certain knowledge in the input sequence; Different from the single-layer neural network adopted by the basic recurrent neural network, LSTM uses three gate structures to control, namely , , ,in For the Gate of Forgetfulness, is the input gate, is the output gate, Used from Remove information from Used to store input information , Determine the output value, The update needs to be combined with and ; The basic structure and formula of the LSTM model are as follows: Forget gate formula: ; in: is the output of the forget gate at time t, is the sigmoid function, whose value range is between 0 and 1; is the weight matrix of the forget gate, Indicates that the hidden state of the previous moment and the current input To splice, is the bias vector of the forget gate; the forget gate determines which information is discarded from the output state, 0 means completely discarded, and 1 means completely retained; Input gate formula: ; ; in, is the book of the input gate at time t, and the calculation method is similar to that of the forget gate; is the candidate output state at the current moment; , is the corresponding weight matrix, , is the bias vector, tanh is the hyperbolic tangent function, whose value range is between -1 and 1, and is used to scale the candidate output state; Output state update formula: ; Among them, the output state The update at time t is done by replacing the output state of the previous time Multiply by the output of the forget gate , plus the output of the input gate With candidate output state In this way, the LSTM model can selectively forget old information and add new information to the output state; Output gate formula: ; ; in, is the output of the output gate at time t; finally, the hidden state is the output of the output gate The output state processed by the hyperbolic tangent function obtained by multiplication; is the weight matrix of the output gate, is the bias vector.

[0029] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and its core ideas of this application. The above is only the preferred implementation method of this application. It should be pointed out that due to the limitations of textual expression and the objective existence of infinite specific structures, ordinary technicians in this technical field can make several improvements, modifications or changes without departing from the principles of this application, and can also combine the above technical features in an appropriate manner; these improvements, modifications, changes or combinations, or the direct application of the concept and technical solution of the invention to other occasions without improvement, should be regarded as the scope of protection of this application.

Claims

1. A 1553 bus data anomaly detection method, characterized in that: The steps include: S100: Periodically obtain the data to be detected transmitted on the 1553 bus; S200: Inputting the data to be detected into a fault diagnosis neural network model, wherein: the input of the fault diagnosis neural network model is the data transmitted by the bus, and the output is whether there is an attack message; S300: The fault diagnosis neural network model processes the data to be detected to obtain a diagnosis result.

2. A 1553 bus data anomaly detection method according to claim 1, characterized in that: Before step S100, the method further includes: S020: Acquire a reorganized data set, wherein the reorganized data set includes a plurality of reorganized data, each of the reorganized data includes at least a forged message; S030: Inputting the reorganized data set into a neural network model for training to obtain an optimized fault diagnosis neural network model.

3. A 1553 bus data anomaly detection method according to claim 2, characterized in that: The reorganized data also includes control and interaction messages, and the control and interaction messages and forged messages are numerically normalized and dimensionally expanded to obtain the reorganized data.

4. A 1553 bus data anomaly detection method according to claim 2, characterized in that: Before step S020, the following steps are also included: S010: Acquire valid test information, and encode it according to the type of the valid test information to obtain the forged information.

5. A 1553 bus data anomaly detection method according to claim 4, characterized in that: Before step S010, the following steps are also included: S001: Obtain training data set; S002: Remove useless fields in the training data set to obtain valid test information; the valid test information includes: command words, data words and status words; the useless fields include timestamps, message channels and message intervals.

6. A 1553 bus data anomaly detection method according to claim 5, characterized in that: Step S001 includes the following steps: Constructing an abnormal test data set, wherein the abnormal test data set includes: first type data and second type data; The message sending frequency of the abnormal test data set is controlled by generating a random number, and after running for a first period of time, the training data set is obtained.

7. A 1553 bus data anomaly detection method according to claim 6, characterized in that: The first type of data is real data obtained from the bus message; The second type of data is forged data written in accordance with the bus message format.

8. A 1553 bus data anomaly detection method according to claim 1, characterized in that: The fault diagnosis neural network model is an LSTM model.

Images